Alpine Linux - User contributions [en]

Tutorials and Howtos

2024-07-03T14:48:57Z

Reddognighttime: /* Security */

{{Todo|This material has been re-organized..., but grouping should be checked: '''Howtos are smaller articles''' and '''tutorials are more detailed document'''}}

[[Image:package_edutainment.svg|right|link=]]
{{TOC left}}
'''Welcome to Tutorials and Howtos, a place of basic and advanced configuration tasks for your Alpine Linux.'''

'''The tutorials are hands-on''' and the reader is expected to try and achieve the goals described in each step, possibly with the help of a good example. The output in one step is the starting point for the following step.

'''Howtos are smaller articles''' explaining how to perform a particular task with Alpine Linux, that expects a minimal knowledge from reader to perform actions.

'''IMPORTANT:''' contributions on those pages must be complete articles as well as requesting topics to be covered, don't override already made contributions. If you want to request a topic, please add your request in this page's [[Talk:Tutorials_and_Howtos|Discussion]].

{{Clear}}

= Howtos =

== Applications ==

=== Miscellaneous ===

* [[Ansible]] ''(Configuration management)''

=== Monitoring ===

* [[Awstats]] ''(Free log file analyzer)''
* [[Cacti: traffic analysis and monitoring network]] ''(Front-end for rrdtool networking monitor)''
* [[Cvechecker]] ''(Compare installed packages for Common Vulnerabilities Exposure)'' 
* [[Linfo]]
* [[Obtaining user information via SNMP]] ''(Using squark-auth-snmp as a Squid authentication helper)'' 
* [[PhpSysInfo]] ''(A simple application that displays information about the host it's running on)''
* [[Matomo]] ''(A real time web analytics software program)''
* [[Setting up A Network Monitoring and Inventory System]] ''(Nagios + OpenAudit and related components)'' 
** [[Setting up NRPE daemon]] ''(Performs remote Nagios checks)'' 
* [[Setting Up Fprobe And Ntop|Ntop]] ''(NetFlow collection and analysis using a remote fprobe instance; for alpine 3.10-3.12 only)'' 
* [[Setting up lm_sensors]]
* [[SqStat]] ''(Script to look at active squid users connections)''
* [[Traffic monitoring]] 
** [[Setting up monitoring using rrdtool (and rrdcollect)]]
** [[Setting up traffic monitoring using rrdtool (and snmp)]] 
* [[Zabbix|Zabbix - the professional complete manager]] ''(Monitor and track the status of network services and hardware)''
* [[ZoneMinder video camera security and surveillance]]

=== Networking ===

* Alpine Wall ''(a new firewall management framework)''
** [[Alpine Wall]]
** [https://git.alpinelinux.org/awall/about/ Alpine Wall User's Guide]
** [[How-To Alpine Wall]]
* [[Freeradius Active Directory Integration]]
* [[GNUnet]]
* [[Setting up a OpenVPN server|OpenVPN server]] ''(Allowing single users or devices to remotely connect to your network)''
* [[OpenVSwitch]]
* [[Using Alpine on Windows domain with IPSEC isolation]]
* [[Configure a Wireguard interface (wg)|Wireguard]]

=== Telephony ===

* [[FreePBX|FreePBX on Alpine Linux]]
* [[Setting up Zaptel/Asterisk on Alpine]]
* [[Kamailio]] ''(SIP Server, formerly OpenSER)''

== Backup and data migration ==

* [[Alpine local backup|Alpine local backup (lbu)]] ''(Permanently store your modifications in case your box needs reboot)''
** [[Back Up a Flash Memory Installation]]
** [[Manually editing a existing apkovl]]
* [[Migrating data]]
* [[Rsnapshot]] - setting up periodic backups

== Desktop ==

* [[Alpine and UEFI]]
* [[Default applications]]
* Desktop cloud
** [[Nextcloud]] ''(Self hostable cloud suite - Dropbox Alternative)''
* [[Desktop environments and Window managers]] (overall information only)
* [[Printer Setup]]
* [[Remote Desktop Server]]
* Sound Systems
** [[ALSA]]
** [[PipeWire]]
** [[PulseAudio]]
* [[Configure action when power-button is pressed]]
* [[Suspend on LID close]]
* [[Alpine setup scripts#setup-xorg-base|Xorg Setup]]
* Wayland compositors:
** [[Sway]]
** [[River]]
** [[LabWC]]

== Networking ==

* [[Bluetooth]] - Instructions for installing and configuring Bluetooth
* [[Bonding]] - Bond (or aggregate) multiple ethernet interfaces
* [[Bridge]] - Configuring a network bridge
** [[Bridge wlan0 to eth0]]
* [[Configure Networking]]
* [[How to configure static routes]]
* Modem
** [[Using HSDPA modem]]
** [[Using serial modem]]
* [[mDNS]] - Howto implement multicast DNS resolution in Alpine.
* [[Multi ISP]] ''(Dual-ISP setup with load-balancing and automatic failover)''
* [[PXE boot]]
* Wi-Fi
** [[Wi-Fi|Connecting to a wireless access point]]
** [[How to setup a wireless access point]] ''(Setting up Secure Wireless AP w/ WPA encryption with bridge to wired network)''
* [[VLAN]]

== Other Architectures ==

=== ARM ===

* [[Alpine on ARM]]

==== Raspberry Pi ====

* [[Raspberry Pi Bluetooth Speaker|Raspberry Pi - Bluetooth Speaker]]
* [[Raspberry Pi|Raspberry Pi - Installation]]
* [[Linux Router with VPN on a Raspberry Pi|Raspberry Pi - Router with VPN]]
* [[Linux Router with VPN on a Raspberry Pi (IPv6)|Raspberry Pi - Router with VPN (IPv6)]]
* [[Classic install or sys mode on Raspberry Pi|Raspberry Pi - Sys mode install]]
* [[Raspberry Pi LVM on LUKS|Raspberry Pi - Sys mode install - LVM on LUKS]]
* [[RPI Video Receiver|Raspberry Pi - Video Receiver]] ''(network video decoder using Rasperry Pi and omxplayer)''
* [[Raspberry Pi 3 - Browser Client]] - kiosk or digital sign
* [[Raspberry Pi 3 - Configuring it as wireless access point -AP Mode]]
* [[Raspberry Pi 3 - Setting Up Bluetooth]]
* [[Raspberry Pi 4 - Persistent system acting as a NAS and Time Machine]]
* [[How to set up Alpine as a wireless router|Raspberry Pi Zero W - Wireless router]] ''(Setting up a firewalled, Wireless AP with wired network on a Pi Zero W)''

=== IBM Z (IBM z Systems) ===

* [[s390x|s390x - Installation]]

=== PowerPC ===

* [[Ppc64le|Powerpc64le - Installation]]

== Post-Install ==

* [[CPU frequency scaling]]
* [[Repositories#Enabling_the_community_repository|Enable Community repository]] ''(Providing additional packages)''
* [[Enable Serial Console on Boot]]
* [[Alpine Linux Init System|Init System (OpenRC)]] ''(Configure a service to automatically boot at next reboot)''
** [[Multiple Instances of Services|Init System - Multiple Instances of Services]]
** [[Writing Init Scripts|Init System - Writing Init Scripts]]
* [[Installing Oracle Java|Oracle Java (installation)]]
* [[IGMPproxy]]
* [[Alpine Package Keeper|Package Management (apk)]] ''(How to add/remove packages on your Alpine)''
** [[Comparison with other distros|Package Management - Comparison with other distros]]
* [[Running glibc programs]]
* [[Setting up a new user]]
* [[Upgrading Alpine]]
* [[Daily driver guide]]

== Remote Administration ==

* ACF
** [[Changing passwords for ACF|ACF - changing passwords]]
** [[Generating SSL certs with ACF]] 
** [[setup-acf| ACF - setup]] ''(Configures ACF (webconfiguration/webmin) so you can manage your box through https)''
* [[Setting up a SSH server]] ''(Using ssh is a good way to administer your box remotely)''
** [[HOWTO OpenSSH 2FA with password and Google Authenticator |OpenSSH 2FA]] ''(A simple two factor setup for OpenSSH)''
* [[OpenVCP]] ''(VServer Control Panel)''
* [[PhpMyAdmin]] ''(Web-based administration tool for MYSQL)''
* [[PhpPgAdmin]] ''(Web-based administration tool for PostgreSQL)''
* [[Webmin]] ''(A web-based interface for Linux system)''

== Server ==

* [[Hosting services on Alpine]] ''(Hosting mail, webservices and other services)''
* [[Hosting Web/Email services on Alpine]]

=== DNS ===

* [[DNSCrypt-Proxy]] ''Encrypt and authenticate DNS calls from your system''
* [[Setting up nsd DNS server]]
* [[Setting up unbound DNS server]]
* [[TinyDNS Format]]

=== HTTP ===

* [[Apache]]
** [[Apache with php-fpm]]
** [[Setting Up Apache with PHP]]
** [[Apache authentication: NTLM Single Signon]]
* [[Darkhttpd]]
* [[Lighttpd]]
** [[Lighttpd Advanced security]]
** [[Setting Up Lighttpd With FastCGI]]
* [[Nginx]]
** [[Nginx as reverse proxy with acme (letsencrypt)]]
** [[Nginx with PHP]]
* Squid Proxy
** [[Obtaining user information via SNMP]] ''(Using squark-auth-snmp as a Squid authentication helper)'' 
** [[Setting up Explicit Squid Proxy]]
** [[Setting up Transparent Squid Proxy]] ''(Covers Squid proxy and URL Filtering system)''
** [[SqStat]] ''(Script to look at active squid users connections)''
* [[Tomcat]]

