jeremy/HON95-wiki @ ceb202b2500e9f4a8b4ceed9c6275e6fffa0a95f

title: Linux Server Applications breadcrumbs:

title: Configuration
title: Server --- {% include header.md %}

Using

{:.no_toc}

Debian 10 Buster

Apache

Outdated and missing information

Setup

Install: apt install apache2
Update security.conf:
```
ServerTokens Prod
ServerSignature Off
```

Usage

Enable/disable stuff: a2<en|dis><conf|mod|site> <...>
Test configuration: apache2ctl

Apticron

Sends an emails when APT updates are available.

Setup

Prerequesites:
- Setup Postfix or similar so the system can actually send mail.
- Make sure the root email alias is set appropriately.
Install: apt install apticron
Setup the config: /etc/apticron/apticron.conf
- Create it: cp /usr/lib/apticron/apticron.conf /etc/apticron/apticron.conf
- The defaults are typically fine.
Modify the check interval in /etc/cron.d/apticron (e.g. 30 23 * * *).
Fix a bug causing it to ignore IPADDRESSNUM and always print all IP adresses:
1. Open /usr/sbin/apticron.
2. Find this line: IPADDRESSES=`(echo $( /bin/hostname --all-ip-addresses ) ;
3. Change it to: IPADDRESSES=`(
Test it: apticron

Avahi Daemon

TODO

Setup

Install: apt install avahi-daemon

AWS CLI

Possibly outdated

Setup

Guide: AWS: Installing the AWS CLI
Install awscli through pip3
Fix permissions: chmod +x /usr/local/bin/aws

Usage

Login: aws configure [--profile <profile>]
- This will store the credentials for the current Linux user.
- London region: eu-west-2
- Output format: json
Examples:
- Upload file: aws s3 cp <local_file> s3://<bucket>/

bitwarden_rs

A free community backend for Bitwarden.

TODO

Ceph

See Storage: Ceph.

Certbot

Setup

Install: apt install certbot
(Optional) Add post-update hook: In /etc/letsencrypt/cli.ini, add renew-hook = systemctl reload nginx or equivalent.

Usage

Create using HTTP challenge (auto-renewable): certbot -d <domain> --preferred-challenges=http --webroot --webroot-path=<webroot> certonly
Create using DNS channelge (not auto-renewable): certbot -d <domain> --preferred-challenges=dns --manual certonly
Dry-run renew: certbot renew --dry-run [--staging]
Revoke certificate: certbot revoke --cert-path <cert>

DDNS

Cloudflare

Cloudflare does not allow limiting the scope for API keys to specific subdomains, so the key will have access to the whole domain (based on how it's registered).
Use e.g. cloudflare-ddns-updater.sh.

Docker

Setup

Install: Docker Documentation: Get Docker Engine - Community for Debian.
(Optional) Setup swap limit:
- If docker info contains WARNING: No swap limit support, it's not working and should maybe be fixed.
- It incurs a small performance degredation and is optional but recommended.
- In /etc/default/grub, add cgroup_enable=memory swapaccount=1 to GRUB_CMDLINE_LINUX.
- Run update-grub and reboot.
Configure /etc/docker/daemon.json:
- Enable IPv6: "ipv6": true and "fixed-cidr-v6": "<ipv6-subnet>/64"
  - Note that IPv6 it not NATed like IPv4 is in Docker.
- Set DNS servers: "dns": ["1.1.1.1", "2606:4700:4700::1111"]
  - If not set, containers will use 8.8.8.8 and 8.8.4.4 by default.
  - /etc/resolv.conf is limited to only three name servers, so don't provide too many. One may be set by the container itself.
- (Optional) Disable automatic IPTables rules: "iptables": false
(Optional, not recommended on servers) Allow certain users to use Docker: Add them to the docker group.

