Skip to content

Instantly share code, notes, and snippets.

@jtmoon79
Last active April 11, 2026 20:52
Show Gist options
  • Select an option

  • Save jtmoon79/b2cc44932adaaca33ec907b56eb64253 to your computer and use it in GitHub Desktop.

Select an option

Save jtmoon79/b2cc44932adaaca33ec907b56eb64253 to your computer and use it in GitHub Desktop.
tool and system setup

Useful Tools

Some useful tools and tweaks for new systems. Probably only useful for me, @jtmoon79.



Distributions

Common

Install my bash profile

curl --silent 'https://raw.githubusercontent.com/jtmoon79/dotfiles/master/install.sh' | bash --norc --noprofile

Debian and Ubuntu

useful tools

Basics
Required

Configure locales

dpkg-reconfigure locales

First

apt update

Second, install apt helpers

apt install apt-utils

Package apt-utils is required for proper configuration of many other apt packages; install it first!

Suggested

Suggested, more packages that will help building of other packages

build-essential autoconf automake libtool cmake pkg-config libssl-dev fakeroot

Suggested, more packages that will help installation of other packages

apt-transport-https apt-file aptitude software-properties-common gnupg debian-keyring debian-archive-keyring man-db manpages

Run apt-file update after installing apt-file.

Optional

Optional, update locales from default C.UTF-8 and POSIX

dpkg-reconfigure locales

Optional, an Apt UI

aptitude

Do this if seeing characters rendering incorrectly.

common utilities
  • info info2man
    information pages
  • man-db manpages manpages-dev
    man manual pages
  • mlocate nocache
    program locate, nocache helps it
  • tmux
    GNU tmux
  • x11-apps
    xeyes and others
  • moreutils
    see https://packages.debian.org/sid/moreutils
    • chronic: runs a command quietly unless it fails
    • combine: combine the lines in two files using boolean operations
    • errno: look up errno names and descriptions
    • ifdata: get network interface info without parsing ifconfig output
    • ifne: run a program if the standard input is not empty
    • isutf8: check if a file or standard input is utf-8
    • lckdo: execute a program with a lock held
    • mispipe: pipe two commands, returning the exit status of the first
    • parallel: run multiple jobs at once
    • pee: tee standard input to pipes
    • sponge: soak up standard input and write to a file
    • ts: timestamp standard input
    • vidir: edit a directory in your text editor
    • vipe: insert a text editor into a pipe
    • zrun: automatically uncompress arguments to command
  • util-linux
    some of the programs among many others
    • lscpu
    • lsblk
    • more
    • su
    • blkid
    • fsck
    • mkfs
    • mkswap
    • flock
    • lsipc
    • lslocks
    • lsmem
    • lslogins
    • lsns
    • whereis
  • bsdutils
    programs
    • logger
    • renice
    • script
    • scriptlive
    • scriptreplay
    • wall
  • sharutils
    • uuencode, uudecode, shar, unshar
  • file
    program file
  • fish
    a better shell
  • zoxide fzf
    smarter cd program z
  • reptyr
    reparent an orphaned process
  • uuid-runtime
    program uuidgen

dropwatch

builds
  • cmake make g++ gcc gdb gdb-doc libc6-dbg cpp autoconf automake build-essential pkg-config libtool gettext cmake
    typical build + make requirements
system
  • htop
  • bottom
    cargo install --locked bottom (run btm)
  • bashtop
    pretty TUI graphics system monitor
    • apt install bashtop sysstat
    • or install manually
      git clone https://github.com/aristocratos/bashtop && cd bashtop && make install
      
