Links

APT
Stalwart email server
Crowdsec
Nextcloud

Updates

sudo apt update   # update available packages list
sudo apt upgrade  # update installed packages

sudo apt autoremove  # removes unused automatically installed dependency packages

System info

uname -a
# kernel 6.18.15-current-rockchip64
# hostname odroidm1s

cat /etc/os-release
# Debian 13.3
# Armbian 26.2.0-trunk.524

System changes

# change the hostname
sudo hostnamectl set-hostname [new-name]

zsh / oh-my-zsh

sudo apt install zsh git

sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"

~/.zshrc

# prefix prompt with hostname
PROMPT="%m $PROMPT"

# add /sbin into PATH (for reboot command)
export PATH=$PATH:/sbin

SSH

/etc/ssh/sshd_config

PermitRootLogin no                 # disallow connection with root user
MaxAuthTries 3                     # max number of authentication attempts per SSH connection
MaxSessions 2                      # max simultaneous sessions per connection
LoginGraceTime 20                  # seconds to complete login before disconnect

PasswordAuthentication no          # disable SSH password authentication, only after setting up SSH keys!

AllowUsers user1@192.168.0.x       # only user1 from 192.168.0.x is allowed

X11Forwarding no                   # not needed

sudo visudo

/etc/sudoers

# allow the user1 to use sudo without to enter the password
# put this line at the very end of the file
user1 ALL=(ALL) NOPASSWD: ALL

SSHFS

user1 must have the right to use sudo without to enter the password at least for /usr/lib/openssh/sftp-server

# from the client, connect as user1, with sudo sftp-server have read/write access to all the files
sshfs user1@host1:/ /media/host1 -o sftp_server="sudo /usr/lib/openssh/sftp-server"

Docker

# install
curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh
systemctl enable --now docker

# install docker compose
sudo apt install docker-compose-plugin

Automatic Security Updates

sudo apt install unattended-upgrades

sudo dpkg-reconfigure unattended-upgrades
# Choose "Yes" to enable automatic security updates

ufw

# port 22
sudo ufw allow ssh
# port 53
sudo ufw allow dns
# port 80 + 443
sudo ufw allow 'www full'
# igmp
sudo ufw allow from 192.168.0.0/24 to 224.0.0.0/24 proto igmp

sudo apt install ufw
# starts the UFW service on boot
sc-enable ufw
# activates the firewall rules (persists across reboots)
sudo ufw enable

Fail2ban

sudo apt install fail2ban
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

/etc/fail2ban/jail.local

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1
bantime  = 1h       # How long to ban
findtime = 10m      # Window to count failures
maxretry = 5        # Failures before ban

[sshd]
enabled = true
port    = ssh

Let's encrypt

certbot-dns-ovh is not available in the debian repo. Use pipx to install it.

sudo apt install pipx

# switch to root
sudo -i

# install certbot in /root/.local/share/pipx/venvs and create a symlink in /root/.local/bin
pipx install certbot

# Install certbot-dns-ovh in the already existing certbot venv
pipx inject certbot certbot-dns-ovh

# create a symlink available from sudo
sudo ln -s /root/.local/bin/certbot /usr/local/bin/certbot

OVH

create a token with the rights GET, PUT, POST, DELETE on /domain/zone/*

/root/.secrets/certbot/ovh.ini

dns_ovh_endpoint = ovh-eu
dns_ovh_application_key = TON_APP_KEY
dns_ovh_application_secret = TON_APP_SECRET
dns_ovh_consumer_key = TON_CONSUMER_KEY

chmod 600 /root/.secrets/certbot/ovh.ini

# generate the certificate
certbot certonly \
  --dns-ovh \
  --dns-ovh-credentials /root/.secrets/certbot/ovh.ini \
  -d "*.bananeatomic.fr" \
  -d "bananeatomic.fr"

# dry-renew the certificate
certbot renew --dry-run

Timer

/etc/systemd/system/certbot.service

[Unit]
Description=Certbot renewal

[Service]
Type=oneshot
ExecStart=/usr/local/bin/certbot renew --quiet

/etc/systemd/system/certbot.timer

[Unit]
Description=Twice daily certbot renewal

[Timer]
OnCalendar=*-*-* 00,12:00:00
; spreads the renewal randomly over 12 hours after triggering
; to prevent all the servers in the world from hitting the Let's Encrypt servers at the same time at midnight sharp
RandomizedDelaySec=43200
Persistent=true

[Install]
WantedBy=timers.target

systemctl daemon-reload
systemctl enable --now certbot.timer

systemctl status certbot.timer

Hook nginx

When certbot renews the certificate, nginx must be reloaded to take effect.

/etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh

#!/bin/bash

systemctl reload nginx

chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh

Dynamic IP and OVH

create OVH login and password for DynHost link

apt install ddclient

/etc/ddclient.conf

protocol=dyndns2 \
use=web, web=dyndns \
server=www.ovh.com \
login=LOGIN \
password='PWD' \
bananeatomic.fr