Usage

Miscellanea:
- Show disk usage: docker system df -v
Cleanup:
- Prune unused images: docker image prune -a
- Prune unused volumes: docker volume prune
Docker run options:
- Set name: --name=<name>
- Run in detatched mode: -d
- Run using interactive terminal: -it
- Automatically remove when stopped: --rm
- Automatically restart: --restart=unless-stopped
- Use "tini" as entrypoint and use PID 1: --init
- Set env var: -e <var>=<val>
- Publish network port: -p <host-port>:<cont-port>[/udp]
- Mount volume: -v <vol>:<cont-path> (<vol> must have a path prefix like ./ or / if it is a directory and not a named volume)

Networking

Containers in production should not use the default Docker networks.
Try to isolate container communication into as small networks as possible (e.g. one network per group of containers for an application).
Docker doesn't integrate with ip6tables at all, meaning certain IPv6 features are lacking. For instance, IPv6 is not NATed like IPv4 and ICC can't be disabled. NAT66 shouldn't generally be used in the first place, but the lack of it means IPv6 requires a bit of extra configuration to get it working with containers. IPv6 routing and port publishing work as they should, though, as they don't use ip6tables.
Network types:
- Bridge: A plain bridge where all containers and the host can communicate. Can optionally be directly connected to a host bridge, but that doesn't always work as expected. Vulnerable to ARP/NDP spoofing.
- Overlay: Overlay network for swarm stuff.
- Host: The container use the network stack of the host. Ports are published directly to the host.
- MACVLAN: Bridges connected to a host (parent) interface, allowing containers to be connected to a network the host is part of. Can optionally use trunking on the host interface. All communication between containers and the host is dropped (consider using a host-connected bridge if you need this).
- L2 IPVLAN: Similar to MACVLAN, but all containers use the host's MAC address. Containers can communicate, but the host can't communicate with any containers.
- L3 IPVLAN: Every VM uses a separate subnet and all communication, internally and externally, is routed. Should avoid ARP/NDP spoofing. (TODO: Containers and the host can communicate?)
Create:
- Create bridged network: docker network create --driver=bridge --subnet=<ipv4-net> --ipv6 --subnet=<ipv6-net> <name>
- Create external bridged network (experimental, doesn't work as intented in some scenarios): docker network create --driver=bridge --subnet=<ipv4-net> --gateway=<ipv4-gateway> --ipv6 --subnet=<ipv6-net> --gateway=<ipv6-gateway> -o "com.docker.network.bridge.name=<host-if> <name>
- Create MACVLAN: docker network create --driver=macvlan --subnet=<ipv4-net> --gateway=<ipv4-gateway> --ipv6 --subnet=<ipv6-net> --gateway=<ipv6-gateway> -o parent=<netif>[.<vid>] <name>
- Create L2 IPVLAN with parent interface: docker network create --driver=ipvlan --subnet=<ipv4-net> --gateway=<ipv4-gateway> --ipv6 --subnet=<ipv6-net> --gateway=<ipv6-gateway> -o parent=<netif> <name>
Use:
- Run container with network: docker run --network=<net-name> --ip=<ipv4-addr> --ip6=<ipv6-addr> --dns=<dns-server> [...] <image>

Docker Compose

Setup

Install Docker: See above.
Install: Docker Documentation: Install Docker Compose.
Install command completion: Docker Documentation: Command-line completion.

Troubleshooting

Fix Docker Compose No-Exec Tmp-Dir

Docker Compose will fail to work if /tmp has noexec.

Move /usr/local/bin/docker-compose to /usr/local/bin/docker-compose-normal.
Create /usr/local/bin/docker-compose with the contents below and make it executable.
Create the new TMPDIR dir.

New docker-compose:

#!/bin/bash
# Some dir without noexec
export TMPDIR=/var/lib/docker-compose-tmp
/usr/local/bin/docker-compose-normal "$@"

Fail2ban

Setup

Install fail2ban.
Fix the firewall first so it configures itself correctly wrt. firewall blocking.
Check the status with fail2ban-client status [sshd].

Google Authenticator

Possibly outdated

This setup requires pubkey plus MFA (if configured) plus password.

Setup

Warning: Keep a shell open and test with a new shell during the process to make sure you don’t lock yourself out.
Install: apt install libpam-google-authenticator
In /etc/pam.d/sshd, add auth required pam_google_authenticator.so nullok after @include common-auth.

