### Install a virtual machine with virt-install Source: https://www.debian.org/doc/manuals/debian-handbook/sect.virtualization.en.html Registers and starts a new virtual machine in libvirtd with specified hardware parameters. ```bash # **virt-install --connect qemu:///system --virt-type kvm --name testkvm --memory 2048 --disk /srv/kvm/testkvm.qcow,format=qcow2,size=10 --cdrom /srv/isos/debian-11.2.0-amd64-netinst.iso --network bridge=virbr0 --graphics vnc --os-type linux --os-variant debiantesting ** ``` -------------------------------- ### Install and configure Let's Encrypt certificate for Apache Source: https://www.debian.org/doc/manuals/debian-handbook/sect.x509-cert.en.html Installs the Certbot Apache plugin and runs the interactive setup wizard to generate and deploy a certificate for a domain. ```bash # **apt install python3-certbot-apache **[...] # **certbot --apache **aving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator apache, Installer apache Enter email address (used for urgent renewal and security notices) (Enter 'c' to cancel): **admin@falcot.com ** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Please read the Terms of Service at https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must agree in order to register with the ACME server. Do you agree? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o: **Y ** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Would you be willing, once your first certificate is successfully issued, to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about our work encrypting the web, EFF news, campaigns, and ways to support digital freedom. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o: ** N ** Account registered. No names were found in your configuration files. Please enter in your domain name(s) (comma and/or space separated) (Enter 'c' to cancel): **falcot.com ** Requesting a certificate for falcot.com Performing the following challenges: http-01 challenge for falcot.com Enabled Apache rewrite module Waiting for verification... Cleaning up challenges Created an SSL vhost at /etc/apache2/sites-available/000-default-le-ssl.conf Enabled Apache socache_shmcb module Enabled Apache ssl module Deploying Certificate to VirtualHost /etc/apache2/sites-available/000-default-le-ssl.conf Enabling available site: /etc/apache2/sites-available/000-default-le-ssl.conf Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1: No redirect - Make no further changes to the webserver configuration. 2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Select the appropriate number [1-2] then [enter] (press 'c' to cancel): **2 ** Enabled Apache rewrite module Redirecting vhost in /etc/apache2/sites-enabled/000-default.conf to ssl vhost in /etc/apache2/sites-available/000-default-le-ssl.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations! You have successfully enabled https://falcot.com You should test your configuration at: https://www.ssllabs.com/ssltest/analyze.html?d=falcot.com - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/falcot.com/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/falcot.com/privkey.pem Your cert will expire on 2022-06-04. To obtain a new or tweaked version of this certificate in the future, simply run certbot again with the "certonly" option. To non-interactively renew *all* of your certificates, run "certbot renew" - Your account credentials have been saved in your Certbot configuration directory at /etc/letsencrypt. You should make a secure backup of this folder now. This configuration directory will also contain certificates and private keys obtained by Certbot so making regular backups of this folder is ideal. - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le ``` -------------------------------- ### Configure