HON’s Wiki # Debian Server

Home / Linux Servers

Contents

Using Debian 12 (Bookworm).

Basic Setup

Installation

Prepare for Ansible Configuration (if Ansible)

Do this if you’re going to use Ansible to manage the system. This is mainly to make the system accessible by Ansible, which can then take over the configuration. If creating a template VM, run the first instructions before saving the template and then run the last instructions on cloned VMs.

  1. Upgrade all packages: apt update && apt full-upgrade
    1. If anything significant was updated, restart the server.
  2. Install the required packages: apt install openssh-server sudo python3 vim
    • If PVE/QEMU VM, install qemu-guest-agent.
  3. Setup sudo for Ansible: usermod -aG sudo ansible
  4. (Optional, for PVE VMs) Convert the VM into a template:
    1. Shut down the VM.
    2. Change to a template.
    3. Clone it into a new VM to be used hereafter.
    4. Boot the new VM and continue with the setup.
  5. (Optional, for non-cloud) Set static IP addresses in /etc/network/interfaces (see the example below).
  6. Reboot.

Example /etc/network/interfaces:

source /etc/network/interfaces.d/*

auto lo
ïface lo inet loopback

allow-hotplug ens18
iface ens18 inet static
    address 10.0.0.100/22
    gateway 10.0.0.1
iface ens18 inet6 static
    address fdaa:aaaa:aaaa:0::100/64
    gateway fdaa:aaaa:aaaa:0::1
    accept_ra 0

Manual Configuration (if not Ansible)

The first steps ((Skip)) may be skipped if already configured during installation (i.e. not cloning a template VM).

  1. (Skip) Check the system status:
    • Check for failed services: systemctl --failed
    • Check that AppArmor is operational: apparmor_status
  2. (Skip) Update the root password: passwd
  3. (Skip) Localization:
    • Check current locale:
      • locale should return en_US.UTF-8.
      • Update if wrong: update-locale LANG=en_US.UTF-8
    • Check the keymap:
      • Try typing characters specific to your keyboard.
      • Update if wrong: dpkg-reconfigure keyboard-configuration
  4. (Skip) Set the hostname:
    • Set the shortname: hostnamectl set-hostname <shortname> (no domain)
    • Set both the shortname and FQDN in /etc/hosts using the following format, one line for IPv4 and one for IPv6: <ip-addr> <fqdn> <shortname>
    • Check the hostname info:
      • Shortname: hostname
      • FQDN: hostname --fqdn
      • IP addresses: hostname --ip-address
  5. Packages:
    • (Optional) Enable the contrib and non-free repo areas: add-apt-repository <area>
      • Or by setting main contrib non-free for every deb/deb-src in /etc/apt/sources.list.
    • Update, upgrade and auto-remove.
    • Install: sudo apt install ca-certificates software-properties-common man-db tree vim screen curl net-tools dnsutils moreutils htop iotop irqtop nmap
    • (Optional) Install per-user tmpdirs: libpam-tmpdir
  6. (Optional) Configure editor (Vim):
    • Update the default editor: sudo update-alternatives --config editor
    • Disable mouse globally: In /etc/vim/vimrc.local, add set mouse= and set ttymouse=.
    • Fix YAML formatting globally: In /etc/vim/vimrc.local, add autocmd FileType yaml setlocal ts=2 sts=2 sw=2 expandtab.
  7. Add mount options:
    • (Not recommended) Setup hidepid:
      • (Note) Hidepid breaks certain systemd things. It’s not recommended to use it until that gets fixed.
      • (Note) The adm group will be granted access.
      • Add your personal user to the PID monitor group: usermod -aG adm <user>
      • Enable hidepid in /etc/fstab: proc /proc proc defaults,hidepid=2,gid=<adm-gid> 0 0 (using the numerical GID of adm)
    • (Optional) Disable the tiny swap partition added by the guided installer by commenting it in the fstab.
    • (Optional) Setup extra mount options: See Storage.
    • Run mount -a to validate fstab.
    • (Optional) Restart the system.
  8. Setup your personal user:
    • If it doesn’t exist, create it: adduser <username>
    • Add the relevant groups (using usermod -aG <group> <user>):
      • sudo for sudo access.
      • systemd-journal for system log access.
      • adm for hidepid, to see all processes (if using hidepid).
    • Add your personal SSH pubkey to ~/.ssh/authorized_keys and fix the owner and permissions (700 for dir, 600 for file).
      • Hint: Get https://github.com/<user>.keys and filter the results.
    • Try logging in remotely and gain root access through sudo.
  9. Setup SSHD:
    • In /etc/ssh/sshd_config, set: 
      PermitRootLogin no
PasswordAuthentication no
# Optional, disable TCP port forwarding
AllowTcpForwarding no
GatewayPorts no
# Comment out to avoid locale issues (or fix it some proper way)
#AcceptEnv ...
    • Restart sshd.
  10. Update MOTD:
    • Clear /etc/motd, /etc/issue and /etc/issue.net.
    • (Optional) Add a MOTD script (see below).
  11. (10/Buster and older) (Optional) Enable persistent logging:
    • (Note) Persistent logging is the default for Debian 11/Bullseye, but not Debian 10/Buster.
    • In /etc/systemd/journald.conf, under [Journal], set Storage=persistent.
    • (Note) auto (the default) is like persistent, but does not automatically create the log directory.
    • (Note) The default journal directory is /var/log/journal.

