277 lines
5.1 KiB
Markdown
277 lines
5.1 KiB
Markdown
---
|
||
tags:
|
||
- Server
|
||
- Security
|
||
---
|
||
# **Initial Server Setup with Debian-Based Distributions**
|
||
|
||
Setting up a new Debian-based server (e.g., **Debian**, **Ubuntu**, or **Linux Mint**) is the foundation of a secure and efficient system. This guide walks you through the essential steps I follow to establish a secure and functional environment, ensuring long-term stability and reliability.
|
||
|
||
---
|
||
|
||
## **Why Initial Server Setup Matters**
|
||
|
||
Properly configuring a server during its initial setup is crucial to:
|
||
|
||
- **Enhance Security**: Protect against unauthorized access.
|
||
- **Ensure Reliability**: Lay the groundwork for stable and efficient operations.
|
||
- **Save Time**: Avoid future headaches by configuring the server correctly upfront.
|
||
|
||
---
|
||
|
||
## **Logging in as Root**
|
||
|
||
Many Debian-based distributions disable direct `root` SSH access for security. If root login is allowed or you're accessing the server via the console, log in as the root user:
|
||
|
||
```bash
|
||
ssh root@<your-server-ip>
|
||
```
|
||
|
||
For cloud-based servers, you might need to log in with a default user like `ubuntu` or `debian`.
|
||
|
||
---
|
||
|
||
## **Secure Password Update**
|
||
|
||
Immediately update the root password (if root login is enabled):
|
||
|
||
```bash
|
||
passwd
|
||
```
|
||
|
||
If you’re using a default user, update its password as well:
|
||
|
||
```bash
|
||
sudo passwd
|
||
```
|
||
|
||
---
|
||
|
||
## **Creating a New User**
|
||
|
||
Using `root` for daily operations is discouraged. Create a new user for regular use:
|
||
|
||
```bash
|
||
adduser username
|
||
```
|
||
|
||
This prompts you to set a password and optional user details.
|
||
|
||
---
|
||
|
||
## **Granting Administrative Privileges**
|
||
|
||
To allow the new user to execute administrative tasks, add them to the `sudo` group:
|
||
|
||
```bash
|
||
usermod -aG sudo username
|
||
```
|
||
|
||
If `sudo` is not installed (common on Debian minimal installs):
|
||
|
||
```bash
|
||
apt install sudo
|
||
```
|
||
|
||
Test the configuration by switching to the new user:
|
||
|
||
```bash
|
||
su - username
|
||
sudo apt update
|
||
```
|
||
|
||
---
|
||
|
||
## **Configuring SSH**
|
||
|
||
### **Setting Up SSH Keys**
|
||
|
||
SSH keys offer better security than passwords. Generate an SSH key pair on your local machine:
|
||
|
||
```bash
|
||
ssh-keygen
|
||
```
|
||
|
||
Copy the public key to the server:
|
||
|
||
```bash
|
||
ssh-copy-id username@<your-server-ip>
|
||
```
|
||
|
||
Alternatively, manually upload the key to the server:
|
||
|
||
```bash
|
||
cat ~/.ssh/id_rsa.pub | ssh username@<your-server-ip> "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"
|
||
```
|
||
|
||
### **Secure SSH Configuration**
|
||
|
||
Edit the SSH configuration file to improve security:
|
||
|
||
```bash
|
||
sudo nano /etc/ssh/sshd_config
|
||
```
|
||
|
||
Update the following settings:
|
||
|
||
- Disable root login:
|
||
|
||
```none
|
||
PermitRootLogin no
|
||
```
|
||
|
||
- Disable password authentication if SSH keys are configured:
|
||
|
||
```none
|
||
PasswordAuthentication no
|
||
```
|
||
|
||
- Allow only specific users (optional):
|
||
|
||
```none
|
||
AllowUsers username
|
||
```
|
||
|
||
|
||
Restart the SSH service:
|
||
|
||
```bash
|
||
sudo systemctl restart ssh
|
||
```
|
||
|
||
---
|
||
|
||
## **Setting Up a Firewall**
|
||
|
||
Use **UFW** (Uncomplicated Firewall) to secure your server:
|
||
|
||
1. Install UFW if it’s not already present:
|
||
|
||
```bash
|
||
sudo apt install ufw
|
||
```
|
||
|
||
2. Allow SSH connections:
|
||
|
||
```bash
|
||
sudo ufw allow OpenSSH
|
||
```
|
||
|
||
3. Enable the firewall:
|
||
|
||
```bash
|
||
sudo ufw enable
|
||
```
|
||
|
||
4. Check the status:
|
||
|
||
```bash
|
||
sudo ufw status
|
||
```
|
||
|
||
|
||
Add rules for other services as needed (e.g., HTTP/HTTPS):
|
||
|
||
```bash
|
||
sudo ufw allow 80/tcp
|
||
sudo ufw allow 443/tcp
|
||
```
|
||
|
||
---
|
||
|
||
## **Regular Updates and Maintenance**
|
||
|
||
### **Keep the System Updated**
|
||
|
||
Update and upgrade the system regularly:
|
||
|
||
```bash
|
||
sudo apt update && sudo apt upgrade -y
|
||
```
|
||
|
||
### **Monitor Disk Usage**
|
||
|
||
Check disk usage to avoid running out of space:
|
||
|
||
```bash
|
||
df -h
|
||
```
|
||
|
||
### **Check Logs**
|
||
|
||
Review system logs for unusual activity:
|
||
|
||
```bash
|
||
sudo journalctl -xe
|
||
```
|
||
|
||
### **Install Monitoring Tools**
|
||
|
||
Install tools like `htop` for performance monitoring:
|
||
|
||
```bash
|
||
sudo apt install htop
|
||
htop
|
||
```
|
||
|
||
---
|
||
|
||
## **Testing the Configuration**
|
||
|
||
1. Log out of the root account:
|
||
|
||
```bash
|
||
exit
|
||
```
|
||
|
||
2. Log back in using the new user:
|
||
|
||
```bash
|
||
ssh username@<your-server-ip>
|
||
```
|
||
|
||
|
||
Verify that:
|
||
|
||
- You can log in using SSH keys.
|
||
- Root login is disabled.
|
||
- Password authentication is disabled (if configured).
|
||
- Firewall rules allow necessary services.
|
||
|
||
---
|
||
|
||
## **Optional Enhancements**
|
||
|
||
- **Enable Automatic Updates**:
|
||
Install and configure `unattended-upgrades` for automatic security updates:
|
||
|
||
```bash
|
||
sudo apt install unattended-upgrades
|
||
sudo dpkg-reconfigure --priority=low unattended-upgrades
|
||
```
|
||
|
||
- **Install Fail2Ban**:
|
||
Protect against brute-force attacks:
|
||
|
||
```bash
|
||
sudo apt install fail2ban
|
||
```
|
||
|
||
|
||
---
|
||
|
||
## **Conclusion**
|
||
|
||
This guide ensures your Debian-based server is secure, stable, and ready for application deployment. By following these steps, you establish a solid foundation for further customization and management, whether you're running a personal project or a production service.
|
||
|
||
**Next Steps**:
|
||
|
||
- Configure and deploy specific applications.
|
||
- Set up automated backups.
|
||
- Explore monitoring and logging tools.
|
||
|
||
Happy administering!
|
||
|
||
---
|
||
|
||
Return to the [Table of Contents](https://wiki.kitpro.us/table-of-contents) for more guides and tutorials. |