  • lshw
  • pciutils lsscsi hdparm
    programs lspci, lsscsi, and hdparm
  • usbutils usb.ids
    program lsusb
  • procps lsof
    various process tools; pstree, ps, lsof
  • lsb-release lsb-core
    program lsb_release
  • chkservice
    systemd CUI
  • whowatch
    Watch logins live.
  • read-edid
    program get-edid to display monitor info that lshw may not show
  • lddtree
    show shared library dependencies of a program in a tree format cargo install --locked lddtree
  • disktest
    disk read/write tester for SSD and NVMe cargo install --locked disktest
  • systemctl-tui
    Helpful TUI for viewing systemctl services cargo install --locked systemctl-tui
security
  • debian-keyring debian-archive-keyring
    for command gpg --verify
  • chkrootkit clamav
    root kit scanner for clam AntiVirus see https://archive.ph/Gy4y2
networking
  • curl wget httpie
  • nmap netcat socat
    nmap and nc
    netcat might be netcat-traditional or netcat-openbsd
  • net-tools
    various small network utilities like ifconfig, arp, route, etc.
  • inetutils-traceroute
    traceroute
  • bind9-dnsutils
    dig
    • dog
      dig on steriods a better dig
  • ipcacl
  • iperf3
    measure net bandwidth
  • iputils iputils-arping iputils-clockdiff iputils-tracepath ipv6calc ipv6toolkit
    more various small network utilities
  • nmap
    nmap
  • nethogs
    net top tool
  • lftp
    lightweight ftp client
  • lynx elinks w3m
    CLI web browsers; elinks is the best
  • mosh autossh sshpass
    resilient SSH connections
  • ethtool
    ethernet interface settings tool
  • tcpdump
  • mtr-tiny "My TraceRoute"
    Call with mtr --curses.
    mtr is a combination of ping and traceroute.
  • nast
    network analyzer and other miscellaneous tools
  • iptraf-ng
    live network monitor
  • termscp
    TUI file transfers
    install with curl --proto '=https' --tlsv1.2 -sSLf "https://git.io/JBhDb" | sh
    or
    cargo install --locked termscp
  • smbclient
    SMB client
filesystem
  • tree
    tree
    • broot
      tree improved
  • parted fdisk
    disk formatting: parted fdisk cfdisk sfdisk
  • acl
    getfacl, setfacl
  • zip unzip xz-utils tar p7zip p7zip-full p7zip-rar lrzip lz4 lzip unar
    zip, unzip, xz, tar; some may already be installed
  • sshfs
    ssh filesystem in fuse
  • zerofree
    zero empty disk blocks; useful for archiving disk backups
  • duc-nox
    interactive disk usage visualizer
    Run command duc-nox ui /
  • ncdu
    interactive disk usage visualizer
    Run command ncdu /
  • yazi
    1. apt install jq unar poppler fzf ffmpegthumbnailer
      ffmpegthumbnailer adds a lot
      poppler cannot be found!?
    2. cargo install --locked fd-find ripgrep zoxide
    3. cargo install --locked yazi-fm
  • fio disk benchmarking
    apt install fio
  • disktest
    disk read/write tester for SSD and NVMe cargo install --locked disktest
Interpreters
  • powershell
  • python3 python3.8 python3.9 python3.10 pypy pypy3 pypy-dev pypy3-dev
    Pythons
  • openjdk-21-jre
    Java Runtime Engine
text utilities
  • colordiff
    diff with color!
  • gettext
    msgcat --color=test
  • pdfgrep
    pdfgrep
  • poppler-utils poppler-data
    pdftotext, among many other PDF tools
  • jq jo
    json handlers
  • figlet
    draw big letters
  • hexcurse
    hex editor
  • shed
    nano-like hex editor
  • nano
    nano simple text editor
  • vim
media
  • lame lame-doc flac oggz-tools vorbis-tools
    mp3, flac, ogg tools
  • vlc
    VLC media player, many dependencies!
  • libimage-exiftool-perl
    tool exiftool is a scriptble file tag reader/writer, supports many file types
miscellaneous
  • goaccess geoip-database
    goaccess web server log analyzer
  • pv
    Pipe Viewer, e.g. dd in=/dev/sda1 | pv | 7z -a -si sda1.img
  • fq
    Binary file viewer inspired by jq
  • rsyslog
    See section rsyslog settings
  • multitail
  • git-crecord
    interactive chunk staging for git
  • curl -sL https://git.io/_has | sudo tee /usr/local/bin/has >/dev/null
    has command to check for installed programs
  • hstr better command history search
    after install run hstr --show-configuration >> ~/.bashrc.local.post binds to crtrl-r by default
  • tenki
    nice terminal screensaver with weather cargo install --git https://github.com/ckaznable/tenki.git
  • Install Docker, groups and users
  • Install Powershell
  • ct
    bash command tracer
    git clone https://github.com/JB63134/bash_ct.git ~/.local/bin/bash_ct
    echo "bash_source_file ~/.local/bin/bash_ct/.bash_ct" >> ~/.bashrc
    

