It was actually a little more complex that I was expecting. Of the few configuration examples I’ve seen on the web, none of them adequately covered the mixing bridges and tunnels in “/etc/network/interfaces”.

Weirdly, even though I’ve been using it for a few years, it’s only now that I’m beginning to grok ifupdown (the Debian way of configuring network interfaces). It’s a powerful, simple, and extensible enough to support fairly complex actions with simple, elegant, configurations. For example, ”uml_proxy_*” handles inserting static routes and ARP proxying.

The downside, sadly, is that it’s near impossible to provide any definitive documentation of “interfaces” – good luck finding documentation for ”uml_proxy_*”!

The following “/etc/network/interfaces” requires the extensions provided by resolvconf, uml-utilities, and bridge-utils to run correctly.

auto lo
iface lo inet loopback

auto umltap0_0 umltap0_1
auto umltap1_0 umltap1_1
auto umltap2_0 umltap2_1

iface umltap0_0 inet static
        tunctl_user uml
        address 192.0.2.30
        netmask 255.255.255.240

iface umltap0_1 inet static
        tunctl_user uml
        address 192.0.2.26
        netmask 255.255.255.240

iface umltap1_0 inet static
        tunctl_user uml
        address 10.140.1.3
        netmask 255.255.255.0

iface umltap1_1 inet static
        tunctl_user uml
        address 10.140.1.4
        netmask 255.255.255.0

iface umltap2_0 inet static
        tunctl_user uml
        address 10.51.1.143
        netmask 255.255.255.0

iface umltap2_1 inet static
        tunctl_user uml
        address 10.51.1.144
        netmask 255.255.255.0

auto br0 br1 br2
iface br0 inet static
        pre-up ifconfig eth0 0.0.0.0 promisc up
        address 192.0.2.27
        netmask 255.255.255.240
        network 192.0.2.16
        broadcast 192.0.2.31
        gateway 192.0.2.17
        bridge_fd 0
        bridge_hello 0
        bridge_stp off
        bridge_ports eth0 umltap0_0 umltap0_1
        uml_proxy_arp 192.0.2.30 192.0.2.26
        uml_proxy_ether br0
        dns-search example.com
        dns-nameservers 192.0.2.17
        post-down ifconfig eth0 down

iface br1 inet static
        pre-up ifconfig eth1 0.0.0.0 promisc up
        address 10.140.1.2
        netmask 255.255.255.0
        network 10.140.1.0
        broadcast 10.140.1.255
        bridge_fd 0
        bridge_hello 0
        bridge_stp off
        bridge_ports eth1 umltap1_0 umltap1_1
        uml_proxy_arp 10.140.1.3 10.140.1.4
        uml_proxy_ether br1
        post-down ifconfig eth1 down

iface br2 inet static
        pre-up ifconfig eth2 0.0.0.0 promisc up
        address 10.51.1.142
        netmask 255.255.255.240
        bridge_fd 0
        bridge_hello 0
        bridge_stp off
        bridge_ports eth2 umltap2_0 umltap2_1
        uml_proxy_arp 10.51.1.143 10.51.1.144
        uml_proxy_ether br2
        up route add -net 10.51.0.0/16 gw 10.51.1.129 br2
        post-down ifconfig eth2 down

Of course, if you’re tracking Debian unstable or testing you probably don’t have full installation CDs. These are too dynamic to make it worth creating full CD installation sets. Usually buring a small ‘netinst’ CD, and pulling the packages from the net will suffice.

However, unless you’re on the same local network as a debian mirror, a full network installation can be painfully slow. The following technique was honed in the days when I used to track unstable with a 56k modem (phear!).

Firstly, apt-get install deborphan.

deborphan is a program that checks the current installation for installed packages that do not represent a dependency for any other package. Typically these ‘orphaned’ packages are library packages of a version that has been superseded in the dependencies of other programs and is now no longer being used. Normal apt-getting won’t remove these packages unless the explicitally conflict with something else. Running “apt-get remove `deborphan`“ will remove these unused libraries.

By default deborphan will only output a list of orphaned libraries, but with the “-a” switch it will output all package types with are not dependencies. Since this will mostly consist of the applications you actually use, it’s not suitable for piping into apt-get remove. Using the “-A” switch (as root) will add it to the “keep” list and suppress it from deborphan output.

If you run “deborphan -an--no-show-section > tmpfile” you’ll have a list of the orphaned packages not currently in the keep list. Edit this file and remove the packages that you don’t think need to be installed. Then do ”deborphan -A - < tmpfile” to populate the keep list. (You can also use ”editkeep” as root.)

In theory the deborphan keep list should now consist of a list of packages that should be selected when reinstalling the system.

Next, apt-get install apt-move.

Unless you run “apt-get clean“, your apt cache (/var/cache/apt/archives/) is probably full of debian archives. apt-move takes the files in the archives considered current and organises them into a repository that is apt accessible.

Firstly, set up the archive with “mkdir -p /srv/mirrors/debian/.disk“ then configure apt-move via /etc/apt-move.conf to use LOCALDIR=/srv/mirrors/debian (and any other settings that apply to you.
Then run “apt-move update“.

The directory should now be suitable for use as an apt repository, either locally, via something like NFS, or used in an httpd configuration.

“apt-move update && apt-get clean” should be run periodically, say once a week. When you’re re-installing, or when the size of the repository is approaching the capacity of your CD or DVD you’ll want to dump it out.

Label the disk as “Debian backup (20041224)” where the date corresponds to the current date. If you’re not planning on re-installing soon, you might want to run “apt-cdrom add” to add the CD to apt’s lists.

When you come to install using the netinst process, add this CD (and possibly others) to apt when prompted. Then when you are asked to select your packages, choose none (this leave you with a bare base debian system). Mount the custom CD and do:

(you could get the list from the CD keep file directly, but doing it this way means that repopulating the keep file on the new system isn’t forgotten).

If it works you should be getting most of your packages from the CD ROM, and only downloading newer versions from remote repositories.

Now we have that and debian security alerts in RDF all I’m waiting for is an RDF interface to the Bug Tracking System.