Changeset 200
- Timestamp:
- 12/08/05 06:07:09
- Files:
-
- trunk/README (modified) (2 diffs)
- trunk/doc/isconf.8 (modified) (7 diffs)
- trunk/doc/isconf.html (modified) (7 diffs)
- trunk/doc/isconf.t2t.in (modified) (6 diffs)
- trunk/version (modified) (1 diff)
Legend:
- Unmodified
- Added
- Removed
- Modified
- Copied
- Moved
trunk/README
r169 r200 27 27 ==================================================== 28 28 29 newversion=isconf-4.2. 6.N29 newversion=isconf-4.2.8.N 30 30 cd /tmp 31 31 isconf -m "upgrade to $newversion" lock … … 37 37 (...and make /etc/rc* symlinks, again using isconf exec) 38 38 isconf exec chmod 755 /usr/bin/isconf 39 (...cp doc/isconf.8 to MANPATH, again using isconf exec) 39 isconf exec cp doc/isconf.8 /usr/man/man8/ 40 40 isconf reboot 41 41 isconf ci trunk/doc/isconf.8
r198 r200 1 .TH "isconf(8)" 1 "1 1/17/2005" "ISconf 4.2.7.197"1 .TH "isconf(8)" 1 "12/01/2005" "ISconf 4.2.7.199" 2 2 3 3 .SH NAME … … 65 65 aren't as interested in O/S patch management, or still want to log in 66 66 as root on target machines and make arbitrary untracked changes, then 67 you don't want this package. (You might, however, want 68 \fBcfengine\fR(8) \-\- see the bottom of this man page.) 67 you don't want this package. 69 68 70 69 .SH BACKGROUND … … 406 405 Rather than set this in an environment variable, you're better off 407 406 populating the \fB/var/is/conf/domain\fR file, below. 407 408 See the \fBdomain\fR glossary entry. 408 409 409 410 .TP … … 670 671 then creating a \fBcheckpoint image\fR. 671 672 672 Branches are named with an arbitrary string of letters and numbers. 673 Branch names must match this regular expression: 674 675 .nf 676 \ew+[-\ew\e.]+ 677 .fi 678 673 679 674 680 See also \fBclass\fR. 675 681 682 For more discussion of what branches are, and how they contrast 683 with domains, see 684 http://trac.t7a.org/isconf/wiki/DomainsVsBranches. 685 676 686 .TP 677 687 \fBcategories of data\fR 688 678 689 There appear to be three categories of data or executables on the 679 690 disk of a typical UNIX machine: … … 702 713 .TP 703 714 \fBclass\fR 715 704 716 This is an anti\-definition: the word "class" should not be used to 705 717 describe anything related to deterministic host management. It … … 708 720 propagated to subclasses", and so on; most of these misconceptions 709 721 imply that \fIediting history\fR is a safe thing to do. 722 723 .TP 724 \fBcongruent\fR 725 726 Remaining in compliance with a fully\-descriptive specification. 727 If a configuration management tool is congruent, the machines it 728 manages will remain in lock\-step with the desired state. This 729 makes it easier to maintain a representative test environment, and 730 allows for more predictable disaster recovery. ISconf is 731 congruent. Also see the \fBconvergent\fR glossary entry, and: 732 733 http://www.infrastructures.org/papers/turing/turing.html#methods/congruence 734 735 .TP 736 \fBconvergent\fR 737 738 Tending to converge towards a desired state. If a configuration 739 management tool is convergent, the machines it manages will trend 740 towards each other in disk state, but for practical reasons they 741 will rarely reach congruence. It will be difficult to maintain a 742 representative test environment, and changes will tend to be made 743 first, and tested first, in production. Predictable disaster 744 recovery will remain elusive. Also see the \fBcongruent\fR glossary 745 entry. For more in\-depth information about convergence, see: 746 747 http://www.infrastructures.org/papers/turing/turing.html#methods/convergence 748 749 .TP 750 \fBdomain\fR 751 752 An ISconf domain name is more or less equivalent to a NIS domain 753 name, an AFS cell name, or a Kerberos realm name. This name is an 754 arbitrary string, but by convention it is usually based on the DNS 755 domain name. 756 757 ISconf domains are a security mechanism, primarily in regards to 758 information hiding. All of the machines sharing the same ISconf 759 domain name will share the same distributed cache, so root users 760 on all of these machines will be able to read the contents of the 761 cache. Likewise, machines that are in different domains will not 762 share the same cache, so root users of these machines will not 763 have access to the cache contents of the other domain. This 764 becomes important if there is any proprietary or sensitive 765 information stored in the ISconf cache, for example via a 'snap' 766 or 'exec' command. 