Machine-Specific Configuration

Physical Host

  1. Install extra firmware:
    • Enable the non-free repo areas.
    • Update microcode: Install intel-microcode (for Intel) or amd64-microcode (for AMD) and reboot (now or later).
    • (Note) APT package examples: firmware-atheros -bnx2 -bnx2x -ralink -realtek
    • If it asked to install non-free firmware in the initial installation installation, try to install it now.
    • Install firmware from other sources (e.g. for some Intel NICs).
    • (Optional) To install all common common firmware and microcode, install firmware-linux (or firmware-linux-free) (includes e.g. microcode packages).
  2. Setup smartmontools to monitor S.M.A.R.T. disks:
    1. Install smartmontools.
    2. (Optional) Monitor disk: sudo smartctl -s on <dev>.
  3. Setup lm_sensors to monitor sensors:
    1. Install lm-sensors.
    2. Run sensors to make sure it runs without errors and shows some (default-ish) sensors.
    3. For further configuration (more sensors) and more info, see Linux Server Applications: lm_sensors.
  4. Check the performance governor and other frequency settings:
    1. Install linux-cpupower.
    2. Show: cpupower frequency-info
      • Check the boost state should be on (Intel).
      • Check the current performance governor (e.g. “powersave”, “ondemand” or “performance”).
    3. (Optional) Temporarily change performance governor: cpupower frequency-set -g <governor>
    4. (Optional) Permanently change performance governor: TODO
  5. (Not recommended) Mask ctrl-alt-del.target to disable CTRL+ALT+DEL reboot at the login screen.

QEMU Virtual Host

  1. Install QEMU guest agent: apt install qemu-guest-agent

Networking

Network Manager

Using ifupdown (Alternative 1)

This is used by default and is the simplest to use for simple setups.

  1. For VLAN support, install vlan.
  2. For bonding/LACP support, install ifenslave.
  3. Configure /etc/network/interfaces.
  4. Reload the config (per interface): systemctl restart ifup@<if>.service
    • Don’t restart networking.service or call ifup/ifdown directly, this is deprecated and may cause problems.
Using systemd-networkd (Alternative 2)

This is the systemd way of doing it and is recommended for more advanced setups as ifupdown is riddled with legacy/compatibility crap.

  1. Add a simple network config: Create /etc/systemd/network/lan.network based on main.network.
  2. Disable/remove the ifupdown config: mv /etc/network/interfaces /etc/network/interfaces.old
  3. Enable the service: systemctl enable --now systemd-networkd
  4. Purge ifupdown and ifupdown2.
  5. Check status: networkctl [status [-a]]
  6. Restart the system to make sure all ifupdown stuff is stopped (like orphaned dhclients).
Configure IPv6/NDP/RA Securely

Prevent enabled (and potentially untrusted) interfaces from accepting router advertisements and autoconfiguring themselves, unless autoconfiguration is what you intended.

Firewall

  1. Install apt install iptables iptables-persistent netfilter-persistent
    • Don’t save the current rules when it asks.
  2. Manually add IPTables rules or make a simple iptables script or something.
  3. Open a new SSH session and make sure you can still log in without closing the current one.
  4. (Note) If you flush the firewall and reconfigure it, remember to restart services modifying it (like libvirt, Docker, Fail2Ban).

DNS

TODO Setup resolvconf to prevent automatic resolv.conf changes?

Using systemd-resolved (Alternative 1)
  1. (Optional) Make sure no other local DNS servers (like dnsmasq) is running.
  2. Configure /etc/systemd/resolved.conf
    • DNS: A space-separated list of DNS servers.
    • (Optional) Domains: A space-separated list of search domains.
    • (Optional) DNSSEC: Set to no to disable (only if you have a good reason to, like avoiding the chicken-and-egg problem with DNSSEC and NTP).
  3. (Optional) If you’re hosting a DNS server on this machine, set DNSStubListener=no to avoid binding to port 53.
  4. Enable the service: systemctl enable --now systemd-resolved.service
  5. Link /etc/resolv.conf: ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
  6. Check status: resolvectl
Using resolv.conf (Alternative 2)

The simplest alternative, without any local system caching.

  1. Make sure /etc/resolv.conf is a regular file and not a symlink.
  2. Manually configure /etc/resolv.conf.
  3. (Optional) Make it immutable to prevent services (like dhclient) from changing it: chattr +i /etc/resolv.conf

NTP

This is typically correct by default. Note that systemd-timesyncd uses SNTP, where only one NTP server is used.

  1. Check the timezome and network time status: timedatectl
  2. (Optional) Fix the timezone: timedatectl set-timezone Europe/Oslo
  3. (Optional) Fix enable network time: timedatectl set-ntp true
  4. Configure /etc/systemd/timesyncd.conf:
    • NTP (optional): A space-separated list of NTP servers. The defaults are fine. Only one is used.
  5. Restart systemd-timesyncd.
  6. Check status works: timedatectl and timedatectl timesync-status (check which servers are used)

Miscellanea

  1. Make sure IPv6 and NDP is configured securely (prevent accidental autoconfiguration on untrusted interfaces):
    • For ifupdown, set accept_ra 0 for all inet6 interface sections which should not use SLAAC.
    • If configuring the interface to not accept RAs, ICMPv6/NDP may be firewalled on the untrusted interfaces.
  2. Reboot and make sure everything still works.

Extra

Everything here is optional.

Troubleshooting

network-online.target is stalling during boot:

Firmware for the network card fails to load:

Perl complains about a locale error:

Boot volume is full:

Miscellanea

Cron

hon.one | HON95/wiki | Edit page