Subject: François Marier: Usual Debian Server Setup

Date: Sat, 23 May 2015 14:58:42 +0200

<!DOCTYPE html>
<html xmlns=3D3D"http://www.w3.org/1999/xhtml">
<head>

<meta charset=3D3D"utf-8" />
<title>Usual Debian Server Setup</title>
<meta name=3D3D"viewport" content=3D3D"width=3D3Ddevice-width, initial-scal=
e=3D3D1"=3D
 />

<link rel=3D3D"icon" href=3D3D"../../favicon.ico" type=3D3D"image/x-icon" />

<link rel=3D3D"stylesheet" href=3D3D"../../style.css" type=3D3D"text/css" />

<link rel=3D3D"stylesheet" href=3D3D"../../local.css" type=3D3D"text/css" />

<link rel=3D3D"alternate" type=3D3D"application/x-wiki" title=3D3D"Edit thi=
s page=3D
" href=3D3D"/ikiwiki.cgi?do=3D3Dedit&amp;page=3D3Dposts%2Fusual-server-setu=
p" />

<link rel=3D3D"vcs-git" href=3D3D"ssh://[email-masked]=
ranc=3D
hable.com/" title=3D3D"wiki git repository" />
<link rel=3D3D"vcs-git" href=3D3D"git://feedingthecloud.branchable.com/" ti=
tle=3D
=3D3D"wiki git repository" />
<link rel=3D3D"license" href=3D3D"#pagelicense" />
<meta name=3D3D"date" content=3D3D"2015-05-23T22:00:00.000+13:00" />

</head>
<body><script src=3D3D"../../ikiwiki/ikiwiki.js" type=3D3D"text/javascript"=
 cha=3D
rset=3D3D"utf-8"></script>
<script src=3D3D"../../ikiwiki/relativedate.js" type=3D3D"text/javascript" =
char=3D
set=3D3D"utf-8"></script><script src=3D3D"../../ikiwiki/ikiwiki.js" type=3D=
3D"tex=3D
t/javascript" charset=3D3D"utf-8"></script>
<script src=3D3D"../../ikiwiki/toggle.js" type=3D3D"text/javascript" charse=
t=3D3D=3D
"utf-8"></script>

<article class=3D3D"page">

<section class=3D3D"pageheader">
<header class=3D3D"header">
<span>
<span class=3D3D"parentlinks">

<a href=3D3D"../../">Feeding the Cloud</a>/=3D20

<a href=3D3D"../">posts</a>/=3D20

</span>
<span class=3D3D"title">
Usual Debian Server Setup

</span>
</span>

<form method=3D3D"get" action=3D3D"https://www.google.com/search" id=3D3D"s=
earchf=3D
orm">
 <div>
  <input name=3D3D"sitesearch" value=3D3D"http://feeding.cloud.geek.nz" typ=
e=3D3D=3D
"hidden" />
  <input name=3D3D"q" value=3D3D"" id=3D3D"searchbox" size=3D3D"16" maxleng=
th=3D3D"25=3D
5" type=3D3D"text"
    placeholder=3D3D"search" />
 </div>
</form>

</header>

<nav class=3D3D"actions">
<ul>

<li><a href=3D3D"/ikiwiki.cgi?do=3D3Dedit&amp;page=3D3Dposts%2Fusual-server=
-setup=3D
" rel=3D3D"nofollow">Edit</a></li>

<li><a href=3D3D"/ikiwiki.cgi?do=3D3Dprefs">Preferences</a></li>

<li><a href=3D3D"/ikiwiki.cgi?do=3D3Dcomment&amp;page=3D3Dposts%2Fusual-ser=
ver-se=3D
tup">Comment</a></li>

</ul>
</nav>

</section>

<aside class=3D3D"sidebar">
<h1 id=3D3D"Subscribe_to_this_blog">Subscribe to this blog</h1>

