Minimum packages for a slack webserver?

technician · 06-15-2005, 03:33 PM

I'm looking to streamline my current webserver (all I use/need is PHP, MySQL, Apache) so I can keep track of security a bit better, and keep things less complex. What packages from a default Slackware 10.0 install can I go without to remove the "bloat" that I don't need on a basic webserver setup? I went with a complete install originally, so I'm hoping I can just go back through with pkgtool and remove anything I don't need.

EDIT: I should note I do not need a GUI, console is just fine for me. I also do not make use of audio on this box.

gbonvehi · 06-15-2005, 03:38 PM

You can start removing things with all window managers. Then X related and finally X.
After that, you've to start looking at the description of the packages and deciding.
Basically what's needed is all under the a/ and l/ section of Slackware pacakges. To run the servers you'll need more stuff like network.

Edit: I forgot to say that you can find info about this in Amigo Linux's homepage ( http://amigolinux.org/ ) that's based on Slackware and has some good information about running a minimal Slackware system.

killerbob · 06-15-2005, 03:43 PM

I'd start with the /a, /d, and /l packages. You'll probably not need all of them, but at the very least you'll need gcc and related libraries. Download a new kernel, apache, mysql, and php and you should be able to compile your own.

Or if you'd rather do it the binary way, then /a and /l are all you really need. Again, pick and choose... you probably won't need the ogg-vorbis libraries or libmpg, for example.

nukey · 06-15-2005, 05:19 PM

and when your done, and know exactly what you need, make the tagfiles so that you can install slack very easy the next time you plan to install such a server

trickykid · 06-15-2005, 08:40 PM

Quote:

Originally posted by killerbob
I'd start with the /a, /d, and /l packages. You'll probably not need all of them, but at the very least you'll need gcc and related libraries. Download a new kernel, apache, mysql, and php and you should be able to compile your own.

Or if you'd rather do it the binary way, then /a and /l are all you really need. Again, pick and choose... you probably won't need the ogg-vorbis libraries or libmpg, for example.

Errmm.. what about /n packages (networking)? You'll most likely need a majority of these..

And depending on if you use imagemagick for any web related stuff like image editing with php applications, you might need some X libs installed at the least but don't need X.

I'd say you need /a, /ap, /d, /l and /n packages..

Here's my package list on a Slackware web server I run.. pretty minimal too..

Code:

