PUBLIC MARKS from camel with tags free & security

Xen is a GPLed virtualization solution available in Debian 4.0 Etch repositories. This article help you to create a coherent Xen installation, with backups and minimum security enhancements. This guide fits my vision of a Xen setup. If it does not fit yours, you are free to adapt it to your needs, or to not use it. For information In this guide, i use the term "virtual host". Be aware that Xen use its own terminology. In a Xen setup, instanciated (aka. started) virtual hosts are called "Domains". Once your computer configured for Xen, all the operating systems run in "domains". The original operating system, where the Xen's control tools are installed, is called "dom0" (for domain No zero). All the guest operating systems are said to be installed in a "domU" (for User domain). As i'm a little lazy (well, yeah... very lazy), i don't want to endure this mind twisting, and i will mainly use the "virtual host" term in this guide. So, if you read this guide, don't by angry at me because of the terms i use.

The Pound program is a reverse proxy, load balancer and HTTPS front-end for Web server(s). Pound was developed to enable distributing the load among several Web-servers and to allow for a convenient SSL wrapper for those Web servers that do not offer it natively. Pound is distributed under the GPL - no warranty, it's free to use, copy and give away. WHAT POUND IS: 1. a reverse-proxy: it passes requests from client browsers to one or more back-end servers. 2. a load balancer: it will distribute the requests from the client browsers among several back-end servers, while keeping session information. 3. an SSL wrapper: Pound will decrypt HTTPS requests from client browsers and pass them as plain HTTP to the back-end servers. 4. an HTTP/HTTPS sanitizer: Pound will verify requests for correctness and accept only well-formed ones. 5. a fail over-server: should a back-end server fail, Pound will take note of the fact and stop passing requests to it until it recovers. 6. a request redirector: requests may be distributed among servers according to the requested URL. Pound is a very small program, easily audited for security problems. It can run as setuid/setgid and/or in a chroot jail. Pound does not access the hard-disk at all (except for reading the certificate file on start, if required) and should thus pose no security threat to any machine.

Secure your Web-Applications on the fly