767 768 Normally you'd want all of the machines in a given legal entity \-\- 769 the same corporation, for instance, to use the same domain name. 770 For example, a small company using ISconf might use an ISconf 771 domain name of 'example.com' on all of their machines. A larger 772 company might have multiple divisions or subsidiaries and legal or 773 security reasons for segregating machines. The large campany 774 might put most of their machines in 'example.com', but for 775 regulatory or security reasons might isolate a subsidiary into 776 'foo.example.com', and might put their bastion and firewall 777 machines into 'security.example.com'. Note again that there 778 doens't need to be a 'security.example.com' DNS domain for this to 779 work. 780 781 The idea of ISconf domains is to completely isolate legal entities 782 from each other when sharing the same net. Machines in different 783 domains refuse to cache each other's data, answer each other's 784 queries, and so on. Domains really come into play in the TCP 785 crypto and user auth code (ISconf 4.3 and later), where each 786 domain has its own PGP keyring; its own database of hosts and 787 users, and all of the wire traffic is encrypted accordingly. 788 789 Establishing two machines in different domains means "I don't want 790 these machines to ever cooperate at all. I will never merge their 791 branches, I don't want them to be able to share or see each 792 other's packages, cache space, or wire traffic." 793 794 For more discussion of what domains are, and how they contrast 795 with branches, see 796 http://trac.t7a.org/isconf/wiki/DomainsVsBranches. 797 798 Domain names must match this regular expression: 799 800 .nf 801 \ew+[-\ew\e.]+ 802 .fi 803 710 804 711 805 .TP … … 823 917 explosion of risk, to the point where all data on disk must be 824 918 considered to be environmental, and all changes must be considered 825 untested prior to production rollout. Tools such as cfengine are 826 in fact optimized for this case. 919 untested prior to production rollout. If you find yourself in 920 this situation, your best bet might be to go with a convergent 921 tool such as cfengine; you'll lose congruence, though, until 922 you're able to fix the original problems and rebuild your 923 machines. See \fBconvergent\fR and \fBcongruent\fR. 827 924 828 925 .TP trunk/doc/isconf.html
r198 r200 7 7 <P ALIGN="center"><CENTER><H1>isconf(8)</H1> 8 8 <FONT SIZE="4"> 9 <I>ISconf 4.2.7.19 7</I><BR>10 1 1/17/20059 <I>ISconf 4.2.7.199</I><BR> 10 12/01/2005 11 11 </FONT></CENTER> 12 12 … … 107 107 aren't as interested in O/S patch management, or still want to log in 108 108 as root on target machines and make arbitrary untracked changes, then 109 you don't want this package. (You might, however, want 110 <B>cfengine</B>(8) -- see the bottom of this man page.) 109 you don't want this package. 111 110 </P> 112 111 <A NAME="toc5"></A> … … 439 438 Rather than set this in an environment variable, you're better off 440 439 populating the <B>/var/is/conf/domain</B> file, below. 440 <P></P> 441 See the <B>domain</B> glossary entry. 441 442 <P></P> 442 443 <DT><B>IS_HOME</B> </DT><DD> … … 693 694 then creating a <B>checkpoint image</B>. 694 695 <P></P> 695 Branches are named with an arbitrary string of letters and numbers. 696 Branch names must match this regular expression: 697 <P></P> 698 <PRE> 699 \w+[-\w\.]+ 700 </PRE> 696 701 <P></P> 697 702 See also <B>class</B>. 698 703 <P></P> 704 For more discussion of what branches are, and how they contrast 705 with domains, see 706 <A HREF="http://trac.t7a.org/isconf/wiki/DomainsVsBranches">http://trac.t7a.org/isconf/wiki/DomainsVsBranches</A>. 707 <P></P> 699 708 <DT><B>categories of data</B></DT><DD> 709 <P></P> 700 710 There appear to be three categories of data or executables on the 701 711 disk of a typical UNIX machine: … … 719 729 <P></P> 720 730 <DT><B>class</B></DT><DD> 731 <P></P> 721 732 This is an anti-definition: the word "class" should not be used to 722 733 describe anything related to deterministic host management. It … … 726 737 imply that <I>editing history</I> is a safe thing to do. 727 738 <P></P> 739 <DT><B>congruent</B></DT><DD> 740 <P></P> 741 Remaining in compliance with a fully-descriptive specification. 742 If a configuration management tool is congruent, the machines it 743 manages will remain in lock-step with the desired state. This 744 makes it easier to maintain a representative test environment, and 745 allows for more predictable disaster recovery. ISconf is 746 congruent. Also see the <B>convergent</B> glossary entry, and: 747 <P></P> 748 <A HREF="http://www.infrastructures.org/papers/turing/turing.html#methods">http://www.infrastructures.org/papers/turing/turing.html#methods</A>/congruence 749 <P></P> 750 <DT><B>convergent</B></DT><DD> 751 <P></P> 752 Tending to converge towards a desired state. If a configuration 753 management tool is convergent, the machines it manages will trend 754 towards each other in disk state, but for practical reasons they 755 will rarely reach congruence. It will be difficult to maintain a 756 representative test environment, and changes will tend to be made 757 first, and tested first, in production. Predictable