Date: Wed, 9 Jul 2003 13:50:55 -0500 From: Paul Smith <paul@cnt.org> To: Gregory Bond <gnb@itga.com.au> Cc: freebsd-stable@freebsd.org Subject: Re: Hardening production servers Message-ID: <20030709185054.GI32234@cnt.org> In-Reply-To: <200307082335.JAA29618@lightning.itga.com.au> References: <200307082335.JAA29618@lightning.itga.com.au>
next in thread | previous in thread | raw e-mail | index | archive | help
Gregory Bond <gnb@itga.com.au> wrote on 08/Jul/03 at 6:35 PM: > Here's what we do: > > For the system: > > - A separate build box, spec'd no higher than the lowest production machine > - keep a CVS repository on the build box > - buildbox /etc/make.conf has KERNCONF="SERVER CLIENT1 CLIENT2..." > - run make update / make buildworld / make buildkernel on the build box > - Install kernel & world on the build box, run mergemaster, etc as documented > - run the build box for a couple of days (rebuilding ports etc) to check it > out > - NFS mount /usr/src and /usr/obj readonly on each client > - client /etc/make.conf has KERNCONF=CLIENTn > - installkernel / installworld / mergemaster on the client in the normal way > > [ ... ] Just a quick addendum for anyone who's stepping through this, as I've just done :) - If you are going to 'make installworld' in single-user mode on the client, you need to '# sh /etc/netstart' after fsck, mount, swapon, etc. to be able to NFS mount the build server. May be obvious, but tripped me up a bit at first. -- Paul Smith <paul@cnt.org> Webmaster/Systems Administrator Center for Neighborhood Technology Chicago, Illinois USA
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030709185054.GI32234>