aaa_base-10.1.0-noarch-2       groff-1.17.2-i386-3            orbit-0.5.17-i386-1
aaa_elflibs-10.1.0-i486-1      guile-1.6.5-i486-1             pango-1.8.1-i486-1
aalib-1.4rc5-i386-1            gzip-1.3.3-i386-2              pciutils-2.1.11-i486-5
acpid-1.0.4-i486-2             hdparm-5.8-i486-1              pcre-5.0-i486-1
apache-1.3.33-i486-1           imagemagick-6.1.9_0-i486-1     perl-5.8.6-i486-1
apmd-3.0.2-i386-1              imapd-4.62-i486-1              php-4.3.11-i486-1
aspell-0.60-i486-2             imlib-1.9.15-i486-1            pidentd-3.0.18-i486-1
aspell-en-6.0_0-noarch-2       indent-2.2.9-i386-1            pine-4.62-i486-1
autoconf-2.59-noarch-1         inetd-1.79s-i486-7             pkgconfig-0.15.0-i486-1
automake-1.9.5-noarch-1        infozip-5.52-i486-1            pkgtools-10.1.0-i486-4
bash-3.0-i486-2                jfsutils-1.1.6-i486-1          pmake-2.1.35-i386-2
bin-9.2.0-i486-2               joe-3.1-i486-1                 popa3d-0.6.4-i486-1
bin86-0.16.15-i486-1           kernel-headers-2.4.26-i386-3   popt-1.7-i386-1
binutils-2.15.92.0.2-i486-2    kernel-ide-2.4.26-i486-4       portmap-5.0-i486-1
bison-1.35-i386-1              kernel-modules-2.4.26-i486-3   procps-3.2.3-i486-1
byacc-1.9-i386-1               kernel-source-2.4.26-noarch-4  readline-4.3-i486-3
bzip2-1.0.2-i486-5             lcms-1.12-i486-1               rsync-2.6.3-i486-1
ccache-2.4-i486-1              less-382-i486-1                rzip-2.0-i486-2
coreutils-5.2.1-i486-1         lesstif-0.93.96-i486-1         screen-4.0.2-i486-1
curl-7.12.0-i486-1             libcaca-0.9-i486-2             sdl-1.2.8-i486-1
cxxlibs-5.0.6-i486-1           libexif-0.6.11-i486-1          sed-4.0.9-i486-2
db3-3.3.11-i486-4              libjpeg-6b-i386-4              seejpeg-1.10-i386-1
db31-3.1.17-i486-1             libmng-1.0.5-i486-1            sendmail-8.13.3-i486-2
db4-4.2.52-i486-2              libpng-1.2.8-i486-1            sgml-tools-1.0.9-i486-12
dcron-2.3.3-i386-4             libtermcap-1.2.3-i486-6        shadow-4.0.3-i486-11
devs-2.3.1-noarch-21           libtiff-3.7.1-i486-2           slang-1.4.9-i486-1
dhcpcd-1.3.22pl4-i386-1        libtool-1.5.14-i486-1          slocate-2.7-i486-3
diffutils-2.8.1-i386-1         libungif-4.1.2-i486-1          sudo-1.6.8p6-i486-1
distcc-2.18.3-i486-1           libxml2-2.6.18-i486-1          svgalib-1.4.3-i386-2
doxygen-1.4.0-i486-1           libxslt-1.1.13-i486-1          sysklogd-1.4.1-i486-9
e2fsprogs-1.35-i486-1          lilo-22.5.9-i486-2             syslinux-2.13-i486-1
elvis-2.2_0-i486-2             logrotate-3.6.8-i486-1         sysvinit-2.84-i486-51
etc-5.1-noarch-9               lsof-4.71-i486-1               t1lib-1.3.1-i386-2
expat-1.95.7-i486-1            m4-1.4.2-i486-1                tar-1.15.1-i486-1
findutils-4.1.7-i386-1         make-3.80-i386-1               tcpdump-3.8.3-i486-2
flex-2.5.4a-i486-3             man-1.5m2-i486-1               tcpip-0.17-i486-29
gawk-3.1.4-i486-1              man-pages-1.64-noarch-1        texinfo-4.7-i486-1
gcc-3.3.5-i486-1               metamail-2.7-i486-2            traceroute-1.4a12-i386-2
gcc-g++-3.3.5-i486-1           mhash-0.9.1-i486-1             udev-054-i486-3
gdb-6.3-i486-1                 mkinitrd-1.0.1-i486-2          utempter-1.1.1-i486-1
gdbm-1.8.3-i486-3              mod_ssl-2.8.22_1.3.33-i486-1   util-linux-2.12p-i486-1
gettext-0.14.3-i486-1          module-init-tools-3.1-i486-1   vim-6.3.007-i486-1
gettext-tools-0.14.3-i486-1    mysql-4.0.24-i486-1            wget-1.9.1-i486-1
glibc-2.3.4-i486-1             nail-11.22-i486-1              x11-6.8.2-i486-1
glibc-solibs-2.3.4-i486-1      ncurses-5.4-i486-2             x11-devel-6.8.2-i486-1
glibc-zoneinfo-2.3.4-noarch-1  nfs-utils-1.0.7-i486-1         x11-fonts-misc-6.8.2-noarch-1
gmp-4.1.4-i486-1               ntp-4.2.0-i486-1               x11-xvfb-6.8.2-i486-1
gnet-2.0.4-i486-1              openssh-4.0p1-i486-1           zlib-1.2.2-i486-1
gnupg-1.2.7-i486-1             openssl-0.9.7e-i486-3
grep-2.5-i386-2                openssl-solibs-0.9.7e-i486-3

buddhahat · 06-16-2005, 08:00 AM

If this box is only a web server than do you might not need man-1.5m2-i486-1 and man-pages-1.64-noarch-1. I don't have them on my web server.

If you're running MySQL then you can drop db3-3.3.11-i486-4, db31-3.1.17-i486-1
db4-4.2.52-i486-2.

You could eliminate the kernel source too.

Do you need mail from your web server? If not then you can remove sendmail-8.13.3-i486-2.