disaster 758 recovery will remain elusive. Also see the <B>congruent</B> glossary 759 entry. For more in-depth information about convergence, see: 760 <P></P> 761 <A HREF="http://www.infrastructures.org/papers/turing/turing.html#methods">http://www.infrastructures.org/papers/turing/turing.html#methods</A>/convergence 762 <P></P> 763 <DT><B>domain</B></DT><DD> 764 <P></P> 765 An ISconf domain name is more or less equivalent to a NIS domain 766 name, an AFS cell name, or a Kerberos realm name. This name is an 767 arbitrary string, but by convention it is usually based on the DNS 768 domain name. 769 <P></P> 770 ISconf domains are a security mechanism, primarily in regards to 771 information hiding. All of the machines sharing the same ISconf 772 domain name will share the same distributed cache, so root users 773 on all of these machines will be able to read the contents of the 774 cache. Likewise, machines that are in different domains will not 775 share the same cache, so root users of these machines will not 776 have access to the cache contents of the other domain. This 777 becomes important if there is any proprietary or sensitive 778 information stored in the ISconf cache, for example via a 'snap' 779 or 'exec' command. 780 <P></P> 781 Normally you'd want all of the machines in a given legal entity -- 782 the same corporation, for instance, to use the same domain name. 783 For example, a small company using ISconf might use an ISconf 784 domain name of 'example.com' on all of their machines. A larger 785 company might have multiple divisions or subsidiaries and legal or 786 security reasons for segregating machines. The large campany 787 might put most of their machines in 'example.com', but for 788 regulatory or security reasons might isolate a subsidiary into 789 'foo.example.com', and might put their bastion and firewall 790 machines into 'security.example.com'. Note again that there 791 doens't need to be a 'security.example.com' DNS domain for this to 792 work. 793 <P></P> 794 The idea of ISconf domains is to completely isolate legal entities 795 from each other when sharing the same net. Machines in different 796 domains refuse to cache each other's data, answer each other's 797 queries, and so on. Domains really come into play in the TCP 798 crypto and user auth code (ISconf 4.3 and later), where each 799 domain has its own PGP keyring; its own database of hosts and 800 users, and all of the wire traffic is encrypted accordingly. 801 <P></P> 802 Establishing two machines in different domains means "I don't want 803 these machines to ever cooperate at all. I will never merge their 804 branches, I don't want them to be able to share or see each 805 other's packages, cache space, or wire traffic." 806 <P></P> 807 For more discussion of what domains are, and how they contrast 808 with branches, see 809 <A HREF="http://trac.t7a.org/isconf/wiki/DomainsVsBranches">http://trac.t7a.org/isconf/wiki/DomainsVsBranches</A>. 810 <P></P> 811 Domain names must match this regular expression: 812 <P></P> 813 <PRE> 814 \w+[-\w\.]+ 815 </PRE> 816 </DL> 817 818 <DL> 728 819 <DT><B>editing history</B></DT><DD> 729 820 <P></P> … … 835 926 explosion of risk, to the point where all data on disk must be 836 927 considered to be environmental, and all changes must be considered 837 untested prior to production rollout. Tools such as cfengine are 838 in fact optimized for this case. 928 untested prior to production rollout. If you find yourself in 929 this situation, your best bet might be to go with a convergent 930 tool such as cfengine; you'll lose congruence, though, until 931 you're able to fix the original problems and rebuild your 932 machines. See <B>convergent</B> and <B>congruent</B>. 839 933 <P></P> 840 934 <DT><B>evolvable data</B></DT><DD> trunk/doc/isconf.t2t.in
r198 r200 89 89 aren't as interested in O/S patch management, or still want to log in 90 90 as root on target machines and make arbitrary untracked changes, then 91 you don't want this package. (You might, however, want 92 **cfengine**(8) -- see the bottom of this man page.) 91 you don't want this package. 93 92 94 93 … … 407 406 Rather than set this in an environment variable, you're better off 408 407 populating the **/var/is/conf/domain** file, below. 408 409 See the **domain** glossary entry. 409 410 410 411 : **IS_HOME** … … 656 657 then creating a **checkpoint image**. 657 658 658 Branches are named with an arbitrary string of letters and numbers. 659 Branch names must match this regular expression: 660 661 ``` 662 \w+[-\w\.]+ 663 ``` 659 664 660 665 See also **class**. 661 666 667 For more discussion of what branches are, and how they contrast 668 with domains, see 669 http://trac.t7a.org/isconf/wiki/DomainsVsBranches. 