Anti-virus

Virustotal CLI

cd /tmp
git clone https://github.com/VirusTotal/vt-cli
cd vt-cli
make install
vt init
vt scan file /tmp/suspicious-file
vt analysis 

See installed packages

( cat /var/log/{dpkg.log,dpkg.log.1} && zcat /var/log/dpkg.*.gz ) \
  | grep -i "status installed" \
  | sort -k5 -k1 -k2 \
  | cut -f5 -d' ' \
  | uniq

Alpine

apk add \
    bash bash-completion \
    tmux \
    file \
    diffutils `# diff` \
    coreutils `# sort cp cat mv ... (many Linux utils)` \
    htop \
    curl wget \
    zip unzip tar xz p7zip \
    git \
    vim \
    python3 \
    gcc g++ \
    lsof lshw \
    alpine-conf \
    util-linux procps \
    man-pages man-db `# man pages` \
    tzdata           `# setup instructions https://wiki.alpinelinux.org/wiki/Setting_the_timezone` \

Alpine package list.

pfsense (FreeBSD)

pkg install \
        htop \
        pstree \
        sudo \
        arping \
        iftop \
        iperf3 \

adding freebsd.org package repository

SKIP THIS SECTION, CAUSES BOOT ERRORS

Derived from https://docs.netgate.com/pfsense/en/latest/recipes/freebsd-pkg-repo.html

In file /usr/local/etc/pkg/repos/pfSense.conf change to

FreeBSD: { enabled: yes }

In file /usr/local/etc/pkg/repos/FreeBSD.conf change to

FreeBSD: { enabled: yes }

The full list of FreeBSD packages is at https://pkg.freebsd.org/FreeBSD:12:amd64/

custom app

For speedtest.net CLI app

pkg install -g libidn2 ca_root_nss
pkg add "https://install.speedtest.net/app/cli/ookla-speedtest-1.2.0-freebsd13-x86_64.pkg"

Windows

See section chocolatey.

Enable Long Paths

See the section Enable Long Paths (Powershell)

System setup

Program frameworks

rust

Linux

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

source ~/.cargo/env
# or
echo 'source "$HOME/.cargo/env"' >> ~/.bashrc.local.post
# or
echo 'bash_path_add "$HOME/.cargo/bin"' >> ~/.bashrc.local.post

Windows

Download rustup-init.exe

rust settings and programs

Install cargo-cache and use it to clean the cache after these installs.

cargo install --locked cargo-cache

Some useful rust programs

cargo install --locked             \
    lsd       `# improved 'ls'`      \
    bottom    `# improved 'top'`     \
    ripgrep   `# faster recursive grep` \
    bat       `# improved 'cat'`     \
    procs     `# improved 'ps'`      \
    sd        `# intuitive find+replace`\
    cargo-update                   \
    hexyl     `# improved 'hexdump'` \
    coreutils `# improved GNU Linux utils` \
    macchina  `# neofetch system viewer` \
    rustscan  `# fast nmap` \
    bingrep                        \
    exa       `# improved 'ls'`     \
    hyperfine `# process perf measurement` \
    systeroid systeroid-tui `# sysctl TUI` \
    diskonaut `# fast disk usage TUI` \
    rhit      `# nginx log analyzer` \
    jaq       `# improved 'jq' clone`\
    fd-find   `# improved 'find'`    \
    du-dust   `# improved 'du'`      \
    tealdeer  `# tldr; shorter 'man', 'info' pages` \
    dog       `# dig on steriods` \
    broot     `# improved tree` \
    gping     `# TUI ping histogram` \
    cargo-outdated `# run cargo outdated; requires apt "libssl-dev"` \
    gitoxide  `# fast git` \
    termscp   `# TUI file transfers` \

After the installs

cargo cache --autoclean

Periodically run cargo-update

cargo install-update -a

Also see

Python

package in apt

apt install python-is-python3 python3-pip python3-virtualenv python3-venv python3-wheel python3-build pipx

pip

curl -sSL https://bootstrap.pypa.io/get-pip.py -o get-pip.py
python get-pip.py

Necessary extras

You can also use pip to get the latest versions since the apt versions are often a few years old.

python -B -O -s -m pip install \
    --no-cache-dir --disable-pip-version-check \
    --upgrade wheel pip setuptools venv virtualenv

If the command fails try without -s.

