Linux:Desktop Tips - Revision history

Queo: /* Installation */

2024-01-04T09:45:33Z

Installation

← Older revision		Revision as of 09:45, 4 January 2024
Line 26:		Line 26:
	* You can grab your copy of Fedora workstation here: https://getfedora.org/en/workstation/download/		* You can grab your copy of Fedora workstation here: https://getfedora.org/en/workstation/download/
	* Burn the iso file either to a optical disc (CD/DVD) or create a bootable USB Stick with the 'dd' command on Linux, here's how to accomplish that:		* Burn the iso file either to a optical disc (CD/DVD) or create a bootable USB Stick with the 'dd' command on Linux, here's how to accomplish that:
	<~~pre~~>$ cd /path/to/your/downloadfolder		: <syntaxhighlight lang="bash">$ cd /path/to/your/downloadfolder
	$ sudo dd if=Fedora-Workstation-Live-x86_64-38-1.6.iso of=/dev/sdX bs=8M status=progress oflag=direct</~~pre~~>		$ sudo dd if=Fedora-Workstation-Live-x86_64-38-1.6.iso of=/dev/sdX bs=8M status=progress oflag=direct</syntaxhighlight>
	: Of course you should replace sdX with the actual device name of your USB stick ;-)		: Of course you should replace sdX with the actual device name of your USB stick ;-)
	: Another method is to create the USB-stick with the free ''unetbootin'' software (available for Linux/Mac/Windows).		: Another method is to create the USB-stick with the free ''unetbootin'' software (available for Linux/Mac/Windows).

Queo: /* Installation */

2024-01-04T09:34:05Z

Installation

← Older revision		Revision as of 09:34, 4 January 2024
Line 26:		Line 26:
	* You can grab your copy of Fedora workstation here: https://getfedora.org/en/workstation/download/		* You can grab your copy of Fedora workstation here: https://getfedora.org/en/workstation/download/
	* Burn the iso file either to a optical disc (CD/DVD) or create a bootable USB Stick with the 'dd' command on Linux, here's how to accomplish that:		* Burn the iso file either to a optical disc (CD/DVD) or create a bootable USB Stick with the 'dd' command on Linux, here's how to accomplish that:
	: <~~syntaxhighlight lang="bash"~~>		<pre>$ cd /path/to/your/downloadfolder
	$ cd /path/to/your/downloadfolder		$ sudo dd if=Fedora-Workstation-Live-x86_64-38-1.6.iso of=/dev/sdX bs=8M status=progress oflag=direct</pre>
	$ sudo dd if=Fedora-Workstation-Live-x86_64-38-1.6.iso of=/dev/sdX bs=8M status=progress oflag=direct</~~syntaxhighlight~~>
	: Of course you should replace sdX with the actual device name of your USB stick ;-)		: Of course you should replace sdX with the actual device name of your USB stick ;-)
	: Another method is to create the USB-stick with the free ''unetbootin'' software (available for Linux/Mac/Windows).		: Another method is to create the USB-stick with the free ''unetbootin'' software (available for Linux/Mac/Windows).

Queo: /* OS */

2024-01-04T09:31:17Z

← Older revision		Revision as of 09:31, 4 January 2024
Line 15:		Line 15:
	== OS ==		== OS ==
	In the example here I used the following:		In the example here I used the following:
	: <pre>$ cat /etc/redhat-release; uname -r		<pre>$ cat /etc/redhat-release; uname -r
	Fedora release 39 (Thirty Nine)		Fedora release 39 (Thirty Nine)
	6.6.4-200.fc39.x86_64</pre>		6.6.4-200.fc39.x86_64</pre>

Queo: /* OS */

2024-01-04T09:29:37Z

← Older revision		Revision as of 09:29, 4 January 2024
Line 15:		Line 15:
	== OS ==		== OS ==
	In the example here I used the following:		In the example here I used the following:
	: <pre>		: <pre>$ cat /etc/redhat-release; uname -r
	$ cat /etc/redhat-release; uname -r
	Fedora release 39 (Thirty Nine)		Fedora release 39 (Thirty Nine)
	6.6.4-200.fc39.x86_64</pre>		6.6.4-200.fc39.x86_64</pre>

Queo: /* OS */

2024-01-04T09:29:16Z

← Older revision		Revision as of 09:29, 4 January 2024
Line 15:		Line 15:
	== OS ==		== OS ==
	In the example here I used the following:		In the example here I used the following:
	: <~~syntaxhighlight lang="bash"~~>		: <pre>
	$ cat /etc/redhat-release; uname -r		$ cat /etc/redhat-release; uname -r
	Fedora release 39 (Thirty Nine)		Fedora release 39 (Thirty Nine)
	6.6.4-200.fc39.x86_64</~~syntaxhighlight~~>		6.6.4-200.fc39.x86_64</pre>