APT sources list Source: https://www.debian.org/doc/manuals/debian-handbook/sect.setup-apt-package-repository.en.html Example entries for the /etc/apt/sources.list.d/falcot.list file to include custom package repositories. ```text deb http://packages.falcot.com/ updates/ deb http://packages.falcot.com/ internal/ ``` -------------------------------- ### Handle unmet dependencies with APT Source: https://www.debian.org/doc/manuals/debian-handbook/sect.manipulating-packages-with-dpkg.en.html Example of APT warning about unmet dependencies resulting from forced package installations. ```bash # **apt full-upgrade **[...] You might want to run 'apt-get -f install' to correct these. The following packages have unmet dependencies: rdesktop: Depends: libc6 (>= 2.5) but 2.3.6.ds1-13etch7 is installed E: Unmet dependencies. Try using -f. ``` -------------------------------- ### Install a Debian package with dpkg Source: https://www.debian.org/doc/manuals/debian-handbook/sect.manipulating-packages-with-dpkg.en.html Use the -i or --install option to install a local .deb file. ```bash # **dpkg -i man-db_2.9.4-2_amd64.deb** (Reading database ... 227466 files and directories currently installed.) Preparing to unpack man-db_2.9.4-2_amd64.deb ... Unpacking man-db (2.9.4-2) over (2.8.5-2) ... Setting up man-db (2.9.4-2) ... Updating database of manual pages ... man-db.service is a disabled or a static unit not running, not starting it. Processing triggers for mailcap (3.69) ... ``` -------------------------------- ### Configure SYSLINUX for hd-media Source: https://www.debian.org/doc/manuals/debian-handbook/sect.automated-installation.en.html Add boot parameters to syslinux.cfg when using the hd-media installer image. ```text default vmlinuz append preseed/file=/hd-media/preseed.cfg locale=en_US.UTF-8 keymap=us language=us country=US vga=788 initrd=initrd.gz -- ``` -------------------------------- ### LILO configuration file example Source: https://www.debian.org/doc/manuals/debian-handbook/sect.config-bootloader.en.html A standard /etc/lilo.conf configuration file for a dual-boot system with Debian and Windows. ```text # The disk on which LILO should be installed. # By indicating the disk and not a partition. # you order LILO to be installed on the MBR. boot=/dev/sda # the partition that contains Debian root=/dev/sda2 # the item to be loaded by default default=Linux # the most recent kernel image image=/vmlinuz label=Linux initrd=/initrd.img read-only # Old kernel (if the newly installed kernel doesn't boot) image=/vmlinuz.old label=LinuxOLD initrd=/initrd.img.old read-only optional # only for Linux/Windows dual boot other=/dev/sda1 label=Windows ``` -------------------------------- ### Start a virtual machine with virsh Source: https://www.debian.org/doc/manuals/debian-handbook/sect.virtualization.en.html Initiates the startup process for a specified virtual machine. ```bash # virsh -c qemu:///system start testkvm Domain testkvm started ``` -------------------------------- ### Performing Package Queries Source: https://www.debian.org/doc/manuals/debian-handbook/sect.manipulating-packages-with-dpkg.en.html Examples of listing files, searching for package ownership, and displaying package status information. ```bash $ **dpkg -L base-passwd** /. /usr /usr/sbin /usr/sbin/update-passwd /usr/share /usr/share/base-passwd /usr/share/base-passwd/group.master /usr/share/base-passwd/passwd.master /usr/share/doc /usr/share/doc/base-passwd /usr/share/doc/base-passwd/README /usr/share/doc/base-passwd/changelog.gz /usr/share/doc/base-passwd/copyright /usr/share/doc/base-passwd/users-and-groups.html /usr/share/doc/base-passwd/users-and-groups.txt.gz /usr/share/doc-base /usr/share/doc-base/users-and-groups /usr/share/lintian /usr/share/lintian/overrides /usr/share/lintian/overrides/base-passwd /usr/share/man /usr/share/man/de /usr/share/man/de/man8 /usr/share/man/de/man8/update-passwd.8.gz /usr/share/man/es /usr/share/man/es/man8 /usr/share/man/es/man8/update-passwd.8.gz /usr/share/man/fr /usr/share/man/fr/man8 /usr/share/man/fr/man8/update-passwd.8.gz /usr/share/man/ja /usr/share/man/ja/man8 /usr/share/man/ja/man8/update-passwd.8.gz /usr/share/man/man8 /usr/share/man/man8/update-passwd.8.gz /usr/share/man/pl /usr/share/man/pl/man8 /usr/share/man/pl/man8/update-passwd.8.gz /usr/share/man/ru /usr/share/man/ru/man8 /usr/share/man/ru/man8/update-passwd.8.gz $ **dpkg -S /bin/date** coreutils: /bin/date $ **dpkg -s coreutils** Package: coreutils Essential: yes Status: install ok installed Priority: required Section: utils Installed-Size: 17478 Maintainer: Michael Stone Architecture: amd64 Multi-Arch: foreign Source: coreutils (8.32-4) Version: 8.32-4+b1 Pre-Depends: libacl1 (>= 2.2.23), libattr1 (>= 1:2.4.44), libc6 (>= 2.28), libgmp10, libselinux1 (>= 3.1~) Description: GNU core utilities This package contains the basic file, shell and text manipulation utilities which are expected to exist on every operating system. . Specifically, this package includes: arch base64 basename cat chcon chgrp chmod chown chroot cksum comm cp csplit cut date dd df dir dircolors dirname du echo env expand expr factor false flock fmt fold groups head hostid id install join link ln logname ls md5sum mkdir mkfifo mknod mktemp mv nice nl nohup nproc numfmt od paste pathchk pinky pr printenv printf ptx pwd readlink realpath rm ``` -------------------------------- ### Configure file installation paths Source: https://www.debian.org/doc/manuals/debian-handbook/sect.building-first-package.en.html The .install file maps source files to their destination directories within the package filesystem. ```text data/* usr/share/falcot-data/ ``` ```text data/* usr/share/falcot-data/ falcot-data.desktop usr/share/applications/ ``` -------------------------------- ### Configure mini-dinstall Source: https://www.debian.org/doc/manuals/debian-handbook/sect.setup-apt-package-repository.en.html Example configuration for ~/.mini-dinstall.conf to manage the package archive structure. ```ini [DEFAULT] archive_style = flat archivedir = /srv/vhosts/packages verify_sigs = 0 mail_to = admin@falcot.com generate_release = 1 release_origin = Falcot Corp release_codename = stable [updates] release_label = Recompiled Debian Packages [internal] release_label = Internal Packages ``` -------------------------------- ### Configure package pinning priority Source: https://www.debian.org/doc/manuals/debian-handbook/sect.apt-cache.en.html Example configuration for /etc/apt/preferences.d/limnoria.pref to increase the priority of a backported package. ```text Package: limnoria Pin: release o=Debian Backports, a=bullseye-backports Pin-Priority: 1001 ``` -------------------------------- ### Managing Multi-Arch Architectures with dpkg Source: https://www.debian.org/doc/manuals/debian-handbook/sect.manipulating-packages-with-dpkg.en.html Commands to inspect, add, and remove foreign architectures for package installation. ```bash # **dpkg --print-architecture** amd64 # **dpkg --print-foreign-architectures** # **dpkg -i gcc-9-base_9.3.0-22_armhf.deb** dpkg: error processing archive gcc-9-base_9.3.0-22_armhf.deb (--install): package architecture (armhf) does not match system (amd64) Errors were encountered while processing: gcc-9-base_9.3.0-22_armhf.deb # **dpkg --add-architecture armhf** # **dpkg --add-architecture armel** # **dpkg --print-foreign-architectures** armhf armel # **dpkg -i gcc-9-base_9.3.0-22_armhf.deb** (Reading database ... 