3.8 KiB
3.8 KiB
# Command to see if someone is trying to gain access to you server over SSH.
tail -n 10 -f /var/log/auth.log
# Update your system
sudo apt update && sudo apt upgrade -y #Update and Update your system
# Change Root Password - Need to be in the system as root.
sudo su
passwd
#Create New User
sudo useradd -m -s /bin/bash miker && sudo passwd miker #you will be prompted to enter in the password
# -m creates a home account and -s sets the shell you will be using
# Add QEMU agent if on Proxmox
sudo apt install qemu-guest-agent -y
# Add new user to the groups
sudo cat /etc/sudoers to see what the admin and sudo groups are # THey are typically %admin and/or %sudo
sudo usermod -aG sudo, adm, admin, docker (username) #add user to admin or sudo group.
groups (username) # verify your account was added
# Ensure unattend upgrades is installed
sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades #set the install to unattended
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades # Edit file to add additional unattended upgrade features
uncomment the -updates line, to recieve all pckage upgrades as well.
# Timezone
Update timezone in Ubuntu servers.
sudo dpkg-reconfigure tzdata
# Set up Secure SSH Keys and Passwords
cd ~/.ssh && ls -a # Go into your ssh directory and ensure that you have a id_rsa.pub on your workstation.
ssh-copy-id <username>@ip_address # Copy your public key to your server
# Use ONLY if you need to create a new keygen
ssh-keygen -t rsa # run in your home directory
#Lock down server access through SSH
sudo nano /etc/ssh/sshd_config # This is your sshd server system-wide configuration file
PasswordAuthentication yes # Change to no, this will disable SSH password authentication.
PermitRootLogin yes # Change to no, this will Disable remote root access, stop users from signing into your server.
AllowUsers (Your username you created)
AddressFamily inet # This will disable IPv6 access
sudo nano /etc/ssh/sshd_config.d/50-cloud-init.conf
PasswordAuthentication yes # Change to no, this will disable SSH password authentication.
clear # Restart your ssh service
Leave your current window open and launch a new terminal window to ensure you can get into the system.
# Enable additional security features
# Set Up UFW Firewall within the server if the VPS provide does not offer one.
sudo ss -tualp # show which ports are open on your server (needed if you plan to use UFW)
sudo apt install ufw # Install the UFW firewall
sudo ufw allow ssh # Add to allow port 22 within your firewall
sudo ufw allow http # add to allow port 80 within your firewall
sudo ufw allow https # Add to allow port 443 within your firewall
# use the same command to add other ports that will be needed.
sudo ufw enable # When complete, use this command to enable the firewall.
# If you need to, use this command to disable "sudo ufw disable" to deactivate the firewall if necessary.
# Install Fail2ban
# This server log application will automatically adjust your firewall to block an attacker’s IP address if it identifies any signs of an attack.
# Those blocks can stay in place permanently or for a period of your choosing.
sudo apt install fail2ban -y # Use this command to install Fail2ban:
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local # configuration file code:
sudo service fail2ban restart # restart the application to start running
sudo fail2ban-client status sshd