==== Debian 11 (Buster) Remote Admin Host on a Raspberry Pi 4 ====

The purpose of this setup is to provide a low power remote administration and access device which can also be used for monitoring via Zabbix.

  * Install Raspbian first and update the eeprom to the latest version
  * Download the xz compress image for Debian 10 from [[https://raspi.debian.net/tested-images/|https://raspi.debian.net/tested-images/]]
  * Decompress and image image to a microsd card
<code>

xzcat 20210718_raspi_4_bullseye.img.xz | dd of=/dev/sdX bs=64k oflag=dsync status=progress

</code>

  * Boot and login with root and no password then set the root password
<code>

passwd

</code>

  * Update and reboot

<code>
 apt update && apt upgrade && reboot

</code>

==== Base Install & Initial Config ====

Install XFCE some other utilities

<code> 
apt install vim wget vlan sudo tmux locales
</code>

Set your hostname

<code>
vim /etc/hostname
</code>

Edit hosts

<code>
vim /etc/hosts
</code>

and add

<code>
127.0.1.1 yourHostName
</code>

Set your timezone

<code>
ln -sf /usr/share/zoneinfo/America/Los_Angeles /etc/localtime
</code>

Set your locale
<code>
dpkg-reconfigure locales
</code>

Set swappiness (to reduce SD card writes)
<code>
vim /etc/sysctl.conf
</code>
Add
<code>
vm.swappiness=1
</code>

Set the /tmp folder to run in RAM (https://wiki.archlinux.org/title/tmpfs)
<code>
sudo vim /etc/fstab
</code>
Add
<code>
tmpfs /tmp tmpfs mode=1777,nosuid,nodev,size=512M 0 0
</code>


==IP Address and VLAN==
<code>
vim /etc/network/interfaces.d/eth0
</code>
On each interface (change from eth0 to wlan0 or other) that you want to configure do one of the following

DHCP no VLAN is default so do nothing

Static IP on VLAN 222
<code>
auto eth0
iface eth0 inet manual

auto eth0.222
iface eth0.222 inet static
        address 10.10.10.1/24
        vlan-raw-device eth0
        gateway 10.10.10.254
        dns-nameservers 10.10.0.2
</code>

DHCP on VLAN 222
<code>
auto eth0
iface eth0 inet manual

auto eth0.222
iface eth0.222 inet dhcp
        vlan-raw-device eth0
</code>

Restart network
<code>
ifdown eth0 && ifup eth0 && ifup eth0.222 (if vlan 222 is used)
</code>

==Disable world readable permissions when creating users==
<code>
vim /etc/adduser.conf
</code>
Set
<code>
DIR_MODE=0750
</code>

==Create sudo user==

<code>
adduser bobberson && adduser bobberson sudo && exit
</code>

Login as sudo user to continue

==Install GUI==
<code>
sudo apt install firefox-esr xserver-xorg remmina tigervnc-viewer network-manager-openvpn network-manager-ssh network-manager-config-connectivity-debian network-manager-gnome gnome-keyring seahorse keepassx lightdm xfce4 xfce4-goodies synaptic (add this if you want to keep the # of packages install to a minimum) --no-install-recommends
</code>

Reboot
<code>
sudo reboot
</code>

==== Firewall ====

[[https://wiki.debian.org/DebianFirewall|https://wiki.debian.org/DebianFirewall]] \\
All traffic is permitted by default otherwise
<code>

sudo vim /etc/systemd/system/firewall.service

</code>

Add the following

<code>
[Unit]
Description=Add Firewall Rules to iptables

[Service]
Type=oneshot
ExecStart=/etc/firewall/enable.sh
#ExecStart=/etc/firewall/enable6.sh  #For IPV6

[Install]
WantedBy=multi-user.target

</code>

Create the firewall rules file

<code>
sudo mkdir /etc/firewall
sudo vim /etc/firewall/enable.sh

</code>

Add the following

<code>
#!/bin/sh
# A very basic IPtables / Netfilter script /etc/firewall/enable.sh

PATH='/sbin'

