Effective configuration file management is crucial for maintaining Alpine Linux systems, ensuring consistent deployments, and enabling reliable rollbacks. This comprehensive guide covers advanced techniques for tracking, versioning, and automating package configuration management across different environments.
🔍 Understanding Alpine Configuration Architecture
Alpine Linux follows the Unix philosophy of storing configuration in plain text files, making configuration management both powerful and accessible through standard tools.
Configuration File Hierarchy
- System-wide configs -
/etc/directory 🌐 - Service-specific configs -
/etc/service-name/📋 - User-specific configs -
~/.config/and~/👤 - Runtime configs -
/var/lib/,/var/run/⚡
Package Configuration Categories
# Essential system configurations
/etc/passwd # User accounts
/etc/group # Group definitions
/etc/shadow # Password hashes
/etc/fstab # Filesystem table
/etc/hostname # System hostname
/etc/hosts # Host name resolution
/etc/resolv.conf # DNS configuration
# Service configurations
/etc/nginx/ # Nginx web server
/etc/ssh/ # SSH daemon
/etc/mysql/ # MySQL/MariaDB
/etc/postgresql/ # PostgreSQL
/etc/redis/ # Redis
/etc/docker/ # Docker daemon
# Network configurations
/etc/network/ # Network interfaces
/etc/iptables/ # Firewall rules
/etc/wireguard/ # VPN configurations🛠️ Configuration Management Strategies
Version Control with Git
# Initialize configuration repository
cd /etc
git init
git config user.name "System Administrator"
git config user.email "[email protected]"
# Create comprehensive .gitignore
cat > .gitignore << 'EOF'
# Sensitive files
shadow*
gshadow*
ssh/ssh_host_*
ssl/private/
*.key
*.pem
# Runtime files
mtab
resolv.conf.auto
*.pid
*.sock
# Backup files
*.bak
*.orig
*~
.#*
# Log files
*.log
*.log.*
# Temporary files
*.tmp
*.swp
*.cache
EOF
# Add initial configuration
git add .
git commit -m "Initial configuration snapshot"
# Create configuration tracking script
cat > /usr/local/bin/track-config-changes << 'EOF'
#!/bin/sh
# Configuration change tracking
cd /etc
# Check for changes
if git diff --quiet && git diff --cached --quiet; then
echo "No configuration changes detected"
exit 0
fi
# Show changes
echo "Configuration changes detected:"
git status --porcelain
# Interactive commit (for manual use)
if [ "$1" = "--interactive" ]; then
git add -i
git commit
else
# Automatic commit with timestamp
git add .
git commit -m "Auto-commit: $(date '+%Y-%m-%d %H:%M:%S') - $(git status --porcelain | wc -l) files changed"
fi
echo "Configuration changes committed"
EOF
chmod +x /usr/local/bin/track-config-changesConfiguration Templates and Environment Management
# Create configuration template system
mkdir -p /etc/config-templates/{production,staging,development}
# Example: Nginx configuration template
cat > /etc/config-templates/nginx.conf.template << 'EOF'
user ${NGINX_USER:-nginx};
worker_processes ${NGINX_WORKERS:-auto};
error_log /var/log/nginx/error.log ${LOG_LEVEL:-warn};
pid /run/nginx.pid;
events {
worker_connections ${WORKER_CONNECTIONS:-1024};
use epoll;
multi_accept on;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Security headers
add_header X-Frame-Options "${X_FRAME_OPTIONS:-SAMEORIGIN}" always;
add_header X-Content-Type-Options "${X_CONTENT_TYPE_OPTIONS:-nosniff}" always;
# Performance settings
sendfile ${SENDFILE:-on};
tcp_nopush ${TCP_NOPUSH:-on};
