Add tech_docs/linux/next_level_debian.md
This commit is contained in:
280
tech_docs/linux/next_level_debian.md
Normal file
280
tech_docs/linux/next_level_debian.md
Normal file
@@ -0,0 +1,280 @@
|
||||
Here's a **`next_level_debian.md`** document that captures all the hardcore optimizations we've discussed, organized for clarity and reuse:
|
||||
|
||||
```markdown
|
||||
# Next-Level Debian Hardening & Minimalism
|
||||
|
||||
For power users who want **maximum control, security, and performance** from their Debian system.
|
||||
|
||||
## Table of Contents
|
||||
1. [Service Hardening](#service-hardening)
|
||||
2. [Network Lockdown](#network-lockdown)
|
||||
3. [Kernel Protections](#kernel-protections)
|
||||
4. [Filesystem Hardening](#filesystem-hardening)
|
||||
5. [User Environment](#user-environment)
|
||||
6. [Extreme Minimalism](#extreme-minimalism)
|
||||
|
||||
---
|
||||
|
||||
## Service Hardening
|
||||
|
||||
### Disable Non-Essential Services
|
||||
```bash
|
||||
# List running services
|
||||
sudo systemctl list-units --type=service --state=running
|
||||
|
||||
# Disable cron (if unused)
|
||||
sudo systemctl disable --now cron.service
|
||||
|
||||
# Disable iperf3 (if not benchmarking)
|
||||
sudo systemctl disable --now iperf3.service
|
||||
|
||||
# Disable systemd-logind (headless only)
|
||||
sudo systemctl mask --now systemd-logind.service
|
||||
```
|
||||
|
||||
### Harden SSH
|
||||
```bash
|
||||
sudo sed -i -E \
|
||||
-e 's/^#?PermitRootLogin .*/PermitRootLogin no/' \
|
||||
-e 's/^#?PasswordAuthentication .*/PasswordAuthentication no/' \
|
||||
-e 's/^#?ClientAliveInterval .*/ClientAliveInterval 300/' \
|
||||
-e 's/^#?MaxAuthTries .*/MaxAuthTries 3/' \
|
||||
/etc/ssh/sshd_config
|
||||
sudo systemctl restart ssh
|
||||
```
|
||||
|
||||
### Restrict DBus
|
||||
```bash
|
||||
sudo mkdir -p /etc/systemd/system/dbus.service.d/
|
||||
echo '[Service]
|
||||
RestrictRealtime=yes
|
||||
MemoryDenyWriteExecute=yes
|
||||
LockPersonality=yes
|
||||
' | sudo tee /etc/systemd/system/dbus.service.d/harden.conf
|
||||
sudo systemctl daemon-reload
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Network Lockdown
|
||||
|
||||
### nftables Firewall (Drop All Inbound Except SSH)
|
||||
```bash
|
||||
sudo nft flush ruleset
|
||||
sudo nft -f - <<EOF
|
||||
table inet filter {
|
||||
chain input {
|
||||
type filter hook input priority 0; policy drop;
|
||||
ct state established,related accept
|
||||
iif lo accept
|
||||
ip protocol icmp accept
|
||||
tcp dport 2222 accept
|
||||
}
|
||||
chain forward { policy drop; }
|
||||
chain output { policy accept; }
|
||||
}
|
||||
EOF
|
||||
sudo nft list ruleset | sudo tee /etc/nftables.conf
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Kernel Protections
|
||||
|
||||
### /etc/sysctl.d/99-hardening.conf
|
||||
```bash
|
||||
echo "
|
||||
kernel.kptr_restrict=2
|
||||
kernel.unprivileged_userns_clone=0
|
||||
vm.unprivileged_userfaultfd=0
|
||||
net.core.bpf_jit_harden=2
|
||||
" | sudo tee /etc/sysctl.d/99-hardening.conf
|
||||
sudo sysctl -p /etc/sysctl.d/99-hardening.conf
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Filesystem Hardening
|
||||
|
||||
### Immutable Critical Files
|
||||
```bash
|
||||
sudo chattr +i /etc/passwd /etc/shadow /etc/group /etc/sudoers
|
||||
```
|
||||
|
||||
### Disable SUID Binaries (Except Essentials)
|
||||
```bash
|
||||
find / -type f -perm /4000 -not -path '/usr/bin/sudo' \
|
||||
-not -path '/usr/bin/passwd' -exec chmod u-s {} \;
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## User Environment
|
||||
|
||||
### Secure ~/.bashrc
|
||||
```bash
|
||||
echo '
|
||||
umask 077
|
||||
alias ports="ss -tulnp | grep -vE '\''127.0.0.1|::1'\''"
|
||||
' >> ~/.bashrc
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Extreme Minimalism
|
||||
|
||||
### Purge All Bloat
|
||||
```bash
|
||||
sudo apt purge --auto-remove -y \
|
||||
snapd lxd lxcfs cloud-init unattended-upgrades \
|
||||
apparmor policykit-1 popularity-contest
|
||||
sudo apt autoremove -y --purge
|
||||
```
|
||||
|
||||
### Replace journald with socklog
|
||||
```bash
|
||||
sudo apt install socklog-void
|
||||
sudo systemctl disable --now systemd-journald
|
||||
sudo systemctl enable --now socklog-unix
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Verification
|
||||
```bash
|
||||
# Check running services (should be < 5)
|
||||
sudo systemctl list-units --type=service --state=running
|
||||
|
||||
# Check installed packages (should be < 150)
|
||||
dpkg -l | wc -l
|
||||
```
|
||||
|
||||
> **Note:** Adjust based on your needs. This is a **starting point**, not dogma.
