80 lines
3.8 KiB
Markdown
80 lines
3.8 KiB
Markdown
|
||
|
||
```
|
||
# Command to see if someone is trying to gain access to you server over SSH.
|
||
tail -n 10 -f /var/log/auth.log
|
||
|
||
# Update your system
|
||
sudo apt update && sudo apt upgrade -y #Update and Update your system
|
||
|
||
# Change Root Password - Need to be in the system as root.
|
||
sudo su
|
||
passwd
|
||
|
||
#Create New User
|
||
sudo useradd -m -s /bin/bash miker && sudo passwd miker #you will be prompted to enter in the password
|
||
# -m creates a home account and -s sets the shell you will be using
|
||
|
||
# Add QEMU agent if on Proxmox
|
||
sudo apt install qemu-guest-agent -y
|
||
|
||
# Add new user to the groups
|
||
sudo cat /etc/sudoers to see what the admin and sudo groups are # THey are typically %admin and/or %sudo
|
||
sudo usermod -aG sudo, adm, admin, docker (username) #add user to admin or sudo group.
|
||
groups (username) # verify your account was added
|
||
|
||
# Ensure unattend upgrades is installed
|
||
sudo apt install unattended-upgrades
|
||
sudo dpkg-reconfigure --priority=low unattended-upgrades #set the install to unattended
|
||
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades # Edit file to add additional unattended upgrade features
|
||
uncomment the -updates line, to recieve all pckage upgrades as well.
|
||
|
||
# Timezone
|
||
Update timezone in Ubuntu servers.
|
||
sudo dpkg-reconfigure tzdata
|
||
|
||
# Set up Secure SSH Keys and Passwords
|
||
cd ~/.ssh && ls -a # Go into your ssh directory and ensure that you have a id_rsa.pub on your workstation.
|
||
ssh-copy-id <username>@ip_address # Copy your public key to your server
|
||
|
||
# Use ONLY if you need to create a new keygen
|
||
ssh-keygen -t rsa # run in your home directory
|
||
|
||
#Lock down server access through SSH
|
||
sudo nano /etc/ssh/sshd_config # This is your sshd server system-wide configuration file
|
||
PasswordAuthentication yes # Change to no, this will disable SSH password authentication.
|
||
PermitRootLogin yes # Change to no, this will Disable remote root access, stop users from signing into your server.
|
||
AllowUsers (Your username you created)
|
||
AddressFamily inet # This will disable IPv6 access
|
||
|
||
sudo nano /etc/ssh/sshd_config.d/50-cloud-init.conf
|
||
PasswordAuthentication yes # Change to no, this will disable SSH password authentication.
|
||
|
||
clear # Restart your ssh service
|
||
Leave your current window open and launch a new terminal window to ensure you can get into the system.
|
||
|
||
# Enable additional security features
|
||
|
||
|
||
# Set Up UFW Firewall within the server if the VPS provide does not offer one.
|
||
|
||
sudo ss -tualp # show which ports are open on your server (needed if you plan to use UFW)
|
||
sudo apt install ufw # Install the UFW firewall
|
||
sudo ufw allow ssh # Add to allow port 22 within your firewall
|
||
sudo ufw allow http # add to allow port 80 within your firewall
|
||
sudo ufw allow https # Add to allow port 443 within your firewall
|
||
# use the same command to add other ports that will be needed.
|
||
|
||
sudo ufw enable # When complete, use this command to enable the firewall.
|
||
# If you need to, use this command to disable "sudo ufw disable" to deactivate the firewall if necessary.
|
||
# Install Fail2ban
|
||
# This server log application will automatically adjust your firewall to block an attacker’s IP address if it identifies any signs of an attack.
|
||
# Those blocks can stay in place permanently or for a period of your choosing.
|
||
|
||
sudo apt install fail2ban -y # Use this command to install Fail2ban:
|
||
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local # configuration file code:
|
||
sudo service fail2ban restart # restart the application to start running
|
||
sudo fail2ban-client status sshd
|
||
```
|
||
|