migrate

Backups/Miker/Linux/Security/Initial Server Setup with Debian-Based Distributions.md

@@ -0,0 +1,277 @@
+---
+tags:
+  - Server
+  - Security
+---
+# **Initial Server Setup with Debian-Based Distributions**
+
+Setting up a new Debian-based server (e.g., **Debian**, **Ubuntu**, or **Linux Mint**) is the foundation of a secure and efficient system. This guide walks you through the essential steps I follow to establish a secure and functional environment, ensuring long-term stability and reliability.
+
+---
+
+## **Why Initial Server Setup Matters**
+
+Properly configuring a server during its initial setup is crucial to:
+
+- **Enhance Security**: Protect against unauthorized access.
+- **Ensure Reliability**: Lay the groundwork for stable and efficient operations.
+- **Save Time**: Avoid future headaches by configuring the server correctly upfront.
+
+---
+
+## **Logging in as Root**
+
+Many Debian-based distributions disable direct `root` SSH access for security. If root login is allowed or you're accessing the server via the console, log in as the root user:
+
+```bash
+ssh root@<your-server-ip>
+```
+
+For cloud-based servers, you might need to log in with a default user like `ubuntu` or `debian`.
+
+---
+
+## **Secure Password Update**
+
+Immediately update the root password (if root login is enabled):
+
+```bash
+passwd
+```
+
+If you’re using a default user, update its password as well:
+
+```bash
+sudo passwd
+```
+
+---
+
+## **Creating a New User**
+
+Using `root` for daily operations is discouraged. Create a new user for regular use:
+
+```bash
+adduser username
+```
+
+This prompts you to set a password and optional user details.
+
+---
+
+## **Granting Administrative Privileges**
+
+To allow the new user to execute administrative tasks, add them to the `sudo` group:
+
+```bash
+usermod -aG sudo username
+```
+
+If `sudo` is not installed (common on Debian minimal installs):
+
+```bash
+apt install sudo
+```
+
+Test the configuration by switching to the new user:
+
+```bash
+su - username
+sudo apt update
+```
+
+---
+
+## **Configuring SSH**
+
+### **Setting Up SSH Keys**
+
+SSH keys offer better security than passwords. Generate an SSH key pair on your local machine:
+
+```bash
+ssh-keygen
+```
+
+Copy the public key to the server:
+
+```bash
+ssh-copy-id username@<your-server-ip>
+```
+
+Alternatively, manually upload the key to the server:
+
+```bash
+cat ~/.ssh/id_rsa.pub | ssh username@<your-server-ip> "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"
+```
+
+### **Secure SSH Configuration**
+
+Edit the SSH configuration file to improve security:
+
+```bash
+sudo nano /etc/ssh/sshd_config
+```
+
+Update the following settings:
+
+- Disable root login:
+    
+    ```none
+    PermitRootLogin no
+    ```
+    
+- Disable password authentication if SSH keys are configured:
+    
+    ```none
+    PasswordAuthentication no
+    ```
+    
+- Allow only specific users (optional):
+    
+    ```none
+    AllowUsers username
+    ```
+    
+
+Restart the SSH service:
+
+```bash
+sudo systemctl restart ssh
+```
+
+---
+
+## **Setting Up a Firewall**
+
+Use **UFW** (Uncomplicated Firewall) to secure your server:
+
+1. Install UFW if it’s not already present:
+    
+    ```bash
+    sudo apt install ufw
+    ```
+    
+2. Allow SSH connections:
+    
+    ```bash
+    sudo ufw allow OpenSSH
+    ```
+    
+3. Enable the firewall:
+    
+    ```bash
+    sudo ufw enable
+    ```
+    
+4. Check the status:
+    
+    ```bash
+    sudo ufw status
+    ```
+    
+
+Add rules for other services as needed (e.g., HTTP/HTTPS):
+
+```bash
+sudo ufw allow 80/tcp
+sudo ufw allow 443/tcp
+```
+
+---
+
+## **Regular Updates and Maintenance**
+
+### **Keep the System Updated**
+
+Update and upgrade the system regularly:
+
+```bash
+sudo apt update && sudo apt upgrade -y
+```
+
+### **Monitor Disk Usage**
+
+Check disk usage to avoid running out of space:
+
+```bash
+df -h
+```
+
+### **Check Logs**
+
+Review system logs for unusual activity:
+
+```bash
+sudo journalctl -xe
+```
+
+### **Install Monitoring Tools**
+
+Install tools like `htop` for performance monitoring:
+
+```bash
+sudo apt install htop
+htop
+```
+
+---
+
+## **Testing the Configuration**
+
+1. Log out of the root account:
+    
+    ```bash
+    exit
+    ```
+    
+2. Log back in using the new user:
+    
+    ```bash
+    ssh username@<your-server-ip>
+    ```
+    
+
+Verify that:
+
+- You can log in using SSH keys.
+- Root login is disabled.
+- Password authentication is disabled (if configured).
+- Firewall rules allow necessary services.
+
+---
+
+## **Optional Enhancements**
+
+- **Enable Automatic Updates**:  
+    Install and configure `unattended-upgrades` for automatic security updates:
+    
+    ```bash
+    sudo apt install unattended-upgrades
+    sudo dpkg-reconfigure --priority=low unattended-upgrades
+    ```
+    
+- **Install Fail2Ban**:  
+    Protect against brute-force attacks:
+    
+    ```bash
+    sudo apt install fail2ban
+    ```
+    
+
+---
+
+## **Conclusion**
+
+This guide ensures your Debian-based server is secure, stable, and ready for application deployment. By following these steps, you establish a solid foundation for further customization and management, whether you're running a personal project or a production service.
+
+**Next Steps**:
+
+- Configure and deploy specific applications.
+- Set up automated backups.
+- Explore monitoring and logging tools.
+
+Happy administering!
+
+---
+
+Return to the [Table of Contents](https://wiki.kitpro.us/table-of-contents) for more guides and tutorials.