# Flush the tables to apply changes
iptables -F

# Default policy to drop 'everything' but our output to internet
iptables -P FORWARD DROP
iptables -P INPUT   DROP
iptables -P OUTPUT  ACCEPT

# Allow established connections (the responses to our outgoing traffic)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow local programs that use loopback (Unix sockets)
iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT

# Uncomment this line to allow incoming SSH/SCP connections to this machine,
# for traffic from 10.20.0.2 (you can use also use a network definition as
# source like -s 10.20.0.0/22).
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT

</code>

Reload and enable service

<code>
sudo chmod 700 /etc/firewall/enable.sh
sudo systemctl daemon-reload
sudo systemctl enable firewall
sudo systemctl restart firewall
</code>

Check the rules by
<code>
sudo iptables -L
</code>
====Fail2ban ====
Install fail2ban

<code>
sudo apt install fail2ban && sudo systemct enable fail2ban && sudo systemctl restart fail2ban
</code>

==== Encryption of Home Dirs ====

Enable encryption of /home/user directories ([[https://wiki.archlinux.org/title/User:Lukeus_Maximus|https://wiki.archlinux.org/title/User:Lukeus_Maximus]])

Note: as long as the user is logged this means their encrypted data will be mounted and that any root user can gain access (similar to other filesystem encryption schemes).

Note: if there are any files (hidden or not) in the users home dir, gocryptfs won't be able to mount there.
<code>

sudo apt-get install gocryptfs rsync lsof fuse libpam-mount

</code>

Create a folder for the users encrypted data, when prompted for a password from gocryptfs use the same password that the user uses to login so automount will work

<code>
sudo mkdir /home/bobberson.cipher
sudo chown bobberson:bobberson /home/bobberson.cipher
sudo gocryptfs -init /home/bobberon.cipher
sudo chmod 700 /home/bobberson.cipher
</code>
Record your master key and name it username@hostname.gocryptfs.masterkey

Temporarily allow root to login via SSH
<code>
sudo vim /etc/ssh/sshd_config
</code>
Add the line
<code>
PermitRootLogin yes
</code>
Restart sshd and logout
<code>
sudo systemctl restart sshd
exit
</code>

Login as root (or a different sudo user from the user you're encrypting the home dir for). The user whose homedir is being encrypted must be completely logged off the system. Check by running
<code>
w
</code>

As root and with bobberson completely logged out
<code>
mv /home/bobberson /home/bobberson.old
mkdir -m 700 /home/bobberson
chown bobberson:bobberson /home/bobberson
chown -R bobberson:bobberson /home/bobberson.cipher
</code>

Mount the encrypted archive and copy the data from the old home directory (be sure to use the trailing / on the source directory, otherwise it will copy the directory itself and not the contents)

<code>
gocryptfs /home/bobberson.cipher /home/bobberson
rsync -av /home/bobberson.old/ /home/bobberson
fusermount -u /home/bobberson
chown -R bobberson:bobberson
sudo chmod 700 /home/bobberson.cipher
</code>

Setup automount on login
<code>
vim /etc/fuse.conf
</code>

Uncomment
<code>
user_allow_other
</code>

Configure PAM
<code>
vim /etc/security/pam_mount.conf.xml
</code>

Add a new XML tag just before </pam_mount> (it's at the end, and be sure to change the user to your username)
<code>
<volume user="bobberson" fstype="fuse" options="nodev,nosuid,quiet,nonempty,allow_other"
path="/usr/bin/gocryptfs#/home/%(USER).cipher" mountpoint="/home/%(USER)" />

</code>
Create /etc/pam.d/homedirs to: (though I need to double check the following creation of files, I don't know of they're necessary)

<code>
vim /etc/pam.d/homedirs
</code>

Add
<code>
#%PAM-1.0
auth      optional                   pam_mount.so
password  optional                   pam_mount.so
session   required                   pam_mkhomedir.so
session   optional                   pam_mount.so
</code>

<code>
vim /etc/pam.d/system-local-login

</code>

Add

<code>
#%PAM-1.0

auth      include   login
auth      include   homedirs
account   include   login
account   include   homedirs
password  include   login
password  include   homedirs
session   include   login
session   include   homedirs

</code>

Copy to /etc/pam.d/system-remote-login

<code>
cp /etc/pam.d/system-local-login /etc/pam.d/system-remote-login

</code>

Logout as root and login as your sudo user

Check your home dir, it should have all the files of the original temp dir. Make test file and folder, it should show up as encrypted file names/folders in your ciper dir.