456367 files and directories currently installed.) Preparing to unpack gcc-9-base_9.3.0-22_armhf.deb ... Unpacking gcc-9-base:armhf (9.3.0-22) ... Setting up gcc-9-base:armhf (9.3.0-22) ... # **dpkg --remove-architecture armhf** dpkg: error: cannot remove architecture 'armhf' currently in use by the database # **dpkg --remove-architecture armel** # **dpkg --print-foreign-architectures** armhf ``` -------------------------------- ### Define SELinux File Contexts Source: https://www.debian.org/doc/manuals/debian-handbook/sect.selinux.en.html Example of a .fc file using gen_context to assign security labels to files. ```text # myapp executable will have: # label: system_u:object_r:myapp_exec_t # MLS sensitivity: s0 # MCS categories: /usr/sbin/myapp -- gen_context(system_u:object_r:myapp_exec_t,s0) ``` -------------------------------- ### Define a fake package header file Source: https://www.debian.org/doc/manuals/debian-handbook/sect.building-first-package.en.html Example configuration file for a fake package created with equivs-control. ```text Section: perl Priority: optional Standards-Version: 4.5.1 Package: libxml-libxml-perl Version: 2.0207-1 Maintainer: Raphael Hertzog Depends: libxml2 (>= 2.9.10) Architecture: all Description: Fake package - module manually installed in site_perl This is a fake package to let the packaging system believe that this Debian package is installed. . In fact, the package is not installed since a newer version of the module has been manually compiled & installed in the site_perl directory. ``` -------------------------------- ### Perform separate unpacking and configuration Source: https://www.debian.org/doc/manuals/debian-handbook/sect.manipulating-packages-with-dpkg.en.html Split the installation process into two distinct steps using --unpack and --configure. ```bash # **dpkg --unpack man-db_2.9.4-2_amd64.deb** (Reading database ... 227466 files and directories currently installed.) Preparing to unpack man-db_2.9.4-2_amd64.deb ... Unpacking man-db (2.9.4-2) over (2.9.4-2) ... Processing triggers for mailcap (3.69) ... # **dpkg --configure man-db** Setting up man-db (2.9.4-2) ... Updating database of manual pages ... man-db.service is a disabled or a static unit not running, not starting it. ``` -------------------------------- ### Apache Access Log Entry Source: https://www.debian.org/doc/manuals/debian-handbook/sect.dealing-with-compromised-machine.en.html An example of an Apache access log entry showing a GET request exploiting a phpBB vulnerability. ```text www.falcot.com 200.58.141.84 - - [27/Nov/2004:13:33:34 +0100] "GET /phpbb/viewtopic.php?t=10&highlight=%2527%252esystem(chr(99)%252echr(100)%252echr(32)%252echr(47)%252echr(116)%252echr(109)%252echr(112)%252echr(59)%252echr(32)%252echr(119)%252echr(103)%252echr(101)%252echr(116)%252echr(32)%252echr(103)%252echr(97)%252echr(98)%252echr(114)%252echr(121)%252echr(107)%252echr(46)%252echr(97)%252echr(108)%252echr(116)%252echr(101)%252echr(114)%252echr(118)%252echr(105)%252echr(115)%252echr(116)%252echr(97)%252echr(46)%252echr(111)%252echr(114)%252echr(103)%252echr(47)%252echr(98)%252echr(100)%252echr(32)%252echr(124)%252echr(124)%252echr(32)%252echr(99)%252echr(117)%252echr(114)%252echr(108)%252echr(32)%252echr(103)%252echr(97)%252echr(98)%252echr(114)%252echr(121)%252echr(107)%252echr(46)%252echr(97)%252echr(108)%252echr(116)%252echr(101)%252echr(114)%252echr(118)%252echr(105)%252echr(115)%252echr(116)%252echr(97)%252echr(46)%252echr(111)%252echr(114)%252echr(103)%252echr(47)%252echr(98)%252echr(100)%252echr(32)%252echr(45)%252echr(111)%252echr(32)%252echr(98)%252echr(100)%252echr(59)%252echr(32)%252echr(99)%252echr(104)%252echr(109)%252echr(111)%252echr(100)%252echr(32)%252echr(43)%252echr(120)%252echr(32)%252echr(98)%252echr(100)%252echr(59)%252echr(32)%252echr(46)%252echr(47)%252echr(98)%252echr(100)%252echr(32)%252echr(38))%252e%2527 