|
Size: 1416
Comment: Correct typo: adduser → addgroup
|
Size: 2618
Comment:
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 7: | Line 7: |
| addgroup xjjk sudo | adduser xjjk sudo echo '%sudo ALL=NOPASSWD: ALL' > /etc/sudoers.d/No-Passwords-for-sudo-Group chmod 0440 /etc/sudoers.d/No-Passwords-for-sudo-Group # Disable installation of recommended packages (TODO: this is interactive; how to pass "yes"?) echo 'APT::Install-Recommends "false";' > /etc/apt/apt.conf.d/90recommends |
| Line 15: | Line 20: |
| # Disable installation of recommended packages echo 'APT::Install-Recommends "false";' > /etc/apt/apt.conf.d/90recommends # Enable log compression with date postfix'd extension |
# Enable log compression with date suffixed extension |
| Line 24: | Line 26: |
| apt-get install libpam-cracklib | aptitude install libpam-cracklib |
| Line 27: | Line 29: |
| sudo aptitude install openssh-server \ |
sudo aptitude install \ openssh-server screen \ rsync \ |
| Line 36: | Line 39: |
| vim less \ bash-completion \ sysfsutils procpsutils \ vnstat \ unattended-upgrades \ ncurses-term \ cpufrequtils powertop \ |
|
| Line 37: | Line 47: |
# Enable automatic security updates (careful!) sudo dpkg-reconfigure -plow unattended-upgrades |
|
| Line 43: | Line 56: |
| # Configure rsyslog for daily archival logging cat << EOF > /etc/rsyslog.d/51-cron.conf # Enable cron logging cron.* /var/log/cron.log EOF cat << EOF > /etc/rsyslog.d/99-archive.conf \$template DailyLogs,"/var/log/archive/%\$YEAR%%\$MONTH%/%\$YEAR%%\$MONTH%%\$DAY%.log" # Archive logging *.* -?DailyLogs EOF cat << EOF > /etc/cron.daily/rsyslog-archive #!/bin/sh # Compress *.log-files not changed in more than 24 hours find /var/log/archive -type f -mtime +1 -name "*.log" -exec xz '{}' \; EOF chmod +x /etc/cron.daily/rsyslog-archive # Use tmpfs for /var/run and /var/lock (may break some buggy packages), like Ubuntu cat << EOF >> /etc/default/rcS RAMRUN=yes RAMLOCK=yes EOF # Allow running X11 apps remotely sudo aptitude install xbase-clients |
Chris Lamb has a good Debian installation checklist, from which I stole most of this list.
1 # Configure sudo, adding my user to the sudo group so I don't get password prompts
2 aptitude install sudo
3 adduser xjjk sudo
4 echo '%sudo ALL=NOPASSWD: ALL' > /etc/sudoers.d/No-Passwords-for-sudo-Group
5 chmod 0440 /etc/sudoers.d/No-Passwords-for-sudo-Group
6
7 # Disable installation of recommended packages (TODO: this is interactive; how to pass "yes"?)
8 echo 'APT::Install-Recommends "false";' > /etc/apt/apt.conf.d/90recommends
9
10 # Configure locales to prevent harassment about it later
11 aptitude install locales
12 dpkg-reconfigure -plow locales
13 # …or install all locales so they don't need to be configured/reinstalled
14 aptitude install locales-all
15
16 # Enable log compression with date suffixed extension
17 cat /etc/logrotate.conf | sed "s/#compress/compress/" > /etc/logrotate.conf.tmp
18 echo "dateext" >> /etc/logrotate.conf.tmp
19 mv /etc/logrotate.conf.tmp /etc/logrotate.conf
20
21 # Prevent PAM from allowing easily-crackable passwords
22 aptitude install libpam-cracklib
23
24 # Install essential utilities
25 sudo aptitude install \
26 openssh-server screen \
27 rsync \
28 atool lzma rzip xz-utils \
29 htop dstat iotop \
30 manpages manpages-dev \
31 strace tcpdump lsof \
32 moreutils \
33 dnsutils \
34 chrony \
35 vim less \
36 bash-completion \
37 sysfsutils procpsutils \
38 vnstat \
39 unattended-upgrades \
40 ncurses-term \
41 cpufrequtils powertop \
42 molly-guard
43
44 # Enable automatic security updates (careful!)
45 sudo dpkg-reconfigure -plow unattended-upgrades
46
47 # HDD Temperature/SMART monitoring utilities
48 aptitude install hddtemp smartmontools
49 sed -i 's/^#start_smartd=yes/start_smartd=yes/' /etc/default/smartmontools
50 /etc/init.d/smartmontools start
51
52 # Configure rsyslog for daily archival logging
53 cat << EOF > /etc/rsyslog.d/51-cron.conf
54 # Enable cron logging
55 cron.* /var/log/cron.log
56 EOF
57 cat << EOF > /etc/rsyslog.d/99-archive.conf
58 \$template DailyLogs,"/var/log/archive/%\$YEAR%%\$MONTH%/%\$YEAR%%\$MONTH%%\$DAY%.log"
59 # Archive logging
60 *.* -?DailyLogs
61 EOF
62 cat << EOF > /etc/cron.daily/rsyslog-archive
63 #!/bin/sh
64 # Compress *.log-files not changed in more than 24 hours
65 find /var/log/archive -type f -mtime +1 -name "*.log" -exec xz '{}' \;
66 EOF
67 chmod +x /etc/cron.daily/rsyslog-archive
68
69 # Use tmpfs for /var/run and /var/lock (may break some buggy packages), like Ubuntu
70 cat << EOF >> /etc/default/rcS
71 RAMRUN=yes
72 RAMLOCK=yes
73 EOF
74
75 # Allow running X11 apps remotely
76 sudo aptitude install xbase-clients