==== Hostable Content ====

* [[DokuWiki]]
* [[Drupal]] ''(Content Management System (CMS) written in PHP)''
* [[Kopano]] ''(Microsoft Outlook compatible Groupware)''
* [[Mahara]] ''(E-portfolio and social networking system)''
* [[MediaWiki]] ''(Free web-based wiki software application)''
* [[Pastebin]] ''(Pastebin software application)''
* [[WordPress]] ''(Web software to create website or blog)''

=== IRC ===

* [[NgIRCd]] ''(Server for Internet Relay Chat/IRC)''

=== Mail ===

* Exim/Dovecot
** [[Small-Time Email with Exim and Dovecot]] ''(A simple configuration for your home network.)
** [[Setting up dovecot with imap and tls]]
* [[relay email to gmail (msmtp, mailx, sendmail]]
* [[Roundcube]] ''(Webmail system)''
* [[Setting up postfix with virtual domains]]
* Server protection
** [[Setting up clamsmtp]]

=== Other Servers ===

* [[Chrony and GPSD | Chrony, gpsd, and a garmin LVC 18 as a Stratum 1 NTP source ]]
* [[Glpi]] ''(Manage inventory of technical resources)''
* [[How to setup a Alpine Linux mirror]]
* [[Setting up an NFS server|nfs-server]]
* [[Odoo]]
* [[Configure OpenLDAP | OpenLDAP]] ''(Installing and configuring the Alpine package for OpenLDAP)''
* [[Setting up a samba-ad-dc|samba-ad-dc]] ''(Active Directory compatible domain controller)''
* [[Setting up a Samba server|samba-server]] ''(standard file sharing)''
* [[Setting up Transmission (bittorrent) with Clutch WebUI]]

=== Software development ===

* [[Cgit]]
* [[OsTicket]] ''(Ticket system)''
* [[Patchwork]] ''(Patch review management system)''
* [[Redmine]] ''(Project management system)''
* [[Request Tracker]] ''(Ticket system)''
* [[Setting up trac wiki|Trac]] ''(Enhanced wiki and issue tracking system for software development projects)''

== Storage ==

* [[Setting up disks manually|Disk setup (manual)]]
* [[Filesystems]]
** [[Burning ISOs]]
* [[Setting up iSCSI|iSCSI Setup]]
** [[iSCSI Raid and Clustered File Systems]]
** [[Linux iSCSI Target (TCM)|iSCSI Target (TCM)/LinuxIO (LIO)]]
** [[Linux iSCSI Target (tgt)|User space iSCSI Target (tgt)]]
* [[Setting up Logical Volumes with LVM|LVM Setup]]
** [[Setting up LVM on GPT-labeled disks|LVM on GPT-labeled disks]]
** [[Installing on GPT LVM|LVM on GPT-labeled disks (updated)]]
** [[LVM on LUKS]]
* RAID
** [[Raid Administration]]
** [[Setting up a software RAID array]]
* ZFS
** [[Root on ZFS with native encryption]]
** [[Setting up ZFS on LUKS]]
** [[Setting up ZFS with native encryption]]
** [[ZFS scrub and trim]]
* [[CEPH|CEPH]]

== Virtualization ==

* [[Docker]]
* [[Installing Alpine in a virtual machine]]
** [[Install Alpine on VMware ESXi]]
* [[KVM]] ''(Setting up Alpine as a KVM hypervisor)''
* [[LXC]] ''(Setting up a Linux container in Alpine Linux)''
* [[QEMU]]
* Xen
** [[Xen Dom0]] ''(Setting up Alpine as a dom0 for Xen hypervisor)''
** [[Xen Dom0 on USB or SD]]
** [[Create Alpine Linux PV DomU|Xen DomU (paravirtualized)]]
** [[Xen LiveCD]]
** [[Xen PCI Passthrough]]

= Tutorials =

== Miscellaneous ==

* [[TTY_Autologin|TTY Autologin]]
* [[Kexec|Faster rebooting with kexec]]
* [[Dynamic Multipoint VPN (DMVPN)]] combined with [[Small Office Services]]
* [[DIY Fully working Alpine Linux for Allwinner and Other ARM SOCs]]
* [[Fault Tolerant Routing with Alpine Linux]]
* [[High Availability High Performance Web Cache]] ''(uCarp + HAProxy for High Availability Services such as Squid web proxy)''
* [[Linux iSCSI Target (TCM)]]
* [[ISP Mail Server 3.x HowTo]]] ''(Postfix+PostfixAdmin+DoveCot+Roundcube+ClamAV+Spamd - A full-service ISP mail server)''
* [[Replacing non-Alpine Linux with Alpine remotely]]
* [[Setting up A Network Monitoring and Inventory System]] ''(Nagios + OpenAudit and related components)'' 
* [[Streaming Security Camera Video with VLC]]

== Newbie corner ==

* [[How to get regular stuff working]] ''some notes on need-to-know topics''

== Servers ==

* [[Alpine production deploy]]
** [[Production Web server: Lighttpd|Production web server: Lighttpd‎‎]]
** [[MySQL|Production database: MySQL]]
** [[Production LAMP system: Lighttpd + PHP + MySQL‎‎]]
* Alpine production monitoring
** [[Cacti: traffic analysis and monitoring network]]
** [[Zabbix|Zabbix - the professional complete manager]]
* Kubernetes
** [[K8s]] Building a K8s Cluster on Alpine Linux

== Security ==

* [[Securing Alpine Linux]] How to Secure Alpine Linux using Security Technical Implementation Guides (STIGs)

Tutorials and Howtos

2024-07-03T14:47:29Z

Reddognighttime: /* Security */

{{Todo|This material has been re-organized..., but grouping should be checked: '''Howtos are smaller articles''' and '''tutorials are more detailed document'''}}

[[Image:package_edutainment.svg|right|link=]]
{{TOC left}}
'''Welcome to Tutorials and Howtos, a place of basic and advanced configuration tasks for your Alpine Linux.'''

'''The tutorials are hands-on''' and the reader is expected to try and achieve the goals described in each step, possibly with the help of a good example. The output in one step is the starting point for the following step.

'''Howtos are smaller articles''' explaining how to perform a particular task with Alpine Linux, that expects a minimal knowledge from reader to perform actions.

'''IMPORTANT:''' contributions on those pages must be complete articles as well as requesting topics to be covered, don't override already made contributions. If you want to request a topic, please add your request in this page's [[Talk:Tutorials_and_Howtos|Discussion]].

{{Clear}}

= Howtos =

== Applications ==

=== Miscellaneous ===

* [[Ansible]] ''(Configuration management)''

=== Monitoring ===

* [[Awstats]] ''(Free log file analyzer)''
* [[Cacti: traffic analysis and monitoring network]] ''(Front-end for rrdtool networking monitor)''
* [[Cvechecker]] ''(Compare installed packages for Common Vulnerabilities Exposure)'' 
* [[Linfo]]
* [[Obtaining user information via SNMP]] ''(Using squark-auth-snmp as a Squid authentication helper)'' 
* [[PhpSysInfo]] ''(A simple application that displays information about the host it's running on)''
* [[Matomo]] ''(A real time web analytics software program)''
* [[Setting up A Network Monitoring and Inventory System]] ''(Nagios + OpenAudit and related components)'' 
** [[Setting up NRPE daemon]] ''(Performs remote Nagios checks)'' 
* [[Setting Up Fprobe And Ntop|Ntop]] ''(NetFlow collection and analysis using a remote fprobe instance; for alpine 3.10-3.12 only)'' 
* [[Setting up lm_sensors]]
* [[SqStat]] ''(Script to look at active squid users connections)''
* [[Traffic monitoring]] 
** [[Setting up monitoring using rrdtool (and rrdcollect)]]
** [[Setting up traffic monitoring using rrdtool (and snmp)]] 
* [[Zabbix|Zabbix - the professional complete manager]] ''(Monitor and track the status of network services and hardware)''
* [[ZoneMinder video camera security and surveillance]]

=== Networking ===

* Alpine Wall ''(a new firewall management framework)''
** [[Alpine Wall]]
** [https://git.alpinelinux.org/awall/about/ Alpine Wall User's Guide]
** [[How-To Alpine Wall]]
* [[Freeradius Active Directory Integration]]
* [[GNUnet]]
* [[Setting up a OpenVPN server|OpenVPN server]] ''(Allowing single users or devices to remotely connect to your network)''
* [[OpenVSwitch]]
* [[Using Alpine on Windows domain with IPSEC isolation]]
* [[Configure a Wireguard interface (wg)|Wireguard]]

=== Telephony ===

* [[FreePBX|FreePBX on Alpine Linux]]
* [[Setting up Zaptel/Asterisk on Alpine]]
* [[Kamailio]] ''(SIP Server, formerly OpenSER)''

== Backup and data migration ==

* [[Alpine local backup|Alpine local backup (lbu)]] ''(Permanently store your modifications in case your box needs reboot)''
** [[Back Up a Flash Memory Installation]]
** [[Manually editing a existing apkovl]]
* [[Migrating data]]
* [[Rsnapshot]] - setting up periodic backups

== Desktop ==

* [[Alpine and UEFI]]
* [[Default applications]]
* Desktop cloud
** [[Nextcloud]] ''(Self hostable cloud suite - Dropbox Alternative)''
* [[Desktop environments and Window managers]] (overall information only)
* [[Printer Setup]]
* [[Remote Desktop Server]]
* Sound Systems
** [[ALSA]]
** [[PipeWire]]
** [[PulseAudio]]
* [[Configure action when power-button is pressed]]
* [[Suspend on LID close]]
* [[Alpine setup scripts#setup-xorg-base|Xorg Setup]]
* Wayland compositors:
** [[Sway]]
** [[River]]
** [[LabWC]]