HTTP/1.1" 200 27969 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" ``` -------------------------------- ### Initialize Kamailio database and add users Source: https://www.debian.org/doc/manuals/debian-handbook/sect.rtc-services.en.html Create the database structure and add a new SIP user via command line. ```bash # **kamdbctl create **[...] # **kamctl add _roland_ _secret_password_** ``` -------------------------------- ### Install specific package version Source: https://www.debian.org/doc/manuals/debian-handbook/sect.apt-get.en.html Installs a package from a specific distribution. ```bash # **apt install spamassassin/unstable** ``` -------------------------------- ### Initialize Easy-RSA Directory Source: https://www.debian.org/doc/manuals/debian-handbook/sect.x509-cert.en.html Create a new directory for the PKI infrastructure using make-cadir. ```bash $ make-cadir pki-falcot $ cd pki-falcot ``` -------------------------------- ### Install packages from backports Source: https://www.debian.org/doc/manuals/debian-handbook/apt.en.html Commands to explicitly install a package from the bullseye-backports repository. ```bash $ sudo apt-get install _package_/bullseye-backports $ sudo apt-get install -t bullseye-backports _package_ ``` -------------------------------- ### Example configuration for /etc/inetd.conf Source: https://www.debian.org/doc/manuals/debian-handbook/sect.inetd.en.html This snippet demonstrates how to define services like talkd, nullidentd, and fingerd within the inetd configuration file. ```text #:BSD: Shell, login, exec and talk are BSD protocols. talk dgram udp wait nobody.tty /usr/sbin/in.talkd in.talkd ntalk dgram udp wait nobody.tty /usr/sbin/in.ntalkd in.ntalkd #:INFO: Info services ident stream tcp nowait nobody /usr/sbin/nullidentd nullidentd finger stream tcp nowait nobody /usr/sbin/tcpd /usr/sbin/in.fingerd ``` -------------------------------- ### Initialize SELinux Policy Templates Source: https://www.debian.org/doc/manuals/debian-handbook/sect.selinux.en.html Copy the standard SELinux policy template files to the current directory to begin development. ```bash $ cp /usr/share/doc/selinux-policy-doc/Makefile.example Makefile $ cp /usr/share/doc/selinux-policy-doc/example.fc ./ $ cp /usr/share/doc/selinux-policy-doc/example.if ./ $ cp /usr/share/doc/selinux-policy-doc/example.te ./ ``` -------------------------------- ### Install GRUB to MBR Source: https://www.debian.org/doc/manuals/debian-handbook/sect.config-bootloader.en.html Installs the GRUB bootloader to the Master Boot Record of the specified disk. ```bash grub-install /dev/sda ``` -------------------------------- ### Export Installed Package List Source: https://www.debian.org/doc/manuals/debian-handbook/sect.apt-get.en.html Retrieves the list of currently installed packages to a file for replication on other systems. ```bash $ **dpkg --get-selections >pkg-list** ``` -------------------------------- ### Install and Verify DKMS Modules Source: https://www.debian.org/doc/manuals/debian-handbook/sect.kernel-compilation.en.html Commands to install a DKMS-enabled module package, check its status, and inspect module information. ```bash $ **sudo apt install dahdi-dkms** [...] Setting up dkms (2.8.4-3) ... Setting up linux-headers-5.10.0-8-amd64 (5.10.46-4) ... /etc/kernel/header_postinst.d/dkms: dkms: running auto installation service for kernel 5.10.0-8-amd64:. Setting up dahdi-dkms (1:2.11.1.0.20170917~dfsg-7.4) ... Loading new dahdi-2.11.1.0.20170917~dfsg-7.4 DKMS files... Building for 5.10.0-8-amd64 Building initial module for 5.10.0-8-amd64 Done. dahdi_dummy.ko: Running module version sanity check. - Original module - No original module exists within this