SamatsWiki

• DebianChecklist

   1 # Configure sudo, adding my user to the sudo group so I don't get password prompts
   2 aptitude install sudo
   3 adduser xjjk sudo
   4 echo '%sudo ALL=NOPASSWD: ALL' > /etc/sudoers.d/No-Passwords-for-sudo-Group
   5 chmod 0440 /etc/sudoers.d/No-Passwords-for-sudo-Group
   6 
   7 # Configure locales to prevent harassment about it later
   8 aptitude install locales
   9 dpkg-reconfigure -plow locales
  10 # …or install all locales so they don't need to be configured/reinstalled
  11 aptitude install locales-all
  12 
  13 # Disable installation of recommended packages
  14 echo 'APT::Install-Recommends "false";' > /etc/apt/apt.conf.d/90recommends
  15 
  16 # Enable log compression with date postfix'd extension
  17 cat /etc/logrotate.conf | sed "s/#compress/compress/" > /etc/logrotate.conf.tmp
  18 echo "dateext" >> /etc/logrotate.conf.tmp
  19 mv /etc/logrotate.conf.tmp /etc/logrotate.conf
  20 
  21 # Prevent PAM from allowing easily-crackable passwords
  22 aptitude install libpam-cracklib
  23 
  24 # Install essential utilities
  25 sudo aptitude install \
  26 openssh-server screen \
  27 rsync \
  28 atool lzma rzip xz-utils \
  29 htop dstat iotop \
  30 manpages manpages-dev \
  31 strace tcpdump lsof \
  32 moreutils \
  33 dnsutils \
  34 chrony \
  35 vim less \
  36 molly-guard
  37 
  38 # HDD Temperature/SMART monitoring utilities
  39 aptitude install hddtemp smartmontools
  40 sed -i 's/^#start_smartd=yes/start_smartd=yes/' /etc/default/smartmontools
  41 /etc/init.d/smartmontools start
  42 
  43 # Configure rsyslog for daily archival logging
  44 cat << EOF > /etc/rsyslog.d/51-cron.conf
  45 # Enable cron logging
  46 cron.* /var/log/cron.log
  47 EOF
  48 cat << EOF > /etc/rsyslog.d/99-archive.conf
  49 $template DailyLogs,"/var/log/archive/%$YEAR%%$MONTH%/%$YEAR%%$MONTH%%$DAY%.log"
  50 # Archive logging
  51 *.* -?DailyLogs
  52 EOF
  53 cat << EOF > /etc/cron.daily/rsyslog-archive
  54 #!/bin/sh
  55 # Compress *.log-files not changed in more than 24 hours
  56 find /var/log/archive -type f -mtime +1 -name "*.log" -exec xz '{}' \;
  57 EOF
  58 
  59 # Use tmpfs for /var/run and /var/lock (may break some buggy packages), like Ubuntu
  60 cat << EOF >> /etc/default/rcS
  61 RAMRUN=yes
  62 RAMLOCK=yes
  63 EOF