<p><a href=3D3D"http://feeding.cloud.geek.nz/index.rss"><img src=3D3D"/feed=
-ico=3D
n.png" height=3D3D"32" width=3D3D"32" align=3D3D"left">Subscribe in a reade=
r</a>
<a href=3D3D"http://www.feedburner.com/fb/a/emailverifySubmit?feedId=3D3D18=
3985=3D
3&amp;loc=3D3Den_US">Subscribe by Email</a></p>

<p><br><a href=3D3D"http://flattr.com/thing/311291/Feeding-the-Cloud"><img =
sr=3D
c=3D3D"/flattr_button.png" border=3D3D"0" alt=3D3D"Flattr" width=3D3D"93" h=
eight=3D3D=3D
"20"></a> <a href=3D3D"https://www.gittip.com/fmarier/"><img src=3D3D"/gitt=
ip_b=3D
utton.png" border=3D3D"0" alt=3D3D"Gittip" width=3D3D"52" height=3D3D"22"><=
/a></p>

<h1 id=3D3D"About_me">About me</h1>

<p><a href=3D3D"http://fmarier.org"><img src=3D3D"/avatar.jpg" width=3D3D"8=
0" hei=3D
ght=3D3D"80"></p>

<p><strong>Fran=3DC3=3D83=3DC2=3DA7ois Marier</strong></a>
<br><a href=3D3D"mailto:[email-masked]">[email-masked]</a>
<br>Free and Open Source software developer
<br>
<br><a href=3D3D"https://twitter.com/fmarier">Twitter</a> / <a href=3D3D"ht=
tp:/=3D
/identi.ca/fmarier">Identica</a>
<br><a href=3D3D"http://linkedin.com/in/fmarier">Linked In</a></p>

<h1 id=3D3D"More_from_this_blog">More from this blog</h1>

<p><a href=3D3D"../../archives/">Archives</a></p>

<p><a href=3D3D"../../comments/">Recent Comments</a></p>

<p><a href=3D3D"../../tags/">Tags</a>:</p>

<div class=3D3D'pagecloud'>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/android/">android</a><=
/spa=3D
n>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/apache/">apache</a></s=
pan>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/backup/">backup</a></s=
pan>
<span class=3D3D"smallPC"><a href=3D3D"../../tags/browserid/">browserid</a>=
</sp=3D
an>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/conference/">conferenc=
e</a=3D
></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/csp/">csp</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/database/">database</a=
></s=3D
pan>
<span class=3D3D"smallPC"><a href=3D3D"../../tags/django/">django</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/dns/">dns</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/dnssec/">dnssec</a></s=
pan>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/emacs/">emacs</a></spa=
n>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/fetchmail/">fetchmail<=
/a><=3D
/span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/firebug/">firebug</a><=
/spa=3D
n>
<span class=3D3D"normalPC"><a href=3D3D"../../tags/firefox/">firefox</a></s=
pan>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/gaia/">gaia</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/gaming/">gaming</a></s=
pan>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/gargoyle/">gargoyle</a=
></s=3D
pan>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/gearman/">gearman</a><=
/spa=3D
n>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/gecko/">gecko</a></spa=
n>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/gerrit/">gerrit</a></s=
pan>
<span class=3D3D"biggestPC"><a href=3D3D"../../tags/git/">git</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/github/">github</a></s=
pan>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/gnome/">gnome</a></spa=
n>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/gstreamer/">gstreamer<=
/a><=3D
/span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/hsts/">hsts</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/html5/">html5</a></spa=
n>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/http/">http</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/i3/">i3</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/indieweb/">indieweb</a=
></s=3D
pan>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/irc/">irc</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/irssi/">irssi</a></spa=
n>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/launchpad/">launchpad<=
/a><=3D
/span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/lenovo/">lenovo</a></s=
pan>
<span class=3D3D"normalPC"><a href=3D3D"../../tags/libravatar/">libravatar<=
/a><=3D
/span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/lxc/">lxc</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/mercurial/">mercurial<=
/a><=3D
/span>
<span class=3D3D"smallPC"><a href=3D3D"../../tags/mutt/">mutt</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/nginx/">nginx</a></spa=
n>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/nodejs/">nodejs</a></s=
pan>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/openvpn/">openvpn</a><=
/spa=3D
n>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/openwrt/">openwrt</a><=
/spa=3D
n>
<span class=3D3D"normalPC"><a href=3D3D"../../tags/optimisation/">optimisat=
ion<=3D
/a></span>
<span class=3D3D"smallPC"><a href=3D3D"../../tags/owasp/">owasp</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/packaging/">packaging<=
/a><=3D
/span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/plupload/">plupload</a=
></s=3D
pan>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/postfix/">postfix</a><=
/spa=3D
n>
<span class=3D3D"smallPC"><a href=3D3D"../../tags/postgres/">postgres</a></=
span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/privacy/">privacy</a><=
/spa=3D
n>
<span class=3D3D"smallPC"><a href=3D3D"../../tags/privoxy/">privoxy</a></sp=
an>
<span class=3D3D"smallPC"><a href=3D3D"../../tags/programming/">programming=
</a>=3D
</span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/publicspeaking/">publi=
cspe=3D
aking</a></span>
<span class=3D3D"smallPC"><a href=3D3D"../../tags/python/">python</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/rackspace/">rackspace<=
/a><=3D
/span>
<span class=3D3D"smallPC"><a href=3D3D"../../tags/raid/">raid</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/rt/">rt</a></span>
<span class=3D3D"biggestPC"><a href=3D3D"../../tags/security/">security</a>=
</sp=3D
an>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/ssh/">ssh</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/ssl/">ssl</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/thinkpad/">thinkpad</a=
></s=3D
pan>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/tor/">tor</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/vnc/">vnc</a></span>
<span class=3D3D"biggestPC"><a href=3D3D"../../tags/web/">web</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/wine/">wine</a></span>
<span class=3D3D"smallestPC"><a href=3D3D"../../tags/xmpp/">xmpp</a></span>
</div>