kernel - Installation - Installing to /lib/modules/5.10.0-8-amd64/updates/dkms/ dahdi_dynamic_eth.ko: Running module version sanity check. - Original module - No original module exists within this kernel - Installation - Installing to /lib/modules/5.10.0-8-amd64/updates/dkms/ [...] DKMS: install completed. $ **sudo dkms status** dahdi, 2.11.1.0.20170917~dfsg-7.4, 5.10.0-8-amd64, x86_64: installed $ **sudo modinfo dahdi_dummy** filename: /lib/modules/5.10.0-8-amd64/updates/dkms/dahdi_dummy.ko license: GPL v2 author: Robert Pleh description: Timing-Only Driver depends: dahdi retpoline: Y name: dahdi_dummy vermagic: 5.10.0-8-amd64 SMP mod_unload modversions parm: debug:int ``` -------------------------------- ### Manage Files and Directories Source: https://www.debian.org/doc/manuals/debian-handbook/short-remedial-course.en.html Shows how to create, rename, and remove directories and files using mkdir, mv, and rmdir. ```bash $ **mkdir test **$ **ls **Desktop Downloads Pictures Templates Videos Documents Music Public test $ **mv test new **$ **ls **Desktop Downloads new Public Videos Documents Music Pictures Templates $ **rmdir new **$ **ls **Desktop Downloads Pictures Templates Videos Documents Music Public ``` -------------------------------- ### Install and remove packages simultaneously Source: https://www.debian.org/doc/manuals/debian-handbook/sect.apt-get.en.html Modifies package states by appending suffixes to package names during install or remove commands. ```bash # **apt install _package1_ _package2_-** ``` ```bash # **apt remove _package1_+ _package2_** ``` -------------------------------- ### Initialize PKI Directory Source: https://www.debian.org/doc/manuals/debian-handbook/sect.x509-cert.en.html Prepare the PKI directory structure after configuring variables. ```bash $ ./easyrsa init-pki ``` -------------------------------- ### Install Wine and Microsoft Core Fonts Source: https://www.debian.org/doc/manuals/debian-handbook/sect.windows-emulation.en.html Installs the Wine emulation layer and the Microsoft core fonts package from the contrib repository. ```bash # apt install wine ttf-mscorefonts-installer ``` -------------------------------- ### Browse Directory Tree and List Files Source: https://www.debian.org/doc/manuals/debian-handbook/short-remedial-course.en.html Demonstrates basic navigation using pwd, cd, and ls commands to explore the filesystem. ```bash $ **pwd **/home/rhertzog $ **cd Desktop **$ **pwd **/home/rhertzog/Desktop $ **cd . **$ **pwd **/home/rhertzog/Desktop $ **cd ..** $ **pwd **/home/rhertzog $ **ls **Desktop Downloads Pictures Templates Documents Music Public Videos ``` -------------------------------- ### Configure static IPv6 address Source: https://www.debian.org/doc/manuals/debian-handbook/sect.ipv6.en.html Example configuration for a static IPv6 address in /etc/network/interfaces. ```text iface enp7s0 inet6 static address 2001:db8:1234:5::1:1/64 # Disabling auto-configuration # autoconf 0 # The router is auto-configured and has no fixed address # (accept_ra 1). If it had: # gateway 2001:db8:1234:5::1 ``` -------------------------------- ### Download and extract a Debian source package Source: https://www.debian.org/doc/manuals/debian-handbook/debian-packaging.en.html Example output showing the process of downloading and extracting the samba source package using apt. ```bash $ **apt source samba **Reading package lists... Done NOTICE: 'samba' packaging is maintained in the 'Git' version control system at: https://salsa.debian.org/samba-team/samba.git Please use: git clone https://salsa.debian.org/samba-team/samba.git to retrieve the latest (possibly unreleased) updates to the package. Need to get 12.3 MB of source archives. Get:1 http://security.debian.org/debian-security