To create a virtual environment run venv-create.sh

curl --silent 'https://raw.githubusercontent.com/jtmoon79/dotfiles/master/utilities/venv-create.sh' | bash --norc --noprofile

More extras

pipx install \
    ipython  `# popular debugger and interactive shell` \
    ptpython `# popular debugger and interactive shell` \
    six      `# most downloaded pip package, might as well` \
    black    `# code formatter` \
    Procpath `# powerful process monitor` \
    dns-benchmark-tool  `# great looking DNS Benchmark` \

go

To install, see https://go.dev/doc/install

CLI tools

  • pdfcpu
    PDF manipulation tool
    go install github.com/pdfcpu/pdfcpu/cmd/pdfcpu@latest

PowerShell

Powershell help

Update-Help -UICulture en-US

Run update-help once per install of Powershell. Updates are rare.

Install-Module Pscx -Scope CurrentUser

Later

Update-Module Pscx

Found in this SO Answer.

Powershell Execution Policy

Check

Get-ExecutionPolicy -List

Set the most lacking policy restricted to current user

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope CurrentUser

TODO: add these turned off Bitlocker TPM (https://archive.ph/WKfOr) turned off automatic update reboot (http://archive.vn/BEs3r)

Powershell Startup check

https://stackoverflow.com/questions/66701954/skip-powershell-startup-check-for-new-version

Recommended Linux system changes

install logrotate

apt install logrotate
systemctl status logrotate

enable acct logging

On Debian-based systems

apt install acct
systemctl enable acct
systemctl start acct

On RedHat-based systems

yum install psacct
systemctl start psacct

Accounting records are stored in /var/log/account/pacct.

See accounting totals with

ac --individual-totals
sa --print-users
sa --user-summary

Other commands.

Add an entry for logrotate.

echo '# acct
/var/log/account/acct
/var/log/account/pacct {
    weekly
    rotate 50
    compress
    delaycompress
    missingok
    notifempty
    create 0660 root root
    sharedscripts
    postrotate
        /usr/sbin/accton off
        /usr/sbin/accton on
    endscript
}' > /etc/logrotate.d/acct

Test logrotate with

logrotate -v -d /etc/logrotate.d/acct

enable auditd

apt install auditd
systemctl enable auditd

extend sudo timeout

sudo visudo

add line

Defaults:USER timestamp_timeout=720

rsyslog settings

A snippet of settings to add to /etc/rsyslog.conf to send logs to a remote server.

# /etc/rsyslog.conf

module(load="imjournal") # added by jtmoon https://www.loggly.com/ultimate-guide/centralizing-with-syslog/
module(load="imuxsock") # provides support for local system logging
module(load="imklog")   # provides kernel logging support

$ActionFileDefaultTemplate RSYSLOG_FileFormat

# from https://www.linuxtechi.com/setup-rsyslog-server-on-debian/
# Enable sending system logs over UDP to rsyslog server
*.* @192.168.X.Y:514
# Enable sending system logs over TCP to rsyslog server
#*.* @@192.168.X.Y:514

A hostname may be used in place of the IP address.

Then restart the service

systemctl restart rsyslog

On the rsyslog server, add an entry for host to /etc/logrotate.d/rsyslog

/var/log/rsyslog/NEWHOST/*
/var/log/rsyslog/newhost/*
/var/log/rsyslog/newhost.net/*
/var/log/rsyslog/newhost.local/*
{
        rotate 999
        notifempty
        size 1M
        compress
        createolddir
        copytruncate
        olddir /var/log/rsyslog-old/newhost
}

ssh

ssh KeepAlive

For openssh sshd server.

Append to /etc/ssh/ssh_config

ServerAliveInterval 10
ServerAliveCountMax 12
TCPKeepAlive no

Append to /etc/ssh/sshd_config

ClientAliveInterval 10
ClientAliveCountMax 24
TCPKeepAlive no

IME, TCPKeepAlive causes too many dropped SSH sessions. The internal application Alive mechanism is more forgiving of lossy connections. From SO Q&A.

sshd user lockdown

For openssh sshd server.