</aside>

<div id=3D3D"pagebody">

<section id=3D3D"content" role=3D3D"main">
<p>I manage a few servers for myself, <a href=3D3D"https://speakerdeck.com/=
fm=3D
arier/supporting-debian-machines-for-friends-and-family-1">friends and
family</a>
as well as for the <a href=3D3D"https://www.libravatar.org">Libravatar</a> =
pr=3D
oject. Here is
how I customize recent releases of Debian on those servers.</p>

<h1 id=3D3D"Hardware_tests">Hardware tests</h1>

<pre><code>apt-get install memtest86+ smartmontools e2fsprogs
</code></pre>

<p>Prior to spending any time configuring a new physical server, I like to
ensure that the hardware is fine.</p>

<p>To check memory, I boot into memtest86+ from the grub menu and let it run
overnight.</p>

<p>Then I check the hard drives using:</p>

<pre><code>smartctl -t long /dev/sdX
badblocks -swo badblocks.out /dev/sdX
</code></pre>

<h1 id=3D3D"Configuration">Configuration</h1>

<pre><code>apt-get install etckeepr git sudo vim
</code></pre>

<p>To keep track of the configuration changes I make in <code>/etc/</code>,=
=3D
 I use etckeeper
to keep that directory in a git repository and make the following changes to
the default <code>/etc/etckeeper/etckeeper.conf</code>:</p>

<ul>
<li>turn off daily auto-commits</li>
<li>turn off auto-commits before package installs</li>
</ul>

<p>To get more control over the various packages I install, I change the
default debconf level to medium:</p>

<pre><code>dpkg-reconfigure debconf
</code></pre>

<p>Since I use vim for all of my configuration file editing, I make it the
default editor:</p>

<pre><code>update-alternatives --config editor
</code></pre>

<h1 id=3D3D"ssh">ssh</h1>

<pre><code>apt-get install openssh-server mosh fail2ban
</code></pre>

<p>Since most of my servers are set to UTC time, I like to <a href=3D3D"htt=
p:=3D
//petereisentraut.blogspot.com/2012/04/setting-time-zone-on-remote-ssh-host=
=3D
s.html">use my local
timezone</a>
when sshing into them. Looking at file timestamps is much less
confusing that way.</p>

