View source for Post Ubuntu Install

= Before using Ubuntu, I do these things =
This is a collection of things to do after installing Ubuntu or most Linux systems actually. Some are just customizations and some are security. While a number of tools are offered as part of the installation, I prefer to get the current set using the package installer.

==Set Network Connection==
From the console open Settings->Network 

Click on the gear to open the network settings window. Enter the IP address, netmask and gateway. Set the DNS server to: 192.168.86.2

Easiest way to continue is to restart.

== Get the System Up to Date==
<syntaxhighlight lang="shell" line>
sudo apt update
sudo apt upgrade
</syntaxhighlight>

==Install and Open Cockpit==
<syntaxhighlight lang="shell">
. /etc/os-release
sudo apt install -t ${VERSION_CODENAME}-backports cockpit
</syntaxhighlight>
Open URL from a web browser:
<syntaxhighlight lang="shell">
 https://<ip address>:9090
</syntaxhighlight>
Login with the user created on the install. After logging in, do a quick check, switch to administrative access and then open the terminal window.
====See Also====
[https://www.linode.com/docs/ Cockpit Reference]
[https://cockpit-project.org/running.html#ubuntu Install Cockpit on Ubuntu]

==Install and Configure sshd==
The sshd server needs to be running so that you can login. This is required in order to cut and paste.
<syntaxhighlight lang="shell" line>
sudo /bin/bash
apt install openssh-server putty-tools -y < /dev/null
systemctl start ssh
</syntaxhighlight>

Continue from an ssh terminal session.

== Fix sudo to not prompt for password==
{{highlight|Do this as login user, NOT root.}}

It might be easier to just do this by manually creating the file and fixing up the permissions.

Create a file for the user in the /etc/sudoers.d directory and add the following line to it. ${USER} matches the user created during the install. This needs to be done by the ordinary user or the steps will create a sudoers.d file for root. Do in two steps because you will be asked to authenticate assuming that this is probably the first sudo command of the session.
<syntaxhighlight lang="shell" line>
cat > ${USER} <<EOF
${USER}    ALL=(ALL) NOPASSWD:ALL
EOF
chmod 440 ${USER}
sudo chown 0:0 ${USER}
</syntaxhighlight>

<syntaxhighlight lang="shell">
sudo mv ${USER} /etc/sudoers.d/${USER}
</syntaxhighlight>

Give yourself superuser privileges before you continue.
<syntaxhighlight lang="shell">
sudo /bin/bash
</syntaxhighlight>

== Do a little account work ==

Add the user to groups adm and sudo

<syntaxhighlight lang="shell" line>
usermod -a -G adm ${SUDO_USER}
usermod -a -G sudo ${SUDO_USER}
</syntaxhighlight>

Change the login shell on www-data to /bin/bash.

We want to have docker as UID/PID of 1000/1000. The user created on install sits there. We could install the system with the docker user. Will have to look at that next time.

Edit the /etc/passwd and /etc/groups files to move the installed user to 1001/1001 and then change the ownership of the user's home directory.
<syntaxhighlight lang="shell" line>
sed -i s/${SUDO_USER}:x:1000:1000/${SUDO_USER}:x:1001:1001/g /etc/passwd
sed -i s/${SUDO_USER}:x:1000/${SUDO_USER}:x:1001/g /etc/group
chown -R ${SUDO_USER}:${SUDO_USER} /home/${SUDO_USER}
</syntaxhighlight>
Generally all that is needed is a logout and a login. Sometimes a reboot is the quickest way around an error creating a terminal instance when logging out and back in after making this change. It means that you screwed up the order of doing this.