== Networking ==

* [[Bluetooth]] - Instructions for installing and configuring Bluetooth
* [[Bonding]] - Bond (or aggregate) multiple ethernet interfaces
* [[Bridge]] - Configuring a network bridge
** [[Bridge wlan0 to eth0]]
* [[Configure Networking]]
* [[How to configure static routes]]
* Modem
** [[Using HSDPA modem]]
** [[Using serial modem]]
* [[mDNS]] - Howto implement multicast DNS resolution in Alpine.
* [[Multi ISP]] ''(Dual-ISP setup with load-balancing and automatic failover)''
* [[PXE boot]]
* Wi-Fi
** [[Wi-Fi|Connecting to a wireless access point]]
** [[How to setup a wireless access point]] ''(Setting up Secure Wireless AP w/ WPA encryption with bridge to wired network)''
* [[VLAN]]

== Other Architectures ==

=== ARM ===

* [[Alpine on ARM]]

==== Raspberry Pi ====

* [[Raspberry Pi Bluetooth Speaker|Raspberry Pi - Bluetooth Speaker]]
* [[Raspberry Pi|Raspberry Pi - Installation]]
* [[Linux Router with VPN on a Raspberry Pi|Raspberry Pi - Router with VPN]]
* [[Linux Router with VPN on a Raspberry Pi (IPv6)|Raspberry Pi - Router with VPN (IPv6)]]
* [[Classic install or sys mode on Raspberry Pi|Raspberry Pi - Sys mode install]]
* [[Raspberry Pi LVM on LUKS|Raspberry Pi - Sys mode install - LVM on LUKS]]
* [[RPI Video Receiver|Raspberry Pi - Video Receiver]] ''(network video decoder using Rasperry Pi and omxplayer)''
* [[Raspberry Pi 3 - Browser Client]] - kiosk or digital sign
* [[Raspberry Pi 3 - Configuring it as wireless access point -AP Mode]]
* [[Raspberry Pi 3 - Setting Up Bluetooth]]
* [[Raspberry Pi 4 - Persistent system acting as a NAS and Time Machine]]
* [[How to set up Alpine as a wireless router|Raspberry Pi Zero W - Wireless router]] ''(Setting up a firewalled, Wireless AP with wired network on a Pi Zero W)''

=== IBM Z (IBM z Systems) ===

* [[s390x|s390x - Installation]]

=== PowerPC ===

* [[Ppc64le|Powerpc64le - Installation]]

== Post-Install ==

* [[CPU frequency scaling]]
* [[Repositories#Enabling_the_community_repository|Enable Community repository]] ''(Providing additional packages)''
* [[Enable Serial Console on Boot]]
* [[Alpine Linux Init System|Init System (OpenRC)]] ''(Configure a service to automatically boot at next reboot)''
** [[Multiple Instances of Services|Init System - Multiple Instances of Services]]
** [[Writing Init Scripts|Init System - Writing Init Scripts]]
* [[Installing Oracle Java|Oracle Java (installation)]]
* [[IGMPproxy]]
* [[Alpine Package Keeper|Package Management (apk)]] ''(How to add/remove packages on your Alpine)''
** [[Comparison with other distros|Package Management - Comparison with other distros]]
* [[Running glibc programs]]
* [[Setting up a new user]]
* [[Upgrading Alpine]]
* [[Daily driver guide]]

== Remote Administration ==

* ACF
** [[Changing passwords for ACF|ACF - changing passwords]]
** [[Generating SSL certs with ACF]] 
** [[setup-acf| ACF - setup]] ''(Configures ACF (webconfiguration/webmin) so you can manage your box through https)''
* [[Setting up a SSH server]] ''(Using ssh is a good way to administer your box remotely)''
** [[HOWTO OpenSSH 2FA with password and Google Authenticator |OpenSSH 2FA]] ''(A simple two factor setup for OpenSSH)''
* [[OpenVCP]] ''(VServer Control Panel)''
* [[PhpMyAdmin]] ''(Web-based administration tool for MYSQL)''
* [[PhpPgAdmin]] ''(Web-based administration tool for PostgreSQL)''
* [[Webmin]] ''(A web-based interface for Linux system)''

== Server ==

* [[Hosting services on Alpine]] ''(Hosting mail, webservices and other services)''
* [[Hosting Web/Email services on Alpine]]

=== DNS ===

* [[DNSCrypt-Proxy]] ''Encrypt and authenticate DNS calls from your system''
* [[Setting up nsd DNS server]]
* [[Setting up unbound DNS server]]
* [[TinyDNS Format]]

=== HTTP ===

* [[Apache]]
** [[Apache with php-fpm]]
** [[Setting Up Apache with PHP]]
** [[Apache authentication: NTLM Single Signon]]
* [[Darkhttpd]]
* [[Lighttpd]]
** [[Lighttpd Advanced security]]
** [[Setting Up Lighttpd With FastCGI]]
* [[Nginx]]
** [[Nginx as reverse proxy with acme (letsencrypt)]]
** [[Nginx with PHP]]
* Squid Proxy
** [[Obtaining user information via SNMP]] ''(Using squark-auth-snmp as a Squid authentication helper)'' 
** [[Setting up Explicit Squid Proxy]]
** [[Setting up Transparent Squid Proxy]] ''(Covers Squid proxy and URL Filtering system)''
** [[SqStat]] ''(Script to look at active squid users connections)''
* [[Tomcat]]

==== Hostable Content ====

* [[DokuWiki]]
* [[Drupal]] ''(Content Management System (CMS) written in PHP)''
* [[Kopano]] ''(Microsoft Outlook compatible Groupware)''
* [[Mahara]] ''(E-portfolio and social networking system)''
* [[MediaWiki]] ''(Free web-based wiki software application)''
* [[Pastebin]] ''(Pastebin software application)''
* [[WordPress]] ''(Web software to create website or blog)''

=== IRC ===

* [[NgIRCd]] ''(Server for Internet Relay Chat/IRC)''

=== Mail ===

* Exim/Dovecot
** [[Small-Time Email with Exim and Dovecot]] ''(A simple configuration for your home network.)
** [[Setting up dovecot with imap and tls]]
* [[relay email to gmail (msmtp, mailx, sendmail]]
* [[Roundcube]] ''(Webmail system)''
* [[Setting up postfix with virtual domains]]
* Server protection
** [[Setting up clamsmtp]]

=== Other Servers ===

* [[Chrony and GPSD | Chrony, gpsd, and a garmin LVC 18 as a Stratum 1 NTP source ]]
* [[Glpi]] ''(Manage inventory of technical resources)''
* [[How to setup a Alpine Linux mirror]]
* [[Setting up an NFS server|nfs-server]]
* [[Odoo]]
* [[Configure OpenLDAP | OpenLDAP]] ''(Installing and configuring the Alpine package for OpenLDAP)''
* [[Setting up a samba-ad-dc|samba-ad-dc]] ''(Active Directory compatible domain controller)''
* [[Setting up a Samba server|samba-server]] ''(standard file sharing)''
* [[Setting up Transmission (bittorrent) with Clutch WebUI]]

=== Software development ===

* [[Cgit]]
* [[OsTicket]] ''(Ticket system)''
* [[Patchwork]] ''(Patch review management system)''
* [[Redmine]] ''(Project management system)''
* [[Request Tracker]] ''(Ticket system)''
* [[Setting up trac wiki|Trac]] ''(Enhanced wiki and issue tracking system for software development projects)''

== Storage ==

* [[Setting up disks manually|Disk setup (manual)]]
* [[Filesystems]]
** [[Burning ISOs]]
* [[Setting up iSCSI|iSCSI Setup]]
** [[iSCSI Raid and Clustered File Systems]]
** [[Linux iSCSI Target (TCM)|iSCSI Target (TCM)/LinuxIO (LIO)]]
** [[Linux iSCSI Target (tgt)|User space iSCSI Target (tgt)]]
* [[Setting up Logical Volumes with LVM|LVM Setup]]
** [[Setting up LVM on GPT-labeled disks|LVM on GPT-labeled disks]]
** [[Installing on GPT LVM|LVM on GPT-labeled disks (updated)]]
** [[LVM on LUKS]]
* RAID
** [[Raid Administration]]
** [[Setting up a software RAID array]]
* ZFS
** [[Root on ZFS with native encryption]]
** [[Setting up ZFS on LUKS]]
** [[Setting up ZFS with native encryption]]
** [[ZFS scrub and trim]]
* [[CEPH|CEPH]]

== Virtualization ==

* [[Docker]]
* [[Installing Alpine in a virtual machine]]
** [[Install Alpine on VMware ESXi]]
* [[KVM]] ''(Setting up Alpine as a KVM hypervisor)''
* [[LXC]] ''(Setting up a Linux container in Alpine Linux)''
* [[QEMU]]
* Xen
** [[Xen Dom0]] ''(Setting up Alpine as a dom0 for Xen hypervisor)''
** [[Xen Dom0 on USB or SD]]
** [[Create Alpine Linux PV DomU|Xen DomU (paravirtualized)]]
** [[Xen LiveCD]]
** [[Xen PCI Passthrough]]