	=== Preparation ===		=== Preparation ===

192.168.1.104: /* Password strength - my personal advice */

2024-01-03T19:34:10Z

Password strength - my personal advice

← Older revision		Revision as of 19:34, 3 January 2024
Line 90:		Line 90:
	** reset account lockout after: 2 minutes		** reset account lockout after: 2 minutes
	:: <pre>$ sudo vim /etc/pam.d/common-auth</pre>		:: <pre>$ sudo vim /etc/pam.d/common-auth</pre>
	:: <syntaxhighlight lang="bash">auth		:: <syntaxhighlight lang="bash"> auth
	required		required
	pam_tally2.so file=/ var /log/tallylog deny=6 unlock_time=120</syntaxhighlight>		pam_tally2.so file=/ var /log/tallylog deny=6 unlock_time=120 </syntaxhighlight>
	:: *) filenames are Debian Linux specific, I'll add the Fedora paths/files asap		:: *) filenames are Debian Linux specific, I'll add the Fedora paths/files asap

192.168.1.104: /* Chat */

2024-01-03T19:32:29Z

Chat

← Older revision		Revision as of 19:32, 3 January 2024
Line 280:		Line 280:
	:: <pre>https://teams.microsoft.com/downloads/desktopurl?env=production&plat=linux&arch=x64&download=true&linuxArchiveType=rpm</pre>		:: <pre>https://teams.microsoft.com/downloads/desktopurl?env=production&plat=linux&arch=x64&download=true&linuxArchiveType=rpm</pre>
	:: and install it with your favorite package manager GUI or via dnf as described above.		:: and install it with your favorite package manager GUI or via dnf as described above.

	=== IDE ===		=== IDE ===
	There are a lot of IDEs out there, here is just one of them below:		There are a lot of IDEs out there, here is just one of them below:

192.168.1.104: /* CD/DVD Creation */

2024-01-03T19:31:42Z

CD/DVD Creation

← Older revision		Revision as of 19:31, 3 January 2024
Line 262:		Line 262:
	File:brasero.png\|Brasero main window		File:brasero.png\|Brasero main window
	</gallery>		</gallery>

	=== Chat ===		=== Chat ===
	If your company uses MS o365 services, you can use the following clients/settings.		If your company uses MS o365 services, you can use the following clients/settings.

Queo: /* Groupware (mail/calendar/addressbook/...) */

2023-12-11T15:57:46Z

Groupware (mail/calendar/addressbook/...)

← Older revision		Revision as of 15:57, 11 December 2023
Line 316:		Line 316:
	: Pro: Imho best user interface, easy to organize mails and tasks.		: Pro: Imho best user interface, easy to organize mails and tasks.
	: Con: some additional plugins are required.		: Con: some additional plugins are required.
	: The setup was tested with Thunderbird 68.7.0 64bit		: The setup was tested with Thunderbird 115.5.1 64bit
	:* <ins>Inbox/Outbox</ins>		:* <ins>Inbox/Outbox</ins>
	:: Plugin: "Owl for Exchange"		:: Plugin: "Owl for Exchange"
Line 326:		Line 326:
	Login User Name: <firstname>.<lastname>@yourcompany.tld</syntaxhighlight>		Login User Name: <firstname>.<lastname>@yourcompany.tld</syntaxhighlight>
	:* <ins>Adressbook/Calendar</ins>		:* <ins>Adressbook/Calendar</ins>
	:: Plugins: "TbSync" and "Provider for Exchange ActiveSync"		:: '''=> works out-of-the-box, the howto below is kept for historic reasons'''
			:: <s>Plugins: "TbSync" and "Provider for Exchange ActiveSync"
	:: If not already present, install the "Lightning" plugin (already included in Thunderbird >60), afterwards install the plugins mentioned above with the help of the add-ons-manager in Thunderbird.		:: If not already present, install the "Lightning" plugin (already included in Thunderbird >60), afterwards install the plugins mentioned above with the help of the add-ons-manager in Thunderbird.
	:: 'Configure the calendar sync:'		:: 'Configure the calendar sync:'
Line 336:		Line 337:
	User name (email address): <firstname>.<lastname>@yourcompany.tld		User name (email address): <firstname>.<lastname>@yourcompany.tld
	Password: <your password></syntaxhighlight>		Password: <your password></syntaxhighlight>
	:: Those steps are described in this [https://www.systutorials.com/252208/how-to-synchronize-thunderbird-calendar-and-address-book-with-office365-exchange-online-using-activesync/ systutorial] howto link , too.		:: Those steps are described in this [https://www.systutorials.com/252208/how-to-synchronize-thunderbird-calendar-and-address-book-with-office365-exchange-online-using-activesync/ systutorial] howto link , too.</s>
	~~:: <gallery mode="nolines">~~
	~~File:Active-sync_o365.png~~
	</~~gallery~~>
	:* <ins>Additional Addons/plugins (my personal recommendation)</ins>		:* <ins>Additional Addons/plugins (my personal recommendation)</ins>
	:: Enigmail (OpenPGP encryption)		:: <s>Enigmail (OpenPGP encryption)</s>
	:: Foxclocks (display different timezones)		:: Foxclocks (display different timezones)
	:: Quicktext (create/insert text templates with shortcuts)		:: Quicktext (create/insert text templates with shortcuts)
	:: Unmangle Outlook Safelinks (disable those unreadable o365 safelinks)		:: Unmangle Outlook Safelinks (disable those unreadable o365 safelinks)

