You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

189 lines
3.2 KiB

2 years ago
# Linux Stuff
## Install distro
2 years ago
## Post install
2 years ago
### Update && Upgrade
2 years ago
```
apt update
apt upgrade
```
### Automatic Updates
2 years ago
```
apt install unattended-upgrades
dpkg-reconfigure --priority=low unattended-upgrades
```
### Static IP
```
sudo nano /etc/netplan/01-netcfg.yaml
2 years ago
network:
version: 2
renderer: networkd
ethernets:
ens18:
dhcp4: no
addresses:
- 192.168.5.50/24
routes:
-to: default
via: 192.168.5.99
nameservers:
addresses: [192.168.5.25]
sudo netplan apply
```
### Install openssh
You can select this during Ubuntu install
```
sudo apt install openssh-server
ssh-keygen
```
### SSH on Client machine
LINUX client machine
```
ssh-keygen
ssh-copy-id username@ipaddress
```
Windows client
```
ssh-keygen
Get-Content $env:USERPROFILE\.ssh\id_rsa.pub | ssh <user>@<hostname> "cat >> .ssh/authorized_keys"
```
### Lockdown Logins to SSH only
2 years ago
```
sudo nano /etc/ssh/sshd_config
```
Make the following changes:
1. Change PasswordAuthentication to **no**
2. Change ChallengeResponseAuthentication to **no**
2 years ago
Save the file and restart the ssh service
```
sudo systemctl restart sshd
```
### Fix LVM
```
sudo lvm
lvm > lvextend -l +100%FREE /dev/ubuntu-vg/ubuntu-lv
exit
sudo resize2fs /dev/ubuntu-vg/ubuntu-lv
```
### Change timezone
```
timedatectl
timedatectl list-timezones
sudo timedatectl set-timezone America/Chicago
```
### Configure Firewall
```
sudo ufw status
sudo ufw default allow outgoing
sudo ufw default deny incoming
sudo ufw allow ssh
sudo ufw enable
```
### Install fail2ban
```
sudo apt install fail2ban
sudo cp /etc/fail2ban/fail2ban.{conf,local}
sudo cp /etc/fail2ban/jail.{conf,local}
sudo nano fail2ban.local
loglevel = INFO
logtarget = /var/log/fail2ban.log
sudo nano /etc/fail2ban/jail.local
bantime = 10m
findtime = 10m
maxretry = 5
backend = systemd
sudo systemctl restart fail2ban
sudo fail2ban-client status /* use to review banned */
```
## Optional Maintenance
### Create new sudo account
Ubuntu Server does this by default
```
sudo adduser {username}
sudo usermod -aG sudo {username}
```
### Disable root
Ubuntu Server does this by default
```
sudo passwd -l root
```
### Change HOSTNAME
```
sudo hostnamectl set-hostname {hostname}
hostnamectl
sudo nano /etc/hosts
/* change hostname in hosts file */
```
## Optional Services
### Install xRDP
If you need to use RDP to access a desktop environment
```
sudo apt install xrdp
sudo systemctl enable xrdp
```
### Install GIT
```
sudo apt install git
```
### Install Guest Agent for Proxmox
Applies only if this box is in a Proxmox server
1. Open Proxmox
2. Click Options
3. Turn on QEMU Agent
```
sudo apt install qemu-guest-agent
sudo shutdown
```
### Install Webmin
```
sudo apt install software-properties-common apt-transport-https
sudo wget -q http://www.webmin.com/jcameron-key.asc -O- | sudo apt-key add -
sudo add-apt-repository "deb [arch=amd64] http://download.webmin.com/download/repository sarge contrib"
sudo apt install webmin
sudo ufw allow 10000/tcp
sudo ufw reload
```
2 years ago
### bind9 DNS
```
sudo apt install -y bind9 bind9utils bind9-doc dnsutils
sudo systemctl start named
sudo systemctl enable named
sudo ufw allow 53
sudo ufw reload
```
### Logging with Prometheus