= Tutorials =

== Miscellaneous ==

* [[TTY_Autologin|TTY Autologin]]
* [[Kexec|Faster rebooting with kexec]]
* [[Dynamic Multipoint VPN (DMVPN)]] combined with [[Small Office Services]]
* [[DIY Fully working Alpine Linux for Allwinner and Other ARM SOCs]]
* [[Fault Tolerant Routing with Alpine Linux]]
* [[High Availability High Performance Web Cache]] ''(uCarp + HAProxy for High Availability Services such as Squid web proxy)''
* [[Linux iSCSI Target (TCM)]]
* [[ISP Mail Server 3.x HowTo]]] ''(Postfix+PostfixAdmin+DoveCot+Roundcube+ClamAV+Spamd - A full-service ISP mail server)''
* [[Replacing non-Alpine Linux with Alpine remotely]]
* [[Setting up A Network Monitoring and Inventory System]] ''(Nagios + OpenAudit and related components)'' 
* [[Streaming Security Camera Video with VLC]]

== Newbie corner ==

* [[How to get regular stuff working]] ''some notes on need-to-know topics''

== Servers ==

* [[Alpine production deploy]]
** [[Production Web server: Lighttpd|Production web server: Lighttpd‎‎]]
** [[MySQL|Production database: MySQL]]
** [[Production LAMP system: Lighttpd + PHP + MySQL‎‎]]
* Alpine production monitoring
** [[Cacti: traffic analysis and monitoring network]]
** [[Zabbix|Zabbix - the professional complete manager]]
* Kubernetes
** [[K8s]] Building a K8s Cluster on Alpine Linux

== Security ==

* [[Securing Alpine Linux]] Securing Alpine Linux using Security Technical Implementation Guides (STIGs)

Tutorials and Howtos

2024-07-03T14:46:54Z

Reddognighttime: /* Security */

{{Todo|This material has been re-organized..., but grouping should be checked: '''Howtos are smaller articles''' and '''tutorials are more detailed document'''}}

[[Image:package_edutainment.svg|right|link=]]
{{TOC left}}
'''Welcome to Tutorials and Howtos, a place of basic and advanced configuration tasks for your Alpine Linux.'''

'''The tutorials are hands-on''' and the reader is expected to try and achieve the goals described in each step, possibly with the help of a good example. The output in one step is the starting point for the following step.

'''Howtos are smaller articles''' explaining how to perform a particular task with Alpine Linux, that expects a minimal knowledge from reader to perform actions.

'''IMPORTANT:''' contributions on those pages must be complete articles as well as requesting topics to be covered, don't override already made contributions. If you want to request a topic, please add your request in this page's [[Talk:Tutorials_and_Howtos|Discussion]].

{{Clear}}

= Howtos =

== Applications ==

=== Miscellaneous ===

* [[Ansible]] ''(Configuration management)''

=== Monitoring ===

* [[Awstats]] ''(Free log file analyzer)''
* [[Cacti: traffic analysis and monitoring network]] ''(Front-end for rrdtool networking monitor)''
* [[Cvechecker]] ''(Compare installed packages for Common Vulnerabilities Exposure)'' 
* [[Linfo]]
* [[Obtaining user information via SNMP]] ''(Using squark-auth-snmp as a Squid authentication helper)'' 
* [[PhpSysInfo]] ''(A simple application that displays information about the host it's running on)''
* [[Matomo]] ''(A real time web analytics software program)''
* [[Setting up A Network Monitoring and Inventory System]] ''(Nagios + OpenAudit and related components)'' 
** [[Setting up NRPE daemon]] ''(Performs remote Nagios checks)'' 
* [[Setting Up Fprobe And Ntop|Ntop]] ''(NetFlow collection and analysis using a remote fprobe instance; for alpine 3.10-3.12 only)'' 
* [[Setting up lm_sensors]]
* [[SqStat]] ''(Script to look at active squid users connections)''
* [[Traffic monitoring]] 
** [[Setting up monitoring using rrdtool (and rrdcollect)]]
** [[Setting up traffic monitoring using rrdtool (and snmp)]] 
* [[Zabbix|Zabbix - the professional complete manager]] ''(Monitor and track the status of network services and hardware)''
* [[ZoneMinder video camera security and surveillance]]

=== Networking ===

* Alpine Wall ''(a new firewall management framework)''
** [[Alpine Wall]]
** [https://git.alpinelinux.org/awall/about/ Alpine Wall User's Guide]
** [[How-To Alpine Wall]]
* [[Freeradius Active Directory Integration]]
* [[GNUnet]]
* [[Setting up a OpenVPN server|OpenVPN server]] ''(Allowing single users or devices to remotely connect to your network)''
* [[OpenVSwitch]]
* [[Using Alpine on Windows domain with IPSEC isolation]]
* [[Configure a Wireguard interface (wg)|Wireguard]]

=== Telephony ===

* [[FreePBX|FreePBX on Alpine Linux]]
* [[Setting up Zaptel/Asterisk on Alpine]]
* [[Kamailio]] ''(SIP Server, formerly OpenSER)''

== Backup and data migration ==

* [[Alpine local backup|Alpine local backup (lbu)]] ''(Permanently store your modifications in case your box needs reboot)''
** [[Back Up a Flash Memory Installation]]
** [[Manually editing a existing apkovl]]
* [[Migrating data]]
* [[Rsnapshot]] - setting up periodic backups

== Desktop ==

* [[Alpine and UEFI]]
* [[Default applications]]
* Desktop cloud
** [[Nextcloud]] ''(Self hostable cloud suite - Dropbox Alternative)''
* [[Desktop environments and Window managers]] (overall information only)
* [[Printer Setup]]
* [[Remote Desktop Server]]
* Sound Systems
** [[ALSA]]
** [[PipeWire]]
** [[PulseAudio]]
* [[Configure action when power-button is pressed]]
* [[Suspend on LID close]]
* [[Alpine setup scripts#setup-xorg-base|Xorg Setup]]
* Wayland compositors:
** [[Sway]]
** [[River]]
** [[LabWC]]

== Networking ==

* [[Bluetooth]] - Instructions for installing and configuring Bluetooth
* [[Bonding]] - Bond (or aggregate) multiple ethernet interfaces
* [[Bridge]] - Configuring a network bridge
** [[Bridge wlan0 to eth0]]
* [[Configure Networking]]
* [[How to configure static routes]]
* Modem
** [[Using HSDPA modem]]
** [[Using serial modem]]
* [[mDNS]] - Howto implement multicast DNS resolution in Alpine.
* [[Multi ISP]] ''(Dual-ISP setup with load-balancing and automatic failover)''
* [[PXE boot]]
* Wi-Fi
** [[Wi-Fi|Connecting to a wireless access point]]
** [[How to setup a wireless access point]] ''(Setting up Secure Wireless AP w/ WPA encryption with bridge to wired network)''
* [[VLAN]]

== Other Architectures ==

=== ARM ===

* [[Alpine on ARM]]

==== Raspberry Pi ====

* [[Raspberry Pi Bluetooth Speaker|Raspberry Pi - Bluetooth Speaker]]
* [[Raspberry Pi|Raspberry Pi - Installation]]
* [[Linux Router with VPN on a Raspberry Pi|Raspberry Pi - Router with VPN]]
* [[Linux Router with VPN on a Raspberry Pi (IPv6)|Raspberry Pi - Router with VPN (IPv6)]]
* [[Classic install or sys mode on Raspberry Pi|Raspberry Pi - Sys mode install]]
* [[Raspberry Pi LVM on LUKS|Raspberry Pi - Sys mode install - LVM on LUKS]]
* [[RPI Video Receiver|Raspberry Pi - Video Receiver]] ''(network video decoder using Rasperry Pi and omxplayer)''
* [[Raspberry Pi 3 - Browser Client]] - kiosk or digital sign
* [[Raspberry Pi 3 - Configuring it as wireless access point -AP Mode]]
* [[Raspberry Pi 3 - Setting Up Bluetooth]]
* [[Raspberry Pi 4 - Persistent system acting as a NAS and Time Machine]]
* [[How to set up Alpine as a wireless router|Raspberry Pi Zero W - Wireless router]] ''(Setting up a firewalled, Wireless AP with wired network on a Pi Zero W)''

=== IBM Z (IBM z Systems) ===

* [[s390x|s390x - Installation]]

=== PowerPC ===

* [[Ppc64le|Powerpc64le - Installation]]

== Post-Install ==

* [[CPU frequency scaling]]
* [[Repositories#Enabling_the_community_repository|Enable Community repository]] ''(Providing additional packages)''
* [[Enable Serial Console on Boot]]
* [[Alpine Linux Init System|Init System (OpenRC)]] ''(Configure a service to automatically boot at next reboot)''
** [[Multiple Instances of Services|Init System - Multiple Instances of Services]]
** [[Writing Init Scripts|Init System - Writing Init Scripts]]
* [[Installing Oracle Java|Oracle Java (installation)]]
* [[IGMPproxy]]
* [[Alpine Package Keeper|Package Management (apk)]] ''(How to add/remove packages on your Alpine)''
** [[Comparison with other distros|Package Management - Comparison with other distros]]
* [[Running glibc programs]]
* [[Setting up a new user]]
* [[Upgrading Alpine]]
* [[Daily driver guide]]