670 662 671 : **categories of data** 672 663 673 There appear to be three categories of data or executables on the 664 674 disk of a typical UNIX machine: … … 680 690 681 691 : **class** 692 682 693 This is an anti-definition: the word "class" should not be used to 683 694 describe anything related to deterministic host management. It … … 686 697 propagated to subclasses", and so on; most of these misconceptions 687 698 imply that //editing history// is a safe thing to do. 699 700 : **congruent** 701 702 Remaining in compliance with a fully-descriptive specification. 703 If a configuration management tool is congruent, the machines it 704 manages will remain in lock-step with the desired state. This 705 makes it easier to maintain a representative test environment, and 706 allows for more predictable disaster recovery. ISconf is 707 congruent. Also see the **convergent** glossary entry, and: 708 709 http://www.infrastructures.org/papers/turing/turing.html#methods/congruence 710 711 : **convergent** 712 713 Tending to converge towards a desired state. If a configuration 714 management tool is convergent, the machines it manages will trend 715 towards each other in disk state, but for practical reasons they 716 will rarely reach congruence. It will be difficult to maintain a 717 representative test environment, and changes will tend to be made 718 first, and tested first, in production. Predictable disaster 719 recovery will remain elusive. Also see the **congruent** glossary 720 entry. For more in-depth information about convergence, see: 721 722 http://www.infrastructures.org/papers/turing/turing.html#methods/convergence 723 724 : **domain** 725 726 An ISconf domain name is more or less equivalent to a NIS domain 727 name, an AFS cell name, or a Kerberos realm name. This name is an 728 arbitrary string, but by convention it is usually based on the DNS 729 domain name. 730 731 ISconf domains are a security mechanism, primarily in regards to 732 information hiding. All of the machines sharing the same ISconf 733 domain name will share the same distributed cache, so root users 734 on all of these machines will be able to read the contents of the 735 cache. Likewise, machines that are in different domains will not 736 share the same cache, so root users of these machines will not 737 have access to the cache contents of the other domain. This 738 becomes important if there is any proprietary or sensitive 739 information stored in the ISconf cache, for example via a 'snap' 740 or 'exec' command. 741 742 Normally you'd want all of the machines in a given legal entity -- 743 the same corporation, for instance, to use the same domain name. 744 For example, a small company using ISconf might use an ISconf 745 domain name of 'example.com' on all of their machines. A larger 746 company might have multiple divisions or subsidiaries and legal or 747 security reasons for segregating machines. The large campany 748 might put most of their machines in 'example.com', but for 749 regulatory or security reasons might isolate a subsidiary into 750 'foo.example.com', and might put their bastion and firewall 751 machines into 'security.example.com'. Note again that there 752 doens't need to be a 'security.example.com' DNS domain for this to 753 work. 754 755 The idea of ISconf domains is to completely isolate legal entities 756 from each other when sharing the same net. Machines in different 757 domains refuse to cache each other's data, answer each other's 758 queries, and so on. Domains really come into play in the TCP 759 crypto and user auth code (ISconf 4.3 and later), where each 760 domain has its own PGP keyring; its own database of hosts and 761 users, and all of the wire traffic is encrypted accordingly. 762 763 Establishing two machines in different domains means "I don't want 764 these machines to ever cooperate at all. I will never merge their 765 branches, I don't want them to be able to share or see each 766 other's packages, cache space, or wire traffic." 767 768 For more discussion of what domains are, and how they contrast 769 with branches, see 770 http://trac.t7a.org/isconf/wiki/DomainsVsBranches. 771 772 Domain names must match this regular expression: 773 774 ``` 775 \w+[-\w\.]+ 776 ``` 777 688 778 689 779 : **editing history** … … 794 884 explosion of risk, to the point where all data on disk must be 795 885 considered to be environmental, and all changes must be considered 796 untested prior to production rollout. Tools such as cfengine are 797 in fact optimized for this case. 798 886 untested prior to production rollout. If you find yourself in 887 this situation, your best bet might be to go with a convergent 888 tool such as cfengine; you'll lose congruence, though, until 889 you're able to fix the original problems and rebuild your 890 machines. See **convergent** and **congruent**. 891 799 892 : **evolvable data** 800 893 trunk/version
r174 r200 1 4.2. 71 4.2.8