For sshd service exposed to The Internet, disallow well-known users from login (i.e. root). Only allow root login from a private network or localhost.

Replace secretuser with a non-obvious user. This is the user that may login from The Internet.

# this sshd is exposed to The Internet so limit allowed user logins
AllowUsers root@10.* root@192.168.* root@127.0.0.1 secretuser

increase cron log level

On Debian 10

Append to /etc/default/cron

EXTRA_OPTS="-L 7"

On Debian 11

systemctl edit --full cron.service

then edit the ExecStart

install latest htop

From the instructions at htop-dev/htop.

# install build dependencies
apt install libncursesw5-dev autotools-dev autoconf automake build-essential libtool
# install extras
apt install libcap-dev libcap2 libcap2-bin libsensors-dev libhwloc15 libhwloc-common libhwloc-dev libhwloc-doc libtool-doc libhwloc-plugins libtool
# get the source code
VER=3.2.2
cd /tmp
wget https://github.com/htop-dev/htop/archive/refs/tags/${VER}.zip
unzip ${VER}.zip
cd htop-${VER}
# build and install
./autogen.sh
./configure --enable-unicode --enable-hwloc --enable-sensors --enable-capabilities
make
make install

On a yum-managed distribution

yum install ncurses ncurses-devel lm_sensors lm_sensors-devel hwloc hwloc-libs hwloc-devel libpcap libpcap-devel libcap libcap-devel

git

extend GPG signing timeout

touch ~/.gnupg/gpg-agent.conf
echo default-cache-ttl 3600 >> ~/.gnupg/gpg-agent.conf

From this SO answer.

add iperf3 service

useradd -M iperf
touch /etc/systemd/system/iperf3.service

Create the service definition file

# copied from https://futurereboot.com/iperf3-as-a-service/
[Unit]
Description="iperf3 server"
After=network.target

[Service]
Type=simple
User=iperf
ExecStart=/usr/bin/iperf3 -s
KillMode=process
Restart=on-abort

[Install]
WantedBy=multi-user.target

enable the service

systemctl enable --now iperf3

check the logs

journalctl -u iperf3 -f

From this article (archived).

services

add endlessh service

See https://github.com/jtmoon79/dotfiles/tree/master/services/endlessh.

Recommended Windows system changes

Tested on a Windows 10 Pro system.

Enable Remote Desktop

TODO: Fill in

Configure Windows Updates

  1. gpedit.msc
    1. Computer Configuration
    2. Administrative Templates
    3. All Settings
    4. Configure Automatic Updates

Set SSH login shell

Set the login to use the default powershell

Set-ItemProperty -verbose -path "HKLM:\HKEY_LOCAL_MACHINE\SOFTWARE\OpenSSH" -Name "DefaultShell" -Value $(Get-Command powershell.exe).Source

Set the login back to the default cmd.exe invocation by the empty string.

Set-ItemProperty -verbose -path "HKLM:\HKEY_LOCAL_MACHINE\SOFTWARE\OpenSSH" -Name "DefaultShell" -Value ""

Taken from here.

Enable Long Paths (Powershell)

New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem" `
-Name "LongPathsEnabled" -Value 1 -PropertyType DWORD -Force

Install chocolatey

Install choco from chocolatey.

As Administrator, run in powershell

Set-ExecutionPolicy Bypass -Scope Process -Force
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
iex ((New-Object System.Net.WebClient).DownloadString("https://community.chocolatey.org/install.ps1"))

Check with

choco --version

chocolatey installs

First install the GUI and extensions

choco install ChocolateyGUI chocolatey-core.extension

Check packages installed

choco list --local-only

See chocolatey packages.

system
  • winaero-tweaker
    system tweaker
  • windirstat
    disk usage analyzer
  • sysinternals
    system utilities
  • winmerge
    file diff
  • cpu-z.install
    system info
  • hwinfo.install
    system info
  • coretemp
    system info for temperatures
  • powertoys
    system utilities
  • ntop.portable
    htop for Windows
  • gopeed
    download manager
  • termscp
    terminal UI remote shell and file copy client
subsystems

Install these independely from choco.