<p>I also ensure that the locale I use is available on the server by adding=
=3D
 it
the list of generated locales:</p>

<pre><code>dpkg-reconfigure locales
</code></pre>

<p>Other than that, I <a href=3D3D"http://feeding.cloud.geek.nz/posts/harde=
ni=3D
ng-ssh-servers/">harden the ssh configuration</a>
and end up with the following settings in <code>/etc/ssh/sshd_config</code>=
=3D
 (jessie):</p>

<pre><code>HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key

KexAlgorithms [email-masked],ecdh-sha2-nistp521,ecdh-sha2-nis=
=3D
tp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers [email-masked],aes256-ctr,aes192-ctr,aes128-ctr
MACs [email-masked],[email-masked],umac-128-e=
=3D
[email-masked],hmac-sha2-512,hmac-sha2-256,[email-masked]

UsePrivilegeSeparation sandbox

AuthenticationMethods publickey
PasswordAuthentication no
PermitRootLogin no

AcceptEnv LANG LC_* TZ
LogLevel VERBOSE
AllowGroups sshuser
</code></pre>

<p>or the following for wheezy servers:</p>

<pre><code>HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
KexAlgorithms ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diff=
=3D
ie-hellman-group-exchange-sha256
Ciphers aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512,hmac-sha2-256
</code></pre>

<p>On those servers where I need <a href=3D3D"https://github.com/paramiko/p=
ar=3D
amiko/issues/509">duplicity/paramiko to
work</a>, I also add the following:</p>

<pre><code>KexAlgorithms ...,diffie-hellman-group-exchange-sha1
MACs ...,hmac-sha1
</code></pre>

<p>Then I remove the "Accepted" filter in <code>/etc/logcheck/ignore.d.serv=
=3D
er/ssh</code>
(first line) to get a notification whenever anybody successfully logs into
my server.</p>

<p>I also create a new group and add the users that need ssh access to it:<=
=3D
/p>

<pre><code>addgroup sshuser
adduser francois sshuser
</code></pre>

<p>and add a timeout for root sessions by putting this in <code>/root/.bash=
=3D
_profile</code>:</p>

<pre><code>TMOUT=3D3D600
</code></pre>

<h1 id=3D3D"Security_checks">Security checks</h1>

<pre><code>apt-get install logcheck logcheck-database fcheck tiger debsums
apt-get remove john john-data rpcbind tripwire
</code></pre>

<p>Logcheck is the main tool I use to keep an eye on log files, which is wh=
=3D
y I
add a few additional log files to the default list in
<code>/etc/logcheck/logcheck.logfiles</code>:</p>

<pre><code>/var/log/apache2/error.log
/var/log/mail.err
/var/log/mail.warn
/var/log/mail.info
/var/log/fail2ban.log
</code></pre>

<p>while ensuring that the apache logfiles are readable by logcheck:</p>

<pre><code>chmod a+rx /var/log/apache2
chmod a+r /var/log/apache2/*
</code></pre>

<p>and fixing the log rotation configuration by adding the following to
<code>/etc/logrotate.d/apache2</code>:</p>

<pre><code>create 644 root adm
</code></pre>

<p>I also modify the main logcheck configuration file
(<code>/etc/logcheck/logcheck.conf</code>):</p>

<pre><code>INTRO=3D3D0
FQDN=3D3D0
</code></pre>

<p>Other than that, I enable daily checks in <code>/etc/default/debsums</co=
=3D
de> and
customize a few tiger settings in <code>/etc/tiger/tigerrc</code>:</p>

