Configuration reference¶
Every setting of the configuration file, generated from pydebuprep's
own definitions. Types follow from the defaults: true/false, numbers, strings,
or lists of strings ([]).
report¶
Defaults for the report command. Command-line options override them.
| Key | Default | Description |
|---|---|---|
format |
text |
Output format: text, json, yaml, html, markdown, jira, confluence |
output_dir |
null |
Write reports to timestamped files in this directory (null = standard output) |
min_severity |
info |
Hide findings below this severity: info, warning, critical (the exit code still counts them) |
color |
true |
Colorize text output when writing to a terminal |
todo |
false |
Add a TODO checklist of what needs fixing at the end of each report |
baseline |
auto |
Snapshot to compare against: auto (newest in snapshot_dir), none, or a file path |
snapshot_dir |
/var/lib/pydebuprep/snapshots |
Where snapshots are written and looked up |
logs¶
| Key | Default | Description |
|---|---|---|
ignore |
[] |
Regular expressions for log messages to leave out of both journal-errors and dmesg-errors, matched against the message text. Kernel messages appear in both, so one pattern here covers them; use a check's own 'ignore' option for the rest. |
checks¶
One section per check, named by its ID. Every section accepts enabled (default true; false leaves the check out of reports and snapshots) plus the check's own options:
| Check | Option | Default | Description |
|---|---|---|---|
apt-lists-age |
max_age_days |
7 |
Report package lists older than this |
config-conflicts |
critical_paths |
["/etc/ssh/sshd_config", "/etc/ssh/sshd_config.d/", "/etc/sudoers", "/etc/sudoers.d/"] |
Config files whose unmerged updates are critical; a trailing / means a directory |
config-conflicts |
ignore_paths |
[] |
Files to leave out, e.g. ones a configuration tool such as Ansible manages (shell-style patterns, matched against the config file or its leftover copy) |
debsums |
timeout_seconds |
600 |
Give up after this many seconds |
boot-space |
warning_pct |
25.0 |
Warn when free space or inodes drop below this percentage |
boot-space |
critical_pct |
10.0 |
Critical when free space or inodes drop below this percentage |
dmesg-errors |
ignore |
[] |
Regular expressions; matching kernel messages are left out |
journal-errors |
ignore |
[] |
Regular expressions; messages matching any of them (as 'IDENTIFIER: message') are left out |
systemd-critical-services |
required_active |
[] |
Units that must be running (or socket-activated) |
systemd-critical-services |
required_enabled |
[] |
Units that must be enabled |
systemd-critical-services |
builtin |
true |
Also require ssh, cron and journald where installed |
systemd-critical-services |
ignore_units |
[] |
Units to leave out (shell-style patterns) |
systemd-failed |
ignore_units |
[] |
Units to leave out (shell-style patterns) |
systemd-timers |
ignore_units |
[] |
Timers to leave out (shell-style patterns) |
python-venvs |
search_paths |
["/opt", "/srv", "/usr/local", "/root", "/home", "/var/www"] |
Directories searched for virtualenvs (pyvenv.cfg) |
python-venvs |
max_depth |
5 |
How many directories deep to search below each path |
python-venvs |
exclude_paths |
["*/.cache/*"] |
Virtualenvs to leave out (shell-style patterns), e.g. tools' throwaway environments under ~/.cache |
network |
ignore_interfaces |
["lo", "veth*", "docker*", "br-*", "virbr*", "vnet*", "tap*", "cni*", "flannel*", "cali*"] |
Interfaces left out of the baseline comparison (shell-style patterns); containers and VMs create and remove these all the time |
disk-space |
include_remote |
false |
Also check network and FUSE filesystems (NFS, CIFS, sshfs, rclone, ...) |
disk-space |
warning_pct |
25.0 |
Warn when free space or inodes drop below this percentage |
disk-space |
critical_pct |
10.0 |
Critical when free space or inodes drop below this percentage |
disk-space |
exclude_mounts |
[] |
Mount points to leave out (shell-style patterns) |
disk-space |
important_mounts |
["/", "/var"] |
Mount points that also need min_free_mib free whatever their size; upgrades download and unpack packages here |
disk-space |
min_free_mib |
2048 |
Free space (MiB) the important mounts need: warning below it, critical below half of it; 0 turns this off |
Checks with no options (only enabled): apt-sources, os-release, apt-autoremove, apt-held, apt-upgradable, dpkg-audit, dpkg-rc, obsolete-packages, bootloader, dkms, kernel-running, boot-time, cron, needrestart, time-sync, bind, docker, mariadb, postfix, postgresql, firewall, apparmor, ssh-server, unattended-upgrades, fstab.
Complete example¶
This is the output of pydebuprep example-config: every setting at its default.
/etc/pydebuprep.conf
# pydebuprep configuration
#
# Read from /etc/pydebuprep.conf if it exists, or from the file given with --config.
# Every value below is the built-in default; keep only what you change.
# Command-line options override these settings. Check a file with:
# pydebuprep configtest --config FILE
report:
# Output format: text, json, yaml, html, markdown, jira, confluence
format: text
# Write reports to timestamped files in this directory (null = standard output)
output_dir: null
# Hide findings below this severity: info, warning, critical (the exit code still counts them)
min_severity: info
# Colorize text output when writing to a terminal
color: true
# Add a TODO checklist of what needs fixing at the end of each report
todo: false
# Snapshot to compare against: auto (newest in snapshot_dir), none, or a file path
baseline: auto
# Where snapshots are written and looked up
snapshot_dir: /var/lib/pydebuprep/snapshots
# Regular expressions for log messages to leave out of both journal-errors and
# dmesg-errors, matched against the message text. Kernel messages appear in both, so one
# pattern here covers them; use a check's own 'ignore' option for the rest.
logs:
ignore: []
# One section per check. 'enabled: false' leaves a check out; the other keys are
# that check's options. Override on the command line with
# --check-option CHECK.OPTION=VALUE
checks:
# Age of downloaded package lists (release)
apt-lists-age:
enabled: true
# Report package lists older than this
max_age_days: 7
# APT sources (release)
apt-sources:
enabled: true
# Operating system release (release)
os-release:
enabled: true
# Packages no longer needed (packages; uses apt-get)
apt-autoremove:
enabled: true
# Held packages (packages; uses apt-mark)
apt-held:
enabled: true
# Pending package upgrades (packages; uses apt)
apt-upgradable:
enabled: true
# Unmerged configuration files (packages)
config-conflicts:
enabled: true
# Config files whose unmerged updates are critical; a trailing / means a directory
critical_paths: ["/etc/ssh/sshd_config", "/etc/ssh/sshd_config.d/", "/etc/sudoers", "/etc/sudoers.d/"]
# Files to leave out, e.g. ones a configuration tool such as Ansible manages (shell-style patterns, matched against the config file or its leftover copy)
ignore_paths: []
# Package file checksums (packages; needs root; uses debsums)
debsums:
enabled: true
# Give up after this many seconds
timeout_seconds: 600
# Broken or half-configured packages (packages; uses dpkg, apt-get)
dpkg-audit:
enabled: true
# Leftover configuration of removed packages (packages; uses dpkg-query)
dpkg-rc:
enabled: true
# Packages not available from any repository (packages; uses apt, dpkg-query)
obsolete-packages:
enabled: true
# Free space on /boot and the EFI partition (boot)
boot-space:
enabled: true
# Warn when free space or inodes drop below this percentage
warning_pct: 25.0
# Critical when free space or inodes drop below this percentage
critical_pct: 10.0
# Bootloader configuration (boot)
bootloader:
enabled: true
# Out-of-tree kernel modules (DKMS) (boot; uses dkms)
dkms:
enabled: true
# Running kernel (boot; uses uname)
kernel-running:
enabled: true
# Boot time (services; uses systemd-analyze)
boot-time:
enabled: true
# cron jobs (services)
cron:
enabled: true
# Kernel errors and warnings (services; needs root; uses dmesg)
dmesg-errors:
enabled: true
# Regular expressions; matching kernel messages are left out
ignore: []
# Errors in the journal (current boot) (services; uses journalctl)
journal-errors:
enabled: true
# Regular expressions; messages matching any of them (as 'IDENTIFIER: message') are left out
ignore: []
# Services using outdated libraries (services; needs root; uses needrestart)
needrestart:
enabled: true
# Critical systemd units (services; uses systemctl)
systemd-critical-services:
enabled: true
# Units that must be running (or socket-activated)
required_active: []
# Units that must be enabled
required_enabled: []
# Also require ssh, cron and journald where installed
builtin: true
# Units to leave out (shell-style patterns)
ignore_units: []
# Failed systemd units (services; uses systemctl)
systemd-failed:
enabled: true
# Units to leave out (shell-style patterns)
ignore_units: []
# systemd timers (services; uses systemctl)
systemd-timers:
enabled: true
# Timers to leave out (shell-style patterns)
ignore_units: []
# Time synchronisation (services)
time-sync:
enabled: true
# BIND configuration (applications; needs root; uses named-checkconf)
bind:
enabled: true
# Docker containers (applications; needs root; uses docker)
docker:
enabled: true
# MariaDB data directory (applications; needs root; uses mariadbd)
mariadb:
enabled: true
# postfix configuration (applications; uses postconf)
postfix:
enabled: true
# PostgreSQL clusters (applications; uses pg_lsclusters)
postgresql:
enabled: true
# Python virtualenvs (applications)
python-venvs:
enabled: true
# Directories searched for virtualenvs (pyvenv.cfg)
search_paths: ["/opt", "/srv", "/usr/local", "/root", "/home", "/var/www"]
# How many directories deep to search below each path
max_depth: 5
# Virtualenvs to leave out (shell-style patterns), e.g. tools' throwaway environments under ~/.cache
exclude_paths: ["*/.cache/*"]
# Firewall rules (network; needs root)
firewall:
enabled: true
# Network interfaces, routes and DNS (network; uses ip)
network:
enabled: true
# Interfaces left out of the baseline comparison (shell-style patterns); containers and VMs create and remove these all the time
ignore_interfaces: ["lo", "veth*", "docker*", "br-*", "virbr*", "vnet*", "tap*", "cni*", "flannel*", "cali*"]
# AppArmor (security; needs root)
apparmor:
enabled: true
# SSH server configuration (security; needs root; uses sshd)
ssh-server:
enabled: true
# Automatic security updates (security; uses apt-config, dpkg-query)
unattended-upgrades:
enabled: true
# Free disk space and inodes (storage; uses df)
disk-space:
enabled: true
# Also check network and FUSE filesystems (NFS, CIFS, sshfs, rclone, ...)
include_remote: false
# Warn when free space or inodes drop below this percentage
warning_pct: 25.0
# Critical when free space or inodes drop below this percentage
critical_pct: 10.0
# Mount points to leave out (shell-style patterns)
exclude_mounts: []
# Mount points that also need min_free_mib free whatever their size; upgrades download and unpack packages here
important_mounts: ["/", "/var"]
# Free space (MiB) the important mounts need: warning below it, critical below half of it; 0 turns this off
min_free_mib: 2048
# /etc/fstab and mounts (storage; uses findmnt)
fstab:
enabled: true