	=== Office (text/spreadsheet/presentation/...) ===		=== Office (text/spreadsheet/presentation/...) ===
	* '''Libreoffice'''		* '''Libreoffice'''

Queo: new chapter ordering, added boot process hardenings

2023-12-11T15:34:36Z

new chapter ordering, added boot process hardenings

← Older revision		Revision as of 15:34, 11 December 2023
Line 19:		Line 19:
	Fedora release 39 (Thirty Nine)		Fedora release 39 (Thirty Nine)
	6.6.4-200.fc39.x86_64</syntaxhighlight>		6.6.4-200.fc39.x86_64</syntaxhighlight>

	=== Preparation ===		=== Preparation ===
	As a first step ensure your UEFI/BIOS firmware is up-to-date.		As a first step ensure your UEFI/BIOS firmware is up-to-date.
	Most hardware manufacturers provide an update utility for direct network update in the UEFI/BIOS itself (e.g. HP).		Most hardware manufacturers provide an update utility for direct network update in the UEFI/BIOS itself (e.g. HP, Lenovo, etc.).
	~~For almost every piece of hardware there's a command called 'fwupdtool', with the help of this tool you can do firmware upgrade later on (when Fedora is installed~~).

	=== Installation ===		=== Installation ===
Line 170:		Line 170:
	General advices for your Linux desktop no matter whether you use it at home or at your workplace.		General advices for your Linux desktop no matter whether you use it at home or at your workplace.

			==== Boot process ====
			* '''UEFI/BIOS'''
			: Make sure that the UEFI/BIOS setup is secured with a strong password, so that nobody can change your configuration without this credentials.
			* '''Bootmanager'''
			** '''Grub2'''
			: It's a good practice to harden the Grub2 setup with a strong password, too:
			: <pre>grub2-setpassword</pre>
			: This avoids the reset of the root password without this credentials.

			==== Crypto/Ciphers ====
	* '''Crypto Policies (system wide)'''		* '''Crypto Policies (system wide)'''
	: To ensure a good crypto cipher setup, my advice is to harden the default slightly:		: To ensure a good crypto cipher setup, my advice is to harden the default slightly:
	: <pre>sudo update-crypto-policies --set DEFAULT:NO-SHA1</pre>		: <pre>sudo update-crypto-policies --set DEFAULT:NO-SHA1</pre>

	* '''~~Encryption~~'''		==== Encryption ====
			* '''Disk encryption'''
	: Use LUKS (hard disk encryption) for portable devices (Laptops)		: Use LUKS (hard disk encryption) for portable devices (Laptops)
	: I would suggest to encrypt every device no matter whether portable or not.		: I would suggest to encrypt every device no matter whether portable or not.