In /etc/ssh/sshd_config, set:

ChallengeResponseAuthentication yes
UsePAM yes
AuthenticationMethods publickey,keyboard-interactive

Restart sshd and check that you can login with pubkey and MFA now.
(Optional) Add my google-auth-config-prompter.sh profile script to /etc/profile.d/ to ask user to configure Google Auth on login.
To allow a group to use only pubkey (no password or OTP):
- In /etc/ssh/sshd_config, add Match Group no-mfa containing AuthenticationMethods publickey (indented) at the bottom.
- Add the system group no-mfa and add special users to it.
To manually configure MFA for a user:
- Example: google-authenticator -tduW
- Use time-based tokens.
- Restrict usage of the same token multiple times.
- Don’t rate limit.
- Allow 3 concurrent codes (1 before, 1 after).

Intel SSD Data Center Tool (isdct)

Setup

Download the ZIP for Linux from Intel's site.
Install the AMD64 deb package.

Usage

Command syntax: isdct <verb> [options] [targets] [properties]
- Target may be either index (as seen in show) or serial number.
Show all SSDs: isdct show -intelssd
Show SSD properties: isdct show -all -intelssd [target]
Show health: isdct show -sensor
Upgrade firmware: isdct load -intelssd <target>
Set physical sector size: isdct set -intelssd <target> PhysicalSectorSize=<512|4096>
- 4k is generally the most optimal choice.
Prepare a drive for removal by putting it in standby: isdct start -intelssd <target> -standby
Show speed: isdct show -a -intelssd [target] | grep -i speed
Fix SATA 3.0 speed: isdct set -intelssd <target> PhySpeed=6
- Check before and after either with isdct or smartctl.

Change the Capacity

Remove all partitions from the drive.
Remove all data: isdct delete -intelssd <target>
(Optional) Set the physical sector size: isdct set -intelssd <target> PhysicalSectorSize=<512|4096>
Set the new size: isdct set -intelssd <target> MaximumLBA=<size>
- If this fails, run isdct set -system EnableLSIAdapter=true. It will add another "version" of the SSDs, which you can try again with.
- The size can be specified either as "native", the LBA count, percent (x%) or in gigabytes (xGB). Use "native" unless you have a reason not to.
Prepare it for removal: isdct start -intelssd <target> -standby
Reconnect the drives or restart the system.

Home Assistant

See Home Assistant.

ISC DHCP Server

Notes

DHCPv4 uses raw sockets, so it bypasses the firewall (i.e. no firewall rules are needed). DHCPv6, however, does not. This includes the respective clients as well.
The DHCPv6 server is typically used with radvd for router advertisements.

Setup

Install and enable isc-dhcp-server.
Setup config files:
- DHCPv4: /etc/dhcp/dhcpd.conf
- DHCPv6 (optional): /etc/dhcp/dhcpd6.conf
If using systemd-networkd, fix wrong startup order:
- TODO

Configuration

Always specify the authorative statement in subnet declarations so that the server will reply with DHCPNAK for misconfigured clients. This may significantly reduce reconfiguration delay when a client moves between subnets.
For range6, prefer using CIDR notation. If using range notation, try to align the start and end on a CIDR block to avoid excessive memory usage.
DHCPv6 uses lease pools of 9973 entries, so using range sizes below this number may be preferable as a very general reference. /116 gives 8191 addresses.

MariaDB

A MySQL fork that is generally MySQL compatible.

Setup

Install: apt install mariadb-server
Run the initial configuration: mysql_secure_installation
- Set a new MyriaDB root password.
- Remove all anmonymous/test stuff.
- Disallow remote root login.

Usage

Open prompt: mariadb [-u <user> [-p]]
- The default user is root.
- The password can be entered interactively by specifying -p.
- A password is typically not needed.
Add new admin user: GRANT ALL ON *.* TO '<user>'@'127.0.0.1' IDENTIFIED BY '<password>' WITH GRANT OPTION;

NFS

The instructions below use NFSv4 without Kerberos. This is not considered secure at all and should only be used on trusted networks and systems.