tcp_nodelay ${TCP_NODELAY:-on};
keepalive_timeout ${KEEPALIVE_TIMEOUT:-65};
# Gzip compression
gzip ${GZIP_ENABLED:-on};
gzip_vary on;
gzip_min_length 1024;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml;
# Rate limiting
limit_req_zone $binary_remote_addr zone=api:10m rate=${API_RATE_LIMIT:-10r/s};
# Include additional configurations
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
EOF
# Environment-specific variable files
cat > /etc/config-templates/production/nginx.env << 'EOF'
NGINX_USER=nginx
NGINX_WORKERS=auto
LOG_LEVEL=error
WORKER_CONNECTIONS=2048
X_FRAME_OPTIONS=DENY
X_CONTENT_TYPE_OPTIONS=nosniff
SENDFILE=on
TCP_NOPUSH=on
TCP_NODELAY=on
KEEPALIVE_TIMEOUT=30
GZIP_ENABLED=on
API_RATE_LIMIT=5r/s
EOF
cat > /etc/config-templates/development/nginx.env << 'EOF'
NGINX_USER=nginx
NGINX_WORKERS=1
LOG_LEVEL=debug
WORKER_CONNECTIONS=1024
X_FRAME_OPTIONS=SAMEORIGIN
X_CONTENT_TYPE_OPTIONS=nosniff
SENDFILE=off
TCP_NOPUSH=off
TCP_NODELAY=on
KEEPALIVE_TIMEOUT=65
GZIP_ENABLED=off
API_RATE_LIMIT=100r/s
EOF
# Configuration deployment script
cat > /usr/local/bin/deploy-config << 'EOF'
#!/bin/sh
# Configuration deployment system
ENVIRONMENT="${1:-production}"
SERVICE="$2"
TEMPLATE_DIR="/etc/config-templates"
BACKUP_DIR="/var/backups/configs"
if [ -z "$SERVICE" ]; then
echo "Usage: $0 <environment> <service>"
echo "Environments: production, staging, development"
echo "Services: nginx, ssh, mysql, postgresql, etc."
exit 1
fi
# Load environment variables
ENV_FILE="$TEMPLATE_DIR/$ENVIRONMENT/$SERVICE.env"
if [ -f "$ENV_FILE" ]; then
source "$ENV_FILE"
else
echo "Warning: No environment file found at $ENV_FILE"
fi
# Template file
TEMPLATE_FILE="$TEMPLATE_DIR/$SERVICE.conf.template"
if [ ! -f "$TEMPLATE_FILE" ]; then
echo "Error: Template file not found: $TEMPLATE_FILE"
exit 1
fi
# Determine target configuration file
case "$SERVICE" in
nginx)
TARGET_FILE="/etc/nginx/nginx.conf"
;;
ssh)
TARGET_FILE="/etc/ssh/sshd_config"
;;
mysql)
TARGET_FILE="/etc/my.cnf"
;;
postgresql)
TARGET_FILE="/etc/postgresql/postgresql.conf"
;;
*)
TARGET_FILE="/etc/$SERVICE/$SERVICE.conf"
;;
esac
# Create backup
mkdir -p "$BACKUP_DIR/$(date +%Y%m%d)"
if [ -f "$TARGET_FILE" ]; then
cp "$TARGET_FILE" "$BACKUP_DIR/$(date +%Y%m%d)/$(basename "$TARGET_FILE").$(date +%H%M%S)"
fi
# Process template
echo "Deploying $SERVICE configuration for $ENVIRONMENT environment"
envsubst < "$TEMPLATE_FILE" > "$TARGET_FILE"
# Validate configuration
case "$SERVICE" in
nginx)
if nginx -t 2>/dev/null; then
echo "✅ Nginx configuration valid"
rc-service nginx reload
else
echo "❌ Nginx configuration invalid, restoring backup"
cp "$BACKUP_DIR/$(date +%Y%m%d)/$(basename "$TARGET_FILE")".* "$TARGET_FILE"
exit 1
fi
;;
ssh)
if sshd -t 2>/dev/null; then
echo "✅ SSH configuration valid"
rc-service sshd reload
else
echo "❌ SSH configuration invalid, restoring backup"
cp "$BACKUP_DIR/$(date +%Y%m%d)/$(basename "$TARGET_FILE")".* "$TARGET_FILE"
exit 1
fi
;;
esac
echo "Configuration deployment completed"
EOF
chmod +x /usr/local/bin/deploy-config
# Deploy configurations
deploy-config production nginx
deploy-config development nginx📊 Configuration Change Management
Automated Configuration Monitoring
# Create configuration monitoring system
cat > /usr/local/bin/monitor-config-changes << 'EOF'
#!/bin/sh
# Configuration change monitoring and alerting
CONFIG_DIR="/etc"
