SamatsWiki

• DebianChecklist

   1 # Configure sudo, adding my user to the sudo group so I don't get password prompts
   2 aptitude install sudo
   3 adduser xjjk sudo
   4 echo '%sudo ALL=NOPASSWD: ALL' > /etc/sudoers.d/No-Passwords-for-sudo-Group
   5 chmod 0440 /etc/sudoers.d/No-Passwords-for-sudo-Group
   6 
   7 # Disable installation of recommended packages (TODO: this is interactive; how to pass "yes"?)
   8 echo 'APT::Install-Recommends "false";' > /etc/apt/apt.conf.d/90recommends
   9 
  10 # Configure locales to prevent harassment about it later
  11 aptitude install locales
  12 dpkg-reconfigure -plow locales
  13 # …or install all locales so they don't need to be configured/reinstalled
  14 aptitude install locales-all
  15 
  16 # Enable log compression with date suffixed extension
  17 cat /etc/logrotate.conf | sed "s/#compress/compress/" > /etc/logrotate.conf.tmp
  18 # FIXME: dateext doesn't have effect when at bottom of file!
  19 echo "dateext" >> /etc/logrotate.conf.tmp
  20 mv /etc/logrotate.conf.tmp /etc/logrotate.conf
  21 
  22 # Prevent PAM from allowing easily-crackable passwords
  23 aptitude install libpam-cracklib
  24 
  25 # Install essential utilities
  26 sudo aptitude install \
  27 openssh-server screen \
  28 rsync \
  29 atool lzma rzip xz-utils \
  30 htop dstat iotop \
  31 manpages manpages-dev \
  32 strace tcpdump lsof \
  33 moreutils \
  34 dnsutils \
  35 chrony \
  36 vim less \
  37 bash-completion \
  38 sysfsutils procps \
  39 vnstat \
  40 unattended-upgrades \
  41 ncurses-term \
  42 cpufrequtils powertop \
  43 molly-guard
  44 
  45 # Enable automatic security updates (careful!)
  46 sudo dpkg-reconfigure -plow unattended-upgrades
  47 
  48 # HDD Temperature/SMART monitoring utilities
  49 aptitude install hddtemp smartmontools
  50 sed -i 's/^#start_smartd=yes/start_smartd=yes/' /etc/default/smartmontools
  51 /etc/init.d/smartmontools start
  52 
  53 # Configure rsyslog for daily archival logging
  54 cat << EOF > /etc/rsyslog.d/51-cron.conf
  55 # Enable cron logging
  56 cron.* /var/log/cron.log
  57 EOF
  58 cat << EOF > /etc/rsyslog.d/99-archive.conf
  59 \$template DailyLogs,"/var/log/archive/%\$YEAR%%\$MONTH%/%\$YEAR%%\$MONTH%%\$DAY%.log"
  60 # Archive logging
  61 *.* -?DailyLogs
  62 EOF
  63 cat << EOF > /etc/cron.daily/rsyslog-archive
  64 #!/bin/sh
  65 # Compress *.log-files not changed in more than 24 hours
  66 find /var/log/archive -type f -mtime +1 -name "*.log" -exec xz '{}' \;
  67 EOF
  68 chmod +x /etc/cron.daily/rsyslog-archive
  69 
  70 # Async logging for rsync (commit every 30m)
  71 cat << EOF > /etc/rsyslog.d/98-async.conf
  72 \$OMFileFlushInterval 1800
  73 \$OMFileASyncWriting on
  74 EOF
  75 
  76 # Use tmpfs for /var/run and /var/lock (may break some buggy packages), like Ubuntu
  77 cat << EOF >> /etc/default/rcS
  78 RAMRUN=yes
  79 RAMLOCK=yes
  80 EOF
  81 
  82 # Allow running X11 apps remotely
  83 sudo aptitude install xbase-clients