== Remote Administration ==

* ACF
** [[Changing passwords for ACF|ACF - changing passwords]]
** [[Generating SSL certs with ACF]] 
** [[setup-acf| ACF - setup]] ''(Configures ACF (webconfiguration/webmin) so you can manage your box through https)''
* [[Setting up a SSH server]] ''(Using ssh is a good way to administer your box remotely)''
** [[HOWTO OpenSSH 2FA with password and Google Authenticator |OpenSSH 2FA]] ''(A simple two factor setup for OpenSSH)''
* [[OpenVCP]] ''(VServer Control Panel)''
* [[PhpMyAdmin]] ''(Web-based administration tool for MYSQL)''
* [[PhpPgAdmin]] ''(Web-based administration tool for PostgreSQL)''
* [[Webmin]] ''(A web-based interface for Linux system)''

== Server ==

* [[Hosting services on Alpine]] ''(Hosting mail, webservices and other services)''
* [[Hosting Web/Email services on Alpine]]

=== DNS ===

* [[DNSCrypt-Proxy]] ''Encrypt and authenticate DNS calls from your system''
* [[Setting up nsd DNS server]]
* [[Setting up unbound DNS server]]
* [[TinyDNS Format]]

=== HTTP ===

* [[Apache]]
** [[Apache with php-fpm]]
** [[Setting Up Apache with PHP]]
** [[Apache authentication: NTLM Single Signon]]
* [[Darkhttpd]]
* [[Lighttpd]]
** [[Lighttpd Advanced security]]
** [[Setting Up Lighttpd With FastCGI]]
* [[Nginx]]
** [[Nginx as reverse proxy with acme (letsencrypt)]]
** [[Nginx with PHP]]
* Squid Proxy
** [[Obtaining user information via SNMP]] ''(Using squark-auth-snmp as a Squid authentication helper)'' 
** [[Setting up Explicit Squid Proxy]]
** [[Setting up Transparent Squid Proxy]] ''(Covers Squid proxy and URL Filtering system)''
** [[SqStat]] ''(Script to look at active squid users connections)''
* [[Tomcat]]

==== Hostable Content ====

* [[DokuWiki]]
* [[Drupal]] ''(Content Management System (CMS) written in PHP)''
* [[Kopano]] ''(Microsoft Outlook compatible Groupware)''
* [[Mahara]] ''(E-portfolio and social networking system)''
* [[MediaWiki]] ''(Free web-based wiki software application)''
* [[Pastebin]] ''(Pastebin software application)''
* [[WordPress]] ''(Web software to create website or blog)''

=== IRC ===

* [[NgIRCd]] ''(Server for Internet Relay Chat/IRC)''

=== Mail ===

* Exim/Dovecot
** [[Small-Time Email with Exim and Dovecot]] ''(A simple configuration for your home network.)
** [[Setting up dovecot with imap and tls]]
* [[relay email to gmail (msmtp, mailx, sendmail]]
* [[Roundcube]] ''(Webmail system)''
* [[Setting up postfix with virtual domains]]
* Server protection
** [[Setting up clamsmtp]]

=== Other Servers ===

* [[Chrony and GPSD | Chrony, gpsd, and a garmin LVC 18 as a Stratum 1 NTP source ]]
* [[Glpi]] ''(Manage inventory of technical resources)''
* [[How to setup a Alpine Linux mirror]]
* [[Setting up an NFS server|nfs-server]]
* [[Odoo]]
* [[Configure OpenLDAP | OpenLDAP]] ''(Installing and configuring the Alpine package for OpenLDAP)''
* [[Setting up a samba-ad-dc|samba-ad-dc]] ''(Active Directory compatible domain controller)''
* [[Setting up a Samba server|samba-server]] ''(standard file sharing)''
* [[Setting up Transmission (bittorrent) with Clutch WebUI]]

=== Software development ===

* [[Cgit]]
* [[OsTicket]] ''(Ticket system)''
* [[Patchwork]] ''(Patch review management system)''
* [[Redmine]] ''(Project management system)''
* [[Request Tracker]] ''(Ticket system)''
* [[Setting up trac wiki|Trac]] ''(Enhanced wiki and issue tracking system for software development projects)''

== Storage ==

* [[Setting up disks manually|Disk setup (manual)]]
* [[Filesystems]]
** [[Burning ISOs]]
* [[Setting up iSCSI|iSCSI Setup]]
** [[iSCSI Raid and Clustered File Systems]]
** [[Linux iSCSI Target (TCM)|iSCSI Target (TCM)/LinuxIO (LIO)]]
** [[Linux iSCSI Target (tgt)|User space iSCSI Target (tgt)]]
* [[Setting up Logical Volumes with LVM|LVM Setup]]
** [[Setting up LVM on GPT-labeled disks|LVM on GPT-labeled disks]]
** [[Installing on GPT LVM|LVM on GPT-labeled disks (updated)]]
** [[LVM on LUKS]]
* RAID
** [[Raid Administration]]
** [[Setting up a software RAID array]]
* ZFS
** [[Root on ZFS with native encryption]]
** [[Setting up ZFS on LUKS]]
** [[Setting up ZFS with native encryption]]
** [[ZFS scrub and trim]]
* [[CEPH|CEPH]]

== Virtualization ==

* [[Docker]]
* [[Installing Alpine in a virtual machine]]
** [[Install Alpine on VMware ESXi]]
* [[KVM]] ''(Setting up Alpine as a KVM hypervisor)''
* [[LXC]] ''(Setting up a Linux container in Alpine Linux)''
* [[QEMU]]
* Xen
** [[Xen Dom0]] ''(Setting up Alpine as a dom0 for Xen hypervisor)''
** [[Xen Dom0 on USB or SD]]
** [[Create Alpine Linux PV DomU|Xen DomU (paravirtualized)]]
** [[Xen LiveCD]]
** [[Xen PCI Passthrough]]

= Tutorials =

== Miscellaneous ==

* [[TTY_Autologin|TTY Autologin]]
* [[Kexec|Faster rebooting with kexec]]
* [[Dynamic Multipoint VPN (DMVPN)]] combined with [[Small Office Services]]
* [[DIY Fully working Alpine Linux for Allwinner and Other ARM SOCs]]
* [[Fault Tolerant Routing with Alpine Linux]]
* [[High Availability High Performance Web Cache]] ''(uCarp + HAProxy for High Availability Services such as Squid web proxy)''
* [[Linux iSCSI Target (TCM)]]
* [[ISP Mail Server 3.x HowTo]]] ''(Postfix+PostfixAdmin+DoveCot+Roundcube+ClamAV+Spamd - A full-service ISP mail server)''
* [[Replacing non-Alpine Linux with Alpine remotely]]
* [[Setting up A Network Monitoring and Inventory System]] ''(Nagios + OpenAudit and related components)'' 
* [[Streaming Security Camera Video with VLC]]

== Newbie corner ==

* [[How to get regular stuff working]] ''some notes on need-to-know topics''

== Servers ==

* [[Alpine production deploy]]
** [[Production Web server: Lighttpd|Production web server: Lighttpd‎‎]]
** [[MySQL|Production database: MySQL]]
** [[Production LAMP system: Lighttpd + PHP + MySQL‎‎]]
* Alpine production monitoring
** [[Cacti: traffic analysis and monitoring network]]
** [[Zabbix|Zabbix - the professional complete manager]]
* Kubernetes
** [[K8s]] Building a K8s Cluster on Alpine Linux

== Security ==

* [[How to Secure Alpine Linux]] Securing Alpine Linux using Security Technical Implementation Guides (STIGs)

Tutorials and Howtos

2024-07-03T14:45:12Z

Reddognighttime: /* Security */

{{Todo|This material has been re-organized..., but grouping should be checked: '''Howtos are smaller articles''' and '''tutorials are more detailed document'''}}

[[Image:package_edutainment.svg|right|link=]]
{{TOC left}}
'''Welcome to Tutorials and Howtos, a place of basic and advanced configuration tasks for your Alpine Linux.'''

'''The tutorials are hands-on''' and the reader is expected to try and achieve the goals described in each step, possibly with the help of a good example. The output in one step is the starting point for the following step.

'''Howtos are smaller articles''' explaining how to perform a particular task with Alpine Linux, that expects a minimal knowledge from reader to perform actions.

'''IMPORTANT:''' contributions on those pages must be complete articles as well as requesting topics to be covered, don't override already made contributions. If you want to request a topic, please add your request in this page's [[Talk:Tutorials_and_Howtos|Discussion]].

{{Clear}}

= Howtos =

== Applications ==

=== Miscellaneous ===

* [[Ansible]] ''(Configuration management)''

=== Monitoring ===

* [[Awstats]] ''(Free log file analyzer)''
* [[Cacti: traffic analysis and monitoring network]] ''(Front-end for rrdtool networking monitor)''
* [[Cvechecker]] ''(Compare installed packages for Common Vulnerabilities Exposure)'' 
* [[Linfo]]
* [[Obtaining user information via SNMP]] ''(Using squark-auth-snmp as a Squid authentication helper)'' 
* [[PhpSysInfo]] ''(A simple application that displays information about the host it's running on)''
* [[Matomo]] ''(A real time web analytics software program)''
* [[Setting up A Network Monitoring and Inventory System]] ''(Nagios + OpenAudit and related components)'' 
** [[Setting up NRPE daemon]] ''(Performs remote Nagios checks)'' 
* [[Setting Up Fprobe And Ntop|Ntop]] ''(NetFlow collection and analysis using a remote fprobe instance; for alpine 3.10-3.12 only)'' 
* [[Setting up lm_sensors]]
* [[SqStat]] ''(Script to look at active squid users connections)''
* [[Traffic monitoring]] 
** [[Setting up monitoring using rrdtool (and rrdcollect)]]
** [[Setting up traffic monitoring using rrdtool (and snmp)]] 
* [[Zabbix|Zabbix - the professional complete manager]] ''(Monitor and track the status of network services and hardware)''
* [[ZoneMinder video camera security and surveillance]]

