Fedora 8 installation procedure

• Target audience
• When to install
• Preliminary procedures
• Custom install options
• Wireless setup
• Updating your applications with Yum
• Hardening the system
• Setting up two screens
• Install Firefox plug-ins
• Web and multimedia
• System administration setup
• KDE eye candy
• Install scientific applications

Target audience

This page contains, of course, personal preferences related to setup and software applications. This page is intended as:

1. A personal reference;
2. A guide for my friends/relatives who never installed Linux. As a result of my continous advocacy :-) I received questions from 3-4 people about this. If they have the same setup as me then it will be easier for me to provide them with advice;
3. A guide for someone who never used Fedora and wants to give it a try. You will need to know some basic things about Linux.

The machine on which the installation described below was performed is a 32-bit Intel desktop. Detailed setup from smolt. No dual boot. The setup is for a personal desktop used also for scientific software and web development. Installation guides for other configurations:

• The official guide
• Mauriat Miranda's personal guide
• Gregory Gulik's Tips and Tricks
• Common problems

When

I usually install about 2 months after the distro comes out (i.e. coming upgrade to Fedora 9 at the beginning of Jul 2008). This allows for some time for:

• initial bugs to be fixed
• Yum repositories to be populated
• documentation for potential problems to appear on the web
• knowledgeable users on the forums to learn about the new OS so that they can answer my questions if need be :-)

Fedora changes quite often. I do not skip Fedora versions and I do a full reinstall of each new version because:

• This forces me to do backups, especially over the network to remote servers. It can take a couple of days to upload several Gb over a slow ftp connection!
• Being up to date insures me against recently-discovered vulnerabilities. Older systems, even if continously patched, have by definition a higher rate of unknown vulnerabilities because hackers had time to discover them. Doing a fresh reinstall and changing all passwords ensures that if the system was compromised without my knowledge, I get rid of the hole.
• Having a clean install and not some super-customized one makes it easy to get help on forums. Going from version to version means smaller steps done more often, which means they are easier to remember, perform and describe.
• This forces me to eliminate junk such as unneeded software that I installed and forgot about. Also, my preferences and needs change gradually, and a reinstall forces me to think what I really need on my system. It also forces me to update software that has not been installed through a yum repository.
• This forces me to remember how my system works and to learn a little bit about Linux each time. It helps me at work by giving me a preview of how RHEL versions will look a few years from now and knowing which problems can be solved by upgrading.

Preliminary procedures

• I save this page with a xhtml extension, and open it in a text editor and web browser. I will write here what I did so I can retrace in case of a mistake, or reinstall.
• Get a DVD with Fedora, by downloading the disk image and burning it to DVD. After the download keep the application open for a while to help others download as well. I then burned it to DVD using K3b under Fedora 7, called with k3b myfile.iso .
• Bring close a second computer with web access so you can consult the web for solutions should anything bad occur. Also, you can look up details on packages that you will be offered to install by the distro, in order to know what various packages do.
• Open this page in a browser on your second machine.
• Check the integrity of your backups stored elsewhere (portable HDD, FTP site).
• If necessary, change boot order in BIOS to allow booting from CD/DVD. You can usually get access to the BIOS by hitting the Del key during the first few seconds after a reboot and supplying the BIOS supervisor password.
• Press Enter for a graphical install
• I skip the integrity check of the installation media, as I had the DVD burning program check the disk.
• Choose the "Install Fedora" radio button instead of the "Upgrade an existing installation" one. I keep two sets of backups outside my hard disk drive, so I do not have a problem doing a fresh install instead of upgrading an existing installation. Remember that Fedora is a perpetual beta test ground for Red Hat Enterprise Linux, and brand new technology can be less than rock solid. If a problem appears, you want to make sure it is not due to old settings/files propagating from the old install. Also, if your machine has been cracked, a fresh install of an upgraded operating system with new passwords goes a long way towards getting rid of intruders.
• Since I do not want to have another operating system on the same computer, I choose "Remove all partitions on selected drives and create default layout".
• I have a wireless network, so I uncheck "Active on boot" for the eth0 network device, and have the hostname be setup manually, using the default (localhost.localdomain).
• I choose the time zone I live in
• I choose a root password - DIFFERENT from the one on the old system (in case the old system was compromised without my knowledge). Password should be at least 9 characters long, and it should have a combination of  symbols, uppercase letters and lowercase letters.

