Article View: ch.comp.os.linux
Article #24752Re: High security server
From: Olivier M.
Date: Sat, 23 Jan 1999 00:00
Date: Sat, 23 Jan 1999 00:00
49 lines
2800 bytes
2800 bytes
<schaefer@alphanet.ch> ecrivait/schrieb/wrote:
>> think that using "dd" is a good idea ? Or should I rather use
>dd is only good provided the fs is umounted, or at least mounted
>read-only.
you mean both fs ? or is it ok if only the destination fs is
unmounted ? for example if I dd the partition of /home, I don't
really want to mount it read-only : users wouldn't be able to
get mail (qmail: mailboxes _are_ in /home/username/Maildir),
and cgi that need to write to the disk wouldn't work anymore
during this (too long) time.
>Anyway, if the power fails, BOTH your RAID partitions will be
>in the same incoherent state, needing fsck, and in the bad cases,
>manual intervention.
tja, that's exactely what I want to avoid. The server is really
far from my workplace (50km), and in case of problem, the only thing
I can do, is to tell by phone to somebody in the server room : take
the rescue disk (LILO, set up to boot on the _second_ HD) and restart
the PC.
>Your idea of ``from time to time copies'' is good. If you unmount
>the backup after the copy, the only ``dangerous'' window is
>during the copy.
could even be good against low level hackers :)
>By the way, how do you intend to automate the recovery process ?
with a LILO disk as said a few lines before.
>One idea would be to have a partition which is never written to
>(initrd) and which attempts to mount all the other partitions,
>doing fsck when needed and if fsck fails, mount the alternate.
well, it sounds interesting, but I currently don't have the
knowledge to make such a thing, at least not without good docs :)
The final goal is to have 2 separate servers (hosted at different
providers) with same setup and harddisk contents, so that even
if a provider is unreachable, the pages will still be viewable.
I'll have to configure named to make it work, but I don't think
it will be too difficult. If you already tried something like
this, feel free to make comments...
If it works, then I'll write something about this on the linux
server guide project ( http://lisa.8304.ch ).
Olivier
--
____________________________________________________________
... Please replace "XD*NUP" by "olm" to answer by e-mail...
--- .-.. .. ...- .. . .-. -- ..- .-.. .-.. . .-.
Technical Details
Message-ID:
<slrn7ajl4q.6au.XD*NUP@tardis-a1.ee.ethz.ch>Path:
arc1-ca.pugleaf.net!unknown!not-for-mailReferences:
<slrn7aj5rd.p2.XO*QVV@tardis-a1.ee.ethz.ch> <78cbdc$glv$1@vulcan.alphanet.ch>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: f4b73,47a69626b085ab62 X-Google-Attributes: gidf4b73,public From: XD*NUP@technologist.com (Olivier M.) Subject: Re: High security server Date: 1999/01/23 Message-ID: <slrn7ajl4q.6au.XD*NUP@tardis-a1.ee.ethz.ch> X-Deja-AN: 435986898 References: <slrn7aj5rd.p2.XO*QVV@tardis-a1.ee.ethz.ch> <78cbdc$glv$1@vulcan.alphanet.ch> X-Trace: 23 Jan 1999 14:54:35 +0100, tardis-a1.ee.ethz.ch Organization: ETH Zurich Newsgroups: ch.comp.os.linux