MONITOR_FILE="/var/lib/config-monitor/checksums"
ALERT_EMAIL="[email protected]"
LOG_FILE="/var/log/config-changes.log"
# Create monitoring directory
mkdir -p "$(dirname "$MONITOR_FILE")"
# Generate current checksums
generate_checksums() {
find "$CONFIG_DIR" -type f \
! -path "*/.*" \
! -name "*.log" \
! -name "*.tmp" \
! -name "*.pid" \
! -name "*.sock" \
! -name "resolv.conf.auto" \
-exec sha256sum {} \; 2>/dev/null | sort
}
# Load previous checksums
if [ -f "$MONITOR_FILE" ]; then
PREVIOUS_CHECKSUMS=$(cat "$MONITOR_FILE")
else
PREVIOUS_CHECKSUMS=""
fi
# Generate current checksums
CURRENT_CHECKSUMS=$(generate_checksums)
# Compare checksums
if [ "$PREVIOUS_CHECKSUMS" != "$CURRENT_CHECKSUMS" ]; then
echo "$(date): Configuration changes detected" | tee -a "$LOG_FILE"
# Find changed files
echo "$PREVIOUS_CHECKSUMS" > /tmp/previous_checksums
echo "$CURRENT_CHECKSUMS" > /tmp/current_checksums
# Files that were modified
MODIFIED_FILES=$(comm -13 /tmp/previous_checksums /tmp/current_checksums | awk '{print $2}')
# Files that were deleted
DELETED_FILES=$(comm -23 /tmp/previous_checksums /tmp/current_checksums | awk '{print $2}')
# Log changes
if [ -n "$MODIFIED_FILES" ]; then
echo "Modified/Added files:" | tee -a "$LOG_FILE"
echo "$MODIFIED_FILES" | while read file; do
echo " - $file" | tee -a "$LOG_FILE"
done
fi
if [ -n "$DELETED_FILES" ]; then
echo "Deleted files:" | tee -a "$LOG_FILE"
echo "$DELETED_FILES" | while read file; do
echo " - $file" | tee -a "$LOG_FILE"
done
fi
# Send alert email
if [ -n "$ALERT_EMAIL" ]; then
{
echo "Configuration changes detected on $(hostname) at $(date)"
echo ""
echo "Modified/Added files:"
echo "$MODIFIED_FILES"
echo ""
echo "Deleted files:"
echo "$DELETED_FILES"
echo ""
echo "Please review these changes immediately."
} | mail -s "Configuration Change Alert - $(hostname)" "$ALERT_EMAIL" 2>/dev/null || true
fi
# Update stored checksums
echo "$CURRENT_CHECKSUMS" > "$MONITOR_FILE"
# Track changes in git if available
if [ -d "$CONFIG_DIR/.git" ]; then
cd "$CONFIG_DIR"
track-config-changes
fi
else
echo "$(date): No configuration changes detected" >> "$LOG_FILE"
fi
# Cleanup
rm -f /tmp/previous_checksums /tmp/current_checksums
EOF
chmod +x /usr/local/bin/monitor-config-changes
# Add to cron for regular monitoring
echo "*/15 * * * * /usr/local/bin/monitor-config-changes >/dev/null 2>&1" >> /etc/crontabs/rootConfiguration Rollback System
# Create configuration rollback system
cat > /usr/local/bin/rollback-config << 'EOF'
#!/bin/sh
# Configuration rollback system
BACKUP_DIR="/var/backups/configs"
SERVICE="$1"
DATE="$2"
usage() {
echo "Usage: $0 <service> [date]"
echo ""
echo "Available services:"
ls -1 "$BACKUP_DIR" 2>/dev/null | head -5
echo ""
echo "Available dates:"
ls -1 "$BACKUP_DIR/" 2>/dev/null | head -10
echo ""
echo "Examples:"
echo " $0 nginx # Rollback to latest backup"
echo " $0 nginx 20250603 # Rollback to specific date"
echo " $0 list # List available backups"
}
list_backups() {
echo "Available configuration backups:"
echo ""
for date_dir in $(ls -1r "$BACKUP_DIR" 2>/dev/null | head -10); do
echo "Date: $date_dir"
ls -la "$BACKUP_DIR/$date_dir/" | while read line; do
echo " $line"
done
echo ""
done
}
if [ "$1" = "list" ]; then
list_backups
exit 0
fi
if [ -z "$SERVICE" ]; then
usage
exit 1
fi
# Determine target configuration file
case "$SERVICE" in
nginx)
