LXC: First commands on a new Debian CT

A list of the first commands I run on a new Debian LXC to homogenize and secure my new environment.

Utilities

apt update && apt upgrade -y

apt install curl nano openssl rsync fail2ban unattended-upgrades apt-listchanges sudo -y

Don’t use root

It is critical that you don’t use root for SSH or for typical CLI tasks. I always create a new user for that reason.

useradd -m -g users -G sudo patrick
chsh -s /bin/bash patrick
passwd patrick

Make the CLI more fun

nano /etc/bash.bashrc

Add the following lines to add color to bash:

export LS_OPTIONS='--color=auto'
eval "`dircolors`"
alias ls='ls $LS_OPTIONS'

SSH Configuration

I always disallow login for root over SSH and allow password logins for other users. To do this, edit /etc/ssh/sshd_config. You’re looking to uncomment and modify the following lines:

nano /etc/ssh/sshd_config

# Authentication:
LoginGraceTime 2m
PermitRootLogin no
StrictModes yes
MaxAuthTries 6
MaxSessions 2

-----

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no
PermitEmptyPasswords no

Once you’ve made the changes, you can restart the LXC and use SSH with your new user.

Unattended Upgrades Configuration

Edit the following file.

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Uncomment the following line

"origin=*";

<--->

Unattended-Upgrade::InstallOnShutdown "false";

<--->

Unattended-Upgrade::Remove-Unused-Dependencies "true";

Unattended-Upgrade::Automatic-Reboot "true";