==Install and Configure NFS==
Install the software and create any directories that will have mounted directories in /nfs and then...
<syntaxhighlight lang="shell" line>
apt install nfs-kernel-server nfs-common -y </dev/null
mkdir /nfs
mkdir -p /nfs/media /nfs/multimedia /nfs/mediaarchive /nfs/public /nfs/tr004
chmod -R 777 /nfs
chown -R nobody:nogroup /nfs
</syntaxhighlight>
Now mount the directories from the NAS. Add the following lines to /etc/fstab
<syntaxhighlight lang="shell">
echo ' ' >>/etc/fstab
echo 'macey.lan:/share/Media              /nfs/media              nfs defaults 0 0' >>/etc/fstab
echo 'macey.lan:/share/Multimedia         /nfs/multimedia         nfs defaults 0 0' >>/etc/fstab
echo 'macey.lan:/share/Media_Archive      /nfs/mediaarchive       nfs defaults 0 0' >>/etc/fstab
echo 'macey.lan:/share/Public             /nfs/public             nfs defaults 0 0' >>/etc/fstab
echo 'macey.lan:/share/Public2            /nfs/public2            nfs defaults 0 0' >>/etc/fstab
echo 'macey.lan:/share/TR004              /nfs/tr004              nfs defaults 0 0' >>/etc/fstab
systemctl restart nfs-kernel-server
systemctl daemon-reload
mount -a
</syntaxhighlight>

== Next setup putty (Optional) ==
This section describes setting up a key file so that you can login with putty without a password. You can skip on down if you already have a key file handy.

This is only required if you have not already done so. See the copy of the authorized-keys file from somewhere.

In the putty application on Windows:
<syntaxhighlight lang="shell" line>
 - Create a new session for the VM
 - Put in the IP and the name for the saved session
 - Under Window, set columns to 135
 - Under Window/Behavior, put the VM name in the Window Title
 - Under Connection/Data put your user into Auto-login
 - Open SSH under connection and select Auth 
 - Browse to your Private Key file
 - Return to Session and Save
</syntaxhighlight>
Note that a current version of putty (using  0.77) is needed to connect to Ubuntu 22.04. 
Create an ECDSA key with unless you have one:
<syntaxhighlight lang="shell" line>
 ssh-keygen -t ecdsa -b 521
</syntaxhighlight>
Install putty tools and generate a ppk key for putty:
<syntaxhighlight lang="shell" line>
 apt install putty-tools dialog
 puttygen keyname -o keyname.ppk
</syntaxhighlight>

== Install Public Key for the user ==
There are two ways to do this. If nfs has been setup and there is a working authorized-keys file it is easiest to copy it in. The below method does work but requires that the lines be edited together to form one long line per entry.

If you are getting the file from a mounted location do this:
<syntaxhighlight lang="shell" line>
mkdir /home/${SUDO_USER}/.ssh
chmod 755 /home/${SUDO_USER}/.ssh
cp /nfs/public/authorized_keys /home/${SUDO_USER}/.ssh
chown ${SUDO_USER}:${SUDO_USER} /home/${SUDO_USER}/.ssh/authorized_keys
</syntaxhighlight> 
Else:
<syntaxhighlight lang="shell" line>
mkdir /home/${SUDO_USER}/.ssh
chmod 755 /home/${SUDO_USER}/.ssh
touch /home/${SUDO_USER}/.ssh/authorized_keys
chmod 664 /home/${SUDO_USER}/.ssh/authorized_keys
</syntaxhighlight>
Did I not warn you?
<syntaxhighlight lang="shell" line>
cd /home/${SUDO_USER}/.ssh
vi authorized_keys
</syntaxhighlight>
<syntaxhighlight lang="shell" line>
Comment: "Lynn Oct-2020"
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAvvWjBI6Yl1u5TSloZ6PY9bx7QKFntKP1uZLuTBeTzqZcw43gIqZ2c8d8hlDyTtPyJtph/KjVsMuUu/fLEqV9P/J2vaZLdgwbApR3pzjlulIiQ4GYpGBieFiVsvI+R5oOatGr0EUDUShSddmChsqVRn17Uy/lZFzZ/awo01z/I5Z63HsH+6eh8SE3YtPayrXkse2HyC5t+O3Qo+iXwMOGjmEvWGP2FuFrxH0JOR9kGehhZdVKk0le0ljOEVKgGLmK2x6mbm990a/l9Mf5n2RgUSt05nAP/myLUs8RBasWwJo5IIf4smZCy0EefRvNCrS+fPQkEbWhycQaSMD6S8aHYw==

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCrVr+M/SrcFqCXbOfBk1YTMd3gN0P/qfnDlCz5SODRXNWhSzLsSE1Q+I17vv+0hq82aBmyUwRcZOXOodAfFZS1ETn3PTmBPGblUlxdgVEyQmf7JtsjSnyYKkqQ5oiJJDnBxFLihlWBm9bYUk9BA0qRC/jbMLDcLMd2jldDceQh2Q2Gdnv0WnNfs/Ha6WH/COOTo0RfmSHsh1GlC6Vog5xqBTW/wRBreVXTZWqAemQ3qwCGhAkDdsiz26Ao1LZxeY1rStfmyjTJUVMBiqIENq5TKpvxx/3k3Epecqvu1lNc4uTK+RsRo8bGUXSUg5NYKZ8fsJKAWnZ1im1XF6ryVdQtHCZsePjWCVKLI3LdqrsIFiwynh58ud2lxMIJDS3zzCESERTLtsFdbkdL95VarOfNcBLqtJ6S4my/BSHAPOuI9PMhhrZM24aSLYWbX6o6THOi1VvsO7r74TzEkfq3ldlen9nFfOTTnu9ks9Co7ODmQvnea1CVsNb7Fr1IcFL/4nsbU+a73HGnejL+VL0hA/D9L1YFOKJsyABsqI7O8UkJpYnL6+CBJgX72/b5GD6ZK93L4oGj0gGHuYd9IaEY9owGIBeMmCoah+rQCfqRHp1J7h9ret1KfEZSu9lH5t7UvZDQwxbfikOAVKTyfLD7fHL8DbE+dxlRMJ2TLaiJVHgcwQ== lynnmacey@gmail.com

ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBACVNiuESaiDRzT0SiZNjvZq+HFV2J2jYV4F88TkW6ysqqCmyjwiyg3L2jeGuj0aA11qFF6voiteHT6D7df6wWZfUQDw/F8Wow6gQjrFW8QhrdIlo/fNmn2CNncDoqRx9onXMKz9FYEvU7QqjisXwMZtQ/DH6G0t6bwc+WyRPNXV5pO1AQ== lynn@chico

Comment: "ecdsa-key-20220712 lynn putty"
AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHw2zURA2K4DZSknQi73t0pAZv6mCK3LD4o6zw/pHqIZMxFiHmV4vj6nEh7/y21okpkCczCzdpmwFd7Se141GLQ=

</syntaxhighlight>

You should now have a key file as pointed to in putty and an authorized-keys file in the ~/.ssh directory. Logout and back in if you are in a putty session. It should work without asking for a password. With cockpit, you can just continue.

==Configure Upgrade Behavior==
<syntaxhighlight lang="Shell" line>
dpkg-reconfigure --priority=low unattended-upgrades
</syntaxhighlight>
Accept the "Yes" response.



== Install KVM agent==
<syntaxhighlight lang="Shell" line>
apt install qemu-guest-agent
</syntaxhighlight>

==Install more packages==
<syntaxhighlight lang="Shell" line>
apt update -y </dev/null
apt upgrade -y </dev/null
apt install apt-utils curl dbus dialog dnsutils less net-tools rsync ufw wget zip dbus dialog rsync less curl dnsutils apt-utils wget ufw zip postgresql postgresql-contrib putty-tools -y </dev/null
</syntaxhighlight>

== Install Tasksel- If this will be a web server==
<syntaxhighlight lang="Shell" line>
apt install tasksel
tasksel
</syntaxhighlight>
Select:
 - all non-minimal desktop packages 
 - LAMP
 - Samba
 - Audio recording and editing suite
 - Large selection of fonts
 - 2D/3D creation and editing suite
 - Photograph touchup and editing suite
 - Publishing applications 
 - Video creation and editing suite
 - Basic Ubuntu server

This takes a while. I had to run several times selecting some as I went.

==Change System Limits==
The default limits for some system operations are too small. The usual result is system applications complaining to syslog which then fills up the root file system. Do the following to solve this problem:
<syntaxhighlight lang=shell line>
cat >> /etc/sysctl.conf <<EOF
fs.file-max = 2097152
EOF
sysctl -p
</syntaxhighlight>

==Configure Apache, Php and MariaDB==
LAMP was installed from tasksel but, I want to replace MySQL with MariaDB and then configure the LAMP stack.
===Apache===
Enable mods that will be needed
<syntaxhighlight lang="Shell" line>
a2enmod rewrite
a2enmod headers
</syntaxhighlight>

Using this tool [https://www.ssllabs.com/ssltest/analyze.html SSL Labs SSL Server Test] should result in an A+ (Whoo Hoo!) rating. The following changes were needed to get past a B+.

Update the /etc/apache2/mods-available/ssl.conf file. 

Replace the SSLCipherSuite definition: (Replaced)

 '''SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"'''

Uncomment:

 '''SSLHonorCipherOrder on'''

And replace the SSLProtocol definition. (Replaced)

 '''SSLProtocol all -SSLv2 -SSLv3'''

Modify the file /etc/apache2/mods-available/http2.conf to read in part: (this can now be done by uncommenting lines)

 Protocols h2 h2c http/1.1
 H2Push on
 H2PushPriority * after
 H2PushPriority text/css before
 H2PushPriority image/jpeg after 32
 H2PushPriority image/png after 32
 H2PushPriority application/javascript interleaved
Enable the mod and restart aApache2 and php.
 a2enmod http2
 systemctl restart apache2
 systemctl start php8.3-fpm

===Install MariaDB===
<syntaxhighlight lang="Shell" line>
 sudo apt install mariadb-server
 sudo systemctl status mariadb
</syntaxhighlight>
Results will vary slightly with the release
 ● mariadb.service - MariaDB 10.1.47 database server
    Loaded: loaded (/lib/systemd/system/mariadb.service; enabled; vendor preset: enabled)
    Active: active (running) since Sun 2020-11-08 23:41:31 UTC; 1min 4s ago
      Docs: man:mysqld(8)
            https://mariadb.com/kb/en/library/systemd/
  Main PID: 6324 (mysqld)
    Status: "Taking your SQL requests now..."
     Tasks: 27 (limit: 4915)
    CGroup: /system.slice/mariadb.service
            └─6324 /usr/sbin/mysqld
 
 Nov 08 23:41:31 system /etc/mysql/debian-start[6357]: performance_schema
 Nov 08 23:41:31 system /etc/mysql/debian-start[6357]: Phase 6/7: Checking and upgrading tables
 Nov 08 23:41:31 system /etc/mysql/debian-start[6357]: Processing databases
 Nov 08 23:41:31 system /etc/mysql/debian-start[6357]: information_schema
 Nov 08 23:41:31 system /etc/mysql/debian-start[6357]: performance_schema
 Nov 08 23:41:31 system /etc/mysql/debian-start[6357]: Phase 7/7: Running 'FLUSH PRIVILEGES'
 Nov 08 23:41:31 system /etc/mysql/debian-start[6357]: OK
 Nov 08 23:41:31 system /etc/mysql/debian-start[6388]: Checking for insecure root accounts.
 Nov 08 23:41:31 system /etc/mysql/debian-start[6392]: Triggering myisam-recover for all MyISAM tables and aria-recover f
 Nov 08 23:41:31 system systemd[1]: Started MariaDB 10.1.47 database server.

To secure MariaDB server as much as possible, run the post installation script. The script will let you continue without adding a password for the MariaDB root user but it is preferred that the standard one be entered.

 sudo mysql_secure_installation

 NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
       SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!
 
 In order to log into MariaDB to secure it, we'll need the current
 password for the root user.  If you've just installed MariaDB, and
 you haven't set the root password yet, the password will be blank,
 so you should just press enter here.
 
 Enter current password for root (enter for none):
 OK, successfully used password, moving on...
 
 Setting the root password ensures that nobody can log into the MariaDB
 root user without the proper authorisation.
 
 You already have a root password set, so you can safely answer 'n'.
 
 Change the root password? [Y/n] '''n'''
 New password:
 Re-enter new password:
 Password updated successfully!
 Reloading privilege tables..
  ... Success!
 
 
 By default, a MariaDB installation has an anonymous user, allowing anyone
 to log into MariaDB without having to have a user account created for
 them.  This is intended only for testing, and to make the installation
 go a bit smoother.  You should remove them before moving into a
 production environment.
 
 Remove anonymous users? [Y/n] '''n'''
  ... skipping.
 
 Normally, root should only be allowed to connect from 'localhost'.  This
 ensures that someone cannot guess at the root password from the network.
 
 Disallow root login remotely? [Y/n] '''n'''
  ... skipping.
 
 By default, MariaDB comes with a database named 'test' that anyone can
 access.  This is also intended only for testing, and should be removed
 before moving into a production environment.
 
 Remove test database and access to it? [Y/n] '''n'''
  ... skipping.
 
 Reloading the privilege tables will ensure that all changes made so far
 will take effect immediately.
 
 Reload privilege tables now? [Y/n] '''y'''
  ... Success!
 
 Cleaning up...
 
 All done!  If you've completed all of the above steps, your MariaDB
 installation should now be secure.
 
 Thanks for using MariaDB!
 root@system:~#

===Make any changes to the MariaDB configuration.===
Note that if this is a system that was previously configured, changing the /etc/mysql entry to the symbolic link is all that is required.

Stop the database engine
<syntaxhighlight lang="Shell" line=0>
systemctl stop mysql
</syntaxhighlight>

'''This was for Wenebojo. We are not moving.'''

Verify that mysql configuration directory in the /data partition exists and contains files:
<syntaxhighlight lang="Shell" line=0>
ls -l /data/etc/mysql
</syntaxhighlight>
If not, execute the following:

Move the MySQL/Mariadb configuration files:
<syntaxhighlight lang="Shell" line=0>
cd /etc
tar xvf /tmp/xfer mysql
cd /data/etc
tar xvf /tmp/xfer
</syntaxhighlight>
Replace the /etc/directory with a symbolic link
<syntaxhighlight lang="Shell" line=0>
mv mysql mysql.dist
ln -s /data/etc/mysql mysql
</syntaxhighlight>

===Perform local MariaDB configuration Changes===
Modify /etc/mysql/mariadb.conf.d/50-server.cnf

====Allow Remote Access====
Change the bind-address line to this:

 bind-address            = 0.0.0.0

====Turn on the slow query log====
 slow_query_log_file    = /var/log/mysql/mariadb-slow.log
 slow_query_log         = 1 <-need to add
 long_query_time        = 1 <- was 10
 log_slow_rate_limit    = 1000
 log_slow_verbosity     = query_plan
 log-queries-not-using-indexes

====Change Location of DB Files====
Edit /etc/mysql/mariadb.conf.d/50-server.cnf and change the datadir definition

 datadir                 = /data/db/mysql

===Restart the Database Engine===
<syntaxhighlight>
systemctl start mysql
</syntaxhighlight>

==Performance Improvements==

===Install Memcached===
<syntaxhighlight lang="Shell" line>
apt update
apt install memcached libmemcached-tools
systemctl status memcached
apt install php-memcached
pip install pymemcache
</syntaxhighlight>

====Install Webmin====
First install dependencies and then Webmin itself. Note that the version is baked into the command.
<syntaxhighlight lang="shell" line="1">
cd /tmp
apt update
apt install perl libnet-ssleay-perl openssl libauthen-pam-perl libpam-runtime libio-pty-perl apt-show-versions unzip nodejs npm
</syntaxhighlight>
The Webmin repository has not changed since 2011 so it is unlikely to sson.
<syntaxhighlight lang="shell" line="1">
chmod 666 /etc/apt/sources.list.d/ubuntu.sources
cat >>/etc/apt/sources.list.d/ubuntu.sources <<EOF
deb http://download.webmin.com/download/repository sarge contrib
EOF
chmod 664 /etc/apt/sources.list.d/ubuntu.sources
wget -q -O- http://www.webmin.com/jcameron-key.asc | apt-key add
apt update 
apt install webmin
</syntaxhighlight>
Digital Ocean has the magic to install a certificate. https://www.digitalocean.com/community/tutorials/how-to-install-webmin-on-ubuntu-20-04

==Install PIA==
'''The one is very important!''' PIA is my VPN provider. This protects against outside snooping.
From the browser go here: [https://www.privateinternetaccess.com/download/linux-vpn PIA Linux download page].

After downloading (version number will likely change),
<syntaxhighlight lang="Shell" line>
cd ~lynn/Downloads
bash pia-linux-3.3.1-06924.run
</syntaxhighlight>
as a regular user. After installing it will open a authentication window.
 Account information:
 Username: p4780415
 Password: Topeka123!
Before connecting make the following changes:
 Select Panama as the VPN server
 Click on the three vertical dots on the upper right.\ and select settings.
 General: 
   Select Launch on System Startup and Connect on Launch
 Protocols:
  Select WireGuard
 Network:
  Select Use Existing DNS
  Select Request Port Forwarding (may not use it but it doesn't hurt)
 Privacy:
  Select Advanced Kill Switch (Ok, I am paranoid)

The changes require a reconnect if you connected earlier. Otherwise, close the settings and click on the big connect button on the main page. It will turn green and indicate "CONNECTED" if all is well. You can close the window and sleep at night.