|
||||
```
|
||||
|
||||
### How to Use This Document
|
||||
1. **Copy-paste** sections as needed
|
||||
2. **Comment out** lines you don't need
|
||||
3. **Add your own** customizations
|
||||
|
||||
---
|
||||
|
||||
Here's a **no-nonsense PCIe passthrough guide** for your Debian system, optimized for your **Intel i7-4790 + Intel I350 NIC** hardware:
|
||||
|
||||
---
|
||||
|
||||
# PCIe Passthrough Guide for Debian (VT-d Enabled Systems)
|
||||
|
||||
## Prerequisites
|
||||
1. **BIOS Settings**:
|
||||
- Enable `VT-d` (Intel) or `AMD-Vi` (AMD)
|
||||
- Disable `CSM` (Legacy Boot)
|
||||
- Enable `Above 4G Decoding` if available
|
||||
|
||||
2. **Verify IOMMU Groups**:
|
||||
```bash
|
||||
sudo apt install -y iommu-tools
|
||||
sudo dmesg | grep -i iommu # Should show "DMAR: IOMMU enabled"
|
||||
for g in $(find /sys/kernel/iommu_groups/* -maxdepth 0 | sort -V); do
|
||||
echo "IOMMU Group ${g##*/}:"
|
||||
for d in $g/devices/*; do
|
||||
echo -e "\t$(lspci -nns ${d##*/})"
|
||||
done
|
||||
done
|
||||
```
|
||||
|
||||
## Step 1: Configure Kernel for Passthrough
|
||||
Edit `/etc/default/grub`:
|
||||
```bash
|
||||
GRUB_CMDLINE_LINUX_DEFAULT="quiet intel_iommu=on iommu=pt pcie_acs_override=downstream,multifunction nofb nomodeset video=vesafb:off,efifb:off"
|
||||
```
|
||||
Then update GRUB:
|
||||
```bash
|
||||
sudo update-grub
|
||||
```
|
||||
|
||||
## Step 2: Isolate Target Devices
|
||||
### For your **Intel I350 NIC (03:00.0 - 03:00.3)**:
|
||||
```bash
|
||||
echo "options vfio-pci ids=8086:1521 disable_vga=1" | sudo tee /etc/modprobe.d/vfio.conf
|
||||
echo "softdep igb pre: vfio-pci" | sudo tee /etc/modproprobe.d/igb.conf
|
||||
```
|
||||
|
||||
## Step 3: Load Required Kernel Modules
|
||||
```bash
|
||||
echo "vfio
|
||||
vfio_iommu_type1
|
||||
vfio_pci
|
||||
vfio_virqfd" | sudo tee /etc/modules-load.d/vfio.conf
|
||||
sudo update-initramfs -u
|
||||
```
|
||||
|
||||
## Step 4: Verify Device Isolation
|
||||
Reboot, then check:
|
||||
```bash
|
||||
lspci -nnk -d 8086:1521 # Should show "Kernel driver in use: vfio-pci"
|
||||
```
|
||||
|
||||
## Step 5: KVM/QEMU Setup
|
||||
### Install minimal virtualization stack:
|
||||
```bash
|
||||
sudo apt install -y --no-install-recommends qemu-system-x86 libvirt-daemon-system virt-manager
|
||||
sudo usermod -aG kvm,input,libvirt $USER
|
||||
```
|
||||
|
||||
### Create VM XML (for NIC passthrough):
|
||||
```xml
|
||||
<hostdev mode='subsystem' type='pci' managed='yes'>
|
||||
<source>
|
||||
<address domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
|
||||
</source>
|
||||
</hostdev>
|
||||
```
|
||||
(Repeat for each NIC function 0x0-0x3)
|
||||
|
||||
## Step 6: Performance Tweaks
|
||||
### CPU Pinning (for your 4C/8T i7-4790):
|
||||
```xml
|
||||
<cputune>
|
||||
<vcpupin vcpu='0' cpuset='0'/>
|
||||
<vcpupin vcpu='1' cpuset='4'/>
|
||||
<vcpupin vcpu='2' cpuset='1'/>
|
||||
<vcpupin vcpu='3' cpuset='5'/>
|
||||
</cputune>
|
||||
```
|
||||
|
||||
### Hugepages (1GB):
|
||||
```bash
|
||||
echo "vm.nr_hugepages = 8" | sudo tee /etc/sysctl.d/10-hugepages.conf
|
||||
sudo sysctl -p
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
1. **Error 43 (AMD GPU)**: Use hidden state and vendor_id:
|
||||
```xml
|
||||
<kvm>
|
||||
<hidden state='on'/>
|
||||
</kvm>
|
||||
<hyperv>
|
||||
<vendor_id state='on' value='1234567890ab'/>
|
||||
</hyperv>
|
||||
```
|
||||
|
||||
2. **IOMMU Group Issues**: Try:
|
||||
```bash
|
||||
sudo virsh nodedev-detach pci_0000_03_00_0
|
||||
```
|
||||
|
||||
3. **Performance Checks**:
|
||||
```bash
|
||||
sudo perf stat -e 'kvm:*' -a sleep 1
|
||||
```
|
||||
|
||||
## Final Notes
|
||||
- Your **I350 NIC** is ideal for pfSense/OPNsense VMs
|
||||
- Consider **CPU isolation** for real-time workloads:
|
||||
```bash
|
||||
sudo systemctl set-property --runtime -- user.slice AllowedCPUs=0,4
|
||||
```
|
||||
|
||||
Want me to adapt this for a specific VM (e.g., networking appliance/gaming VM)?
|
||||
Reference in New Issue
Block a user