System Administration

1. Server Side

   • Config files are located at /etc/ssh/sshd_config

   A few key items to look at:

   • PermitRootLogin yes|no
   • PasswordAuthentication yes|no

1. Client Side
   • $ ssh-keygen
   • Will produce a key on the user's machine
   • $ ssh-copy-id
   • Will copy the public key of the ssh keypair to the remote machine. Requires password login to be enabled on the remote machine.

Several avenues:

1. ufw (a front end for iptables):
   • A basic ufw set up:
     • # ufw default deny
     • # ufw allow ssh
     • # ufw allow nginx-full
     • # ufw enable
2. iptables: This is the old school method. Still works great, not a bad option.
3. nftables (replaces iptables): A newer implementation, became standard in several distrobutions (Debian Buster and RHEL 7 circa 2017)
4. firewalld (a frontend for iptables): The systemd solution

1. Scanning:
   1. iwconfig : list network interfaces
   2. ip link set interface up : turn on interface
   3. iwlist interface scan | less : scan available networks
   4. ip link set interface down
2. Accessing:
   1. wifi-menu

Uncomplicated Firewall makes setting up a firewall easy. To make a profile for an application simply place a file in `/etc/ufw/applications.d` with the following format: ``` [appname] title=1-liner here description=A longer line ports=80,443,8080/tcp|10000/udp|53 ```

1. Adding users
   • `adduser user`
   • Creates user 'user'
   • Creates usergroup and home directory according to /etc/adduser.conf
   • Populates the user's home directory with the contents of /etc/skel

This will create the user "user" and prompt for password and other info, including creating a standard home dir for the user.

1. Granting Sudo
   • usermod -aG sudo user Give the user "user" sudo privileges
   • $ cp -r .ssh home/user && chown -R user:user home/user.ssh Useful for copying the public key the root is using to log in to a user they have elevated to sudo priveleges and wish to use going forward.
2. Changing users
   • `su - user` log in as user
   • `sudo su` elevate to root
   • `sudo su -` elevate to root and obtain root's environment
   • `sudo su - user` change to user and the environment you'd expect for them
   • `su - user -c "commands to execute"` execute commands as given user
3. Changing login shell: usermod –shell /bin/shell user

[Unit]
Description=Describe me
[Service]
ExecStart=absolute/path/to/bin

[Install]
WantedBy=multi-user.target

If you need to move certs from one server to another:

1. Copy the certs from `/etc/letsencrypt/archive` and `/etc/letsencrypt/renewal`
2. Symlink from `archive` to `live` appropriately.

1. Block to serve public_html dir in the user directory ``` location ~ ^/(.+?)(/.*)?$ { alias /home/$1/www$2; index index.html index.htm; autoindex on; } ```
2. Serve files not in the root directory for specific URI ``` location /URI/to/match { root /path/to/files } ``` This is useful for linking to static files that you don't want to host in the root directory for whatever reason.
3. Test nginx config for any errors:
   • `nginx -c /etc/nginx/nginx.conf -t`

1. Multiple Domains

It is possible to make one jitsi daemon accesible from multiple domains. Two settings need to be altered.

• Make a proper configuration for the new domain in nginx. This really just means copying the one generated by the jitsi install and altering the server entries to the new domain.
• Then change the bosh entry in /etc/jitsi/meet/domain-config.js to `bosh: '//<!–# echo var="http<sub>host</sub>" –>/<!–# echo var="subdir" default="" –>http-bind'`

Fonts are defined on a user level in `~/.config/fontconfig/fonts.conf`. You can see there what fonts the system will attempt to load when particular font families get called.

$ display ~/Comic-mono.ttf Use imagemagick tool display to view fonts

Use xdg-mime to manipulate when not using a DE.

• To see what the filetype for a file is: xdg-mime query filetype FILE
• To see the default application for a type is: xdg-mime query default application/type
• To change the default:
  • First find the .desktop file to use. Peak in usr/share/applications and grep around for the one you want.
  • then run this command: xdg-mime default application.desktop application/type

Export to another machine: gpg –export-secret-key SOMEKEYID | ssh othermachine gpg –import

Set trust level: gpg –edit-key [key-id] enter command "trust"

Make sure you have an appropriate pinentry program installed.

the GPG_TTY variable might also need to be set

Chezmoi Templates remove trailing newline from shell command: {{ (output "shell.sh") | trimAll "\n" }}

Option 2: use the WireGuard app

1. Install WireGuard

sudo apt-get update && sudo apt-get install curl jq openresolv wireguard

For non-Debian based distributions, follow WireGuard's official installation instructions.