=== Networking ===

* Alpine Wall ''(a new firewall management framework)''
** [[Alpine Wall]]
** [https://git.alpinelinux.org/awall/about/ Alpine Wall User's Guide]
** [[How-To Alpine Wall]]
* [[Freeradius Active Directory Integration]]
* [[GNUnet]]
* [[Setting up a OpenVPN server|OpenVPN server]] ''(Allowing single users or devices to remotely connect to your network)''
* [[OpenVSwitch]]
* [[Using Alpine on Windows domain with IPSEC isolation]]
* [[Configure a Wireguard interface (wg)|Wireguard]]

=== Telephony ===

* [[FreePBX|FreePBX on Alpine Linux]]
* [[Setting up Zaptel/Asterisk on Alpine]]
* [[Kamailio]] ''(SIP Server, formerly OpenSER)''

== Backup and data migration ==

* [[Alpine local backup|Alpine local backup (lbu)]] ''(Permanently store your modifications in case your box needs reboot)''
** [[Back Up a Flash Memory Installation]]
** [[Manually editing a existing apkovl]]
* [[Migrating data]]
* [[Rsnapshot]] - setting up periodic backups

== Desktop ==

* [[Alpine and UEFI]]
* [[Default applications]]
* Desktop cloud
** [[Nextcloud]] ''(Self hostable cloud suite - Dropbox Alternative)''
* [[Desktop environments and Window managers]] (overall information only)
* [[Printer Setup]]
* [[Remote Desktop Server]]
* Sound Systems
** [[ALSA]]
** [[PipeWire]]
** [[PulseAudio]]
* [[Configure action when power-button is pressed]]
* [[Suspend on LID close]]
* [[Alpine setup scripts#setup-xorg-base|Xorg Setup]]
* Wayland compositors:
** [[Sway]]
** [[River]]
** [[LabWC]]

== Networking ==

* [[Bluetooth]] - Instructions for installing and configuring Bluetooth
* [[Bonding]] - Bond (or aggregate) multiple ethernet interfaces
* [[Bridge]] - Configuring a network bridge
** [[Bridge wlan0 to eth0]]
* [[Configure Networking]]
* [[How to configure static routes]]
* Modem
** [[Using HSDPA modem]]
** [[Using serial modem]]
* [[mDNS]] - Howto implement multicast DNS resolution in Alpine.
* [[Multi ISP]] ''(Dual-ISP setup with load-balancing and automatic failover)''
* [[PXE boot]]
* Wi-Fi
** [[Wi-Fi|Connecting to a wireless access point]]
** [[How to setup a wireless access point]] ''(Setting up Secure Wireless AP w/ WPA encryption with bridge to wired network)''
* [[VLAN]]

== Other Architectures ==

=== ARM ===

* [[Alpine on ARM]]

==== Raspberry Pi ====

* [[Raspberry Pi Bluetooth Speaker|Raspberry Pi - Bluetooth Speaker]]
* [[Raspberry Pi|Raspberry Pi - Installation]]
* [[Linux Router with VPN on a Raspberry Pi|Raspberry Pi - Router with VPN]]
* [[Linux Router with VPN on a Raspberry Pi (IPv6)|Raspberry Pi - Router with VPN (IPv6)]]
* [[Classic install or sys mode on Raspberry Pi|Raspberry Pi - Sys mode install]]
* [[Raspberry Pi LVM on LUKS|Raspberry Pi - Sys mode install - LVM on LUKS]]
* [[RPI Video Receiver|Raspberry Pi - Video Receiver]] ''(network video decoder using Rasperry Pi and omxplayer)''
* [[Raspberry Pi 3 - Browser Client]] - kiosk or digital sign
* [[Raspberry Pi 3 - Configuring it as wireless access point -AP Mode]]
* [[Raspberry Pi 3 - Setting Up Bluetooth]]
* [[Raspberry Pi 4 - Persistent system acting as a NAS and Time Machine]]
* [[How to set up Alpine as a wireless router|Raspberry Pi Zero W - Wireless router]] ''(Setting up a firewalled, Wireless AP with wired network on a Pi Zero W)''

=== IBM Z (IBM z Systems) ===

* [[s390x|s390x - Installation]]

=== PowerPC ===

* [[Ppc64le|Powerpc64le - Installation]]

== Post-Install ==

* [[CPU frequency scaling]]
* [[Repositories#Enabling_the_community_repository|Enable Community repository]] ''(Providing additional packages)''
* [[Enable Serial Console on Boot]]
* [[Alpine Linux Init System|Init System (OpenRC)]] ''(Configure a service to automatically boot at next reboot)''
** [[Multiple Instances of Services|Init System - Multiple Instances of Services]]
** [[Writing Init Scripts|Init System - Writing Init Scripts]]
* [[Installing Oracle Java|Oracle Java (installation)]]
* [[IGMPproxy]]
* [[Alpine Package Keeper|Package Management (apk)]] ''(How to add/remove packages on your Alpine)''
** [[Comparison with other distros|Package Management - Comparison with other distros]]
* [[Running glibc programs]]
* [[Setting up a new user]]
* [[Upgrading Alpine]]
* [[Daily driver guide]]

== Remote Administration ==

* ACF
** [[Changing passwords for ACF|ACF - changing passwords]]
** [[Generating SSL certs with ACF]] 
** [[setup-acf| ACF - setup]] ''(Configures ACF (webconfiguration/webmin) so you can manage your box through https)''
* [[Setting up a SSH server]] ''(Using ssh is a good way to administer your box remotely)''
** [[HOWTO OpenSSH 2FA with password and Google Authenticator |OpenSSH 2FA]] ''(A simple two factor setup for OpenSSH)''
* [[OpenVCP]] ''(VServer Control Panel)''
* [[PhpMyAdmin]] ''(Web-based administration tool for MYSQL)''
* [[PhpPgAdmin]] ''(Web-based administration tool for PostgreSQL)''
* [[Webmin]] ''(A web-based interface for Linux system)''

== Server ==

* [[Hosting services on Alpine]] ''(Hosting mail, webservices and other services)''
* [[Hosting Web/Email services on Alpine]]

=== DNS ===

* [[DNSCrypt-Proxy]] ''Encrypt and authenticate DNS calls from your system''
* [[Setting up nsd DNS server]]
* [[Setting up unbound DNS server]]
* [[TinyDNS Format]]

=== HTTP ===

* [[Apache]]
** [[Apache with php-fpm]]
** [[Setting Up Apache with PHP]]
** [[Apache authentication: NTLM Single Signon]]
* [[Darkhttpd]]
* [[Lighttpd]]
** [[Lighttpd Advanced security]]
** [[Setting Up Lighttpd With FastCGI]]
* [[Nginx]]
** [[Nginx as reverse proxy with acme (letsencrypt)]]
** [[Nginx with PHP]]
* Squid Proxy
** [[Obtaining user information via SNMP]] ''(Using squark-auth-snmp as a Squid authentication helper)'' 
** [[Setting up Explicit Squid Proxy]]
** [[Setting up Transparent Squid Proxy]] ''(Covers Squid proxy and URL Filtering system)''
** [[SqStat]] ''(Script to look at active squid users connections)''
* [[Tomcat]]

==== Hostable Content ====

* [[DokuWiki]]
* [[Drupal]] ''(Content Management System (CMS) written in PHP)''
* [[Kopano]] ''(Microsoft Outlook compatible Groupware)''
* [[Mahara]] ''(E-portfolio and social networking system)''
* [[MediaWiki]] ''(Free web-based wiki software application)''
* [[Pastebin]] ''(Pastebin software application)''
* [[WordPress]] ''(Web software to create website or blog)''

=== IRC ===

* [[NgIRCd]] ''(Server for Internet Relay Chat/IRC)''

=== Mail ===

* Exim/Dovecot
** [[Small-Time Email with Exim and Dovecot]] ''(A simple configuration for your home network.)
** [[Setting up dovecot with imap and tls]]
* [[relay email to gmail (msmtp, mailx, sendmail]]
* [[Roundcube]] ''(Webmail system)''
* [[Setting up postfix with virtual domains]]
* Server protection
** [[Setting up clamsmtp]]

=== Other Servers ===

* [[Chrony and GPSD | Chrony, gpsd, and a garmin LVC 18 as a Stratum 1 NTP source ]]
* [[Glpi]] ''(Manage inventory of technical resources)''
* [[How to setup a Alpine Linux mirror]]
* [[Setting up an NFS server|nfs-server]]
* [[Odoo]]
* [[Configure OpenLDAP | OpenLDAP]] ''(Installing and configuring the Alpine package for OpenLDAP)''
* [[Setting up a samba-ad-dc|samba-ad-dc]] ''(Active Directory compatible domain controller)''
* [[Setting up a Samba server|samba-server]] ''(standard file sharing)''
* [[Setting up Transmission (bittorrent) with Clutch WebUI]]

=== Software development ===

* [[Cgit]]
* [[OsTicket]] ''(Ticket system)''
* [[Patchwork]] ''(Patch review management system)''
* [[Redmine]] ''(Project management system)''
* [[Request Tracker]] ''(Ticket system)''
* [[Setting up trac wiki|Trac]] ''(Enhanced wiki and issue tracking system for software development projects)''