Custom install options

... as modifications from defaults. These are of course my personal preferences, I have them here mainly for personal reference for future installs. The main thing for a desktop system is to avoid having any servers running. Besides that, it is good to have as few packages as possible: the more software your machine has, the more vulnerabilities. Unnecessary packages will be updated by the update manager too, clogging your bandwidth and possibly resulting in dependency problems. I select "Office and Productivity" and "Software Development". I do not add additional repositories. I also select "Customize now", then click "Next".

• Desktop Environments: uncheck Gnome, and select KDE. At Optional Packages, check kdegraphics-extras, uncheck kdepim, kftpgrabber, konversation, leave others unchanged
• Applications
• Check "Authoring and Publishing. Uncheck everything inside except scribus and tetex.
• Leave Editors and "Engineering and scientific" as they are.
• Deselect and "Games and entertainment"
• In "Graphical Internet", uncheck ekiga, evolution* and pidgin
• In "Graphics", select ImageMagick, deselect dcraw, xsane*
• "Office and Productivity" -- leave unchanged
• In "Sound and Video", unselect wodim.
• In "Text-based Internet": check bittorrent, elinks, and lynx, uncheck all others
• Development
• Uncheck "Development libraries".
• "Development tools": Uncheck automake-*, byacc, cvs, diffstat, patchutils, python/ldap, rcs, . Select ccache, cscope, gcc-gfortran, indent, ltrace, oprofile-*, subversion, swig, texinfo
• N to Fedora Eclipse, Gnome Software Development, Java Development, Ruby and X Software Development
• KDE Software Development: select kdevelop, uncheck others
• Servers: leave defaults untouched, except at "Printing support", where I uncheck bluez-utils-cups, hpijs, hplip, samba-client
• Base System
• Administration Tools: uncheck authconfig-gtk
• Base: uncheck bluez-utils, dhcpv6-client, dmraid, ftp, irda-utils, nano, nfs-utils, openssh-server, rdate, rdist, rsh, sendmail, talk, telnet
• Dial-up Networking Support: uncheck
• Fonts, Hardware Support, Java: leave unchanged
• Legacy Fonts: check fonts-ISO*, xorg-x11-fonts-ISO8859-9-100dpi
• System Tools: Uncheck all, except ntp and yum-utils
• Languages: add Romanian, Norwegian support

Services and first boot

At the first boot, make sure the firewall is enabled. At Trusted services, uncheck even SSH, I can live without inbound SSH connections to my machine. At Hardware Profile, I check "Send Profile" to help the Fedora guys. I create a user and at first boot I choose Sessions... KDE and language... English (USA)

To set services, I type system-config-services at the "Run Command" prompt in K menu to start the GUI. I use Mauriat Miranda's Fedora 8 services page as a guide. For runlevel 5, check NetworkManager and NetworkManagerDispatcher, uncheck cpuspeed (I have a Pentium M), firstboot, ip6tables, irqbalance, lm_sensors, mdmonitor, netfs, nfslock, rpc*, sendmail, sshd. I enable ntpd to get my computer time from the internet and smartd to watch my hard drives state. I enable smolt to help Fedora developers and wpa_supplicant because I have wireless. Click the "Save" button.

If your speakers or headphones are plugged in, go to K menu... Administration... Soundcard detection and play the test sound.

Tell KDE about any hardware that is likely to be different from Fedora's assumptions –in my case a certain keyboard: K Menu ... Control Center... Regional and accessibility... Keyboard Layout... Layout tab. Check "Enable keyboard layouts". Select Keyboard model "Generic 105-key (Intl) PC". From "Available layouts" select "Norway (no)" as the active layout. Select as "layout variant": nodeadkeys. Click "Apply".

Wireless setup

As root, type system-config-network, select wlan0, click the Edit button, and uncheck "Activate device when computer starts", but check "Allow all users to enable and disable the device". Click the knetworkmanager systray icon, click on your network SSID and give it the password. Reboot.