TARGET_FILE="/etc/nginx/nginx.conf"
RESTART_CMD="rc-service nginx restart"
TEST_CMD="nginx -t"
;;
ssh)
TARGET_FILE="/etc/ssh/sshd_config"
RESTART_CMD="rc-service sshd restart"
TEST_CMD="sshd -t"
;;
mysql)
TARGET_FILE="/etc/my.cnf"
RESTART_CMD="rc-service mysql restart"
TEST_CMD="mysqld --help --verbose > /dev/null"
;;
apache2)
TARGET_FILE="/etc/apache2/httpd.conf"
RESTART_CMD="rc-service apache2 restart"
TEST_CMD="httpd -t"
;;
*)
TARGET_FILE="/etc/$SERVICE/$SERVICE.conf"
RESTART_CMD="rc-service $SERVICE restart"
TEST_CMD="true"
;;
esac
# Find backup file
if [ -n "$DATE" ]; then
BACKUP_FILE=$(find "$BACKUP_DIR/$DATE" -name "$(basename "$TARGET_FILE")*" | head -1)
else
BACKUP_FILE=$(find "$BACKUP_DIR" -name "$(basename "$TARGET_FILE")*" | sort -r | head -1)
fi
if [ -z "$BACKUP_FILE" ] || [ ! -f "$BACKUP_FILE" ]; then
echo "❌ No backup found for $SERVICE"
list_backups
exit 1
fi
echo "Rolling back $SERVICE configuration"
echo "Target: $TARGET_FILE"
echo "Backup: $BACKUP_FILE"
echo ""
# Create emergency backup of current config
EMERGENCY_BACKUP="/tmp/$(basename "$TARGET_FILE").emergency.$(date +%Y%m%d_%H%M%S)"
cp "$TARGET_FILE" "$EMERGENCY_BACKUP"
echo "Emergency backup created: $EMERGENCY_BACKUP"
# Restore configuration
cp "$BACKUP_FILE" "$TARGET_FILE"
# Test configuration
echo "Testing configuration..."
if eval "$TEST_CMD"; then
echo "✅ Configuration test passed"
# Restart service
echo "Restarting $SERVICE..."
if eval "$RESTART_CMD"; then
echo "✅ Service restarted successfully"
echo "Configuration rollback completed"
# Remove emergency backup
rm -f "$EMERGENCY_BACKUP"
else
echo "❌ Service restart failed, restoring emergency backup"
cp "$EMERGENCY_BACKUP" "$TARGET_FILE"
eval "$RESTART_CMD"
exit 1
fi
else
echo "❌ Configuration test failed, restoring emergency backup"
cp "$EMERGENCY_BACKUP" "$TARGET_FILE"
exit 1
fi
EOF
chmod +x /usr/local/bin/rollback-config
# Example usage
# rollback-config nginx
# rollback-config nginx 20250603
# rollback-config list🔧 Advanced Configuration Techniques
Configuration Validation Framework
# Create configuration validation framework
mkdir -p /etc/config-validators
# Nginx validator
cat > /etc/config-validators/nginx << 'EOF'
#!/bin/sh
# Nginx configuration validator
CONFIG_FILE="/etc/nginx/nginx.conf"
validate_nginx_config() {
local errors=""
# Basic syntax check
if ! nginx -t 2>/dev/null; then
errors="$errors\n- Nginx syntax check failed"
fi
# Security checks
if grep -q "server_tokens on" "$CONFIG_FILE"; then
errors="$errors\n- Security: server_tokens should be off"
fi
if ! grep -q "X-Frame-Options" "$CONFIG_FILE"; then
errors="$errors\n- Security: Missing X-Frame-Options header"
fi
# Performance checks
if ! grep -q "gzip on" "$CONFIG_FILE"; then
errors="$errors\n- Performance: gzip compression not enabled"
fi
# Configuration completeness
if ! grep -q "error_log" "$CONFIG_FILE"; then
errors="$errors\n- Missing error_log directive"
fi
if [ -n "$errors" ]; then
echo "❌ Nginx configuration validation failed:"
echo "$errors"
return 1
else
echo "✅ Nginx configuration validation passed"
return 0
fi
}
validate_nginx_config
EOF
# SSH validator
cat > /etc/config-validators/ssh << 'EOF'
#!/bin/sh
# SSH configuration validator
CONFIG_FILE="/etc/ssh/sshd_config"
validate_ssh_config() {
local errors=""
# Basic syntax check
if ! sshd -t 2>/dev/null; then
errors="$errors\n- SSH syntax check failed"
fi