  • msys2
    a whole 'nother linux-like subsystem packages under mysys2 can be found using pkg (I THINK?)
  • cygwin
    a whole 'nother linux-like subsystem use cygcheck -c to list installed packages use cygcheck -p to find which package a file belongs to
  • wsl
    1. use Turn Windows Features On Or Off
      • Windows Subsystem For Linux
    2. Microsoft Store to choose the OS
files and development
  • 7zip
    file archiver
    • 7zip-zstd
      with zstd support (more compression algorithms)
  • notepadplusplus
    text editor
  • notepad3
    text editor
  • hxd
    hex editor
  • winmerge
    file diff
  • poshgit
    git tab-completions in Powershell
GNUWin32
  • gnuwin32-coreutils.portable
  • nano
    handy console text editor
  • gawk
  • sed
  • awk
  • grep
  • diffutils
  • findutils
  • tac
  • jq
networking
  • winscp.install
    sftp client
  • stunnel
    SSL tunneling
  • iperf3
    network performance testing
  • curl
    command line http client
  • wget
    command line http client
  • lftp
    command line ftp client
  • termscp
    terminal UI remote shell and file copy client
  • putty or putty-portable
    ssh client
  • telnet
    a basic telnet client
office
  • sumatrapdf.install
    pdf viewer
media copying
  • imgburn
    CD/DVD/ISO burning
  • win32diskimager.portable
    disk copying
  • dvddecrypter
    DVD ripping
images
  • irfanview
    image viewer
audio
  • eartumpet
    volume control
  • foobar2000
    audio player
video
  • mpc-hc-clsid2
    media player classic
  • vlc
    video player

Update WSL2

Update to the latest WSL2 kernel.

WSL2 wsl.conf

Configure WSL2 memory

In file $env:USERPROFILE\.wslconfig (notepad.exe "$env:USERPROFILE\.wslconfig") to set contents

[wsl2]
memory=500MB
processors=2

enable WSL systemd

Inside the distribution, edit file /etc/wsl.conf

[boot]
systemd=true

do not regenerate resolv.conf

Do not regenerate /etc/resolv.conf per start.

Inside the distribution, edit file /etc/wsl.conf

[network]
generateResolvConf=false

set a unique hostname

Inside the distribution, edit file /etc/wsl.conf

[network]
hostname=host-ubuntu22

Allow Multiple RDP Users

https://archive.ph/rbejJ

Set bitlocker to require an interactive password

TODO:

Remote Powershell

https://awakecoding.com/posts/powershell-remoting-trusted-hosts-what-does-it-mean/

Miscellaneous

On Debian-derived requires packages (among others)

apt install libtool libssh2-1-dev zstd libgssapi-krb5-2 libzstd-dev nghttp2

Link to latest source code

wget https://github.com/curl/curl/archive/refs/tags/curl-7_79_1.zip
unzip curl-7_79_1.zip
cd curl-7_79_1
autoreconf -fi
./configure --with-openssl --with-nghttp2 --with-ngtcp2 --with-gssapi --with-libssh2 --with-zstd
make && make test && make install

Step make test is optional.

By default, installs to /usr/local. To change, pass --prefix=... to configure command.

Or just use the docker image!

docker run -it --rm curlimages/curl:latest --version

git

Add git alias dog for pretty graphs

git config --global alias.adog "log --all --decorate --oneline --graph"

git-crecord

Install git-crecord. Interactive git staging using ncurses.

apt install git-crecord

system startup service

Like the old /etc/rc.local script, a custom systemd service to run miscellaneous commands at system startup.

From Running a Linux Command on Start-Up

touch /lib/systemd/system/startup.service

Service file startup.service

[Unit]
Description=Startup Script
[Service]
ExecStart=/root/.local/bin/startup.sh
[Install]
WantedBy=multi-user.target

Startup script

touch /root/bin/startup.sh
chmod +x /root/bin/startup.sh

script startup.sh

#!/usr/bin/env bash
#
# manual script run by systemd at system start

set -eux
logger -s -t 'startup.sh' "running startup.sh"

add whatever other commands are needed to startup.sh

Enable and test

systemctl enable startup.service --now

TODO notes

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment