SamatsWiki

• DebianChecklist

   1 # Configure sudo, adding my user to the sudo group so I don't get password prompts
   2 apt install sudo
   3 adduser xjjk sudo
   4 echo '%sudo ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/No-Passwords-for-sudo-Group
   5 chmod 0440 /etc/sudoers.d/No-Passwords-for-sudo-Group
   6 
   7 # Disable installation of recommended packages
   8 echo 'APT::Install-Recommends "false";' > /etc/apt/apt.conf.d/90recommends
   9 
  10 # Configure locales to prevent harassment about it later
  11 apt install locales
  12 export LANGUAGE=en_US.UTF-8
  13 export LANG=en_US.UTF-8
  14 export LC_ALL=en_US.UTF-8
  15 locale-gen en_US.UTF-8
  16 dpkg-reconfigure -plow locales
  17 # …or install all locales so they don't need to be configured/reinstalled
  18 apt install locales-all
  19 
  20 # Enable log compression with date suffixed extension
  21 cat /etc/logrotate.conf | sed "s/#compress/compress\ndateext/" > /etc/logrotate.conf.tmp
  22 mv /etc/logrotate.conf.tmp /etc/logrotate.conf
  23 
  24 # Disable root login—public key access only!
  25 sed -i \
  26     -e "s/[#]*PermitRootLogin yes/PermitRootLogin without-password/g" \
  27     -e "s/AcceptEnv LANG LC_\*$/AcceptEnv LANG LC_\* TZ/" \
  28     /etc/ssh/sshd_config
  29 service ssh restart
  30 
  31 # Prevent PAM from allowing easily-crackable passwords
  32 apt install libpam-cracklib
  33 
  34 # Install essential utilities
  35 sudo apt install \
  36 openssh-server screen \
  37 rsync \
  38 atool lzma rzip xz-utils \
  39 htop dstat iotop \
  40 manpages manpages-dev \
  41 strace tcpdump lsof \
  42 less moreutils \
  43 mosh \
  44 dnsutils \
  45 vim vim-pathogen vim-addon-manager vim-scripts \
  46 bash-completion \
  47 direnv \
  48 sysfsutils procps \
  49 vnstat \
  50 unattended-upgrades \
  51 ncurses-term \
  52 molly-guard
  53 
  54 # Optional stuff…
  55 sudo apt install \
  56 chrony \
  57 cpufrequtils powertop
  58 
  59 # Ensure enough entropy is always available
  60 sudo apt install \
  61 haveged rng-tools
  62 
  63 # I hate rm
  64 sudo apt install \
  65 trash-cli
  66 
  67 # Reduce bufferbloat
  68 echo 'net.core.default_qdisc=fq_codel' > /etc/sysctl.d/reduce-bufferbloat.conf
  69 
  70 # Enable automatic security updates (careful!)
  71 sudo DEBIAN_FRONTEND=noninteractive dpkg-reconfigure -plow unattended-upgrades
  72 
  73 # HDD Temperature/SMART monitoring utilities
  74 apt install hddtemp smartmontools
  75 sed -i 's/^#start_smartd=yes/start_smartd=yes/' /etc/default/smartmontools
  76 /etc/init.d/smartmontools start
  77 
  78 # Configure rsyslog for daily archival logging
  79 cat << EOF > /etc/rsyslog.d/51-cron.conf
  80 # Enable cron logging
  81 cron.* /var/log/cron.log
  82 EOF
  83 cat << EOF > /etc/rsyslog.d/99-archive.conf
  84 \$template DailyLogs,"/var/log/archive/%\$YEAR%%\$MONTH%/%\$YEAR%%\$MONTH%%\$DAY%.log"
  85 # Archive logging
  86 *.* -?DailyLogs
  87 EOF
  88 cat << EOF > /etc/cron.daily/rsyslog-archive
  89 #!/bin/sh
  90 # Compress *.log-files not changed in more than 24 hours
  91 find /var/log/archive -type f -mtime +1 -name "*.log" -exec xz '{}' \;
  92 EOF
  93 chmod +x /etc/cron.daily/rsyslog-archive
  94 
  95 # Async logging for rsync (commit every 30m)
  96 cat << EOF > /etc/rsyslog.d/98-async.conf
  97 \$OMFileFlushInterval 1800
  98 \$OMFileASyncWriting on
  99 EOF
 100 
 101 # Use tmpfs for /var/run and /var/lock (may break some buggy packages), like Ubuntu
 102 cat << EOF >> /etc/default/rcS
 103 RAMRUN=yes
 104 RAMLOCK=yes
 105 EOF
 106 
 107 # Allow running X11 apps remotely
 108 sudo apt install xbase-clients
 109 
 110 # Add noatime,commit=900 to entries in /etc/fstab
 111 
 112 # Enable SATA ALPM
 113 echo SATA_ALPM_ENABLE=true | sudo tee /etc/pm/config.d/sata_alpm
 114 
 115 # Switch to systemd
 116 sudo apt install systemd-sysv libpam-systemd

   1 # Quiet login
   2 touch .hushlogin
   3 cd ~
   4 mkdir -p .ssh/controls
   5 mkdir -p .vim/tmp
   6 chmod -R 755 .ssh
   7 chmod 644 .ssh/authorized_keys

   1 # Setup dot files
   2 mkdir -p ~/src/git.other/
   3 cd ~/src/git.other/
   4 git clone https://github.com/samatjain/dotfiles.git
   5 cd dotfiles
   6 source init-dots
   7 dots groups set base # Set addtl groups as necessary
   8 dots install

   1 # Switch from wheezy to testing
   2 cd /etc/apt/
   3 sed -i 's/wheezy/testing/g' /etc/apt/sources.list
   4 #sudo find . -type f -exec sed -i 's/wheezy/testing/g' {} \;
   5 
   6 # Disable tty2–tty6
   7 sed -i '/[2-6]:23:respawn:\/sbin\/getty 38400 tty[2-6]/s%^%#%g' /etc/inittab
   8 # Disable tty on serial line
   9 sed -i '/T0:23:respawn:\/sbin\/getty -L ttyAMA0 115200 vt100/s%^%#%g' /etc/inittab
  10 
  11 # Optimize mounts
  12 sed -i 's/defaults,noatime/defaults,noatime,nodiratime/g' /etc/fstab
  13 
  14 # Overclock to 800 Mhz (no overvolting required). Overclocking not forced, but keep it on for the first 2 min during boot
  15 echo -e "arm_freq=800\nsdram_freq=400\ncore_freq=300\nforce_turbo=0\ninitial_turbo=120" >> /boot/config.txt
  16 
  17 # Use only 16 MiB for GPU (only run after updating firmware!)
  18 echo -e "gpu_mem=16" >> /boot/config.txt
  19 
  20 # Enable IPv6 for Avahi
  21 sudo sed -i 's/mdns4_minimal/mdns_minimal/g' /etc/nsswitch.conf
  22 
  23 # Delete default 'pi' user
  24 sudo deluser --remove-all-files pi