# Security checks
if grep -q "^PermitRootLogin yes" "$CONFIG_FILE"; then
errors="$errors\n- Security: Root login should be disabled"
fi
if grep -q "^PasswordAuthentication yes" "$CONFIG_FILE"; then
errors="$errors\n- Security: Password authentication should be disabled"
fi
if grep -q "^PermitEmptyPasswords yes" "$CONFIG_FILE"; then
errors="$errors\n- Security: Empty passwords should not be permitted"
fi
# Protocol version check
if grep -q "^Protocol 1" "$CONFIG_FILE"; then
errors="$errors\n- Security: SSH Protocol 1 is deprecated"
fi
if [ -n "$errors" ]; then
echo "❌ SSH configuration validation failed:"
echo "$errors"
return 1
else
echo "✅ SSH configuration validation passed"
return 0
fi
}
validate_ssh_config
EOF
# Make validators executable
chmod +x /etc/config-validators/*
# Configuration validation runner
cat > /usr/local/bin/validate-configs << 'EOF'
#!/bin/sh
# Run all configuration validators
VALIDATOR_DIR="/etc/config-validators"
FAILED_SERVICES=""
echo "Running configuration validation..."
echo "================================="
for validator in "$VALIDATOR_DIR"/*; do
if [ -x "$validator" ]; then
service_name=$(basename "$validator")
echo ""
echo "Validating $service_name:"
if "$validator"; then
echo "✅ $service_name validation passed"
else
echo "❌ $service_name validation failed"
FAILED_SERVICES="$FAILED_SERVICES $service_name"
fi
fi
done
echo ""
echo "Validation Summary:"
echo "=================="
if [ -n "$FAILED_SERVICES" ]; then
echo "❌ Failed services:$FAILED_SERVICES"
exit 1
else
echo "✅ All configuration validations passed"
exit 0
fi
EOF
chmod +x /usr/local/bin/validate-configs
# Run validation
validate-configsConfiguration Automation with Ansible
# Create Ansible-compatible configuration management
mkdir -p /etc/ansible/{playbooks,roles,inventory}
# Ansible inventory
cat > /etc/ansible/inventory/hosts << 'EOF'
[alpine_servers]
server1 ansible_host=192.168.1.10
server2 ansible_host=192.168.1.11
server3 ansible_host=192.168.1.12
[alpine_servers:vars]
ansible_user=root
ansible_ssh_private_key_file=/root/.ssh/id_rsa
EOF
# Nginx configuration playbook
cat > /etc/ansible/playbooks/configure_nginx.yml << 'EOF'
---
- name: Configure Nginx on Alpine Linux
hosts: alpine_servers
vars:
nginx_user: nginx
nginx_workers: auto
nginx_worker_connections: 1024
tasks:
- name: Install Nginx
apk:
name: nginx
state: present
- name: Create nginx user
user:
name: "{{ nginx_user }}"
system: yes
shell: /sbin/nologin
- name: Deploy nginx configuration
template:
src: nginx.conf.j2
dest: /etc/nginx/nginx.conf
backup: yes
notify: restart nginx
- name: Validate nginx configuration
command: nginx -t
changed_when: false
- name: Enable and start nginx
service:
name: nginx
enabled: yes
state: started
handlers:
- name: restart nginx
service:
name: nginx
state: restarted
EOF
# Nginx Jinja2 template
cat > /etc/ansible/playbooks/templates/nginx.conf.j2 << 'EOF'
user {{ nginx_user }};
worker_processes {{ nginx_workers }};
error_log /var/log/nginx/error.log warn;
pid /run/nginx.pid;
events {
worker_connections {{ nginx_worker_connections }};
use epoll;
multi_accept on;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Logging
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
# Performance
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
# Security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
# Gzip compression
gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml;
