Configuration

Zethro keeps Debian's configuration files as Debian ships them and adds its own beside them, in drop-in directories and under /etc/zethro. A file Zethro manages says so in its first line and names the place to put your own version, /etc/zethro/local/; the next run of zethro-setup or zethro-update keeps your file and never overwrites it. Everything below is done as a user in the sudo group.

First boot

Stage 2 runs by itself at the first boot and applies the specification, packages, hardening, firewall, shell and network. Check that it finished, then check the system.

systemctl status zethro-setup
sudo zethro-doctor

Every line of the doctor's report names the requirement it checks. A FAIL names what is wrong; zethro why on the file it names tells you why the rule exists.

Time zone, hostname, keyboard

The installer's location question sets the time zone. Change it any time.

sudo timedatectl set-timezone Europe/Bucharest
sudo hostnamectl set-hostname myhost
sudo dpkg-reconfigure keyboard-configuration

SSH

If you skipped the key at install, SSH accepts your password until a key is in place. Run this from the machine you log in from.

ssh-copy-id user@myhost

Zethro's SSH settings live in /etc/ssh/sshd_config.d/zethro.conf, with no root login, limited attempts and no forwarding. Put your own in another file in that directory; Debian's sshd_config stays untouched. fail2ban watches the SSH log on the server edition.

Network

Zethro uses netplan. The installer's answers, wired or Wi-Fi, DHCP or static, are carried into a netplan file under /etc/netplan at first boot. To change the address, edit that file and apply it.

sudo nano /etc/netplan/zethro.yaml
sudo netplan apply

The desktop edition manages Wi-Fi from the panel through NetworkManager; the file is still the record.

Firewall

nftables with a denied default. SSH comes in on the server, nothing comes in on the desktop, everything goes out. Zethro's table is its own file and is never Debian's nftables.conf; open a port by adding your rule file beside it and reloading.

sudo nft list ruleset
sudo systemctl reload nftables

Users

sudo adduser alice
sudo usermod -aG sudo alice

New users get the Zethro shell and prompt from /etc/skel; a user who prefers bash runs chsh -s /bin/bash.

Updates

Security updates from Debian install unattended. The move to the next Zethro release is one command, and it can be reversed.

sudo zethro-update
sudo zethro-update --undo

The updater verifies the repository key before installing anything, refuses an update that would remove a package, runs the doctor at the end, and records the release in /etc/zethro/release.

Why is this here

zethro why /etc/sysctl.d/50-zethro-net.conf
zethro why fail2ban
zethro why 22

Give it a path, a package or a port. The answer is the chapter and rule of the specification, the package and version that put it there, and the release it arrived in. A line Zethro did not write answers with the Debian package that owns it.

The specification

The eleven chapters ship on the machine under /usr/share/doc/zethro, and man zethro-setup, man zethro-doctor, man zethro-update and man zethro describe the commands. The same text is in the repository.