Updating your applications with Yum

• Open a terminal in Superuser mode (From the K button... "System" menu). Do the following things as root. In the future, for regular system maintenance, it is more secure to use su -c, but this is inconvenient when there are so many commands.
• Now I have a computer with a fresh installed OS connected to the Internet. Well, I have a hardware firewall, but still. The first thing to do is use Yum to update with the patches released since the distribution was issued by typing yum -y update.
• Reboot to allow changes to take place. Theoretically, unless you downloaded kernel updates that should not be necessary, but if you are not in a hurry, why not, who knows what else may need it. And if you install 2 months after the Fedora release, you can be certain you will get an updated kernel, anyway.
• Because my PC is not on and off on a predictable schedule, I do not set up automatic updates with yum. Those who need them can follow the instructions in Software Management with Yum.
• You may need packages that are only found in the Livna repo. Install it with

  rpm -ivh http://rpm.livna.org/livna-release-8.rpm
  rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-livna
  

Hardening

So, now I have an up-to-date box. However, Fedora is a general-purpose distribution so its defaults can be tightened (security-wise) if you know what your needs will be.

• Reboot and press "Delete" while the system is coming up to access the BIOS. Change the boot order so that the hard disk is the only device to boot from. This will prevent against local intrusions with a LiveCD or memory stick. Make sure you have BIOS passwords set so that nobody can change the boot order.
• Set up a boot loader password, following instructions from the Red Hat Linux Security Guide. As root, run /sbin/grub-md5-crypt, type the desired boot loader password, then add to /boot/grub/grub.conf the line:

  password --md5 <password-hash>

  where you replace <password-hash> with the output of /sbin/grub-md5-crypt. I added the line between the splashimage one and the first title line; I do not know if location of the line matters.
• The only possible local attack now is for somebody to remove your hard disk, change the jumper from master to slave and mount it to another computer. The way to prevent this, besides physically locking the computer case, is to encrypt the hard-disk. That, however, as the Japanese bank Sumitomo Mitsui found out at the expense of over 300 million dollars, can be overcome by the use of software or hardware keyboard loggers. Keyboard loggers can be thwarted by using an assymetrically encrypted keyboard with the public key in a USB dongle and decryption at application level, but that would be dangerous to implement – you would risk the encrypted HDD becoming useless if a certain keyboard is not available (i.e. you spilled coffee on it!). You also could not use two-factor authentification because a poor hard disk taken out of the machine cannot communicate with anyone. So what is left is encrypting the disk with a one-time password system such as S/Key (Lamport's scheme); but if you are in need of that, you probably need much, much better security references than this n00b page :-)
• Start Firefox, then go to Edit... Preferences...Privacy . In the History tab, set 1 day as the history expiration limit. In the "Cookies" tab, check "for the originating site only" in order to reject third-party cookies and "Keep Cookies"... "Until I close Firefox". Make FF automatically delete the saved session info by going to Settings and check all boxes except "Saved Passwords" and "Ask me". With this occasion, set the home page (not a security issue, but a personal preference) I usually set it to "about:blank" so that: I do not have to wait for a site to load every time I open the browser, and I can clean the address bar for typing an URL just by clicking the Home button. I set the Downloads window to close when all downloads are finished.

Setting up two screens

I must first mention that this is a particular setup for my two single-head nVidia graphics cards serving video to my two 19 inch LCD panels. The commodity box I bought had a single-head card, so I simply added a second cheap card to a free PCI slot and plugged the second monitor in it.

I download the livna-packaged Nvidia driver:

yum -y install kmod-nvidia

Install Firefox plug-ins and extensions

• To install the Adobe Flash player, I first installed Adobe's yum repo, then download and install the package:

  rpm -ihv http://linuxdownload.adobe.com/adobe-release/adobe-release-i386-1.0-1.noarch.rpm
  rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-adobe-linux
  yum -y install flash-plugin
  

• To install the embedded video player, type: yum -y install mplayerplug-in . I then followed Greg Gulik's instructions and executed mkdir ~/.mplayer; echo 'ao=pulse' > ~/.mplayer/config' to make it use the Pulse sound system and I enabled support for mms streaming by opening Firefox and click on the special URL about:config. Right click on the list and choose New then choose String. For the preference name enter network.protocol-handler.app.mms then for the string value enter gmplayer.
• I download and install NoScript and Adblock Plus.