# Hide nginx version
server_tokens off;
# Include additional configurations
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
EOF
# Configuration deployment script
cat > /usr/local/bin/deploy-ansible-config << 'EOF'
#!/bin/sh
# Deploy configurations using Ansible
PLAYBOOK="$1"
ENVIRONMENT="${2:-production}"
if [ -z "$PLAYBOOK" ]; then
echo "Usage: $0 <playbook> [environment]"
echo "Available playbooks:"
ls -1 /etc/ansible/playbooks/*.yml | xargs basename -s .yml
exit 1
fi
echo "Deploying $PLAYBOOK configuration to $ENVIRONMENT environment"
# Run ansible playbook
ansible-playbook \
-i /etc/ansible/inventory/hosts \
-l "$ENVIRONMENT" \
--check \
"/etc/ansible/playbooks/$PLAYBOOK.yml"
if [ $? -eq 0 ]; then
echo "Dry run completed successfully. Deploy for real? (y/N)"
read -r confirmation
if [ "$confirmation" = "y" ] || [ "$confirmation" = "Y" ]; then
ansible-playbook \
-i /etc/ansible/inventory/hosts \
-l "$ENVIRONMENT" \
"/etc/ansible/playbooks/$PLAYBOOK.yml"
fi
else
echo "❌ Dry run failed. Please check the configuration."
exit 1
fi
EOF
chmod +x /usr/local/bin/deploy-ansible-config🔒 Security and Compliance
Configuration Security Scanning
# Create security scanner for configurations
cat > /usr/local/bin/scan-config-security << 'EOF'
#!/bin/sh
# Configuration security scanner
SCAN_RESULTS="/tmp/config-security-scan.txt"
CRITICAL_ISSUES=""
WARNING_ISSUES=""
scan_file_permissions() {
echo "=== File Permission Security Scan ===" >> "$SCAN_RESULTS"
# Check for world-writable config files
find /etc -type f -perm -002 2>/dev/null | while read file; do
echo "CRITICAL: World-writable config file: $file" >> "$SCAN_RESULTS"
CRITICAL_ISSUES="$CRITICAL_ISSUES\n- World-writable: $file"
done
# Check for files with incorrect ownership
find /etc -type f ! -user root 2>/dev/null | while read file; do
owner=$(stat -c "%U" "$file")
echo "WARNING: Non-root owned config file: $file (owner: $owner)" >> "$SCAN_RESULTS"
WARNING_ISSUES="$WARNING_ISSUES\n- Non-root owned: $file"
done
}
scan_ssh_security() {
echo "=== SSH Security Scan ===" >> "$SCAN_RESULTS"
if [ -f "/etc/ssh/sshd_config" ]; then
# Check for dangerous SSH settings
if grep -q "^PermitRootLogin yes" /etc/ssh/sshd_config; then
echo "CRITICAL: SSH root login enabled" >> "$SCAN_RESULTS"
CRITICAL_ISSUES="$CRITICAL_ISSUES\n- SSH root login enabled"
fi
if grep -q "^PasswordAuthentication yes" /etc/ssh/sshd_config; then
echo "WARNING: SSH password authentication enabled" >> "$SCAN_RESULTS"
WARNING_ISSUES="$WARNING_ISSUES\n- SSH password auth enabled"
fi
if grep -q "^PermitEmptyPasswords yes" /etc/ssh/sshd_config; then
echo "CRITICAL: SSH empty passwords permitted" >> "$SCAN_RESULTS"
CRITICAL_ISSUES="$CRITICAL_ISSUES\n- SSH empty passwords allowed"
fi
fi
}
scan_web_server_security() {
echo "=== Web Server Security Scan ===" >> "$SCAN_RESULTS"
# Nginx security
if [ -f "/etc/nginx/nginx.conf" ]; then
if grep -q "server_tokens on" /etc/nginx/nginx.conf; then
echo "WARNING: Nginx server tokens enabled" >> "$SCAN_RESULTS"
WARNING_ISSUES="$WARNING_ISSUES\n- Nginx server tokens exposed"
fi
if ! grep -q "X-Frame-Options" /etc/nginx/nginx.conf; then
echo "WARNING: Nginx missing X-Frame-Options header" >> "$SCAN_RESULTS"
WARNING_ISSUES="$WARNING_ISSUES\n- Missing X-Frame-Options"
fi
fi
# Apache security
if [ -f "/etc/apache2/httpd.conf" ]; then
