Packages (Wheezy)

This document covers package management itself, in addition to documenting some smaller packages that I use.

Apt

I tend to use aptitude rather than apt-get, personally, and I always turn off 'auto-resolve dependencies' and 'install recommended packages automatically'.

Your mileage may vary, but I try to know something about every component going into my system.

• /etc/apt/sources.list

deb http://ftp.us.debian.org/debian/ wheezy main
deb-src http://ftp.us.debian.org/debian/ wheezy main

deb http://ftp.us.debian.org/debian/ wheezy-updates main
deb-src http://ftp.us.debian.org/debian/ wheezy-updates main

deb http://security.debian.org/ wheezy/updates main
deb-src http://security.debian.org/ wheezy/updates main

Generally a good idea to try to find your closest mirror. Sometimes your host even provides a mirror - will certainly make them happier if you use it.

To save time, I automatically run apt-get update hourly, through cron:

• /etc/cron.hourly/apt-get-update

#!/bin/sh
#/etc/cron.hourly/apt-get-update
# Much simpler than the cron-apt package.
/usr/bin/apt-get update
/usr/bin/apt-get -dy upgrade

Run:

chmod 0750 /etc/cron.hourly/apt-get-update

This automatically checks for updates, and downloads them, but it does not apply them.

DotDeb?

While not always needed, you may find yourself frustrated by Debian's slow upgrade page of some packages, most notably php and the plethora of bugs within.

Run

wget http://www.dotdeb.org/dotdeb.gpg
apt-key add dotdeb.gpg

And add

deb http://packages.dotdeb.org wheezy all
deb-src http://packages.dotdeb.org wheezy all

to your sources.list

Package Removal

Debian has some defaults that you probably do not need on a server:

• Basic Purge: acpi-support-base, acpid, acpi, at, bsd-mailx, exim4, exim4-base, isc-dhcp-client, isc-dhcp-common, laptop-detect, libx11-data, libxau6, libxdmcp6, mutt, portmap, procmail, python 2.6, tasksel, xauth, xkb-data
  • Make sure openssh-server doesn't get removed along with tasksel and friends.
  • deluser --remove-all-files Debian-exim

• The culturally insensitive may also purge: console-setup, console-terminus, kbd, keyboard-configuration
  • /etc/console-setup may need to get removed manually

• If not using nfs, rpcbind and nfs-common

Package Additions

• apt-get install conntrack sysstat iotop lm-sensors ninja chkconfig sash libpam-tmpdir heirloom-mailx zip unzip rkhunter unhide libdigest-whirlpool-perl acct nmap cgdb sudo
  • You may want to devote some time to what acct and sysstat can do for you.

• Development: apt-get install fakeroot debhelper build-essential

• Better editing: apt-get install vim vim-doc exuberant-ctags
  • Heretics may substitute this with their inferior editor of choice
• update-alternatives --config editor
• /etc/vim/vimrc
  • syntax on, set background=dark, set showmatch, set mouse=nvc
• I uncomment set mouse in /etc/nanorc as well. I sometimes am training people and teaching both vim and some other arcane topic at the same time can become more than it is worth.

ntpdate

Significantly more lightweight than ntp, easier to configure and one less server to run. If you have a number of machines at a site, you may want to run one server and have the others pull off of it. Beyond this, though,

• /etc/default/ntpdate
  • NTPOPTIONS=" -B "
  • forces slewing. Prevents time travel. Time travel bad.
• /etc/cron.hourly/ntpdate

#!/bin/sh
#/etc/cron.hourly/ntpdate
#ntpdate autorun
if [ -f /usr/sbin/ntpdate-debian ]; then
    /usr/sbin/ntpdate-debian -B
fi

• Run:

chmod 0750 /etc/cron.hourly/ntpdate

Random silly packages

• fortunes (and friends), cowsay, filters
  • Is good to greet visitors with a talking cow. Reminds you how seriously you should take your job.

• bsdgames, nethack, slashem
  • One of these decades I will get around to ascending...