# System Preparation

## Doing the basics

Reguardless of what system you deploy, there are things you need to do to prepare the OS.

- Update to the latest patches
- Install basic testing and support tools
- Turn off services that are wasteful or can interfere
- Tune the use of memory and file access for best performance
- Automate updates and startup for resilliency

### Rocky Linux Example

Rocky Linux is very similar to CentOS, as is Alma and RHEL  The instructions below are shown for a Rocky 8 system but with slight modification, should work for any DNF package management system. For Amazon Linux (AL2) the instructions are identical, but replace "dnf" with "yum".

```bash
# Do basic updates 
sudo dnf clean all
sudo dnf update -y

# Grab some handy tools
sudo dnf install -y chrony wget bind bind-utils telnet curl mlocate unzip sudo cronie

sudo systemctl enable chrony

# Slightly more optional handy tools for dev work
sudo dnf install -y make gcc firewalld sysstat
```

!!! note
    The following commands must be executed as the root user

```bash
# RUN AS ROOT
sudo -s
```

Then run these:
```
# Make sure it all stays up to date
# Run a dnf update at 3AM daily
sudo echo "0 3 * * * root /usr/bin/dnf update -y >/dev/null 2>&1">/etc/cron.d/dnf-updates

# Tune sysctl setings. Note that these are suggestions, 
#  you should tune according to your specific build

echo "
vm.max_map_count = 768000
net.core.rmem_default = 32768
net.core.wmem_default = 32768
net.core.rmem_max = 262144
net.core.wmem_max = 262144
fs.file-max = 250000
net.ipv4.ip_local_port_range = 5000 63000
net.ipv4.tcp_tw_reuse = 1
kernel.shmmax = 68719476736
net.core.somaxconn = 1024
vm.nr_hugepages = 20
kernel.shmmni = 4096
" >> /etc/sysctl.conf

/sbin/sysctl -p /etc/sysctl.conf
```

**Now exit from root user**

```exit```

### Ubuntu Linux Example

The instructions below are shown for an Ubuntu 22 system but with slight modification, should work for any APT package management system.

```bash
# Do basic updates 
sudo apt-get -y update
sudo apt-get -y upgrade

# Grab some handy tools
sudo apt-get install -y chrony wget bind9 bind9-utils telnet curl mlocate unzip sudo cron

sudo systemctl enable chrony

# Slightly more optional handy tools for dev work
sudo apt-get install -y make gcc firewalld sysstat
```

!!! note
    The following commands must be executed as the root user

```bash
# RUN AS ROOT
sudo -s

# Make sure it all stays up to date
# Run a dnf update at 3AM daily
sudo echo "0 3 * * * root /usr/bin/apt-get update -y >/dev/null 2>&1">/etc/cron.d/apt-get-updates
sudo echo "5 3 * * * root /usr/bin/apt-get upgrade -y >/dev/null 2>&1">>/etc/cron.d/apt-get-updates

# Tune sysctl setings. Note that these are suggestions, you should tune according to your specific build

sudo echo "
vm.max_map_count = 768000
net.core.rmem_default = 32768
net.core.wmem_default = 32768
net.core.rmem_max = 262144
net.core.wmem_max = 262144
fs.file-max = 250000
net.ipv4.ip_local_port_range = 5000 63000
net.ipv4.tcp_tw_reuse = 1
kernel.shmmax = 68719476736
net.core.somaxconn = 1024
vm.nr_hugepages = 20
kernel.shmmni = 4096
" >> /etc/sysctl.conf

/sbin/sysctl -p /etc/sysctl.conf
```


**Now exit from root user**

```exit```



## OS Hardening
Above the basics of any system deloyment, you may also want to do some "hardening".  This is the process of minimizing exposure to threats.  This is not a comprehensive list, but are some of the common things you should do to protect your system.

 - Disabling unnecessary services like postfix and qpidd
   
```
sudo systemctl stop  postfix.service
sudo systemctl disable postfix.service
sudo systemctl stop  qpidd.service
sudo systemctl disable qpidd.service

```

 - Firewall
 - SSH config
 - Switch to keypair only
 - 

 # TBD

Beyond the basics of any system deloyment, you may also want to do some "hardening".  This is the process of minimizing exposure to threats.  This is not a comprehensive list, but are some of the common things you should do to protect your system.

- Disabling unnecessary services
- Firewall
- SSH config
- Switch to keypair only