Product SiteDocumentation Site

3. Changes in Fedora for System Administrators

3.1. Security

3.1.1. OpenSCAP Abstract
Fedora 14 brings in support of the SCAP (Security Content Automation Protocol). A library called OpenSCAP that provides development framework and several SCAP scanning tools are included in the distribution. OVAL and XCCDF contents specific for Fedora 14 that can be used for automated system configuration checking are also provided.

3.1.2. Description

OpenSCAP is an open-source framework for SCAP developers. SCAP is a line of standards managed by NIST (National Institute of Standards and Technology). It was created to provide a standardized approach to maintaining the security of systems, such as automatically verifying the presence of patches, checking system security configuration settings, and examining systems for signs of compromise.
The SCAP suite contains multiple complex data exchange formats that are to be used to transmit important vulnerability, configuration, and other security data. Historically, there have been few tools that provide a way to query this data in the needed format. The OpenSCAP project aims to create a framework of libraries to improve the accessibility of SCAP and enhance the usability of the information it represents.
The tools based on OpenSCAP library which are included in this Fedora feature are:
  • oscap-scan - command line scanner driven by OVAL/XCCDF content
  • secstate - tool that attempts to streamline the Certification and Accreditation (C&A) process of Linux systems by providing a mechanism to verify, validate, and provide remediation to security relevant configuration items.
  • firstaidkit-plugin-openscap - Plugin for FirstAidKit which allows user to perform basic automated security audit and evaluate the results in text or graphical environment.
With this feature installed, the user can use different ways to perform automatic scan of his system and make sure the system is in compliance with defined security configuration. The user is enabled to automatically remediate the system.

3.1.3. References

3.2. Virtualization

3.2.1. Amazon Elastic Computing Cloud

Fedora 14 and later versions will now be available for users of the Amazon Elastic Computing Cloud service.
For more information, refer to:

3.2.2. Spice Framework for Desktop Virtualization

The Simple Protocol for Independent Computing Environments (SPICE) is used for client-server communication and enhances interaction with virtual machine guests. Spice adds a QXL display device to QEMU and provides drivers for this device for both X and Windows.
The Spice framework for desktop virtualization aims to provide a complete open source solution for interaction with virtualized desktops.
For more information, refer to:

3.2.3. Xen to KVM Migration

virt-v2v is a command line tool that enables Xen domUs (ie. guests) to be migrated to use KVM. Users with Xen guests can try out KVM. Users can also migrate from Xen to KVM for its enhanced ease of use.
For more information, refer to:

3.2.4. Other Improvements Virtualization Technology Preview Repo
The Virtualization Preview Repository exists for people who would like to test the very latest virtualization related packages. This repo is intended primarily as an aid to testing and early experimentation. It is not intended for 'production' deployment.
For further details refer to: Xen Kernel Support
The kernel package in Fedora 14 supports booting as a guest domU, but will not function as a dom0 until such support is provided upstream.
The most recent Fedora release with dom0 support is Fedora 8.
Booting a Xen domU guest within a Fedora 14 host requires the KVM based xenner. Xenner runs the guest kernel and a small Xen emulator together as a KVM guest.
For further details refer to:

3.3. Web Servers

3.3.1. Varnish

Varnish was updated to 2.1.3. Improvements include better scalability and a new log function.
The main changes you can read here, from Varnish website.

3.3.2. Apache

httpd was updated from 2.2.14 to 2.2.16. This version includes mod and security fixes, and core change:
  • Filter init functions are now run strictly once per request before handler invocation. The init functions are no longer run for connection filters.
For more information refer to CHANGES 2.2 from Apache website.

3.4. Server Configuration Tools

3.4.1. ipmiutil

ipmiutil performs a series of common IPMI server management functions to allow administrators to perform management functions without a learning curve. It can gather FRU inventory data, SEL firmware log, sensors, watchdog, power control, health, monitoring, and has an SOL console. It can write sensor thresholds, FRU asset tags, and supports a full IPMI configuration save/restore. Ease-of-use examples with ipmiutil: configuring the IPMI LAN requires a single command, and a soft-reboot can be easily performed instead of a hard reboot. This utility can use various existing IPMI drivers, or run in driverless mode, which is useful for boot media or test environments. The decoding of IPMI events includes a severity, and any events not recognized at least return the data, rather than just Unknown. Features compared to other IPMI packages:

3.5. X Display System

3.5.1. vbetool not installed by default

Due to problems with vbetool, this package has been removed from the default installation of Fedora. This change may impact users with suspending and resuming their computers. These problems should only affect users of uncommon VGA adaptors and not users of nVidia, ATI, or Intel adaptors.

3.5.2. Mouse Behavior

The latest version of evdev, version 2.5, changed the default for the middle mouse button emulation code. This change has disabled emulation of the middle mouse button by clicking the left and right mouse buttons. Enabling the middle mouse button emulation
Middle mouse button emulation can be enabled by the addition of a xorg.conf snippet:
        Section "InputClass"
	  Identifier "middle button emulation class"
	  MatchIsPointer "on"
	  Option "Emulate3Buttons" "on"