1.1.1.1.12 Servidor Debian 12 - sivasmartins/Documentos GitHub Wiki

Pacotes

Bookworm - Debian 12

vi /etc/apt/sources.list

deb http://deb.debian.org/debian/ bookworm main contrib non-free non-free-firmware
#deb-src http://deb.debian.org/debian/ bookworm main contrib non-free non-free-firmware

deb http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware
#deb-src http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware

# bookworm-updates, to get updates before a point release is made;
# see https://www.debian.org/doc/manuals/debian-reference/ch02.en.html#_updates_and_backports
deb http://deb.debian.org/debian/ bookworm-updates main contrib non-free non-free-firmware
#deb-src http://deb.debian.org/debian/ bookworm-updates main contrib non-free non-free-firmware

# bookworm-backports, previously on backports.debian.org
deb http://deb.debian.org/debian/ bookworm-backports main contrib non-free non-free-firmware
#deb-src http://deb.debian.org/debian/ bookworm-backports main contrib non-free non-free-firmware

Atualização dos pacotes

apt update
apt upgrade -y

Pacotes básicos

apt install -y net-tools vim aptitude openssh-server less telnet netcat-openbsd psmisc lsof pciutils rpcbind sysstat

Compactadores

aptitude install -y unace unrar-free zip unzip p7zip-full p7zip-rar sharutils rar uudeview mpack arj cabextract

Firmwares

aptitude install -y firmware-linux firmware-linux-free firmware-linux-nonfree

SSH

vim /etc/ssh/sshd_config

PermitRootLogin yes

Editor

vim /etc/vim/vimrc

sintax on

Editor Padrão

Sistema

update-alternatives --config editor

Crontab

select-editor

Identificação

  • Hostname

vim /etc/hostname

srv-xxx
  • Hosts

vim /etc/hosts

127.0.0.1	localhost
127.0.1.1	srv-xxx
  • Motd

vim /etc/motd

(manter só a 1ª linha)
  • Issue

vim /etc/issue

Substituir a informação

Shell

  • Bashrc

vim ~/.bashrc

export PS1='\H:\w\$ '
umask 022
export LS_OPTIONS='--color=auto'
alias ls='ls $LS_OPTIONS'
alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'
export HISTSIZE=9999
export HISTFILESIZE=999999
export HISTCONTROL=ignoreboth
export HISTSIZE=1000
shopt -s histappend

Profile

echo "export TMOUT=900" >> /etc/profile

NTP

  • Escolher serviço/alternativa

chrony

aptitude install chrony

Configuração

vim /etc/chrony/chrony.conf

Verificar funcionamento

chronyc tracking

Verificar status

timedatectl status

systemd-timesyncd

Install

aptitude install systemd-timesyncd

Configuração

vim /etc/systemd/timesyncd.conf NTP=a.ntp.br b.ntp.br c.ntp.br

Ativar serviço

timedatectl set-ntp true

ntpdate (legado)

Install
aptitude purge ntp
aptitude install ntpdate

Alterar contrab

crontab -e

00,30 * * * * root /usr/sbin/ntpdate a.ntp.br

SSH

Copiar chaves de Acesso

scp /chave de acesso/authorized_keys 192.168.x.x:/destino

Permissões

chmod 600 /caminho/authorized_keys

SSH Server

vim /etc/ssh/sshd_config

Várias chaves como root
Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
LoginGraceTime 2m
PermitRootLogin without-password
#PermitRootLogin yes
StrictModes yes
MaxAuthTries 6
PubkeyAuthentication yes
AuthorizedKeysFile /camimnho/.sshkeys/authorized_keys
PasswordAuthentication no
PermitEmptyPasswords no
UsePrivilegeSeparation yes
Subsystem sftp /usr/lib/sftp-server
AllowUsers root
Várias chaves acesso comum
Port 22
Protocol 2
HostKey /camimnho/.sshkeys/authorized_keys
LoginGraceTime 2m
#PermitRootLogin without-password
PermitRootLogin yes
StrictModes yes
MaxAuthTries 6
PubkeyAuthentication yes
AuthorizedKeysFile /etc/ssh/authorized_keys
PasswordAuthentication no
PermitEmptyPasswords no
#UsePrivilegeSeparation yes
Subsystem sftp /usr/lib/sftp-server
AllowUsers usuario01 usuario02 usuario03

Chaves

ssh localhost
(no)

Logout

cp /etc/skel/.bash_logout ~

VALIDAR

Fuso Horário

Reconfigurar horario

dpkg-reconfigure tzdata 
/etc/init.d/ntp stop
ntpd -q -g
hwclock --systohc
/etc/init.d/ntp start

#Test
date

Cron

Alterar cron

crontab -e

 CRONTZ=""

vim /etc/crontab

MAILTO=

Alteração do Nome do Servidor (caso necesssário)

vim /etc/hosts

vim /etc/hostname

hostname

ping hostname

rm -f /etc/ssh/ssh_host*

Reconfigurar

dpkg-reconfigure openssh-server

Notificação

  • Exim

vim /etc/exim4/update-exim4.conf.conf

dc_eximconfig_configtype='smarthost'
dc_other_hostnames=
dc_local_interfaces='127.0.0.1'
dc_readhost=
dc_relay_domains=
dc_minimaldns='false'
dc_relay_nets='127.0.0.1'
dc_smarthost='smtp.dominio.com.br'
CFILEMODE='644'
dc_use_split_config='false'
dc_hide_mailname='false'
dc_mailname_in_oh='true'
dc_localdelivery='mail_spool'

Configurando usuário de envio

echo "smtp.dominio.com.br:[email protected]:SENHA" > /etc/exim4/passwd.client

Aliases

echo "root: [email protected]" >> /etc/aliases

Gerar novo aliase

newaliases

Nome do Servidor

echo "srv-xxx" > /etc/mailname

Email

echo "root: [email protected]" > /etc/email-addresses

Reiniciar serviço

/etc/init.d/exim4 restart

Teste

date | mail -s "teste `hostname`" [email protected]

Smart

aptitude install -y smartmontools

Habilitar Smart (Bios)

smartctl --smart=on --offlineauto=on --saveauto=on /dev/sda
smartctl --smart=on --offlineauto=on --saveauto=on /dev/sdb...

Testar suporte

smartctl --all /dev/sda | grep "SMART support"

Caso não for identificado

aptitude purge smartmontools

Configuração

vim /etc/default/smartmontools

enable_smart="/dev/sda" ou enable_smart="/dev/sda /dev/sdb"
start_smartd=yes
echo "/dev/sda -a -m [email protected] -s S/../../7/01" > /etc/smartd.conf
/etc/init.d/smartmontools restart

Testes

smartctl -i /dev/sdx # Modelo, nº de série, versão de firmware e status
smartctl -a /dev/sdx # Auto teste: SMART overall-health self-assessment test result: PASSED
smartctl -l error /dev/sdx # Busca por erros no log do smart
smartctl -t short /dev/sdx # Teste curto (2min)
smartctl -t long /dev/sdx # Teste long (2h)
smartctl -l selftest /dev/sdx      # Mostrar o resultado do teste
smartctl -H /dev/sdx | grep result # Mostrar o resultado interno: em caso de passed o disco esta ok

Sysstat

Habilitar

echo ENABLED="true" > /etc/default/sysstat

Reiniciar Serviço

/etc/init.d/sysstat restart

Sar

sar