Change keyboard layout

dpkg-reconfigure keyboard-configuration

Set locale

locale-gen dpkg-reconfigure locales vi /etc/default/locale

LANG="en_US.UTF-8"
LANGUAGE="en_US:en"
LC_CTYPE="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_COLLATE=en_US.UTF-8
LC_MONETARY="en_US.UTF-8"
LC_MESSAGES=en_US.UTF-8
LC_PAPER="en_US.UTF-8"
LC_NAME="en_US.UTF-8"
LC_ADDRESS="en_US.UTF-8"
LC_TELEPHONE="en_US.UTF-8"
LC_MEASUREMENT="en_US.UTF-8"
LC_IDENTIFICATION="en_US.UTF-8"
LC_ALL="en_US.UTF-8"

Set timezone

dpkg-reconfigure tzdata

Add new user and allow sudo

adduser MyNewUsername usermod -aG sudo MyNewUsername

Do not ask for root password on sudo

visudo

MyNewUsername ALL=NOPASSWD: ALL

Disable root account

passwd -l root

Rename computer (change hostname)

hostnamectl set-hostname newhostname

To go the full way: How to change a cloned GNU/Linux machine's identity

Use traditional network interface names

vi /etc/default/grub and add net.ifnames=0 to GRUB_CMDLINE_LINUX.

Then run update-grub.

Enbable DHCPv6

vi /etc/network/interfaces append:

iface eth0 inet6 dhcp

Disable IPv6 SLAAC

vi /etc/network/interfaces:

iface eth0 inet6 dhcp
  pre-up /sbin/sysctl -w net.ipv6.conf.eth0.autoconf=0
  pre-up /sbin/sysctl -w net.ipv6.conf.eth0.accept_ra=0

Disable kernel security features and CPU vulnerabilities mitigations

vi /etc/default/grub, add selinux=0 security=off audit=0 mitigations=off to GRUB_CMDLINE_LINUX.

Then run update-grub.

Run a mainline kernel

Install the zabbly kernel.

Install packages from testing or unstable

Use Apt-Pinning. APT::Default-Release won't cut it due to packages coming from stable-updates.

Encrypt home directory

gocryptfs is now (2025) preferred over ecryptfs. It achieves the same performance and has file integrity checks and better UX.

Follow bacardi55's guide. Caveats:

• The fuse package needs to be installed too.
• When editing /etc/security/pam_mount.conf.xml add idle=30s to the options. This makes sure the directory is auto unmounted after log out.
• On pam_mount.conf.xml add <pmvarrun>/usr/sbin/pmvarrun -u %(USER)</pmvarrun> to work around Debian bug #1034339.
• Run chmod og-rx /home/username*, to keep permissions the same as in any other home dir.

Create LVM partition and expand existing volume into it

parted /dev/sda (parted) mkpart primary ext2 0 4000 (parted) set 3 lvm on (parted) quit pvcreate /dev/sda3 vgextend vg0 /dev/sda3 lvextend /dev/vg0 -l +100%FREE resize2fs /dev/vg0