|
Size: 288
Comment:
|
Size: 2824
Comment:
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 1: | Line 1: |
| Describe DebianChecklist here. | Chris Lamb has a good [[http://www.chris-lamb.co.uk/2009/06/03/checklist-configuring-debian-system/|Debian installation checklist]], from which I stole most of this list. |
| Line 5: | Line 5: |
| # Enable log compression with date postfix'd extension | # Configure sudo, adding my user to the sudo group so I don't get password prompts aptitude install sudo adduser xjjk sudo echo '%sudo ALL=NOPASSWD: ALL' > /etc/sudoers.d/No-Passwords-for-sudo-Group chmod 0440 /etc/sudoers.d/No-Passwords-for-sudo-Group # Disable installation of recommended packages (TODO: this is interactive; how to pass "yes"?) echo 'APT::Install-Recommends "false";' > /etc/apt/apt.conf.d/90recommends # Configure locales to prevent harassment about it later aptitude install locales dpkg-reconfigure -plow locales # …or install all locales so they don't need to be configured/reinstalled aptitude install locales-all # Enable log compression with date suffixed extension |
| Line 7: | Line 22: |
| # FIXME: dateext doesn't have effect when at bottom of file! | |
| Line 9: | Line 25: |
# Prevent PAM from allowing easily-crackable passwords aptitude install libpam-cracklib # Install essential utilities sudo aptitude install \ openssh-server screen \ rsync \ atool lzma rzip xz-utils \ htop dstat iotop \ manpages manpages-dev \ strace tcpdump lsof \ moreutils \ dnsutils \ chrony \ vim less \ bash-completion \ sysfsutils procps \ vnstat \ unattended-upgrades \ ncurses-term \ cpufrequtils powertop \ molly-guard # Enable automatic security updates (careful!) sudo dpkg-reconfigure -plow unattended-upgrades # HDD Temperature/SMART monitoring utilities aptitude install hddtemp smartmontools sed -i 's/^#start_smartd=yes/start_smartd=yes/' /etc/default/smartmontools /etc/init.d/smartmontools start # Configure rsyslog for daily archival logging cat << EOF > /etc/rsyslog.d/51-cron.conf # Enable cron logging cron.* /var/log/cron.log EOF cat << EOF > /etc/rsyslog.d/99-archive.conf \$template DailyLogs,"/var/log/archive/%\$YEAR%%\$MONTH%/%\$YEAR%%\$MONTH%%\$DAY%.log" # Archive logging *.* -?DailyLogs EOF cat << EOF > /etc/cron.daily/rsyslog-archive #!/bin/sh # Compress *.log-files not changed in more than 24 hours find /var/log/archive -type f -mtime +1 -name "*.log" -exec xz '{}' \; EOF chmod +x /etc/cron.daily/rsyslog-archive # Async logging for rsync (commit every 30m) cat << EOF > /etc/rsyslog.d/98-async.conf \$OMFileFlushInterval 1800 \$OMFileASyncWriting on EOF # Use tmpfs for /var/run and /var/lock (may break some buggy packages), like Ubuntu cat << EOF >> /etc/default/rcS RAMRUN=yes RAMLOCK=yes EOF # Allow running X11 apps remotely sudo aptitude install xbase-clients |
Chris Lamb has a good Debian installation checklist, from which I stole most of this list.
1 # Configure sudo, adding my user to the sudo group so I don't get password prompts
2 aptitude install sudo
3 adduser xjjk sudo
4 echo '%sudo ALL=NOPASSWD: ALL' > /etc/sudoers.d/No-Passwords-for-sudo-Group
5 chmod 0440 /etc/sudoers.d/No-Passwords-for-sudo-Group
6
7 # Disable installation of recommended packages (TODO: this is interactive; how to pass "yes"?)
8 echo 'APT::Install-Recommends "false";' > /etc/apt/apt.conf.d/90recommends
9
10 # Configure locales to prevent harassment about it later
11 aptitude install locales
12 dpkg-reconfigure -plow locales
13 # …or install all locales so they don't need to be configured/reinstalled
14 aptitude install locales-all
15
16 # Enable log compression with date suffixed extension
17 cat /etc/logrotate.conf | sed "s/#compress/compress/" > /etc/logrotate.conf.tmp
18 # FIXME: dateext doesn't have effect when at bottom of file!
19 echo "dateext" >> /etc/logrotate.conf.tmp
20 mv /etc/logrotate.conf.tmp /etc/logrotate.conf
21
22 # Prevent PAM from allowing easily-crackable passwords
23 aptitude install libpam-cracklib
24
25 # Install essential utilities
26 sudo aptitude install \
27 openssh-server screen \
28 rsync \
29 atool lzma rzip xz-utils \
30 htop dstat iotop \
31 manpages manpages-dev \
32 strace tcpdump lsof \
33 moreutils \
34 dnsutils \
35 chrony \
36 vim less \
37 bash-completion \
38 sysfsutils procps \
39 vnstat \
40 unattended-upgrades \
41 ncurses-term \
42 cpufrequtils powertop \
43 molly-guard
44
45 # Enable automatic security updates (careful!)
46 sudo dpkg-reconfigure -plow unattended-upgrades
47
48 # HDD Temperature/SMART monitoring utilities
49 aptitude install hddtemp smartmontools
50 sed -i 's/^#start_smartd=yes/start_smartd=yes/' /etc/default/smartmontools
51 /etc/init.d/smartmontools start
52
53 # Configure rsyslog for daily archival logging
54 cat << EOF > /etc/rsyslog.d/51-cron.conf
55 # Enable cron logging
56 cron.* /var/log/cron.log
57 EOF
58 cat << EOF > /etc/rsyslog.d/99-archive.conf
59 \$template DailyLogs,"/var/log/archive/%\$YEAR%%\$MONTH%/%\$YEAR%%\$MONTH%%\$DAY%.log"
60 # Archive logging
61 *.* -?DailyLogs
62 EOF
63 cat << EOF > /etc/cron.daily/rsyslog-archive
64 #!/bin/sh
65 # Compress *.log-files not changed in more than 24 hours
66 find /var/log/archive -type f -mtime +1 -name "*.log" -exec xz '{}' \;
67 EOF
68 chmod +x /etc/cron.daily/rsyslog-archive
69
70 # Async logging for rsync (commit every 30m)
71 cat << EOF > /etc/rsyslog.d/98-async.conf
72 \$OMFileFlushInterval 1800
73 \$OMFileASyncWriting on
74 EOF
75
76 # Use tmpfs for /var/run and /var/lock (may break some buggy packages), like Ubuntu
77 cat << EOF >> /etc/default/rcS
78 RAMRUN=yes
79 RAMLOCK=yes
80 EOF
81
82 # Allow running X11 apps remotely
83 sudo aptitude install xbase-clients
