Important post-install configuration
The following are not part of the base install, but either can be essential to system function (like adding boot entropy for some headless systems like the Raspberry Pi) or are widely accepted best practices (like creating a non-root admin user and limiting time spent as root).
- Headless? Add boot entropy
Some systems might take an excessively long time to boot when no peripherals are attached (not only with the Pi series). In those cases it may be useful to add the rng-tools package to speed up the gathering of entropy.
- Create a non-root admin user
It is generally considered an administrative best practise to avoid logging in and/or operating with elevated privileges, to the extent reasonable to do so. Therefore one needs a user that is not root for performing most operations, but which can gain elevated access when required. In addition if, as recommended, one prevents root login over SSH one needs a user than one can SSH into and gain temporary elevated privileges. (Assuming a remotely accessed system, of course).
- SSH pubkey only
Disallowing SSH login with only a username and password is a well known security best practise, therefore we implement it.
- Pre-mount FS check
Where possible it is a best practise to safely check your filesystems before mounting them. Here we add the needed packages.
- Use encrypted LBU
Unless you need headless, or unattended reboots or power up, it is highly recommended to use an encrypted configuration backup.