Dominik Lenhardt OnkelDom

Ubuntu 22.04 Annoyances

Here are a few collected ways I like to customize Ubuntu 22.04 servers. I used to love Ubuntu, but I hate auto updates and snaps. They also put ads and other usless ads diguised as "news" in MOTD. ESM FUD is spread throughout the OS including simple apt functions. You do not need ESM and thus Ubuntu 22.04 has become super annoying. unattended-upgrade is an automatic installation of security (and other) upgrades without user intervention. Consider the ramifications of disabling this service.

Disable unattended upgrades

The Unattended Upgrades feature is enabled by default and it runs at system boot without the user's permission. The configuration is stored in /etc/apt/apt.conf.d/20auto-upgrades

Disable: sudo dpkg-reconfigure unattended-upgrades then a TUI will come up, select "No"

This will not permantently disable the function. After an update it will be enabled. In the file /etc/apt/apt.conf.d/20auto-upgrades change these values from 1 to 0. Even doing this it will

OpenVPN on UniFi USG Instructions for FIT

Last Updated: 2021/01/19

Fork Notes

Forked this to provide better details for our environment, you should be able to copy paste most of the commands from the command blocks

Details

I wanted to run an OpenVPN server on the USG. Since it has a Radius server built in, I figured this would be a much better way to handle OpenVPN authentication. Make sure you have the Radius server enabled on your USG under Settings > Services > Radius > Server in the controller. Add OpenVpn users under Settings > Services > Radius > Server.

Last Updated: 8/30/18

Details

I wanted to run an OpenVPN server on the USG. Since it has a Radius server built in, I figured this would be a much better way to handle OpenVPN authentication. Make sure you have the Radius server enabled on your USG under Settings > Services > Radius > Server in the controller. Add OpenVpn users under Settings > Services > Radius > Server.

Thanks to the following resources in helping to configure this:

	#Install WinGet
	#Based on this gist: https://gist.github.com/crutkas/6c2096eae387e544bd05cde246f23901
	#Which I found here: https://chrislayers.com/2021/08/01/scripting-winget/
	$hasPackageManager = Get-AppPackage -name 'Microsoft.DesktopAppInstaller'
	if (!$hasPackageManager -or [version]$hasPackageManager.Version -lt [version]"1.10.0.0") {
	"Installing winget Dependencies"
	Add-AppxPackage -Path 'https://aka.ms/Microsoft.VCLibs.x64.14.00.Desktop.appx'

	$releases_url = 'https://api.github.com/repos/microsoft/winget-cli/releases/latest'

	# Some UniFi devices may not have the current ISRG root cert that LE uses
	# Some devices also have an older version of OpenSSL
	# These older versions will not validate a cert if the expired DST root cert is part of the chain

	# USG
	# This has an older OpenSSL version
	# The current ISRG root cert is not included in the latest firmware
	sudo -i
	sed -i 's\|^mozilla\/DST_Root_CA_X3\.crt\|!mozilla/DST_Root_CA_X3.crt\|' /etc/ca-certificates.conf
	curl -sk https://letsencrypt.org/certs/isrgrootx1.pem -o /usr/local/share/ca-certificates/ISRG_Root_X1.crt

	- hosts: all
	vars:
	version: "1.4.2"
	interface: "enp2s0"
	dante_port: "1089"
	tasks:
	- name: install dependencies
	become: yes
	become_user: root
	yum: name={{ item }} state=present