---
title: Debian Server
toc_enable: yes
breadcrumbs:
- title: Home
  url: /
- title: Configuration
- title: Linux Server
---
{% include header.md %}

### Using
{:.no_toc}
Debian 10 Buster

## Basic Setup

### Installation

- Always verify the downloaded installation image after downloading it.
- Use UEFI if possible.
- Use the non-graphical installer. It's basically the same as the graphical one.
- Localization:
  - Language: United States English
  - Location: Your location.
  - Locale: United States UTF-8 (`en_US.UTF-8`)
  - Keymap: Your keyboard's keymap.
- Use an FQDN as the hostname.
- Use separate password for root and your personal admin user.
- Disk partitioning:
  - (Recommended) Manually partition the system drive(s). See [system storage](#system-storage) for a suggestion.
  - Guided partitioning makes weird partition/volume sizes, try to avoid it.
  - For simple or temporary systems, just use "guided - use entire disk" with all files in one partition.
- At the software selection menu, select only "SSH server" and "standard system utilities".
- If it asks to install non-free firmware, take note of the packages so they can be installed later.

### Basic Configuration

1. Login as root.
    - Since sudo is not installed yet, use `su -` if you log in through a non-root user.
1. Check the system status:
    - Check for failed services: `systemctl --failed`
    - Check that AppArmor is operational: `apparmor_status`
1. Localization:
    - Check current locale:
      - `locale` should return `en_US.UTF-8`.
      - Update if wrong: `update-locale LANG=en_US.UTF-8`
    - Check the keymap:
      - Try typing characters specific to your keyboard.
      - Update if wrong: `dpkg-reconfigure keyboard-configuration`
    - Comment `AcceptEnv LANG LC_*` in `/etc/ssh/sshd_config` to prevent clients bringing their own locale.
1. Set the hostname:
    - Use both the shortname and the FQDN as hostnames.
    - Set the shortname: `hostnamectl set-hostname <shortname>`
    - Set both the shortname and FQDN in `/etc/hosts`.
1. Packages:
    - Update, upgrade and auto-remove.
    - Install basics: `sudo ca-certificates mailutils`
    - Install extra tools: `screen vim htop tree curl nmap net-tools`
    - (Optional) Enable the `contrib` and `non-free` repo areas:
      - Add `contrib non-free` to every line in `/etc/apt/sources.list`.
    - Install extra firmware: `firmware-linux`
    - If it asked to install non-free firmware in the initial installation installation, try to install it now using APT (hint: search for `firmware-`).
1. Configure your personal user:
    - Add it to the sudo group (`usermod -aG sudo <user>`).
    - Add your personal SSH pubkey to `~/.ssh/authorized_keys` and fix the owner and permissions (700 for dir, 600 for file).
    - Try logging in remotely and gain root access through sudo.

### Machine-Specic Configuration

#### Physical Host

- (Optional) If using SSD, add `vm.swappiness = 10` to `/etc/sysctl.conf` to reduce swappiness.
- Install `smartmontools` and run `smartctl -s on <dev>` for all physical drives to enable SMART monitoring.
- Install `lm-sensors` and run `sensors-detect` to detect temperatur sensors etc. Add the modules to `/etc/modules` when asked.
- Mask `ctrl-alt-del.target` to disable CTRL+ALT+DEL reboot at the login screen.

#### QEMU Virtual Host

- Install `qemu-guest-agent`.

### Networking

1. (Alternative 1) Setup ifupdown (default):
    - **TODO** ifupdown2?
    - For VLAN support, install `vlan`.
    - For bond support, install `ifenslave`.
    - **TODO**: DHCPv4, IPv6 (static, SLAAC, DHCPv6)
1. (Alternative 2) Setup networkd:
    - Make the new networkd configs.
      - Special network device configs: `/etc/systemd/network/*.netdev`
      - Network configs: `/etc/systemd/network/*.network`
      - Check `...` for the networkd version of the current network configuration. Copy them ... 123
    - Disable/remove the ifupdown config: `mv /etc/network/interfaces /etc/network/interfaces.disabled`
    - Enable systemd-networkd: `systemctl enable systemd-networkd`
    - Check the status: `networkctl [status [-a]]`
1. Setup DNS:
    - Enable `systemd-resolved.service`, the systemd resolver.
    - Point `/etc/resolv.conf` to the one generated by systemd: `ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf`
1. Setup NTP:
    - Check the timezone: `timedatectl`
      - If wrong: `timedatectl set-timezone Europe/Oslo`
    - Enable network time: `timedatectl set-ntp true`
    - In `/etc/systemd/timesyncd.conf`, set `ntp.justervesenet.no`.
    - Restart `systemd-timesyncd`.
    - Check **TODO**.
1. Setup firewall:
    - Install: `iptables iptables-persistent netfilter-persistent`
    - Add basic rules (it defaults to accepting everything).
1. Reboot and make sure it still works.