bullseye-security/main samba 2:4.13.13+dfsg-1~deb11u3 (dsc) [4,514 B] Get:2 http://security.debian.org/debian-security bullseye-security/main samba 2:4.13.13+dfsg-1~deb11u3 (tar) [11.8 MB] Get:3 http://security.debian.org/debian-security bullseye-security/main samba 2:4.13.13+dfsg-1~deb11u3 (diff) [468 kB] Fetched 12.3 MB in 3s (4,582 kB/s) dpkg-source: info: extracting samba in samba-4.13.13+dfsg dpkg-source: info: unpacking samba_4.13.13+dfsg.orig.tar.xz dpkg-source: info: unpacking samba_4.13.13+dfsg-1~deb11u3.debian.tar.xz dpkg-source: info: using patch list from debian/patches/series dpkg-source: info: applying 07_private_lib dpkg-source: info: applying bug_221618_precise-64bit-prototype.patch dpkg-source: info: applying [...] ``` -------------------------------- ### Configure Samba via debconf Source: https://www.debian.org/doc/manuals/debian-handbook/sect.windows-file-server-with-samba.en.html Use the debconf tool to adapt the Samba configuration after installation. ```bash dpkg-reconfigure samba-common ``` -------------------------------- ### Configure Dirvish default settings Source: https://www.debian.org/doc/manuals/debian-handbook/sect.backup.en.html Example configuration file for defining client, tree, and exclusion rules for Dirvish backups. ```text client: rivendell.falcot.com tree: / xdev: 1 index: gzip image-default: %Y%m%d exclude: /var/cache/apt/archives/*.deb /var/cache/man/** /tmp/** /var/tmp/** *.bak ``` -------------------------------- ### Format and Mount Logical Volumes Source: https://www.debian.org/doc/manuals/debian-handbook/advanced-administration.en.html Initialize a filesystem on a logical volume, mount it to a directory, and configure it in fstab for persistence. ```bash # mkfs.ext4 /dev/vg_normal/lv_backups mke2fs 1.46.2 (28-Feb-2021) Discarding device blocks: done Creating filesystem with 3140608 4k blocks and 786432 inodes Filesystem UUID: 7eaf0340-b740-421e-96b2-942cdbf29cb3 Superblock backups stored on blocks: 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208 Allocating group tables: done Writing inode tables: done Creating journal (16384 blocks): done Writing superblocks and filesystem accounting information: done # mkdir /srv/backups # mount /dev/vg_normal/lv_backups /srv/backups # df -h /srv/backups Filesystem Size Used Avail Use% Mounted on /dev/mapper/vg_normal-lv_backups 12G 24K 12G 1% /srv/backups # [...] [...] # cat /etc/fstab [...] /dev/vg_critical/lv_base /srv/base ext4 defaults 0 2 /dev/vg_critical/lv_files /srv/files ext4 defaults 0 2 /dev/vg_normal/lv_backups /srv/backups ext4 defaults 0 2 ``` -------------------------------- ### List installed packages with dpkg Source: https://www.debian.org/doc/manuals/debian-handbook/sect.manipulating-packages-with-dpkg.en.html Use the -l option to list packages matching a specific pattern. ```bash dpkg -l 'b*' ``` -------------------------------- ### Identify X.org driver loading in logs Source: https://www.debian.org/doc/manuals/debian-handbook/workstation.en.html Example output from an X.org log file showing the driver loading process for the Intel driver. ```text (==) Matched nouveau as autoconfigured driver 0 (==) Matched modesetting as autoconfigured driver 1 (==) Matched fbdev as autoconfigured driver 2 (==) Matched vesa as autoconfigured driver 3 (==) Assigned the driver to the xf86ConfigLayout (II) LoadModule: "intel" (II) Loading /usr/lib/xorg/modules/drivers/intel_drv.so (II) Module intel: vendor="X.Org Foundation" ``` -------------------------------- ### Define APT source entry format Source: https://www.debian.org/doc/manuals/debian-handbook/apt.en.html Standard syntax for declaring binary and source package repositories in /etc/apt/sources.list. ```text deb url distribution component1 component2 