migrate
This commit is contained in:
Mike McFetridge
@@ -0,0 +1,277 @@
|
||||
---
|
||||
tags:
|
||||
- Server
|
||||
- Security
|
||||
---
|
||||
# **Initial Server Setup with Debian-Based Distributions**
|
||||
|
||||
Setting up a new Debian-based server (e.g., **Debian**, **Ubuntu**, or **Linux Mint**) is the foundation of a secure and efficient system. This guide walks you through the essential steps I follow to establish a secure and functional environment, ensuring long-term stability and reliability.
|
||||
|
||||
---
|
||||
|
||||
## **Why Initial Server Setup Matters**
|
||||
|
||||
Properly configuring a server during its initial setup is crucial to:
|
||||
|
||||
- **Enhance Security**: Protect against unauthorized access.
|
||||
- **Ensure Reliability**: Lay the groundwork for stable and efficient operations.
|
||||
- **Save Time**: Avoid future headaches by configuring the server correctly upfront.
|
||||
|
||||
---
|
||||
|
||||
## **Logging in as Root**
|
||||
|
||||
Many Debian-based distributions disable direct `root` SSH access for security. If root login is allowed or you're accessing the server via the console, log in as the root user:
|
||||
|
||||
```bash
|
||||
ssh root@<your-server-ip>
|
||||
```
|
||||
|
||||
For cloud-based servers, you might need to log in with a default user like `ubuntu` or `debian`.
|
||||
|
||||
---
|
||||
|
||||
## **Secure Password Update**
|
||||
|
||||
Immediately update the root password (if root login is enabled):
|
||||
|
||||
```bash
|
||||
passwd
|
||||
```
|
||||
|
||||
If you’re using a default user, update its password as well:
|
||||
|
||||
```bash
|
||||
sudo passwd
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## **Creating a New User**
|
||||
|
||||
Using `root` for daily operations is discouraged. Create a new user for regular use:
|
||||
|
||||
```bash
|
||||
adduser username
|
||||
```
|
||||
|
||||
This prompts you to set a password and optional user details.
|
||||
|
||||
---
|
||||
|
||||
## **Granting Administrative Privileges**
|
||||
|
||||
To allow the new user to execute administrative tasks, add them to the `sudo` group:
|
||||
|
||||
```bash
|
||||
usermod -aG sudo username
|
||||
```
|
||||
|
||||
If `sudo` is not installed (common on Debian minimal installs):
|
||||
|
||||
```bash
|
||||
apt install sudo
|
||||
```
|
||||
|
||||
Test the configuration by switching to the new user:
|
||||
|
||||
```bash
|
||||
su - username
|
||||
sudo apt update
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## **Configuring SSH**
|
||||
|
||||
### **Setting Up SSH Keys**
|
||||
|
||||
SSH keys offer better security than passwords. Generate an SSH key pair on your local machine:
|
||||
|
||||
```bash
|
||||
ssh-keygen
|
||||
```
|
||||
|
||||
Copy the public key to the server:
|
||||
|
||||
```bash
|
||||
ssh-copy-id username@<your-server-ip>
|
||||
```
|
||||
|
||||
Alternatively, manually upload the key to the server:
|
||||
|
||||
```bash
|
||||
cat ~/.ssh/id_rsa.pub | ssh username@<your-server-ip> "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"
|
||||
```
|
||||
|
||||
### **Secure SSH Configuration**
|
||||
|
||||
Edit the SSH configuration file to improve security:
|
||||
|
||||
```bash
|
||||
sudo nano /etc/ssh/sshd_config
|
||||
```
|
||||
|
||||
Update the following settings:
|
||||
|
||||
- Disable root login:
|
||||
|
||||
```none
|
||||
PermitRootLogin no
|
||||
```
|
||||
|
||||
- Disable password authentication if SSH keys are configured:
|
||||
|
||||
```none
|
||||
PasswordAuthentication no
|
||||
```
|
||||
|
||||
- Allow only specific users (optional):
|
||||
|
||||
```none
|
||||
AllowUsers username
|
||||
```
|
||||
|
||||
|
||||
Restart the SSH service:
|
||||
|
||||
```bash
|
||||
sudo systemctl restart ssh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## **Setting Up a Firewall**
|
||||
|
||||
Use **UFW** (Uncomplicated Firewall) to secure your server:
|
||||
|
||||
1. Install UFW if it’s not already present:
|
||||
|
||||
```bash
|
||||
sudo apt install ufw
|
||||
```
|
||||
|
||||
2. Allow SSH connections:
|
||||
|
||||
```bash
|
||||
sudo ufw allow OpenSSH
|
||||
```
|
||||
|
||||
3. Enable the firewall:
|
||||
|
||||
```bash
|
||||
sudo ufw enable
|
||||
```
|
||||
|
||||
4. Check the status:
|
||||
|
||||
```bash
|
||||
sudo ufw status
|
||||
```
|
||||
|
||||
|
||||
Add rules for other services as needed (e.g., HTTP/HTTPS):
|
||||
|
||||
```bash
|
||||
sudo ufw allow 80/tcp
|
||||
sudo ufw allow 443/tcp
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## **Regular Updates and Maintenance**
|
||||
|
||||
### **Keep the System Updated**
|
||||
|
||||
Update and upgrade the system regularly:
|
||||
|
||||
```bash
|
||||
sudo apt update && sudo apt upgrade -y
|
||||
```
|
||||
|
||||
### **Monitor Disk Usage**
|
||||
|
||||
Check disk usage to avoid running out of space:
|
||||
|
||||
```bash
|
||||
df -h
|
||||
```
|
||||
|
||||
### **Check Logs**
|
||||
|
||||
Review system logs for unusual activity:
|
||||
|
||||
```bash
|
||||
sudo journalctl -xe
|
||||
```
|
||||
|
||||
### **Install Monitoring Tools**
|
||||
|
||||
Install tools like `htop` for performance monitoring:
|
||||
|
||||
```bash
|
||||
sudo apt install htop
|
||||
htop
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## **Testing the Configuration**
|
||||
|
||||
1. Log out of the root account:
|
||||
|
||||
```bash
|
||||
exit
|
||||
```
|
||||
|
||||
2. Log back in using the new user:
|
||||
|
||||
```bash
|
||||
ssh username@<your-server-ip>
|
||||
```
|
||||
|
||||
|
||||
Verify that:
|
||||
|
||||
- You can log in using SSH keys.
|
||||
- Root login is disabled.
|
||||
- Password authentication is disabled (if configured).
|
||||
- Firewall rules allow necessary services.
|
||||
|
||||
---
|
||||
|
||||
## **Optional Enhancements**
|
||||
|
||||
- **Enable Automatic Updates**:
|
||||
Install and configure `unattended-upgrades` for automatic security updates:
|
||||
|
||||
```bash
|
||||
sudo apt install unattended-upgrades
|
||||
sudo dpkg-reconfigure --priority=low unattended-upgrades
|
||||
```
|
||||
|
||||
- **Install Fail2Ban**:
|
||||
Protect against brute-force attacks:
|
||||
|
||||
```bash
|
||||
sudo apt install fail2ban
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## **Conclusion**
|
||||
|
||||
This guide ensures your Debian-based server is secure, stable, and ready for application deployment. By following these steps, you establish a solid foundation for further customization and management, whether you're running a personal project or a production service.
|
||||
|
||||
**Next Steps**:
|
||||
|
||||
- Configure and deploy specific applications.
|
||||
- Set up automated backups.
|
||||
- Explore monitoring and logging tools.
|
||||
|
||||
Happy administering!
|
||||
|
||||
---
|
||||
|
||||
Return to the [Table of Contents](https://wiki.kitpro.us/table-of-contents) for more guides and tutorials.
