First Time Setup for Linux Servers

This is a copy of the software, tools and configs that Techno Tim uses to secure his servers. This is a list of the commands used in order to make the setup easier. Prepare for some cutting and pasting.

Update

sudo apt-get update && sudo apt-get upgrade -y

Reconfigure unattended-upgrades

sudo dpkg-reconfigure --priority=low unattended-upgrades

Verify unattended upgrades configuration file in your text editor of choice

/etc/apt/apt.conf.d/20auto-upgrades

To disable automatic reboots by the automatic upgrades configuration edit the following file:

/etc/apt/apt.conf.d/50unattended-upgrades

And uncomment the following line by removing the leading slashes:

//Unattended-Upgrade::Automatic-Reboot "false";

Account

Add user

sudo adduser someuser

Add to sudoers

sudo usermod -aG sudo someuser

SSH Server

Install

sudo apt-get install openssh-server

Copy key from client to server

ssh-copy-id [email protected]

Switch to key based auth

sudo nano /etc/ssh/sshd_config

Add these attributes

PasswordAuthentication no
ChallengeResponseAuthentication no

Networking

Static IP

sudo nano /etc/netplan/01-netcfg.yaml

network:
  version: 2
  renderer: networkd
  ethernets:
    ens18:
     dhcp4: no
     addresses:
        - 192.168.0.222/24
     gateway4: 192.168.0.1
     nameservers:
       addresses: [192.168.0.4]

Hostname

sudo hostnamectl set-hostname

sudo nano /etc/hosts

Time Zone

Check time zone:

timedatectl

Change time zone:

sudo timedatectl set-timezone

You can also use this command if you want to use a menu.

sudo dpkg-reconfigure tzdata 

NTP Time

sudo nano /etc/systemd/timesyncd.conf

NTP=192.168.0.4

sudo timedatectl set-net off

sudo timedatectl set-ntp on

Install KVM Agent

sudo apt-get install qemu-guest-agent

Firewall

sudo  ufw default deny incoming

sudo ufw default allow outgoing

sudo ufw allow ssh

sudo ufw enable

Fail2ban

sudo apt-get install fail2ban

sudo cp /etc/fail2ban/fail2ban.{conf,local}

sudo cp /etc/fail2ban/jail.{conf,local}

sudo nano /etc/fail2ban/jail.local

backend = systemd

Check status

sudo fail2ban-client status

sudo fail2ban-client status sshd