Server

Setup

(Recommended) Use NTP on both server and clients to make sure the clocks are synchronized.
Install: apt install nfs-kernel-server portmap
- "portmap" is only required for NFSv2 and v3, not for NFSv4.
See which versions are running: cat /proc/fs/nfsd/versions

(Recommended) Enable only v4:

In /etc/default/nfs-common, set:
```
NEED_STATD="no"
NEED_IDMAPD="yes"
```

In /etc/default/nfs-kernel-server, set:

RPCNFSDOPTS="-N 2 -N 3"
RPCMOUNTDOPTS="--manage-gids -N 2 -N 3"

Mask "rpcbind":

systemctl mask rpcbind.service
systemctl mask rpcbind.socket

Usage

Setup a new directory contain all exports in:
1. Create the container: mkdir /export
2. Create the export mount dirs within the container.
3. Mount the exports in the container using bind mounts.
  - Example fstab entry using ZFS: /mnt/zfspool /srv/nfs4/music none bind,defaults,nofail,x-systemd.requires=zfs-mount.service 0 0
4. Remember to set appropriate permissions.
Add filesystems to export in /etc/exports.
1. (Optional) For NFSv4, the container directory can be set as the root export by specifying option fsid=root.
2. For a list of options, see exports(5).
Update the NFS table: exportfs -ra
- Or, restart the service: systemctl restart nfs-server
(Optional) Show exports: exportfs -v
(Optional) Update the firewall:
- NFSv4 uses only TCP port 2049.

Client

Setup

Install: apt install nfs-common

Usage

Create a dir to mount the export to.
(Optional) Try to mount it: mount -t nfs4 <server-hostname>:<export> <mountpoint>
- Note that for NFSv4 with a root export, the export path is relative to the root export.
(Optional) Make it permanent by adding it to fstab.

ntopng

Setup

Install ntopng.
Make sure service ntopng is enabled and running.
Fix log dir owner: chown nobody:nogroup /var/log/ntopng
Configure:
1. Open /etc/ntopng.conf.
2. Add -W=<new_port> to enable HTTPS.
3. (Optional) Set -w=0 to disable HTTP.
Restart it (takes a while).

ntpd

Setup

Disable systemd-timesyncd NTP client by disabling and stopping systemd-timesyncd.
Install ntp.
In /etc/ntp.conf, replace existing servers/pools with ntp.justervesenet.no with the iburst option.
Test with ntpq -pn (it may take a minute to synchronize).

NUT

Setup

Instructions for both servers and clients. Exclusive steps are marked "(Server)" or "(Client)".

Since SSL/TLS is not enabled by default for client-server communication, use only trusted networks for this communication.

Install: apt install nut
- The service will fail to start since NUT is not configured yet.
Set the mode: Open /etc/nut/nut.conf and set MODE=netserver for server or MODE=netclient for client.
(Server) Add the UPS(s): Open /etc/nut/ups.conf and add a declaration for all UPSes (see example below).
- Try using the usbhid-ups driver if using USB. Otherwise, check the hardware compatibility list to find the correct driver. If the exact model isn't there, try a similar one.
- For usbhid-ups, see the example below and usbhid-ups(8).
- You may need to modify some udev rules, but probably not.
(Server) Restart driver service: systemctl restart nut-driver.service
(Server) Set up local and remote access: Open /etc/nut/upsd.conf and set LISTEN ::.
- Alternatively add one or multiple LISTEN directives for only the endpoints you wish to listen on.
(Server) Set up users: Open /etc/nut/upsd.users and add users (see example below).
- Each client should have a separate user.
(Server) Restart the server service: systemctl restart nut-server.service
(Client) TODO: Something about nut-client.service.
Monitor the UPS: Open /etc/nut/upsmon.conf and add MONITOR <ups>@<host>[:<port>] <ups-count> <user> <password> <master|slave>.
- ups-count is typically 1. If this system is not powered by the UPS but you want to monitor it without shutting down, set it to 0.
(Optional) Tweak upsmon:
- Set RBWARNTIME (how often upsmon should complain about batteries needing replacement) to an appropriate value, e.g. 604800 (1 week).
(Optional) Add a notify script to run for certain events:
- In /etc/nut/upsmon.conf, add EXEC to all NOTIFYFLAG entries you want to run the script for (typically all except LOWBATT).
- In /etc/nut/upsmon.conf, set the script to run using format NOTIFYCMD /opt/scripts/nut-notify.sh.
- Create the executable script. See an example below for sending email (if Postfix is set up).
Restart monitoring service: systemctl restart nut-monitor.service
Check the log to make sure nut-monitor successfully connected to the server.
- Note that upsc does not use a server user or the monitoring service, so it's not very useful for debugging that.
Configure delays:
1. Figure out how much time is needed to shut down the master and all slaves, with some buffer time.
2. Set the remaining runtime and remaining battery charge for when the UPS should send the "battery low" event (requires admin login): upsrw -s battery.runtime.low=<seconds> <ups> and upsrw -s battery.charge.low=<percent> <ups>
  - This may not work on all UPSes, even if the values appear to be modifiable. This means you're probably stuck with the defaults.
3. Set the delay from when the master issues the shutdown command to the UPS, to when the UPS powers off; and the delay from when the UPS receives power again to when it should turn on power: For usbhid-ups, this is set using offdelay and ondelay. Otherwise, it's set using ups.delay.shutdown and ups.delay.start. The start delay must be greater than the stop delay.
  - The shutdown command is issued from the master after it's done waiting for itself and slaves and is shutting itself down. The shutdown delay may be useful to increase if there are slaves that take much longer than the master to shut down.
4. Restart the affected NUT services.
Simulate a power loss, which should power off all monitoring clients and then the UPS: upsmon -c fsd
- If the client machines are not given enough time to power off before the UPS powers off, you need to modify the shutdown delay settings in the UPS.