== Storage ==

* [[Setting up disks manually|Disk setup (manual)]]
* [[Filesystems]]
** [[Burning ISOs]]
* [[Setting up iSCSI|iSCSI Setup]]
** [[iSCSI Raid and Clustered File Systems]]
** [[Linux iSCSI Target (TCM)|iSCSI Target (TCM)/LinuxIO (LIO)]]
** [[Linux iSCSI Target (tgt)|User space iSCSI Target (tgt)]]
* [[Setting up Logical Volumes with LVM|LVM Setup]]
** [[Setting up LVM on GPT-labeled disks|LVM on GPT-labeled disks]]
** [[Installing on GPT LVM|LVM on GPT-labeled disks (updated)]]
** [[LVM on LUKS]]
* RAID
** [[Raid Administration]]
** [[Setting up a software RAID array]]
* ZFS
** [[Root on ZFS with native encryption]]
** [[Setting up ZFS on LUKS]]
** [[Setting up ZFS with native encryption]]
** [[ZFS scrub and trim]]
* [[CEPH|CEPH]]

== Virtualization ==

* [[Docker]]
* [[Installing Alpine in a virtual machine]]
** [[Install Alpine on VMware ESXi]]
* [[KVM]] ''(Setting up Alpine as a KVM hypervisor)''
* [[LXC]] ''(Setting up a Linux container in Alpine Linux)''
* [[QEMU]]
* Xen
** [[Xen Dom0]] ''(Setting up Alpine as a dom0 for Xen hypervisor)''
** [[Xen Dom0 on USB or SD]]
** [[Create Alpine Linux PV DomU|Xen DomU (paravirtualized)]]
** [[Xen LiveCD]]
** [[Xen PCI Passthrough]]

= Tutorials =

== Miscellaneous ==

* [[TTY_Autologin|TTY Autologin]]
* [[Kexec|Faster rebooting with kexec]]
* [[Dynamic Multipoint VPN (DMVPN)]] combined with [[Small Office Services]]
* [[DIY Fully working Alpine Linux for Allwinner and Other ARM SOCs]]
* [[Fault Tolerant Routing with Alpine Linux]]
* [[High Availability High Performance Web Cache]] ''(uCarp + HAProxy for High Availability Services such as Squid web proxy)''
* [[Linux iSCSI Target (TCM)]]
* [[ISP Mail Server 3.x HowTo]]] ''(Postfix+PostfixAdmin+DoveCot+Roundcube+ClamAV+Spamd - A full-service ISP mail server)''
* [[Replacing non-Alpine Linux with Alpine remotely]]
* [[Setting up A Network Monitoring and Inventory System]] ''(Nagios + OpenAudit and related components)'' 
* [[Streaming Security Camera Video with VLC]]

== Newbie corner ==

* [[How to get regular stuff working]] ''some notes on need-to-know topics''

== Servers ==

* [[Alpine production deploy]]
** [[Production Web server: Lighttpd|Production web server: Lighttpd‎‎]]
** [[MySQL|Production database: MySQL]]
** [[Production LAMP system: Lighttpd + PHP + MySQL‎‎]]
* Alpine production monitoring
** [[Cacti: traffic analysis and monitoring network]]
** [[Zabbix|Zabbix - the professional complete manager]]
* Kubernetes
** [[K8s]] Building a K8s Cluster on Alpine Linux

== Security ==

* [[Securing Alpine Linux]] Securing Alpine Linux using Security Technical Implementation Guides (STIGs)

Securing Alpine Linux

2024-07-03T14:43:16Z

Reddognighttime:

Securing Alpine Linux using Security Technical Implementation Guides (STIGs) involves several steps. STIGs are a series of security requirements and configurations that help to secure systems. While there might not be a specific STIG for Alpine Linux, you can follow general Linux hardening guidelines and apply the principles from other Linux STIGs. Here’s a step-by-step process:

Step 1: Update and Upgrade System

1. Update package lists:

sudo apk update

2. Upgrade installed packages:

sudo apk upgrade

Step 2: Install Necessary Security Tools

1. Install `audit` package:

sudo apk add audit

2. Install other necessary security packages:

sudo apk add sudo logrotate bash-completion openssh-server

Step 3: User and Access Management

1. Disable root login over SSH:

Edit `/etc/ssh/sshd_config`:

sudo vi /etc/ssh/sshd_config

Set the following parameter:

PermitRootLogin no

2. Ensure password complexity:

Edit `/etc/security/pwquality.conf`:

sudo vi /etc/security/pwquality.conf

Add or update the following lines:

minlen = 14
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1

3. Lock unused system accounts:

for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do
if [ $user != "root" ]; then
sudo passwd -l $user
sudo chage -E 0 $user
fi
done

Step 4: File System and Directory Permissions

1. Set appropriate permissions on important directories:

sudo chmod 700 /root
sudo chmod 600 /boot/grub/grub.cfg
sudo chmod 600 /etc/ssh/sshd_config

2. Configure mount options:

Edit `/etc/fstab`:

sudo vi /etc/fstab

Add `nosuid`, `nodev`, and `noexec` options to non-root partitions:

/dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2

Step 5: Network Security

1. Disable unnecessary services:

sudo rc-update del <service_name>
sudo rc-service <service_name> stop

2. Configure firewall (iptables):

sudo apk add iptables
sudo rc-service iptables start
sudo rc-update add iptables

Create a basic firewall ruleset:

sudo vi /etc/iptables/rules.v4

Example rules:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp --dport 22 -j ACCEPT
COMMIT

Step 6: Logging and Auditing

1. Configure system logging:

Edit `/etc/rsyslog.conf` to ensure all log files are being captured:

sudo vi /etc/rsyslog.conf

Example configuration:

*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron

2. Set up audit rules:

Edit `/etc/audit/rules.d/audit.rules`:

sudo vi /etc/audit/rules.d/audit.rules

Example rules:

-w /etc/passwd -p wa -k passwd_changes
-w /etc/shadow -p wa -k shadow_changes
-w /etc/group -p wa -k group_changes

Step 7: Apply Kernel and Service Hardening

1. Disable unused filesystems:

Edit `/etc/modprobe.d/disable-filesystems.conf`:

sudo vi /etc/modprobe.d/disable-filesystems.conf

Add the following lines:

install cramfs /bin/true
install freevxfs /bin/true
install jffs2 /bin/true
install hfs /bin/true
install hfsplus /bin/true
install squashfs /bin/true
install udf /bin/true
install vfat /bin/true

2. Configure kernel parameters:

Edit `/etc/sysctl.conf`:

sudo vi /etc/sysctl.conf

Add or update the following parameters:

net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

Step 8: Regular Maintenance

1. Set up regular updates:

Create a cron job for regular updates:

sudo crontab -e

Add the following line to update daily at 2 AM:

0 2 * * * apk update && apk upgrade

2. Review and monitor logs regularly:

Ensure logs are rotated and reviewed frequently:

sudo logrotate /etc/logrotate.conf

Conclusion

This process provides a foundation for securing an Alpine Linux system. Regular reviews and updates, along with compliance with the latest security guidelines, are essential to maintaining a secure environment.

Securing Alpine Linux

2024-07-03T14:40:14Z

Reddognighttime: Securing Alpine Linux

Securing Alpine Linux using Security Technical Implementation Guides (STIGs) involves several steps. STIGs are a series of security requirements and configurations that help to secure systems. While there might not be a specific STIG for Alpine Linux, you can follow general Linux hardening guidelines and apply the principles from other Linux STIGs. Here’s a step-by-step process:

Step 1: Update and Upgrade System

1. Update package lists:

sudo apk update

2. Upgrade installed packages:

sudo apk upgrade

Step 2: Install Necessary Security Tools

1. Install `audit` package:

sudo apk add audit

2. Install other necessary security packages:

sudo apk add sudo logrotate bash-completion openssh-server

Step 3: User and Access Management

1. Disable root login over SSH:

Edit `/etc/ssh/sshd_config`:

sudo vi /etc/ssh/sshd_config

Set the following parameter:

PermitRootLogin no

2. Ensure password complexity:

Edit `/etc/security/pwquality.conf`:

sudo vi /etc/security/pwquality.conf

Add or update the following lines:

minlen = 14
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1

3. Lock unused system accounts:

for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do
if [ $user != "root" ]; then
sudo passwd -l $user
sudo chage -E 0 $user
fi
done

Step 4: File System and Directory Permissions

1. Set appropriate permissions on important directories:

sudo chmod 700 /root
sudo chmod 600 /boot/grub/grub.cfg
sudo chmod 600 /etc/ssh/sshd_config

2. Configure mount options:
Edit `/etc/fstab`:

sudo vi /etc/fstab

Add `nosuid`, `nodev`, and `noexec` options to non-root partitions:

/dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2

Step 5: Network Security

1. Disable unnecessary services:

sudo rc-update del <service_name>
sudo rc-service <service_name> stop

2. Configure firewall (iptables):

sudo apk add iptables
sudo rc-service iptables start
sudo rc-update add iptables

Create a basic firewall ruleset:

sudo vi /etc/iptables/rules.v4

Example rules:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp --dport 22 -j ACCEPT
COMMIT

Step 6: Logging and Auditing

1. Configure system logging:

Edit `/etc/rsyslog.conf` to ensure all log files are being captured:

sudo vi /etc/rsyslog.conf

Example configuration:

*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron

2. Set up audit rules:

Edit `/etc/audit/rules.d/audit.rules`:

sudo vi /etc/audit/rules.d/audit.rules

Example rules:

-w /etc/passwd -p wa -k passwd_changes
-w /etc/shadow -p wa -k shadow_changes
-w /etc/group -p wa -k group_changes

Step 7: Apply Kernel and Service Hardening

1. Disable unused filesystems:

Edit `/etc/modprobe.d/disable-filesystems.conf`:

sudo vi /etc/modprobe.d/disable-filesystems.conf

Add the following lines:

install cramfs /bin/true
install freevxfs /bin/true
install jffs2 /bin/true
install hfs /bin/true
install hfsplus /bin/true
install squashfs /bin/true
install udf /bin/true
install vfat /bin/true

2. Configure kernel parameters:

Edit `/etc/sysctl.conf`:

sudo vi /etc/sysctl.conf

Add or update the following parameters:

net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

Step 8: Regular Maintenance

1. Set up regular updates:

Create a cron job for regular updates:

sudo crontab -e

Add the following line to update daily at 2 AM:

0 2 * * * apk update && apk upgrade

2. Review and monitor logs regularly:

Ensure logs are rotated and reviewed frequently:

sudo logrotate /etc/logrotate.conf

Conclusion

This process provides a foundation for securing an Alpine Linux system. Regular reviews and updates, along with compliance with the latest security guidelines, are essential to maintaining a secure environment.