<pre><code>Tiger_Check_RUNPROC=3D3DY
Tiger_Check_DELETED=3D3DY
Tiger_Check_APACHE=3D3DY
Tiger_FSScan_WDIR=3D3DY
Tiger_SSH_Protocol=3D3D'2'
Tiger_Passwd_Hashes=3D3D'sha512'
Tiger_Running_Procs=3D3D'rsyslogd cron atd /usr/sbin/apache2 postgres'
Tiger_Listening_ValidProcs=3D3D'sshd|mosh-server|ntpd'
</code></pre>

<h1 id=3D3D"General_hardening">General hardening</h1>

<pre><code>apt-get install harden-clients harden-environment harden-servers=
=3D
 apparmor apparmor-profiles apparmor-profiles-extra
</code></pre>

<p>While the harden packages are configuration-free, AppArmor must be <a hr=
=3D
ef=3D3D"https://wiki.debian.org/AppArmor/HowToUse#Enable_AppArmor">manually=
 e=3D
nabled</a>:</p>

<pre><code>perl -pi -e 's,GRUB_CMDLINE_LINUX=3D3D"(.*)"$,GRUB_CMDLINE_LINUX=
=3D
=3D3D"$1 apparmor=3D3D1 security=3D3Dapparmor",' /etc/default/grub
update-grub
</code></pre>

<h1 id=3D3D"Entropy_and_timekeeping">Entropy and timekeeping</h1>

<pre><code>apt-get install haveged rng-tools ntp
</code></pre>

<p>To keep the system clock accurate and increase the amount of entropy
available to the server, I install the above packages and add the <code>tpm=
=3D
_rng</code>
module to <code>/etc/modules</code>.</p>

<h1 id=3D3D"Preventing_mistakes">Preventing mistakes</h1>

<pre><code>apt-get install molly-guard safe-rm sl
</code></pre>

<p>The above packages are all about catching mistakes (such as
<a href=3D3D"http://feeding.cloud.geek.nz/posts/preventing-accidental-delet=
io=3D
n-of/">accidental deletions</a>).
However, in order to extend the molly-guard protection to mosh sessions, on=
=3D
e needs to
manually <a href=3D3D"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D3D=
7053=3D
97">apply a patch</a>.</p>

<h1 id=3D3D"Package_updates">Package updates</h1>

<pre><code>apt-get install apticron unattended-upgrades deborphan debfoster=
=3D
 apt-listchanges update-notifier-common aptitude popularity-contest
</code></pre>

<p>These tools help me keep packages up to date and remove unnecessary or
obsolete packages from servers. On Rackspace servers, a small <a href=3D3D"=
ht=3D
tp://feeding.cloud.geek.nz/posts/using-unattended-upgrades-on-rackspace-deb=
=3D
ian-ubuntu-servers/">configuration
change</a>
is needed to automatically update the monitoring tools.</p>

<p>In addition to this, I use the <code>update-notifier-common</code> packa=
=3D
ge along with
the following cronjob in <code>/etc/cron.daily/reboot-required</code>:</p>

<pre><code>#!/bin/sh
cat /var/run/reboot-required 2&gt; /dev/null || true
</code></pre>

<p>to send me a notification whenever a kernel update requires a reboot to =
=3D
take
effect.</p>

<h1 id=3D3D"Handy_utilities">Handy utilities</h1>

<pre><code>apt-get install renameutils atool iotop sysstat lsof mtr-tiny
</code></pre>

<p>Most of these tools are configure-free, except for sysstat, which requir=
=3D
es
enabling data collection in <code>/etc/default/sysstat</code> to be useful.=
=3D
</p>

<h1 id=3D3D"Apache_configuration">Apache configuration</h1>

<pre><code>apt-get install apache2-mpm-event
</code></pre>

<p>While configuring apache is often specific to each server and the servic=
=3D
es
that will be running on it, there are a few common changes I make.</p>

<p>I enable these in <code>/etc/apache2/conf.d/security</code>:</p>

<pre><code>&lt;Directory /&gt;
    AllowOverride None
    Order Deny,Allow
    Deny from all
&lt;/Directory&gt;
ServerTokens Prod
ServerSignature Off
</code></pre>