Example USB UPS declaration for usbhid-ups (/etc/nut/ups.conf):

[alpha]
    desc = "PowerWalker VI 3000 RLE"
    # usbhid-ups should work for most UPSes with
    driver = usbhid-ups
    # If you have multiple UPSes connected, see usbhid-ups(8) for more specifying which USB device it should use
    port = auto
    # Sets "ups.delay.shutdown", the delay between the shutdown command and when the UPS powers off (default 20s)
    offdelay = 60
    # Sets "ups.delay.start", which has something to do with letting the UPS charge enough to make sure devices may fully boot (default 30s, must be greater than offdelay)
    ondelay = 120

Example server users (/etc/nut/upsd.users):

[admin]
    password = <password>
    actions = SET
    instcmds = ALL

[local]
    password = <password>
    upsmon master

Example notify script:

#!/bin/bash
echo -e "Time: $(date)\nMessage: $@" | mail -s "NUT: $@" root

OpenSSL

Usage

Many OpenSSL default options are insecure and must be specified.
Specifying -noout -text prints the data as formatted text instead of raw Base64.
Create self-signed cert: openssl req -new -x509 -sha256 -newkey rsa:4096 -nodes -keyout key.pem -out cert.pem -days 3650 -subj "/C=ZZ/ST=Local/L=Local/O=Local/OU=Local/CN=localhost"

Pi-hole (Docker)

(Optional) Set up an upstream DNS server.
Image: pihole/pihole
Run on LAN-accessible bridge.
Don’t give capability NET_ADMIN.
Add a reject rule in the firewall to more easily block HTTPS ads.
Find the admin password with docker logs pihole 2>&1 | grep "random password"
Specify the upstream DNS server twice so that it doesn’t choose the second itself.
Whitelists and blacklists:
- Blacklist (example): https://v.firebog.net/hosts/lists.php
- Whitelist (example): https://github.com/anudeepND/whitelist
- Add blocklists to /etc/pihole/adlists.list.
- Add whitelist domains to /etc/pihole/whitelist.txt.
- Run pihole -g to update lists.

Portainer

Standalone Server Setup

Is typically run on a Docker host. Includes the agent.

docker run -d -p 8000:8000 -p 9000:9000 --name=portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v ./data:/data portainer/portainer:<version>
- Port 9000 is the web UI.
- Port 8000 is an SSH tunnel server for communicating with agents.
Open the web UI through port 9000 (by default) or a reverse proxy to configure it.
- If /var/run/docker.sock was mounted, use "local".

Standalone Agent Setup

Must be run on a Docker host. For extra Docker hosts you want to control with another Portainer server.

docker run -d -p 9001:9001 --name portainer_agent --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/docker/volumes:/var/lib/docker/volumes portainer/agent:<version>
TODO

Postfix

Satellite system

Notes

When using an SMTP relay, the original IP address will likely be found in the mail headers.
Make sure DNS is configured correctly (SPF, DKIM, DMARC).