If everything looks good disable root access via ssh
<code>
sudo vim /etc/ssh/sshd_config
</code>
Set
<code>
PermitRootLogin no
</code>
Restart sshd
<code>
sudo systemctl restart sshd
</code>

Delete the bobberson.old folder
<code>
rm -rf /home/bobberson.old
</code>

==== VNC Server ====
https://wiki.archlinux.org/title/TigerVNC \\

We will need to modify some default paths since we are encrypting the home directory, pay attention to the addition of .ciper to environment paths.

== Install Packages ==
<code>

sudo apt install tigervnc-standalone-server dbus-x11
sudo cp /usr/lib/systemd/system/tigervncserver@.service /etc/systemd/system/tigervncserver@.service
</code>

Edit path for default VNC folder

Note: this change is needed since your home dir is encrypted and the systemd service won't be able to read it until you login, so the .vnc server will need to be in your .ciper folder unencrypted for the service to start. Or you'll need to login via ssh, restart the service and stay logged into ssh while vnc is being used.
<code>
sudo vim /etc/tigervnc/vncserver-config-defaults
</code>

Uncomment and set the VNC user dir as follows

<code>
Default: $vncUserDir = "$ENV{HOME}.cipher/.vnc";
</code>

Add user to user config
<code>
sudo vim /etc/tigervnc/vncserver.users
</code>
Add
<code>
:8=bobberson
</code>

Start VNC server to set password, don't use read-only password

<code>
vncserver
</code>
Set the default config for your user
<code>
vim /home/bobberson.cipher/.vnc/config
</code>
Add
<code>
session=xfce
geometry=1600x900
localhost
alwaysshared
</code>

Reload, enable and restart service

<code>
sudo systemctl daemon-reload
sudo systemctl enable tigervncserver@:8
sudo systemctl restart tigervncserver@:8
</code>

https://unix.stackexchange.com/questions/43398/is-it-possible-to-keep-a-vnc-server-alive-after-log-out \\
If you want to be able to log out of xfce via VNC and have the tigervncserver restart automatically do this:
<code>
sudo systemctl edit tigervncserver@:8
</code>
Add
<code>
[Service]
Restart=on-success
RestartSec=10
</code>
and...
<code>
sudo systemctl daemon-reload
sudo systemctl enable tigervncserver@:8
sudo systemctl restart tigervncserver@:8
</code>


On a remote computer on the same subnet listen for port 5908 over ssh, open a console and type

<code>
ssh -L 5908:127.0.0.1:5908 -C -N -l  bobberson vnc.server.ip.address
</code>

Open open your VNC viewer and use localhost:5908 or in a console type

<code>
vncviewer localhost:5908
</code>

====Mosh====
Because it's the pits using SSH over a high latency connection...

Install
<code>
sudo apt install mosh
</code>

Add firewall ports (since this is a small server for a select few we are only going to open 5 ports)
<code>
sudo vim /etc/firewall/enable.sh
</code>
Add
<code>
iptables -A INPUT -p udp --dport 60000:60005 -m state --state NEW -j ACCEPT
</code>
Restart firewall
<code>
sudo systemctl restart firewall
</code>

To connect just use mosh instead of ssh
<code>
mosh remoteuser@remotecomputer
</code>




====Tang====
https://semanticlab.net/sysadmin/encryption/Network-bound-disk-encryption-in-ubuntu-20.04/ \\
Use this if you're using NBDE for any of your RHEL/CentOS/Rocky installs.