component3 [..] componentX deb-src url distribution component1 component2 component3 [..] componentX ``` -------------------------------- ### Kernel Certificate Configuration Source: https://www.debian.org/doc/manuals/debian-handbook/sect.kernel-compilation.en.html Example of the kernel configuration settings related to signature checking and trusted keys. ```text [..] # # Certificates for signature checking # CONFIG_MODULE_SIG_KEY="" CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYS="debian/certs/debian-uefi-certs.pem" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set CONFIG_SECONDARY_TRUSTED_KEYRING=y CONFIG_SYSTEM_BLACKLIST_KEYRING=y CONFIG_SYSTEM_BLACKLIST_HASH_LIST="" # end of Certificates for signature checking [..] ``` -------------------------------- ### Perform nmap scans Source: https://www.debian.org/doc/manuals/debian-handbook/sect.network-diagnosis-tools.en.html Examples of scanning a remote host and performing a detailed service scan on localhost. ```bash # **nmap debian** Starting Nmap 7.80 ( https://nmap.org ) at 2022-02-22 20:58 CET Nmap scan report for debian (192.168.122.57) Host is up (0.000087s latency). Not shown: 996 closed ports PORT STATE SERVICE 22/tcp open ssh 79/tcp open finger 80/tcp open http 113/tcp open ident Nmap done: 1 IP address (1 host up) scanned in 0.07 seconds ``` ```bash # **nmap -A localhost** nmap -A localhost Starting Nmap 7.80 ( https://nmap.org ) at 2022-02-22 20:56 CET Stats: 0:01:16 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan Service scan Timing: About 83.33% done; ETC: 20:57 (0:00:15 remaining) Nmap scan report for localhost (127.0.0.1) Host is up (0.000086s latency). Other addresses for localhost (not scanned): ::1 Not shown: 994 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5 (protocol 2.0) |_auth-owners: foobar 25/tcp open smtp Postfix smtpd |_auth-owners: foobar |_smtp-commands: debian, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING, | ssl-cert: Subject: commonName=debian | Subject Alternative Name: DNS:debian | Not valid before: 2022-02-22T14:48:42 |_Not valid after: 2032-02-20T14:48:42 |_ssl-date: TLS randomness does not represent time 79/tcp open finger? |_auth-owners: foobar |_finger: ERROR: Script execution failed (use -d to debug) 80/tcp open http Apache httpd 2.4.52 ((Debian)) |_auth-owners: foobar |_http-server-header: Apache/2.4.52 (Debian) |_http-title: Apache2 Debian Default Page: It works 113/tcp open ident Liedentd (Claimed user: foobar) |_auth-owners: foobar 631/tcp open ipp CUPS 2.3 |_auth-owners: foobar | http-robots.txt: 1 disallowed entry |_/ |_http-server-header: CUPS/2.3 IPP/2.1 |_http-title: Home - CUPS 2.3.3op2 Service Info: Host: debian; OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 87.91 seconds ``` -------------------------------- ### Configure git-buildpackage with ~/.gbp.conf Source: https://www.debian.org/doc/manuals/debian-handbook/sect.becoming-package-maintainer.en.html Configuration file for gbp to automate builds using sbuild and run autopkgtest post-build. ```ini [DEFAULT] builder = sbuild -d bullseye --build-dep-resolver=aptitude -s --source-only-changes --build-failed-commands "%SBUILD_SHELL" pristine-tar = true [buildpackage] sign-tags = true keyid = XXXX postbuild = autopkgtest --user debci --apt-upgrade -s "$GBP_CHANGES_FILE" -- lxc --sudo autopkgtest-bullseye-amd64 export-dir = /tmp/build-area/ notify = off [import-orig] filter-pristine-tar = true sign-tags = true [pq] drop = true ``` -------------------------------- ### Define SMTP Relay Credentials Source: https://www.debian.org/doc/manuals/debian-handbook/network-services.en.html Example content for the /etc/postfix/sasl_passwd file containing relay server credentials. ```text [mail.falcot.com] joe:LyinIsji ```