if grep -q "ServerTokens Full" /etc/apache2/httpd.conf; then
echo "WARNING: Apache server tokens full" >> "$SCAN_RESULTS"
WARNING_ISSUES="$WARNING_ISSUES\n- Apache server tokens exposed"
fi
fi
}
scan_database_security() {
echo "=== Database Security Scan ===" >> "$SCAN_RESULTS"
# MySQL security
if [ -f "/etc/my.cnf" ]; then
if grep -q "bind-address.*0.0.0.0" /etc/my.cnf; then
echo "WARNING: MySQL bound to all interfaces" >> "$SCAN_RESULTS"
WARNING_ISSUES="$WARNING_ISSUES\n- MySQL exposed to all interfaces"
fi
fi
# PostgreSQL security
if [ -f "/etc/postgresql/postgresql.conf" ]; then
if grep -q "listen_addresses.*'\*'" /etc/postgresql/postgresql.conf; then
echo "WARNING: PostgreSQL listening on all interfaces" >> "$SCAN_RESULTS"
WARNING_ISSUES="$WARNING_ISSUES\n- PostgreSQL exposed to all interfaces"
fi
fi
}
# Run all scans
echo "Starting configuration security scan..."
echo "========================================"
> "$SCAN_RESULTS" # Clear results file
scan_file_permissions
scan_ssh_security
scan_web_server_security
scan_database_security
# Generate report
echo ""
echo "Security Scan Results:"
echo "====================="
cat "$SCAN_RESULTS"
echo ""
echo "Summary:"
echo "========"
if [ -n "$CRITICAL_ISSUES" ]; then
echo "🚨 CRITICAL ISSUES FOUND:"
echo "$CRITICAL_ISSUES"
fi
if [ -n "$WARNING_ISSUES" ]; then
echo "⚠️ WARNING ISSUES FOUND:"
echo "$WARNING_ISSUES"
fi
if [ -z "$CRITICAL_ISSUES" ] && [ -z "$WARNING_ISSUES" ]; then
echo "✅ No security issues found"
fi
# Cleanup
rm -f "$SCAN_RESULTS"
EOF
chmod +x /usr/local/bin/scan-config-security
# Run security scan
scan-config-security🎯 Best Practices and Guidelines
Configuration Management Checklist
# Create configuration management checklist
cat > /usr/local/share/config-management-checklist.md << 'EOF'
# Configuration Management Checklist
## Before Making Changes
- [ ] Document the reason for configuration changes
- [ ] Create backup of current configuration
- [ ] Test changes in non-production environment
- [ ] Review security implications
- [ ] Check for dependencies and conflicts
## During Changes
- [ ] Use version control for tracking
- [ ] Apply principle of least privilege
- [ ] Validate configuration syntax
- [ ] Test configuration in isolated environment
- [ ] Document all modifications
## After Changes
- [ ] Verify service functionality
- [ ] Run security scans
- [ ] Update monitoring and alerts
- [ ] Document rollback procedures
- [ ] Commit changes to version control
## Regular Maintenance
- [ ] Review configuration changes monthly
- [ ] Audit file permissions quarterly
- [ ] Update configuration templates
- [ ] Test rollback procedures
- [ ] Clean up old backups
EOF🎉 Conclusion
Effective package configuration management in Alpine Linux requires systematic approaches, proper tooling, and consistent practices. By implementing version control, automation, and monitoring, you can maintain reliable, secure, and scalable configuration management systems.
Key takeaways:
- Use version control for all configuration changes 📝
- Implement automated validation and testing ✅
- Create comprehensive backup and rollback procedures 🔄
- Monitor configuration changes continuously 📊
- Apply security best practices consistently 🔒
With proper configuration management, your Alpine Linux systems will be more reliable, secure, and maintainable! 🚀