Install packages
<code>
sudo apt install tang jose
</code>
Edit default port Tang listens on
<code>
sudo systemctl edit tangd.socket
</code>
Add the following for port 7500
<code>
[Socket]
ListenStream=
ListenStream=7500
</code>
Edit your firewall and add port 7500
<code>
sudo vim /etc/firewall/enable.sh
</code>
Add
<code>
#TCP port for Tang server
iptables -A INPUT -p tcp --dport 7500 -m state --state NEW -j ACCEPT
</code>
Enable and start the service
<code>
sudo systemctl daemon-reload
sudo systemctl restart firewall
sudo systemctl enable tangd.socket
sudo systemctl start tangd.socket
</code>

====Zabbix=====
https://www.zabbix.com/documentation/5.0/manual/installation/install  \\

Go to https://www.zabbix.com/download_sources#50LTS -> choose 5.0 LTS -> copy link and 
<code>
wget https://cdn.zabbix.com/zabbix/sources/stable/5.0/zabbix-5.0.14.tar.gz
tar xvfz zabbix-release.gz
</code>

Create user and group
<code>
sudo addgroup --system --quiet zabbix
sudo adduser --quiet --system --disabled-login --ingroup zabbix --home /var/lib/zabbix --no-create-home zabbix
</code>

Install required packages for source
<code>
sudo apt install libmariadb-dev libxml2-dev libsnmp-dev libevent-dev libopenipmi-dev libcurl4-nss-dev libpcre++-dev gcc make 
</code>

Configure
<code>
cd zabbix-release
./configure --enable-server --enable-agent --with-mysql --enable-ipv6 --with-net-snmp --with-libcurl --with-libxml2 --with-openipmi
sudo make install
</code>

Install required packages for runtime
<code>
sudo apt install apache2 php7.4-common php7.4-xml php7.4-mysql mariadb-server php-php-gettext php-gd php-bcmath php7.4-common php-xml php-mbstring php-ldap ibapache2-mod-php
</code>

Edit php.ini
<code>
sudo vim /etc/php/7.4/apache2/php.ini
</code>
I needed to set the following
<code>
post_max_size = 16M
max_execution_time = 300
max_input_time = 300
date.timezone = America/Los_Angeles
</code>



Enable and start services
<code>
sudo systemctl enable mariadb && sudo systemctl restart mariadb
sudo systemctl enable apache2 && sudo systemctl restart apache2
</code>


Secure mysql
<code>
sudo mysql_secure_installation
</code>
Create database
<code>
sudo mysql -uroot -p
create database zabbix character set utf8 collate utf8_bin;
create user zabbix@localhost identified by 'password';
grant all privileges on zabbix.* to zabbix@localhost;
quit;
</code>

Import mysql schema
<code>
cd database/mysql
sudo mysql -uzabbix -p<password> zabbix < schema.sql
sudo mysql -uzabbix -p<password> zabbix < images.sql
sudo mysql -uzabbix -p<password> zabbix < data.sql
</code>

Add password to zabbix_server.conf
<code>
sudo vim /usr/local/etc/zabbix_server.conf
</code>
Set your database password
<code>
DBpassword=yourpassword
</code>

Copy init.d scripts
<code>
sudo cp misc/init.d/debian/* /etc/init.d
sudo reboot
</code>

Add firewall port for active checks (tcp 10051)
<code>
sudo vim /etc/firewall/enable.sh
</code>
Add
<code>
#TCP port for Zabbix active checks
iptables -A INPUT -p tcp --dport 10051 -m state --state NEW -j ACCEPT
</code>
Restart firewall
<code>
sudo systemctl restart firewall
</code>

==Setup Web Server==
<code>
sudo mkdir /var/www/html/zabbix
cd ui
sudo cp -a . /var/www/html/zabbix
</code>

Launch firefox and go to http:\\localhost\zabbix to start the setup. After you create the php file it has you download, delete the .example file in the same dir. Even though you can't go past finish, reloading http:\\localhost\zabbix should take you to the login; the username Admin and password zabbix (note, user and pass are both case sensitive). Note: use the ip of your computer for the server hostname, otherwise services might not work.

====App Armor====
https://wiki.debian.org/AppArmor/HowToUse \\
Because you want to try to do your best, or at least the best you can do with the tools and time available to you; SELinux doesn't appear to be in this kernel... or I didn't give it enough effort.

Install utils
<code>
sudo apt install apparmor-utils apparmor-profiles apparmor-profiles-extra
</code>