1. Run our configuration script

curl -LO https://mullvad.net/media/files/mullvad-wg.sh && chmod +x ./mullvad-wg.sh && ./mullvad-wg.sh

If you're running WireGuard on multiple devices, generate a separate key pair for each device. You will otherwise likely run into connectivity issues.

1. Turn on WireGuard

wg-quick up mullvad-se4

You may replace "se4" with any of the other regions found on our server page.

Note: Make sure that the configuration file name is no more than 15 characters long (not including ".conf"). Disconnect

wg-quick down mullvad-se4

As before, you may replace "se4" with the currently used region. Verify your connection

To verify that WireGuard is working, use our Connection check to check your IP.

Multihop with WireGuard

Multihop can be used for many different reasons, for example, increasing your privacy or improving latency/performance due to suboptimal ISP peering.

Each WireGuard server is connected to all the other WireGuard servers through WireGuard tunnels. This means you can multihop from one server to another. One way to do this is to connect to a specific port on a WireGuard server which will then connect to the other WireGuard server via the tunnel.

In the WireGuard configuration file the Endpoint port defines the exit server, and the preceding IP-address or hostname defines the entry server: "INSERVER-IP:OUTSERVER-PORT". The PublicKey is that of the exit server.

For example, let's say you want to connect to nl1 via se4 (so nl1 is the exit server). To do this, you would connect to se4-wireguard.mullvad.net:3004 and use the public key of the nl1 server. The port 3004 is the multihop port for nl1.

Choose a multihop port from our server page. Then add a new multihop configuration file by modifying an existing one. In the following example you start with an existing configuration file for nl1 so you have the public key for that. Then you change the Endpoint to connect to se4-wireguard.mullvad.net (or 193.138.218.130) and jump to nl1 via it's multihop port 3004. The configuration is saved as a new configuration file.

sudo sh -c "umask 077; sed 's/^Endpoint.*/Endpoint = se4-wireguard.mullvad.net:3004/' /etc/wireguard/mullvad-nl1.conf > /etc/wireguard/wireguard-se4nl1.conf" Multihop via SOCKS5 proxies

Our SOCKS5 proxy guide includes steps for configuring your browser or other programs to multihop using our WireGuard SOCKS5 proxies. Troubleshooting

If you run into any issues while testing WireGuard, please contact us at support@mullvad.net and let us know what you experience.

Due to a Debian bug, Debian/Ubuntu users may want to install openresolv rather than Debian's broken resolvconf, in order to prevent DNS leaks. DNS leaking Ubuntu 18.04 or newer (or other systems that use systemd-resolved)

In the WireGuard configuration file replace the 'DNS = ' line with : PostUp = systemd-resolve -i %i –set-dns=193.138.218.74 –set-domain=~. FAQ How do I enable a kill switch?

Add the following lines under the [Interface] section of the WireGuard configuration files found in etc/wireguard:

PostUp = iptables -I OUTPUT ! -o %i -m mark ! –mark $(wg show %i fwmark) -m addrtype ! –dst-type LOCAL -j REJECT && ip6tables -I OUTPUT ! -o %i -m mark ! –mark $(wg show %i fwmark) -m addrtype ! –dst-type LOCAL -j REJECT PreDown = iptables -D OUTPUT ! -o %i -m mark ! –mark $(wg show %i fwmark) -m addrtype ! –dst-type LOCAL -j REJECT && ip6tables -D OUTPUT ! -o %i -m mark ! –mark $(wg show %i fwmark) -m addrtype ! –dst-type LOCAL -j REJECT

Issue man wg-quick for more information. How do I make WireGuard start automatically on boot?

Run the following command, replacing mullvad-se4 with the WireGuard server you wish to use.

systemctl enable wg-quick@mullvad-se4 How do I enable port forwarding?

Log in with your account on our website and then add the ports from your account page, you can move the ports to different pubkeys. External resources

WireGuard homepage WireGuard Whitepaper (PDF) Installation Instructions Quickstart Instructions Donate to Upstream WireGuard Development Formal Verification of WireGuard Protocol wg(8) man page wg-quick(8) man page

"WireGuard" is a registered trademark of Jason A. Donenfeld.

Fix an issue on arch linux where kde connect can't reach the phone bc of a firewall.

sudo firewall-cmd –permanent –zone=public –add-service=kdeconnect sudo firewall-cmd –reload

lpoptions -d Printer-to-be-default localhost:631 : The web interface to CUPS print with `lp` command