Securing Alpine Linux

2024-07-03T14:36:15Z

Reddognighttime:

Securing Alpine Linux using Security Technical Implementation Guides (STIGs) involves several steps. STIGs are a series of security requirements and configurations that help to secure systems. While there might not be a specific STIG for Alpine Linux, you can follow general Linux hardening guidelines and apply the principles from other Linux STIGs. Here’s a step-by-step process:

Step 1: Update and Upgrade System

1. Update package lists:

sudo apk update

2. **Upgrade installed packages:**
```sh
sudo apk upgrade
```

### Step 2: Install Necessary Security Tools

1. **Install `audit` package:**
```sh
sudo apk add audit
```

2. **Install other necessary security packages:**
```sh
sudo apk add sudo logrotate bash-completion openssh-server
```

### Step 3: User and Access Management

1. **Disable root login over SSH:**
Edit `/etc/ssh/sshd_config`:
```sh
sudo vi /etc/ssh/sshd_config
```
Set the following parameter:
```sh
PermitRootLogin no
```

2. **Ensure password complexity:**
Edit `/etc/security/pwquality.conf`:
```sh
sudo vi /etc/security/pwquality.conf
```
Add or update the following lines:
```sh
minlen = 14
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1
```

3. **Lock unused system accounts:**
```sh
for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do
if [ $user != "root" ]; then
sudo passwd -l $user
sudo chage -E 0 $user
fi
done
```

### Step 4: File System and Directory Permissions

1. **Set appropriate permissions on important directories:**
```sh
sudo chmod 700 /root
sudo chmod 600 /boot/grub/grub.cfg
sudo chmod 600 /etc/ssh/sshd_config
```

2. **Configure mount options:**
Edit `/etc/fstab`:
```sh
sudo vi /etc/fstab
```
Add `nosuid`, `nodev`, and `noexec` options to non-root partitions:
```sh
/dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2
```

### Step 5: Network Security

1. **Disable unnecessary services:**
```sh
sudo rc-update del <service_name>
sudo rc-service <service_name> stop
```

2. **Configure firewall (iptables):**
```sh
sudo apk add iptables
sudo rc-service iptables start
sudo rc-update add iptables
```

Create a basic firewall ruleset:
```sh
sudo vi /etc/iptables/rules.v4
```
Example rules:
```sh
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp --dport 22 -j ACCEPT
COMMIT
```

### Step 6: Logging and Auditing

1. **Configure system logging:**
Edit `/etc/rsyslog.conf` to ensure all log files are being captured:
```sh
sudo vi /etc/rsyslog.conf
```
Example configuration:
```sh
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
```

2. **Set up audit rules:**
Edit `/etc/audit/rules.d/audit.rules`:
```sh
sudo vi /etc/audit/rules.d/audit.rules
```
Example rules:
```sh
-w /etc/passwd -p wa -k passwd_changes
-w /etc/shadow -p wa -k shadow_changes
-w /etc/group -p wa -k group_changes
```

### Step 7: Apply Kernel and Service Hardening

1. **Disable unused filesystems:**
Edit `/etc/modprobe.d/disable-filesystems.conf`:
```sh
sudo vi /etc/modprobe.d/disable-filesystems.conf
```
Add the following lines:
```sh
install cramfs /bin/true
install freevxfs /bin/true
install jffs2 /bin/true
install hfs /bin/true
install hfsplus /bin/true
install squashfs /bin/true
install udf /bin/true
install vfat /bin/true
```

2. **Configure kernel parameters:**
Edit `/etc/sysctl.conf`:
```sh
sudo vi /etc/sysctl.conf
```
Add or update the following parameters:
```sh
net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
```

### Step 8: Regular Maintenance

1. **Set up regular updates:**
Create a cron job for regular updates:
```sh
sudo crontab -e
```
Add the following line to update daily at 2 AM:
```sh
0 2 * * * apk update && apk upgrade
```

2. **Review and monitor logs regularly:**
Ensure logs are rotated and reviewed frequently:
```sh
sudo logrotate /etc/logrotate.conf
```

### Conclusion

This process provides a foundation for securing an Alpine Linux system. Regular reviews and updates, along with compliance with the latest security guidelines, are essential to maintaining a secure environment.

Securing Alpine Linux

2024-07-03T14:35:43Z

Reddognighttime: Securing Alpine Linux using Security Technical Implementation Guides (STIGs)

Securing Alpine Linux using Security Technical Implementation Guides (STIGs) involves several steps. STIGs are a series of security requirements and configurations that help to secure systems. While there might not be a specific STIG for Alpine Linux, you can follow general Linux hardening guidelines and apply the principles from other Linux STIGs. Here’s a step-by-step process:

### Step 1: Update and Upgrade System

1. **Update package lists:**
```sh
sudo apk update
```

2. **Upgrade installed packages:**
```sh
sudo apk upgrade
```

### Step 2: Install Necessary Security Tools

1. **Install `audit` package:**
```sh
sudo apk add audit
```

2. **Install other necessary security packages:**
```sh
sudo apk add sudo logrotate bash-completion openssh-server
```

### Step 3: User and Access Management

1. **Disable root login over SSH:**
Edit `/etc/ssh/sshd_config`:
```sh
sudo vi /etc/ssh/sshd_config
```
Set the following parameter:
```sh
PermitRootLogin no
```

2. **Ensure password complexity:**
Edit `/etc/security/pwquality.conf`:
```sh
sudo vi /etc/security/pwquality.conf
```
Add or update the following lines:
```sh
minlen = 14
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1
```

3. **Lock unused system accounts:**
```sh
for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do
if [ $user != "root" ]; then
sudo passwd -l $user
sudo chage -E 0 $user
fi
done
```

### Step 4: File System and Directory Permissions

1. **Set appropriate permissions on important directories:**
```sh
sudo chmod 700 /root
sudo chmod 600 /boot/grub/grub.cfg
sudo chmod 600 /etc/ssh/sshd_config
```

2. **Configure mount options:**
Edit `/etc/fstab`:
```sh
sudo vi /etc/fstab
```
Add `nosuid`, `nodev`, and `noexec` options to non-root partitions:
```sh
/dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2
```

### Step 5: Network Security

1. **Disable unnecessary services:**
```sh
sudo rc-update del <service_name>
sudo rc-service <service_name> stop
```

2. **Configure firewall (iptables):**
```sh
sudo apk add iptables
sudo rc-service iptables start
sudo rc-update add iptables
```

Create a basic firewall ruleset:
```sh
sudo vi /etc/iptables/rules.v4
```
Example rules:
```sh
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp --dport 22 -j ACCEPT
COMMIT
```

### Step 6: Logging and Auditing

1. **Configure system logging:**
Edit `/etc/rsyslog.conf` to ensure all log files are being captured:
```sh
sudo vi /etc/rsyslog.conf
```
Example configuration:
```sh
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
```

2. **Set up audit rules:**
Edit `/etc/audit/rules.d/audit.rules`:
```sh
sudo vi /etc/audit/rules.d/audit.rules
```
Example rules:
```sh
-w /etc/passwd -p wa -k passwd_changes
-w /etc/shadow -p wa -k shadow_changes
-w /etc/group -p wa -k group_changes
```

### Step 7: Apply Kernel and Service Hardening

1. **Disable unused filesystems:**
Edit `/etc/modprobe.d/disable-filesystems.conf`:
```sh
sudo vi /etc/modprobe.d/disable-filesystems.conf
```
Add the following lines:
```sh
install cramfs /bin/true
install freevxfs /bin/true
install jffs2 /bin/true
install hfs /bin/true
install hfsplus /bin/true
install squashfs /bin/true
install udf /bin/true
install vfat /bin/true
```

2. **Configure kernel parameters:**
Edit `/etc/sysctl.conf`:
```sh
sudo vi /etc/sysctl.conf
```
Add or update the following parameters:
```sh
net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
```

### Step 8: Regular Maintenance

1. **Set up regular updates:**
Create a cron job for regular updates:
```sh
sudo crontab -e
```
Add the following line to update daily at 2 AM:
```sh
0 2 * * * apk update && apk upgrade
```

2. **Review and monitor logs regularly:**
Ensure logs are rotated and reviewed frequently:
```sh
sudo logrotate /etc/logrotate.conf
```

### Conclusion

This process provides a foundation for securing an Alpine Linux system. Regular reviews and updates, along with compliance with the latest security guidelines, are essential to maintaining a secure environment.

Tutorials and Howtos

2024-07-03T14:34:57Z

Reddognighttime: /* Security */

Tutorials and Howtos

2024-07-03T14:28:42Z

Reddognighttime: /* Tutorials */