### Security

- Add mount options:
  - Add PID monitor group: `groupadd -g 1500 pidmonitor`
  - Add your personal user to the PID monitor group: `usermod -aG pidmonitor <user>`
  - Set mount options in `/etc/fstab`:
    - See [Storage](system.md).
    - Enable hidepid: `proc /proc proc defaults,hidepid=2,gid=1500 0 0`
  - Run `mount -a` to validate fstab.
  - Restart the system for it to take effect.
- Setup SSHD:
  - `PermitRootLogin no`
  - `PasswordAuthentication no`
  - `AllowTcpForwarding no`
  - `GatewayPorts no`
  - Restart `sshd`.
- (Optional) Prevent root login:
  - Alternatively, keep it enabled with a strong password as a local backdoor for recovery or similar.
  - Add a personal user first.
  - Check that the password field (the second field) for root in `/etc/shadow` is something invalid like "\*" or "!", but not empty and not valid password hash. This prevents password login.
  - Clear `/etc/securetty` to prevent root local/console login.
- Extra tools:
  - Install `libpam-tmpdir`.
  - (Optional) Install `fail2ban`.
    - Fix the firewall first so it configures itself correctly wrt. firewall blocking.
    - Check the status with `fail2ban-client status [sshd]`.
    - See [Applications](applications.md#fail-2-ban) for more info.
  - (Optional) Install and run Lynis:
    - Install `lynis`.
    - Run `lynis audit system`.
- (Optional) Extra package security:
  - Install `apt-listbugs` and `apt-listchanges` and run them before upgrading a package.
  - Install `needrestart` and run it after upgrading.

    Install `debsums` and run it after upgrading to check deb checksums.

    Install `debsecan` to get automatically alerted when new vulnerabilities are discovered and security updates are available.
- 2FA with Google Authenticator: **TODO**


### Extra

- Postfix mail relay: **TODO**
- MOTD:
  - Clear `/etc/motd`.
  - Download [dmotd.sh](https://github.com/HON95/misc-configs/blob/master/linux-server/profile/dmotd.sh) to `/etc/profile.d/` and install the dependencies `neofetch` and `lolcat`.
  - Add an ASCII art (or Unicode art) logo to `/etc/logo`, using e.g. [TAAG](http://patorjk.com/software/taag/).
  - (Optional) Add a MOTD to `/etc/motd`.
  - (Optional) Clear or change the pre-login message in `/etc/issue`.
- Monitor free disk space:
  - Download [disk-space-checker.sh](https://github.com/HON95/misc-configs/blob/master/linux-server/cron/disk-space-checker.sh) either to `/cron/cron.daily/` or to `/opt/bin` and create a cron job for it.
  - Example cron job (15 minutes past every 4 hours): `15 */4 * * * root /opt/bin/disk-space-checker`
  - Configure which disks/file systems it should exclude and how full they should be before it sends an email alert.

## System Storage

- The system drive doesn’t need to be super fast if not used a lot for service stuff. It's typically built from one SSD (optionally overprovisioned) or 2 mirrored HDDs (as they're less reliable).
- Set the boot flag on `/boot/efi` (UEFI) or `/boot` (BIOS). It's not used, but some hardware may require it to try booting the drive.
- Swap can be added either as a partition, as an LVM volume or not added at all.
- Use LVM or ZFS (if supported/stable) for the whole main disk, except the boot and EFI partitions.
- Generally use EXT4, but try to use ZFS if appropriate.
- Optionally use only the first half of the disk for LVM/system stuff and the other half as for ZFS.
- Storage typically uses base-10 prefixes, not base-2, like speed and unlike memory.
- SSDs can be overprovisioned in order to improve performance by leaving unused space the SSD can use internally. Factories typically reserve some minimum size appropriate to the drive, but users can overprovision further by leaving space unallocated/unpartitioned at the end of the drive. It's typically not needed to overprovision newer SSDs.

### System Volumes Suggestion

This is just a suggestion for how to partition your main system drive. Since LVM volumes can be expanded later, it's fine to make them initially small. Create the volumes during system installation and set the mount options later in `/etc/fstab`.

| Volume/Mount | Type | Minimal Size (GiB) | Mount Options |
| :--- | :--- | :--- | :--- |
| `/proc` | Runtime | N/A | hidepid=2,gid=1500 |
| `/boot/efi` | FAT32 w/ boot flag (UEFI), none (BIOS) | 0.5 | nodev,nosuid,noexec |
| `/boot` | EXT4 (UEFI), FAT32 w/ boot flag (BIOS) | 0.5 | nodev,nosuid,noexec |
| Swap | Swap or swap on LVM | 4, 8, 16 | N/A |
| `vg0` | LVM | 90% | N/A |
| `/` | EXT4 (LVM) | 10 | nodev |
| `/tmp` | EXT4 (LVM) | 5 | nodev,nosuid,noexec |
| `/var` | EXT4 (LVM) | 5 | nodev,nosuid |
| `/var/lib` | EXT4 (LVM) | 5 | nodev,nosuid |
| `/var/log` | EXT4 (LVM) | 5 | nodev,nosuid,noexec |
| `/var/log/audit` | EXT4 (LVM) | 1 | nodev,nosuid,noexec |
| `/var/tmp` | EXT4 (LVM) | 5 | nodev,nosuid,noexec |
| `/home` | EXT4 (LVM) | 10 | nodev,nosuid |
| `/srv` | EXT4 (LVM) or none if external | 10 | nodev,nosuid |

## Miscellaneous

### Cron

- Don't use periods (including file extensions) in the hourly/daily/weekly/monthly scripts.

## Troubleshooting

- `network-online.target` is stalling during boot:
  - See all services it depends on: `systemctl show -p WantedBy network-online.target`
  - Disable the unused services which stall.
- Firmware for the network card fails to load:
  - Causes a syslog record like "firmware: failed to load rtl\_nic/rtl8168g-3.fw (-2)" when trying to up the interface.
  - Might happen after installation even if working initially (for some reason).
  - Realtek solution: Enable the "non-free" repo and install "firmware-realtek".
- Perl complains about a locale error:
  - Test with `perl -e exit`. It will complain if there's an error.
  - Check the locale: `locale`
  - Comment `AcceptEnv LANG LC_*` in `/etc/ssh/sshd_config` to prevent clients bringing their own locale.

{% include footer.md %}