Setup

Install: postfix libsasl2-modules mailutils
- If asked, choose to configure Postfix as a satellite system.
Set the FQDN in /etc/postfix/main.cf.
Update the root alias to point your real email address in /etc/aliases, then run newaliases.
Update the main.cf config (example not provided here).
1. Only listen to localhost: Set inet_interfaces = loopback-only
2. Disable relaying: Set mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
3. Anonymize banner: smtpd_banner = $myhostname ESMTP
See the specific relay guides:
- Mailgun:
  - How To Start Sending Email (Mailgun)
  - How to Set Up a Mail Relay with Postfix and Mailgun on Ubuntu 16.04 (DigitalOcean)
- SendGrid:
  - Postfix (SendGrid)
  - Use API-key with permission to send mail only.
  - The API-key username is apikey.
Setup address rewrite rules:
- For fixing the To and From fields, which is typically from root to root.
- Add the rewrite config (see example below).
- Reference the config using smtp_header_checks in the main config.
- Test: postmap -fq "From: root@$(hostname --fqdn)" regexp:smtp_header_checks
Setup relay credentials (SASL):
1. Credentials file: /etc/postfix/sasl_passwd
2. Add your credentials using format: [relay_domain]:port user@domain:password
3. Run: postmap sasl_passwd
4. Fix permissions: chmod 600 sasl_passwd*
Restart postfix.
Try sending an email: echo "Test from $(hostname) at time $(date)." | mail -s "Test" root

File smtp_header_checks:

/^From:\s*.*\S+@node\.example\.bet.*.*$/ REPLACE From: "Node" <node@example.net>
/^To:\s*.*\S+@node\.example\.net.*$/ REPLACE To: "Someone" <someone@example.net>

Usage

Send a test mail: echo "Test from $HOSTNAME at time $(date)." | mail -s "Test" root
Test the config: postconf > /dev/null
Print the config: postconf -n
If mailq tells you mails are stuck in the mail queue because of previous errors, run postqueue -f to flush them.

Pterodactyl

General

The panel must be able to communicate with all daemons and all vice versa. The user must be able to communicate with both the panel and daemons.
Both the panel and daemons need valid TLS certificates.

Panel (Docker)

Setup

TODO

Logs are located in /app/storage/logs/laravel/ inside the container.

Daemon

Follow the official guide.
Install unzip.
Setup a valid TLS certificate.
Setup Docker DNS servers: Add { "dns": ["1.1.1.1", "1.0.0.1", "2606:4700:4700::1111", "2606:4700:4700::1001"] } to /etc/docker/daemon.json.

Game Servers

General

You can typically watch the installation progress by watching the docker logs.

Counter-Strike: Global Offensive

See Counter-Strike: Global Offensive (CS:GO).

Team Fortress 2

See Team Fortress 2 (TF2).

Router Advertisement Daemon (radvd)

Setup

Install and enable radvd.
Setup config file: /etc/radvd.conf

Samba

Server

Setup

Install: apt install samba
Open TCP port 445 (and 139 if using NetBIOS).
(Optional) Disable NetBIOS: systemctl disable --now nmbd and systemctl mask nmbd
Configure it (see usage).

Usage

Enforce encryption and signing (server signing and smb encrypt) on important volumes.
Performance tuning:
- Socket options: socket options = TCP_NODELAY SO_KEEPALIVE IPTOS_LOWDELAY
- If the stuff is not important and the network is secure and high throughput is desired: smb encrypt = disabled
- Raw IO: read raw = yes and read raw = yes
- Sendfile: use sendfile = yes
- Zero-copy from net to FS (doesn't work for signed connections): min receivefile size = 16384
- Async RW for large files: aio read size = 16384 and aio write size = 16384
Making changes:
- Change the configuration file: /etc/samba/smb.conf
- Test the configuration: testparm -t
- Restart the service: systemctl restart smbd
Manage access to a share:
- Add a Linux group for the share, like "smb-media", to restrict user access.
- Fix permissions for only that group on the system.
- Configure the share to only allow that group.
- Add Linux users to the group.
Manage users:
- Samba users are somewhat using Linux users but with a different password.
- To separate pure Samba users from real users, you can add a "smb-" prefix to its username and make it a system user.
- Create a new Linux (system) user without shell login: useradd -r <name>
  - Or: useradd
- Add a user and set its password: smbpasswd -a <user>
- Show users: sudo pdbedit -L -v

Client

Setup

Install: apt install cifs-utils
Add permanent shares (see usage).

