migrate

2026-07-20 09:23:17 -04:00
parent c1315882da
commit 72272e4006
3179 changed files with 562960 additions and 14 deletions
@@ -0,0 +1,84 @@
+---
+tags:
+  - Server
+  - Security
+---
+
+
+```
+# Command to see if someone is trying to gain access to you server over SSH.
+    tail -n 10 -f /var/log/auth.log
+
+# Update your system
+    sudo apt update && sudo apt upgrade -y      #Update and Update your system
+
+# Change Root Password - Need to be in the system as root.
+    sudo su
+    passwd
+
+#Create New User
+    sudo useradd -m -s /bin/bash miker && sudo passwd miker #you will be prompted to enter in the password
+        # -m creates a home account and -s sets the shell you will be using
+
+# Add QEMU agent if on Proxmox
+    sudo apt install qemu-guest-agent -y
+
+# Add new user to the groups
+    sudo cat /etc/sudoers to see what the admin and sudo groups are    # THey are typically %admin and/or %sudo
+        sudo usermod -aG sudo,adm,admin,docker (username)    #add user to admin or sudo group.
+        groups (username) # verify your account was added
+
+# Ensure unattend upgrades is installed
+    sudo apt install unattended-upgrades
+    sudo dpkg-reconfigure --priority=low unattended-upgrades  #set the install to unattended
+    sudo nano /etc/apt/apt.conf.d/50unattended-upgrades   # Edit file to add additional unattended upgrade features
+        uncomment the -updates line, to recieve all pckage upgrades as well.
+
+# Timezone
+    Update timezone in Ubuntu servers.
+        sudo dpkg-reconfigure tzdata
+
+# Set up Secure SSH Keys and Passwords
+    cd ~/.ssh && ls -a          # Go into your ssh directory and ensure that you have a id_rsa.pub on your workstation.
+    ssh-copy-id <username>@ip_address   # Copy your public key to your server
+
+# Use ONLY if you need to create a new keygen
+    ssh-keygen -t rsa  # run in your home directory
+
+#Lock down server access through SSH
+    sudo nano /etc/ssh/sshd_config           # This is your sshd server system-wide configuration file
+        PasswordAuthentication yes      # Change to no, this will disable SSH password authentication.
+        PermitRootLogin yes             # Change to no, this will Disable remote root access, stop users from signing into your server.
+        AllowUsers (Your username you created)
+        AddressFamily inet              # This will disable IPv6 access
+
+    sudo nano /etc/ssh/sshd_config.d/50-cloud-init.conf
+        PasswordAuthentication yes      # Change to no, this will disable SSH password authentication.
+
+    clear          # Restart your ssh service
+        Leave your current window open and launch a new terminal window to ensure you can get into the system.
+
+# Enable additional security features
+
+
+# Set Up UFW Firewall within the server if the VPS provide does not offer one.
+
+    sudo ss -tualp                      # show which ports are open on your server (needed if you plan to use UFW)
+    sudo apt install ufw                # Install the UFW firewall
+        sudo ufw allow ssh              # Add to allow port 22 within your firewall
+        sudo ufw allow http             # add to allow port 80 within your firewall
+        sudo ufw allow https            # Add to allow port 443 within your firewall
+    # use the same command to add other ports that will be needed.
+
+    sudo ufw enable                     # When complete, use this command to enable the firewall.
+                                        # If you need to, use this command to disable "sudo ufw disable" to deactivate the firewall if necessary.
+# Install Fail2ban
+    # This server log application will automatically adjust your firewall to block an attacker’s IP address if it identifies any signs of an attack.
+        # Those blocks can stay in place permanently or for a period of your choosing.
+
+    sudo apt install fail2ban -y        # Use this command to install Fail2ban:
+    sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local  # configuration file code:
+    sudo service fail2ban restart     # restart the application to start running
+    sudo fail2ban-client status sshd
+```
+