	* '''~~Updates~~'''		==== Intrusion detection ====
	: ~~Keep your system up to date (!)~~		* '''AIDE'''
	: ~~Either use~~ the ~~Update function of your preferred Desktop (Gnome3, Cinnamon, KDE,~~ ...) or ~~use good old CLI command~~:		** There's a free alternative to commercial intrusion detection tools like Tripwire and so on, which is called AIDE:
	: <pre>sudo ~~dnf~~ update -y</pre>		:: The setup isn't complicated at all, here's a very good howto link from Fedora: https://docs.fedoraproject.org/en-US/quick-docs/aide-checking-file-integrity/
			:: The commands for the initial setup/test:
			:: <pre>$ sudo dnf install aide; sudo aide --init; sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz; sudo aide --check</pre>
			:: After a system update or config file changes, a new aide database has to be created:
			:: <pre>$ sudo aide --update; sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz</pre>
			:: For a daily check add this in the /etc/crontab file (I prefer my typical lunch time for this ;-) )
			:: <pre>00 13 * * * /usr/sbin/aide --check</pre>

	* '''~~MAC (~~SELinux)'''		==== Mandatory Access Control (MAC) ====
			* '''SELinux'''
	: Please do '''NOT''' disable SELinux, it's enabled by default in Fedora and adds additional security → mandatory access control (MAC) to Linux' standard DAC		: Please do '''NOT''' disable SELinux, it's enabled by default in Fedora and adds additional security → mandatory access control (MAC) to Linux' standard DAC
	: You can check the status with the following command		: You can check the status with the following command
Line 190:		Line 208:
	Enforcing</syntaxhighlight>		Enforcing</syntaxhighlight>

			==== Plug&Play Safety ====
	* '''USB devices'''		* '''USB devices'''
	** To ensure "bad" USB devices will not harm your computer, my advice is to install and configure USBGuard.		** To ensure "bad" USB devices will not harm your computer, my advice is to install and configure USBGuard.
Line 200:		Line 219:
	:: <pre>$ sudo allow-device <nr></pre>		:: <pre>$ sudo allow-device <nr></pre>

	* '''~~Intrusion detection~~'''		==== Updates ====
	** There's a free alternative to ~~commercial intrusion detection tools like Tripwire and so on, which is called AIDE:~~		* '''OS/App-Updates'''
	:~~: The setup isn't complicated at all~~, ~~here's a very good howto link from Fedora: https://docs~~.~~fedoraproject~~.~~org/en-US/quick-docs/aide-checking-file-integrity/~~		: Keep your system up to date (!)
	~~:: The commands for the initial setup/test~~:		: Either use the Update function of your preferred Desktop (Gnome3, Cinnamon, KDE, ...) or use good old CLI command:
	:: <pre>$ sudo dnf ~~install aide; sudo aide --init; sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz; sudo aide~~ -~~-check~~</pre>		: <pre>sudo dnf update -y</pre>
	~~:: After a system update or config file changes, a new aide database has to be created:~~		* '''Firmware Updates'''
	~~:: <pre>$ sudo aide --update; sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz</pre>~~		: For almost every piece of hardware there's a command called 'fwupdtool', with the help of this tool you can accomplish the firmware upgrades (e.g. for your motherboard, usb dongles, etc.)
	:: For a ~~daily check add~~ this in the ~~/etc/crontab file~~ (~~I prefer my typical lunch time~~ for ~~this ;-)~~ )
	~~:: <pre>00 13 * * * /usr/sbin/aide --check</pre>~~

	* '''~~Antivirus~~'''		==== Virus "protection" ====
			* '''In general...'''
	** There are a lot of discussions ongoing whether it's a good choice to use AV (aka snakeoil) in general and in Linux in particular or not.		** There are a lot of discussions ongoing whether it's a good choice to use AV (aka snakeoil) in general and in Linux in particular or not.
	:: Links to these discussions:		:: Links to these discussions:
Line 219:		Line 237:
	:: http://fortune.com/2016/06/29/symantec-norton-vulnerability/		:: http://fortune.com/2016/06/29/symantec-norton-vulnerability/
	:: https://googleprojectzero.blogspot.co.at/2016/06/how-to-compromise-enterprise-endpoint.html		:: https://googleprojectzero.blogspot.co.at/2016/06/how-to-compromise-enterprise-endpoint.html
	:* My advice is to use ClamAV if an AV is a 'must-have'		* '''ClamAV'''
			** My advice is to use ClamAV if an AV is a 'must-have'
	:: Here's how to install ClamAV via the CLI:		:: Here's how to install ClamAV via the CLI:
	:: <pre>$ sudo dnf install clamav clamtk -y</pre>		:: <pre>$ sudo dnf install clamav clamtk -y</pre>
Line 228:		Line 247:
	File:clamav_network-settings.png\|ClamTK network settings		File:clamav_network-settings.png\|ClamTK network settings
	</gallery>		</gallery>
	: As ClamAV is a on demand scanner you have to configure a schedule (maybe every ~~30 min~~ or similar)		: As ClamAV is a on demand scanner you have to configure a schedule (maybe every day or similar)

	== Applications ==		== Applications ==