Web and multimedia

• To install the Foxit PDF Reader, I simply downloaded it, unarchived the directory, copied the file into /usr/local/bin and chmod-ed it executable. Also gave it a convenient name (foxit).
• Make DVDs play:

  yum -y install xine xine-lib xine-skins xine-lib-extras-nonfree libdvdcss
  
  gconftool-2 --set /desktop/gnome/volume_manager/autoplay_dvd_command \
  'xine --auto-play --auto-scan dvd' --type='string'
  

  To watch a DVD, insert it in the tray, start xine, click the DVD tab, then the play button.
• Install Internet Explorer 6, for those few sites that dislike Mozilla: yum -y install wine cabextract , then download ies4linux , unpack it and run the script.
• Install mp3 players:

  yum -y install xmms xmms-mp3 xmms-faad2 gstreamer-plugins-ugly \
  	gstreamer-plugins-bad libmad libid3tag
  

• KDE's CD burning application:

  yum -y install k3b
  

System administration setup

• Copy my stuff from the portable USB hard drive backup to the machine. Remember to restore hidden files (.bashrc, Firefox's bookmarks.html, adblock/patterns.ini and prefs.js)
• Remove junk directories created by KDE in my $HOME (Documents, Download, Music, Pictures, Public, Templates, Videos)
• Create extra users and groups
• Create database for slocate by running updatedb as root.
• I make backups in three places – on disk, on a portable hard drive and through ftp to a remote machine. For those on disk, I have to make a directory as superuser: mkdir /var/bak.
• Add to root's .bashrc:

  B=/home/nick/computers/Linux_admin/ACTIVE_SCRIPTS/bak_
  alias bak_des=$B_des.sh
  alias bak_rar=$B_rar.sh
  alias bak_min=$B_min.sh
  alias bak_rsync=$B_rsync.sh
  

• Configure kedit, my favorite editor. Start it, go to Settings.. Configure KEdit, Miscellaneous, uncheck "make backup" to avoid having filenames ending with tildas all over. Same with kate.
• Move my KDE Trash outside my home dir, to avoid backing it up: su; mkdir /var/nick/; chown nick:vlad /var/nick/; exit; mv $HOME/.local/share/Trash /var/nick/; ln -s /var/nick/Trash $HOME/.local/share/Trash .
• For each user, place the KDE Trash outside the home dir: su - user; mkdir -p /var/$USER/Trash; mkdir -p $HOME/.local/share/; ln -s /var/$USER/Trash $HOME/.local/share/Trash
• For users that are known to need a little technical handholding, set Firefox options to delete all private data at the end of session.

KDE eye candy

• I use a script that changes the desktop wallpaper at every restart of KDE. To initiate it, create a link from one of the wallpapers in the wallpaper "tank" to $HOME/.wallpaper.jpg . Then right click on desktop... Configure desktop... Background, and choose $HOME/.wallpaper.jpg . Then, make sure the script that changes the link is started every time KDE is:

  ln -s \
  /home/nick/computers/Linux_admin/ACTIVE_SCRIPTS/randomize_wallpaper.py \
  $HOME/.kde/Autostart/
  

  The script can be downloaded here if you need it. Change its extension back to py -- my hosting provider does not serve to users files with this extension so I had to change it.
• Right click on desktop... Configure desktop... Screen saver, uncheck "require password to stop".
• Right click Panel menu - Add application to Panel, Internet, Firefox. Same for kedit and konsole. Add konsole button, su mode, choose cache icon
• Right-click on one of the virtual desktop in the taskbar, Configure desktops, number of desktops, 2
• Configure konsole: from Settings...: Schema... Linux colors; Save as Default
• Make available pictures for the login screen, with:

  su
  cd /usr/share/apps/kdm/pics/users/
  # for each user
  ln -s /vlad/poze_login/<username>.jpg
  

  Select those links from the K menu... Control Center... System Administration...Login Manager – Administrator Mode button, Users tab

Install scientific applications

• Install Seismic Unix to /usr/local/su.
• Madagascar: As root, mkdir /usr/local/rsf; chown [username].[group] /usr/local/rsf . Then, download it. Then install Madagascar.
• Establish passwordless login to Sourceforge, using the instructions in $HOME/madagascar/wiki/rsf_wiki_bak.sh