There are many GNU\/Linux distributions available but my favorite is Debian. The latest version at the time of this post is Debian 9 “Strecth”. Debian does not come\u00a0optimally prepared for\u00a0my specific needs right out of the box. Other distributions come with some of these things pre-installed, but Debian does not want to force them on those who don’t want them. However, with a few quick configuration changes and additional packages, the system can be greatly improved. This\u00a0post\u00a0describes the initial changes I prefer to make after installing the stock images.<\/p>\n
The first step is to ensure\u00a0that all packages are up to date.<\/p>\n
# apt-get update\n# apt-get upgrade<\/pre>\nInstall etckeeper<\/h5>\n
The first thing I like to install is etckeeper, which keeps track of any changes made to etc configuration files with a version control system. \u00a0But before I install etckeeper, I first install and configure git. I prefer to do this first so that all my other configuration changes in \/etc are tracked in git.<\/p>\n
# apt-get install -y git\n# git config --global user.name \"Jon Doe\"\n# git config --global user.email \"jondoe@example.com\"\n# apt-get install -y etckeeper<\/pre>\nInstall vim<\/h5>\n
Next I like to install vim and make sure it is selected as the default editor.<\/p>\n
# apt-get install -y vim\n# echo 'SELECTED_EDITOR=\"\/usr\/bin\/vim.basic\"' > ~\/.selected_editor<\/pre>\nI also run update-alternatives to set vim.basic as my editor of choice. You can optionally\u00a0use readlink to confirm that the change worked.<\/p>\n
# update-alternatives --set editor \/usr\/bin\/vim.basic\n# readlink \/etc\/alternatives\/editor\n\/usr\/bin\/vim.basic<\/pre>\nModify bashrc<\/h5>\n
Define PS1 in root’s .bashrc to add color to terminal prompt.<\/p>\n
# sed -i \\\n -e \"s\/^# export LS_OPTIONS='--color=auto'$\/export LS_OPTIONS='--color=auto'\/\" \\\n -e \"s\/^# eval \\\"\\`dircolors\\`\\\"$\/eval \\\"\\`dircolors\\`\\\"\/\" \\\n -e \"s\/^# alias ls='ls \\$LS_OPTIONS'$\/alias ls='ls \\$LS_OPTIONS'\/\" \\\n -e \"s\/^# alias ll='ls \\$LS_OPTIONS -l'$\/alias ll='ls \\$LS_OPTIONS -l'\/\" \\\n -e \"s\/^# alias l='ls \\$LS_OPTIONS -lA'$\/alias l='ls \\$LS_OPTIONS -lA'\/\" \\\n -e \"s\/^# alias rm='rm -i'$\/alias rm='rm -i'\/\" \\\n -e \"s\/^# alias cp='cp -i'$\/alias cp='cp -i'\/\" \\\n -e \"s\/^# alias mv='mv -i'$\/alias mv='mv -i'\/\" \\\n \/root\/.bashrc\n# echo \"PS1='${debian_chroot:+($debian_chroot)}\\[\\033[01;31m\\]\\u@\\h\\[\\033[00m\\]:\\[\\033[01;34m\\]\\w\\[\\033[00m\\]$ '\" >> \/root\/.bashrc<\/pre>\nSetup User Account<\/h5>\n
Next, I create a user account, add it to the sudo group, and update it’s .bashrc file.<\/p>\n
# apt-get install -y sudo\n# adduser danny\n# adduser danny sudo\n# sed -i \\\n -e \"s\/^#force_color_prompt=yes$\/force_color_prompt=yes\/\" \\\n -e \"s\/^ #alias ls='ls --color=auto'$\/ alias ls='ls --color=auto'\/\" \\\n -e \"s\/^ #alias grep='grep --color=auto'$\/ alias grep='grep --color=auto'\/\" \\\n -e \"s\/^ #alias fgrep='fgrep --color=auto'$\/ alias fgrep='fgrep --color=auto'\/\" \\\n -e \"s\/^ #alias egrep='egrep --color=auto'$\/ alias egrep='egrep --color=auto'\/\" \\\n -e \"s\/^#alias ll='ls -l'\/alias ll='ls -l'\/\" \\\n -e \"s\/^#alias la='ls -A'\/alias la='ls -A'\/\" \\\n -e \"s\/^#alias l='ls -CF'\/alias l='ls -CF'\/\" \\\n -e \"$a\\\\nexport PATH=$PATH:\/usr\/sbin:\/sbin\" \\\n \/home\/danny\/.bashrc\n<\/span><\/pre>\nKeep Clock Synchronized with NTP<\/h5>\n
To keep the clock synchronized with internet standard time servers, install the ntp daemon.<\/p>\n
$ sudo apt-get install -y ntp<\/pre>\nPrevent Catastrophic User Error<\/h5>\n
Next, I like to install several packages that help prevent catastrophic user error. Firstly, I like to install safe-rm, which is a wrapper around the rm command that prevents accidental deletions of files. Secondly, I like to install molly-guard, which guards against accidental shutdowns or reboots by prompting the user for the hostname before allowing the instructions to execute.<\/p>\n
$ sudo apt-get install -y safe-rm\u00a0molly-guard<\/pre>\nEnsure Latest Version of Libraries Are In Use<\/h5>\n
needrestart checks which running daemons\u00a0need to be restarted after library upgrades. This may help catch issues sooner and ensure that the latest version of the library is being used by all running daemons. It also informs you when a restart is required to use a newer version of the kernel.<\/p>\n
$ sudo apt-get install -y needrestart<\/pre>\nMake iptables Changes Persistent<\/h5>\n
By default changes to iptables will not be preserved on reboot. To fix this, I install iptables-persistent and have it save the current running configuration to\u00a0\/etc\/iptables\/rules.v4 and\u00a0\/etc\/iptables\/rules.v6 for IPv4 and IPv6, respsectively.<\/p>\n
$ sudo apt-get install -y iptables-persistent<\/pre>\nWhenever changes are made to iptables, the files can be updated with the following commands for IPv4 and IPv6, respectively:<\/p>\n
$ sudo iptables-save > \/etc\/iptables\/rules.v4\n$ sudo ip6tables-save > \/etc\/iptables\/rules.v6<\/pre>\nEmail Notifications Listing Packages Pending an Upgrade<\/h5>\n
Some upgrades \u00a0have important bug or security patches that leave the system vulnerable if they remain unpatched. Email notifications may help keep the system administrator informed about important updates.<\/p>\n
$ sudo apt-get install -y apticron<\/pre>\nInstall and Configure ufw<\/h5>\n
Uncomplicated firewall (ufw) is an easy to use front-end for netfilter.<\/p>\n
$ sudo apt-get install ufw\n$ sudo\u00a0ufw allow ssh\n$ sudo ufw enable<\/pre>\nInstall Optional Utilities<\/h5>\n
The tree utility lists contents of directories in a tree-like format. The file utility determines file type. The less utility is an alternative pager to the more utility that allows scrolling upwards.<\/p>\n
$ sudo apt-get install -y\u00a0tree file less<\/pre>\nThe\u00a0dos2unix utility converts text files from DOS to Unix. The renameutils package provides utilities for quickly moving or copying files, editing the file name in a text editor. The bzip2 package provides utilities for bzip2 compression.<\/p>\n
$ sudo apt-get install -y\u00a0dos2unix renameutils bzip2<\/pre>\nThe sysstat package which provides iostat and mpstat. The dstat utility is an alternative to iostat and mpstat that is more pretty.<\/p>\n
$ sudo apt-get install -y sysstat dstat<\/pre>\nThe htop utility is an alternative to top but allows you to scroll and looks pretty. The iotop utility is a top-like disk I\/O monitor. The itop utility is a top-like interrupt load monitor.<\/p>\n
$ sudo apt-get install -y\u00a0htop iotop itop iftop<\/pre>\nThe dnsutils package provides dig and nslookup. The bind9-host provides the host utility.<\/p>\n
$ sudo apt-get install -y dnsutils bind9-host<\/pre>\nThe mtr-tiny package provides the mtr utility which combines the ping and traceroute programs in a single diagnostic tool. Th telnet utility is useful for testing TCP connectivity. The nmap utility is a network exploration tool and port scanner. The tcpdump utility dumps traffic on a network.<\/p>\n
$ sudo apt-get install -y mtr-tiny telnet nmap tcpdump<\/pre>\n","protected":false},"excerpt":{"rendered":"Background There are many GNU\/Linux distributions available but my favorite is Debian. The latest version at the time of this post is Debian 9 “Strecth”. Debian does not come\u00a0optimally prepared for\u00a0my specific needs right out of the box. Other distributions come with some of these things pre-installed, but Debian does not want to force them […]<\/p>\n","protected":false},"author":1,"featured_media":346,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[5],"class_list":["post-164","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sysadmin","tag-debian"],"_links":{"self":[{"href":"https:\/\/codemonkeyden.com\/index.php?rest_route=\/wp\/v2\/posts\/164","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/codemonkeyden.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/codemonkeyden.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/codemonkeyden.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/codemonkeyden.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=164"}],"version-history":[{"count":1,"href":"https:\/\/codemonkeyden.com\/index.php?rest_route=\/wp\/v2\/posts\/164\/revisions"}],"predecessor-version":[{"id":503,"href":"https:\/\/codemonkeyden.com\/index.php?rest_route=\/wp\/v2\/posts\/164\/revisions\/503"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/codemonkeyden.com\/index.php?rest_route=\/wp\/v2\/media\/346"}],"wp:attachment":[{"href":"https:\/\/codemonkeyden.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/codemonkeyden.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=164"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/codemonkeyden.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}