added content to the linux cheatsheet

Runbooks/linux.md

@@ -1,14 +1,14 @@
 # Linux Stuff
 
-## Hardening
+## Install distro
 
-1. Automatic Updates (Non-prod only)
+## Post install
-2. SSH Logins
+```
-3. Lockdown logins
+apt update
-4. Firewall
+apt upgrade
-
+```
-### Automatic Updates
 
+## Automatic Updates
 To do updates manually. Don't do this on Production servers because you should have better planning to upgrade you key servers.
 
 ```
@@ -28,10 +28,37 @@ Configure the utility
 dpkg-reconfigure --priority=low unattended-upgrades
 ```
 
-### SSH Logins
+## Create new sudo account
+```
+sudo adduser {username}
+sudo usermod -aG sudo {username}
+```
 
-### Lockdown Logins
+## Disable root
+
+```
+sudo passwd -l root
+```
+
+## SSH Logins
+
+### Install openssh
+```
+sudo apt install openssh-server
+```
 
+### Setup key generated login
+```
+ssh-keygen
+```
+
+Go to client machine
+```
+ssh-keygen
+ssh-copy-d username@ipaddress
+```
+
+### Lockdown Logins
 Edit the following file in nano on the server:
 
 ```
@@ -40,14 +67,98 @@ sudo nano /etc/ssh/sshd_config
 
 Make the following changes:
 
-1. Change the **Port** to something other than 22
+1. Change PasswordAuthentication to **no**
-2. Uncomment **AddressFamily** 
+2. Change ChallengeResponseAuthentication to **no**
-3. Change AddressFamily to **inet**
-4. Change PermitRooLogin to **no**
-5. Change PasswordAuthentication to **no**
 
 Save the file and restart the ssh service
 
 ```
 sudo systemctl restart sshd
+```
+
+## Static IP
+
+```
+sudo nano /etc/netplan/01-netcfg.yaml
+
+network:
+  version: 2
+  renderer: networkd
+  ethernets:
+    ens18:
+        dhcp4: no
+        addresses:
+          - 192.168.5.50/24
+        gateway: 192.168.5.99
+        nameservers:
+            addresses: [192.168.5.25]
+
+sudo netplan apply
+```
+
+## Fix LVM
+```
+sudo lvm
+lvm > lvextend -l +100%FREE /dev/ubuntu-vg/ubuntu-lv
+exit
+
+sudo resize2fs /dev/ubuntu-vg/ubuntu-lv
+```
+
+## Change HOSTNAME
+```
+sudo hostnamectl set-hostname {hostname}
+hostnamectl
+
+sudo nano /etc/hosts
+/* change hostname in hosts file */
+```
+
+## Change timezone
+```
+timedatectl
+timedatectl list-timezones
+sudo timedatectl set-timezone America/Chicago
+```
+
+## Install Guest Agent for Proxmox
+Applies only if this box is in a Proxmox server
+
+1. Open Proxmox
+2. Click Options
+3. Turn on QEMU Agent
+
+```
+sudo apt install qemu-guest-agent
+sudo shutdown 
+```
+
+## Configure Firewall
+```
+sudo ufw status
+sudo ufw default allow outgoing
+sudo ufw default deny incoming
+sudo ufw allow ssh
+sudo ufw enable
+```
+## Install fail2ban
+```
+sudo apt install fail2ban
+sudo cp /etc/fail2ban/fail2ban.{conf,local}
+sudo cp /etc/fail2ban/jail.{conf,local}
+sudo nano fail2ban.local
+
+loglevel = INFO
+logtarget = /var/log/fail2ban.log
+
+sudo nano /etc/fail2ban/jail.local
+
+bantime = 10m
+findtime = 10m
+maxretry = 5
+backend = systemd
+
+sudo systemctl restart fail2ban
+
+sudo fail2ban-client status /* use to review banned */
 ```