|
||||
@@ -0,0 +1,84 @@
|
||||
---
|
||||
tags:
|
||||
- Server
|
||||
- Security
|
||||
---
|
||||
|
||||
|
||||
```
|
||||
# Command to see if someone is trying to gain access to you server over SSH.
|
||||
tail -n 10 -f /var/log/auth.log
|
||||
|
||||
# Update your system
|
||||
sudo apt update && sudo apt upgrade -y #Update and Update your system
|
||||
|
||||
# Change Root Password - Need to be in the system as root.
|
||||
sudo su
|
||||
passwd
|
||||
|
||||
#Create New User
|
||||
sudo useradd -m -s /bin/bash miker && sudo passwd miker #you will be prompted to enter in the password
|
||||
# -m creates a home account and -s sets the shell you will be using
|
||||
|
||||
# Add QEMU agent if on Proxmox
|
||||
sudo apt install qemu-guest-agent -y
|
||||
|
||||
# Add new user to the groups
|
||||
sudo cat /etc/sudoers to see what the admin and sudo groups are # THey are typically %admin and/or %sudo
|
||||
sudo usermod -aG sudo,adm,admin,docker (username) #add user to admin or sudo group.
|
||||
groups (username) # verify your account was added
|
||||
|
||||
# Ensure unattend upgrades is installed
|
||||
sudo apt install unattended-upgrades
|
||||
sudo dpkg-reconfigure --priority=low unattended-upgrades #set the install to unattended
|
||||
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades # Edit file to add additional unattended upgrade features
|
||||
uncomment the -updates line, to recieve all pckage upgrades as well.
|
||||
|
||||
# Timezone
|
||||
Update timezone in Ubuntu servers.
|
||||
sudo dpkg-reconfigure tzdata
|
||||
|
||||
# Set up Secure SSH Keys and Passwords
|
||||
cd ~/.ssh && ls -a # Go into your ssh directory and ensure that you have a id_rsa.pub on your workstation.
|
||||
ssh-copy-id <username>@ip_address # Copy your public key to your server
|
||||
|
||||
# Use ONLY if you need to create a new keygen
|
||||
ssh-keygen -t rsa # run in your home directory
|
||||
|
||||
#Lock down server access through SSH
|
||||
sudo nano /etc/ssh/sshd_config # This is your sshd server system-wide configuration file
|
||||
PasswordAuthentication yes # Change to no, this will disable SSH password authentication.
|
||||
PermitRootLogin yes # Change to no, this will Disable remote root access, stop users from signing into your server.
|
||||
AllowUsers (Your username you created)
|
||||
AddressFamily inet # This will disable IPv6 access
|
||||
|
||||
sudo nano /etc/ssh/sshd_config.d/50-cloud-init.conf
|
||||
PasswordAuthentication yes # Change to no, this will disable SSH password authentication.
|
||||
|
||||
clear # Restart your ssh service
|
||||
Leave your current window open and launch a new terminal window to ensure you can get into the system.
|
||||
|
||||
# Enable additional security features
|
||||
|
||||
|
||||
# Set Up UFW Firewall within the server if the VPS provide does not offer one.
|
||||
|
||||
sudo ss -tualp # show which ports are open on your server (needed if you plan to use UFW)
|
||||
sudo apt install ufw # Install the UFW firewall
|
||||
sudo ufw allow ssh # Add to allow port 22 within your firewall
|
||||
sudo ufw allow http # add to allow port 80 within your firewall
|
||||
sudo ufw allow https # Add to allow port 443 within your firewall
|
||||
# use the same command to add other ports that will be needed.
|
||||
|
||||
sudo ufw enable # When complete, use this command to enable the firewall.
|
||||
# If you need to, use this command to disable "sudo ufw disable" to deactivate the firewall if necessary.
|
||||
# Install Fail2ban
|
||||
# This server log application will automatically adjust your firewall to block an attacker’s IP address if it identifies any signs of an attack.
|
||||
# Those blocks can stay in place permanently or for a period of your choosing.
|
||||
|
||||
sudo apt install fail2ban -y # Use this command to install Fail2ban:
|
||||
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local # configuration file code:
|
||||
sudo service fail2ban restart # restart the application to start running
|
||||
sudo fail2ban-client status sshd
|
||||
```
|
||||
|
||||
Reference in New Issue
Block a user