Usage

Add permanent share:
1. Create the mountpoint.
2. Create a credentials file (/root/.credentials/smb/<whatever>):
```
user=<user>
password=<password>
```
3. In /etc/fstab, add: //<share> <mountpoint> cifs vers=3.1.1,uid=<uid>,gid=<gid>,credentials=<file>,iocharset=utf8 0 0
4. Test it: mount -a

smartmontools

For monitoring disk health.
Install: apt install smartmontools
Show all info: smartctl -a <dev>
Tests are available in foreground and background mode, where foreground mode is given higher priority.
Tests:
- Short test: Can be useful to quickly identify a faulty drive.
- Long test: May be used to validate the results found in the short test.
- Convoyance test: Intended to quickly discover damage incurred during transportation/shipping.
- Select test: Test only the specified LBAs.
Run test: smartctl -t <short|long|conveyance|select> [-C] <dev>
- -C: Foreground mode.

TFTP-HPA

Setup

Install tftpd-hpa.
Update /etc/default/tftpd-hpa based on the config below.
Create the folder /var/tftp with permissions 777 and user-group pair tftp:tftp.
Restart it.
If it shouldn't automatically start, disble it.

File /etc/default/tftpd-hpa:

TFTP_USERNAME="tftp"
TFTP_DIRECTORY="/var/tftp"
TFTP_ADDRESS=":69"
TFTP_OPTIONS="--create --secure"

Unbound

Setup

Install: apt install unbound dns-root-data
- It may fail to start due to systemd-resolved listening to the DNS UDP port.
Setup the config: /etc/unbound/unbound.conf
Make sure /etc/hosts contains the short and FQDN hostnames.
Setup systemd-resolved:
1. Open /etc/resolv.conf.
2. Set DNSStubListener=no.
3. Set DNS=::1.
4. Restart systemd-resolved.

Setup resolv.conf:

Open /etc/resolv.conf.

Set:

nameserver 127.0.0.1
nameserver ::1
domain <domain>
search <domain-list>

Restart unbound: systemctl restart unbound
Test DNSSEC:
- drill sigfail.verteiltesysteme.net should give an rcode of SERVFAIL.
- drill sigok.verteiltesysteme.net should give an rcode of NOERROR.
Make sure dns-root-data is updating root hints in file /usr/share/dns/root.hints.

Notes

Use DNS over HTTPS/TLS.
Setup private addresses for DNS rebinding prevention.

UniFi

See Ubiquiti UniFi Controller (Debian).

ZFS

See Storage: ZFS.

{% include footer.md %}

linux-applications.md 30 KB History Raw

Using

Apache

Setup

Usage

Apticron

Setup

Avahi Daemon

Setup

AWS CLI

Setup

Usage

bitwarden_rs

Ceph

Certbot

Setup

Usage

DDNS

Cloudflare

Docker

Setup

Usage

Networking

Docker Compose

Setup

Troubleshooting

Fix Docker Compose No-Exec Tmp-Dir

Fail2ban

Setup

Google Authenticator

Setup

Intel SSD Data Center Tool (isdct)

Setup

Usage

Change the Capacity

Home Assistant

ISC DHCP Server

Notes

Setup

Configuration

MariaDB

Setup

Usage

NFS

Server

Setup

Usage

Client

Setup

Usage

ntopng

Setup

ntpd

Setup

NUT

Setup

OpenSSL

Usage

Pi-hole (Docker)

Portainer

Standalone Server Setup

Standalone Agent Setup

Postfix

Satellite system

Notes

Setup

Usage

Pterodactyl

General

Panel (Docker)

Setup

Daemon

Game Servers

General

Counter-Strike: Global Offensive

Team Fortress 2

Router Advertisement Daemon (radvd)

Setup

Samba

Server

linux-applications.md 30 KB

History Raw