<p>and remove cgi-bin directives from <code>/etc/apache2/sites-enabled/000-=
=3D
default</code>.</p>

<p>I also create a new <code>/etc/apache2/conf.d/servername</code> which co=
=3D
ntains:</p>

<pre><code>ServerName machine_hostname
</code></pre>

<h1 id=3D3D"Mail">Mail</h1>

<pre><code>apt-get install postfix
</code></pre>

<p>Configuring mail properly is tricky but the following has worked for me.=
=3D
</p>

<p>In <code>/etc/hostname</code>, put the bare hostname (no domain), but in
<code>/etc/mailname</code> put the fully qualified hostname.</p>

<p>Change the following in <code>/etc/postfix/main.cf</code>:</p>

<pre><code>inet_interfaces =3D3D loopback-only
myhostname =3D3D (fully qualified hostname)
smtp_tls_security_level =3D3D may
smtp_tls_protocols =3D3D !SSLv2, !SSLv3
</code></pre>

<p>Set the following aliases in <code>/etc/aliases</code>:</p>

<ul>
<li>set <code>francois</code> as the destination of <code>root</code> email=
=3D
s</li>
<li>set an external email address for <code>francois</code></li>
<li>set <code>root</code> as the destination for <code>www-data</code> emai=
=3D
ls</li>
</ul>

<p>before running <code>newaliases</code> to update the aliases database.</=
=3D
p>

<p>Create a new cronjob (<code>/etc/cron.hourly/checkmail</code>):</p>

<pre><code>#!/bin/sh
ls /var/mail
</code></pre>

<p>to ensure that email doesn't accumulate unmonitored on this box.</p>

<p>Finally, set reverse DNS for the server's IPv4 and IPv6 addresses and th=
=3D
en
test the whole setup using <code>mail root</code>.</p>

<h1 id=3D3D"Network_tuning">Network tuning</h1>

<p>To <a href=3D3D"https://lwn.net/Articles/616241/">reduce the server's co=
nt=3D
ribution to
bufferbloat</a> I change the default kernel
queueing discipline (jessie or later) by putting the following in <code>/et=
=3D
c/sysctl.conf</code>:</p>

<pre><code>net.core.default_qdisc=3D3Dfq_codel
</code></pre>

</section>

<section id=3D3D"comments" role=3D3D"complementary">

<div class=3D3D"addcomment">
<a href=3D3D"/ikiwiki.cgi?do=3D3Dcomment&amp;page=3D3Dposts%2Fusual-server-=
setup"=3D
>Add a comment</a>
</div>

</section>

</div>

<footer id=3D3D"footer" class=3D3D"pagefooter" role=3D3D"contentinfo">

<nav id=3D3D"pageinfo">

<nav class=3D3D"tags">
Tags:

<a href=3D3D"../../tags/debian/" rel=3D3D"tag">debian</a>

<a href=3D3D"../../tags/nzoss/" rel=3D3D"tag">nzoss</a>

<a href=3D3D"../../tags/sysadmin/" rel=3D3D"tag">sysadmin</a>

</nav>

<div class=3D3D"pagelicense">
<a name=3D3D"pagelicense"></a>
License: <a href=3D3D"http://creativecommons.org/licenses/by-sa/4.0/">Creat=
iv=3D
e Commons Attribution-ShareAlike 4.0 International License</a>
</div>

<div class=3D3D"pagedate">
Last edited <time datetime=3D3D"2015-05-23T10:52:40Z" class=3D3D"relativeda=
te" =3D
title=3D3D"Sat, 23 May 2015 22:52:40 +1200">Sat May 23 22:52:40 2015</time>
<!-- Created <time datetime=3D3D"2015-05-23T09:00:00Z" pubdate=3D3D"pubdate=
" cl=3D
ass=3D3D"relativedate" title=3D3D"Sat, 23 May 2015 21:00:00 +1200">Sat May =
23 2=3D
1:00:00 2015</time> -->
</div>

</nav>

<!-- from Feeding the Cloud -->
</footer>

</article>

</body>
</html>