I'm not sure about all the archiving tools but I only run tar-1.15.1-i486-1 and haven't had any issues.

I also didn't install all the text editors, I only run vi.

If security is your concern then I would run nmap "servername" to see what ports are open.

Good luck!

trickykid · 06-16-2005, 08:58 AM

Quote:

Originally posted by buddhahat
If this box is only a web server than do you might not need man-1.5m2-i486-1 and man-pages-1.64-noarch-1. I don't have them on my web server.

If you're running MySQL then you can drop db3-3.3.11-i486-4, db31-3.1.17-i486-1
db4-4.2.52-i486-2.

You could eliminate the kernel source too.

Do you need mail from your web server? If not then you can remove sendmail-8.13.3-i486-2.

I'm not sure about all the archiving tools but I only run tar-1.15.1-i486-1 and haven't had any issues.

I also didn't install all the text editors, I only run vi.

If security is your concern then I would run nmap "servername" to see what ports are open.

Good luck!

That is true about the kernel sources and such since I even compile from source and don't use the Slackware packages, just left them there as they were harmless. The man pages are always nice to have around though, just in case and don't take up hardly any space.

I would imagine most webservers will need sendmail or another type of mail application for online forms and such for web pages, etc. I'd keep something like that around just in case.

And the db packages are dependencies for many other things, I'd keep them around.

Alot of the untilities and tools are good to keep around, I've been stuck in cases where I thought I never needed a tool so it was removed and then I found out the hard way when I could have used it, same reason for keep the man pages around, I doubt anyone really knows the flags and options for every single command..

buddhahat · 06-16-2005, 09:32 AM

Quote:

Originally posted by trickykid

And the db packages are dependencies for many other things, I'd keep them around.

I'm curious to know what depends on the db packages?

Quote:

Originally posted by trickykid

Alot of the untilities and tools are good to keep around, I've been stuck in cases where I thought I never needed a tool so it was removed and then I found out the hard way when I could have used it, same reason for keep the man pages around, I doubt anyone really knows the flags and options for every single command.

I have certainly learned this the hard way! I started with (what I thought) was the minimum install and have run into some issues. For example I didn't install mhash and soon learned that Apache 2 requires it! But it's been a great learning experience.

technician · 06-16-2005, 11:18 AM

Thanks a lot of the replies guys, they are all much appreciated. My plan is to create a really slim pure webserver running just PHP, MySQL, Apache, SSH, webmin and shorewall for a software firewall. I just want to keep things really simple, and as secure as possible. Assuming someone was able to break in via SSH it'd be a tad bit tougher to do damage without having access to compilers and the like.

I probably will need sendmail for online forms, but I'm unsure if that's going to be vital or not.

buddhahat · 06-16-2005, 11:23 AM

Good luck technician. If you get the chance, post the packages you did end up installing. It would be interesting to see the list.

keefaz · 06-16-2005, 12:01 PM

Quote:

I'm curious to know what depends on the db packages?

just a few :
ab
afpd
cnid_dbd
cnid_metad
editmap
httpd
logresolve
mail.local
mailstats
makemap
rotatelogs
sendmail
smrsh
suexec
hoststat
htdigest
htpasswd
newaliases
php
rmail
sendmail
uniconv
vacation

buddhahat · 06-16-2005, 01:58 PM

Wow, I wasn't aware that so many packages were dependent on the db packages. Thanks keefaz.

Out of curiosity, why do httpd and php depend on the db packages? I've been running my web server for a short time now without the db packages (only MySQL) and have not had any problems.

keefaz · 06-16-2005, 02:46 PM

Well I just did a ldd test in /usr/bin and in /usr/sbin dirs
to know what binaries were linked to libdb

It is curious that you never had problem without db shared
lib installed, did you compile apache yourself ?

buddhahat · 06-16-2005, 04:10 PM

No, I didn't compile apache. I installed the apache2.0.53 package from linuxpackages.net.

What types of problems could I be experiencing? Maybe I have had problems and just don't know it.

keefaz · 06-16-2005, 05:29 PM

What is your output with ldd /usr/sbin/httpd ?

Quote:

What types of problems could I be experiencing?

Usually a program does not run at all if a linked shared
library is not found, that's why I asked if you compiled apache
yourself (without libdb)