mirror of
https://github.com/mailscope/kumomta.git
synced 2026-08-20 03:18:18 +00:00
Tom Mairs
156 lines
4.0 KiB
Markdown
156 lines
4.0 KiB
Markdown
# System Preparation
|
|
|
|
## Doing the basics
|
|
|
|
Reguardless of what system you deploy, there are things you need to do to prepare the OS.
|
|
|
|
- Update to the latest patches
|
|
- Install basic testing and support tools
|
|
- Turn off services that are wasteful or can interfere
|
|
- Tune the use of memory and file access for best performance
|
|
- Automate updates and startup for resilliency
|
|
|
|
### Rocky Linux Example
|
|
|
|
Rocky Linux is very similar to CentOS, as is Alma and RHEL The instructions below are shown for a Rocky 8 system but with slight modification, should work for any DNF package management system. For Amazon Linux (AL2) the instructions are identical, but replace "dnf" with "yum".
|
|
|
|
```bash
|
|
# Do basic updates
|
|
sudo dnf clean all
|
|
sudo dnf update -y
|
|
|
|
# Grab some handy tools
|
|
sudo dnf install -y chrony wget bind bind-utils telnet curl mlocate unzip sudo cronie
|
|
|
|
sudo systemctl enable chrony
|
|
|
|
# Slightly more optional handy tools for dev work
|
|
sudo dnf install -y make gcc firewalld sysstat
|
|
```
|
|
|
|
!!! note
|
|
The following commands must be executed as the root user
|
|
|
|
```bash
|
|
# RUN AS ROOT
|
|
sudo -s
|
|
```
|
|
|
|
Then run these:
|
|
```
|
|
# Make sure it all stays up to date
|
|
# Run a dnf update at 3AM daily
|
|
sudo echo "0 3 * * * root /usr/bin/dnf update -y >/dev/null 2>&1">/etc/cron.d/dnf-updates
|
|
|
|
# Tune sysctl setings. Note that these are suggestions,
|
|
# you should tune according to your specific build
|
|
|
|
echo "
|
|
vm.max_map_count = 768000
|
|
net.core.rmem_default = 32768
|
|
net.core.wmem_default = 32768
|
|
net.core.rmem_max = 262144
|
|
net.core.wmem_max = 262144
|
|
fs.file-max = 250000
|
|
net.ipv4.ip_local_port_range = 5000 63000
|
|
net.ipv4.tcp_tw_reuse = 1
|
|
kernel.shmmax = 68719476736
|
|
net.core.somaxconn = 1024
|
|
vm.nr_hugepages = 20
|
|
kernel.shmmni = 4096
|
|
" >> /etc/sysctl.conf
|
|
|
|
/sbin/sysctl -p /etc/sysctl.conf
|
|
```
|
|
|
|
**Now exit from root user**
|
|
|
|
```exit```
|
|
|
|
### Ubuntu Linux Example
|
|
|
|
The instructions below are shown for an Ubuntu 22 system but with slight modification, should work for any APT package management system.
|
|
|
|
```bash
|
|
# Do basic updates
|
|
sudo apt-get -y update
|
|
sudo apt-get -y upgrade
|
|
|
|
# Grab some handy tools
|
|
sudo apt-get install -y chrony wget bind9 bind9-utils telnet curl mlocate unzip sudo cron
|
|
|
|
sudo systemctl enable chrony
|
|
|
|
# Slightly more optional handy tools for dev work
|
|
sudo apt-get install -y make gcc firewalld sysstat
|
|
```
|
|
|
|
!!! note
|
|
The following commands must be executed as the root user
|
|
|
|
```bash
|
|
# RUN AS ROOT
|
|
sudo -s
|
|
|
|
# Make sure it all stays up to date
|
|
# Run a dnf update at 3AM daily
|
|
sudo echo "0 3 * * * root /usr/bin/apt-get update -y >/dev/null 2>&1">/etc/cron.d/apt-get-updates
|
|
sudo echo "5 3 * * * root /usr/bin/apt-get upgrade -y >/dev/null 2>&1">>/etc/cron.d/apt-get-updates
|
|
|
|
# Tune sysctl setings. Note that these are suggestions, you should tune according to your specific build
|
|
|
|
sudo echo "
|
|
vm.max_map_count = 768000
|
|
net.core.rmem_default = 32768
|
|
net.core.wmem_default = 32768
|
|
net.core.rmem_max = 262144
|
|
net.core.wmem_max = 262144
|
|
fs.file-max = 250000
|
|
net.ipv4.ip_local_port_range = 5000 63000
|
|
net.ipv4.tcp_tw_reuse = 1
|
|
kernel.shmmax = 68719476736
|
|
net.core.somaxconn = 1024
|
|
vm.nr_hugepages = 20
|
|
kernel.shmmni = 4096
|
|
" >> /etc/sysctl.conf
|
|
|
|
/sbin/sysctl -p /etc/sysctl.conf
|
|
```
|
|
|
|
|
|
**Now exit from root user**
|
|
|
|
```exit```
|
|
|
|
|
|
|
|
## OS Hardening
|
|
Above the basics of any system deloyment, you may also want to do some "hardening". This is the process of minimizing exposure to threats. This is not a comprehensive list, but are some of the common things you should do to protect your system.
|
|
|
|
- Disabling unnecessary services like postfix and qpidd
|
|
|
|
```
|
|
sudo systemctl stop postfix.service
|
|
sudo systemctl disable postfix.service
|
|
sudo systemctl stop qpidd.service
|
|
sudo systemctl disable qpidd.service
|
|
|
|
```
|
|
|
|
- Firewall
|
|
- SSH config
|
|
- Switch to keypair only
|
|
-
|
|
|
|
# TBD
|
|
|
|
Beyond the basics of any system deloyment, you may also want to do some "hardening". This is the process of minimizing exposure to threats. This is not a comprehensive list, but are some of the common things you should do to protect your system.
|
|
|
|
- Disabling unnecessary services
|
|
- Firewall
|
|
- SSH config
|
|
- Switch to keypair only
|
|
|
|
|
|
|