==Install Remote access tools==
===X2go===
This installs the requisite software to connect to and from the machine with X2go.

[https://www.digitalocean.com/community/tutorials/how-to-set-up-a-remote-desktop-with-x2go-on-ubuntu-20-04 X2go]
<syntaxhighlight lang="Shell" line>
sudo apt install xubuntu-desktop
sudo apt install xubuntu-core
sudo apt install mate-core mate-desktop-environment mate-notification-daemon
sudo apt install x2goserver x2goserver-xsession
sudo apt install x2goclient
</syntaxhighlight>
Fixup for startup problems.
<syntaxhighlight lang="Shell" line>
sudo ln -s /usr/bin/startplasma-x11 /usr/bin/startkde
</syntaxhighlight>
Notes: Install lightdm at the prompt.

===xRDP===
Used to access system from other systems.

Install the package:
<syntaxhighlight lang="Shell" line>
sudo apt update
sudo apt install xrdp 
</syntaxhighlight>
Test that xrdp is running
<syntaxhighlight lang="Shell" line>
sudo systemctl status xrdp
</syntaxhighlight>
You should see something like this:
 Output
 ● xrdp.service - xrdp daemon
     Loaded: loaded (/lib/systemd/system/xrdp.service; enabled; vendor preset: enabled)
     Active: active (running) since Fri 2020-05-22 17:36:16 UTC; 4min 41s ago
  ...
By default Xrdp uses the /etc/ssl/private/ssl-cert-snakeoil.key file that is readable only by members of the “ssl-cert” group. Run the following command to add the user to the user and restart:
<syntaxhighlight lang="Shell" line>
sudo adduser xrdp ssl-cert  
sudo systemctl restart xrdp
</syntaxhighlight>

==Install Python==
Python2 and python3 are installed as part of the default Ubuntu 20.04 release but verify. Python3 is installed on 24.04 so skip on down to the linking python to python3 below.
<syntaxhighlight lang="shell" line="1">
sudo apt install python3
</syntaxhighlight>
This will probably give a response that it is already at the latest version.
<syntaxhighlight lang="shell" line="1">
python --version
</syntaxhighlight>
The response here will likely be to display that it is version 2 or, that python is not found. To fix that do the following:
<syntaxhighlight lang="shell" line="1">
cd /usr/bin
ls -l python*
</syntaxhighlight>
If python is not symlink to python version 3.12 do this:
<syntaxhighlight lang="shell" line="1">
sudo rm /usr/bin/python
sudo ln -s /usr/bin/python3.12 /usr/bin/python
</syntaxhighlight>
For Ubuntu 24.04 it is simply:
<syntaxhighlight lang="shell" line="0">
cd /usr/bin
ln -s python3.12 python
</syntaxhighlight>
===Install pip===
<syntaxhighlight lang="shell" line="1">
sudo apt update
sudo apt install python3-pip
</syntaxhighlight>
The current install creates pip as an identical file to pip3. This may change or, has changed.
<syntaxhighlight lang="shell" line="1">
sudo ln -s /usr/bin/pip3 /usr/bin/pip
</syntaxhighlight>

==The time zone may be wrong==
<syntaxhighlight lang="Shell" line>
timedatectl
sudo timedatectl set-timezone America/Los_Angeles
</syntaxhighlight>




== Install KVM guest agent==
Enable QEMU in the Proxmox Options menu
<syntaxhighlight lang="Shell" line>
apt install qemu qemu-guest-agent
systemctl enable qemu-guest-agent
systemctl start qemu-guest-agent
</syntaxhighlight>
Once started verify its operation by looking at the Proxmox summary page for the server. It will show IP information rather than a message that the guest agent is not running.

In a Proxmox shell session execute the following. Replace 100 with the appropriate VM instance
<syntaxhighlight lang="Shell" line>
qm agent 100 ping
</syntaxhighlight>
If it is not working you will get an error. No response means that it is working.