Supporting Debian machines for friends and family

Many Debian developers find themselves providing some form of technical support to friends and family. Achieving the mystical five nines is well beyond the means of an amateur sysadmin like myself, but giving my dad reliable boxes to use can be achieved without eating all of my free time.

This talk will draw on my experience supporting and maintaining my dad's Debian-based computers. I will briefly describe the hardware setup, introduce some useful packages and share some configuration hints. Areas of focus will include system updates, reliability, monitoring and security.

http://nz2015.mini.debconf.org/Programme/Francois/

Transcript

1. François Marier @fmarier francois@debian.org Supporting Debian machines for friends and family Notes and tricks from an amateur sysadmin
2. “providing an enjoyable computing environment so that they can fully experience the benefits of Free Software...”
3. “... without using up all of our precious spare time”
4. hardware
5. package updates
6. monitoring
7. safety
8. security
9. remote access
10. backups
11. example [ ]
15. keflavik
18. akureyri
20. hardware [==== ]
23. memtest86+ badblocks -swo out /dev/sdX
24. package updates [========= ]
25. apticron unattended-upgrades
26. deborphan debfoster
27. debian-security-support
28. monitoring [============= ]
29. logcheck
30. smartmontools
31. smartmontools mcelog
32. smartmontools mcelog lm-sensors
33. $ sar -A Linux 2.6.32-23-generic 2010-07-08 _x86_64_ 00:00:01 CPU %usr %nice %sys %iowait %steal 00:05:01 0 44,23 1,07 4,20 9,74 0,00 00:15:01 0 40,83 0,18 1,85 0,61 0,00 00:25:01 0 39,14 0,18 2,26 0,68 0,00 00:35:02 0 46,30 4,86 9,16 11,44 0,00 00:45:01 0 43,13 2,19 7,26 6,30 0,00 00:55:01 0 36,73 0,22 2,12 0,75 0,00 01:05:01 0 24,21 9,15 19,56 5,90 0,00 01:15:02 0 1,17 14,03 38,30 11,95 0,00 01:25:02 0 1,22 8,72 22,72 8,75 0,00 01:35:01 0 1,11 0,31 2,19 0,28 0,00 01:45:01 0 1,09 0,25 2,16 0,21 0,00 01:55:01 0 1,03 0,40 2,17 0,23 0,00 02:05:01 0 1,19 1,86 3,28 0,99 0,00 02:15:01 0 1,03 0,28 2,15 0,25 0,00 02:25:01 0 1,13 0,43 2,26 0,27 0,00 02:35:01 0 0,98 0,41 2,09 0,46 0,00 02:45:01 0 1,07 0,25 2,04 0,21 0,00 02:55:01 0 1,01 0,27 2,25 0,24 0,00 03:05:01 0 1,92 2,28 2,76 1,13 0,00 03:15:01 0 1,02 0,26 2,19 0,22 0,00 03:25:01 0 1,12 0,26 2,14 0,27 0,00 03:35:01 0 1,06 0,28 2,34 0,28 0,00 03:45:01 0 1,08 0,26 2,26 0,26 0,00 03:55:01 0 1,06 0,39 2,15 0,22 0,00 04:05:01 0 1,04 1,75 2,70 0,40 0,00 04:15:01 0 1,10 0,30 2,33 0,26 0,00 04:25:01 0 1,09 0,31 2,29 0,21 0,00 04:35:01 0 1,16 9,76 13,21 6,99 0,00 sysstat
34. safety [================= ]
35. molly-guard
36. safe-rm $ rm -rf /usr/lib/libfoo.so
37. safe-rm $ rm -rf /usr/lib /libfoo.so
38. safe-rm $ rm -rf /usr/lib /libfoo.so /bin/rm: cannot remove `/libfoo.so': No such file or directory
39. safe-rm $ rm -rf /usr/lib /libfoo.so /bin/rm: cannot remove `/libfoo.so': No such file or directory $ ls /usr/lib ls: cannot access /usr/lib: No such file or directory
40. / /etc /usr /var/lib ...
41. safe-rm $ rm -rf /usr/lib safe-rm: skipping /usr/lib
42. etckeeper
43. mythtv-status
44. sl
45. security [====================== ]
48. apparmor apparmor-profiles apparmor-profiles-extra
49. debsums
50. fcheck
51. chkrootkit checksecurity
52. rkhunter tiger
53. remote access [========================== ]
54. openssh-server mosh http://feeding.cloud.geek.nz/posts/hardening-ssh-servers/
55. iptables
56. $ cat /etc/network/iptables.up.rules *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] -A OUTPUT -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -m conntrack --ctstate RELATED, ESTABLISHED -j ACCEPT -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT :LOGDROP - [0:0] -A LOGDROP -j LOG --log-level 6 -A LOGDROP -j DROP -A INPUT -j LOGDROP COMMIT
57. $ cat /etc/network/iptables.up.rules *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] -A OUTPUT -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -m conntrack --ctstate RELATED, ESTABLISHED -j ACCEPT -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT :LOGDROP - [0:0] -A LOGDROP -j LOG --log-level 6 -A LOGDROP -j DROP -A INPUT -j LOGDROP COMMIT -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT
58. fwknop
59. fwknop
60. ipcheck
61. x11vnc ssvnc http://feeding.cloud.geek.nz/posts/high-latency-vnc-tech-support/
62. backups [============================== ]
63. 1. config files 2. important documents 3. non-critical data
64. 1. config files duplicity
65. 1. config files all of /etc installed packages Myth TV DB dump
66. 2. important documents ~/documents/safe emails bookmarks
67. 3. non-critical data
68. “giving back” [================================== ]
69. popularity-contest
70. kerneloops
71. hardware package updates monitoring safety security remote access backups
72. Photos credits: blue lagoon: http://www.flickr.com/photos/benhusmann/4467839635/ in-flight entertainment: http://www.flickr.com/photos/kalleboo/2473197800/ ssd and hdd: http://www.flickr.com/photos/28771658@N03/3377026684/in/photostream/ igloo: http://www.flickr.com/photos/zuc123/426508881/ canadian flag: http://www.flickr.com/photos/webhamster/2914086018/ broom: http://www.flickr.com/photos/jrigol/2821450325/ intel cpu: http://www.flickr.com/photos/andresrueda/3274875773/ thermometer: http://www.flickr.com/photos/andresrueda/3407340937/ open harddrive: http://www.flickr.com/photos/uwehermann/2994944961/ ram: http://www.flickr.com/photos/detodounpoquito/2481060491/ baby hay stack: http://www.flickr.com/photos/nerdcoregirl/2959701240/ safe: http://www.flickr.com/photos/pong/288491653/ padlock: http://www.flickr.com/photos/shelleygibb/3396463409/ tiger: http://www.flickr.com/photos/auburnnewyork/4439937219/ old modem: http://www.flickr.com/photos/rexroof/3302978710/ red door: http://www.flickr.com/photos/romdos/8846131/ dvd on cat: http://www.flickr.com/photos/suzanneandsimon/84038024/ uncle sam: http://www.flickr.com/photos/notionscapital/2942067553/ This presentation is © 2015 François Marier and released under the terms of the Creative Commons Attribution Share-Alike 4.0 license
73. /* TODO */ [===================================]
74. ECC memory https://blogs.oracle.com/ksplice/entry/attack_of_the_cosmic_rays1