# Linux Stuff ## Install distro ## Post install ``` apt update apt upgrade ``` ## Automatic Updates To do updates manually. Don't do this on Production servers because you should have better planning to upgrade you key servers. ``` apt update apt upgrade ``` Install a utility that will perform auto-upgrades ``` apt install unattended-upgrades ``` Configure the utility ``` dpkg-reconfigure --priority=low unattended-upgrades ``` ## Create new sudo account ``` sudo adduser {username} sudo usermod -aG sudo {username} ``` ## Disable root ``` sudo passwd -l root ``` ## SSH Logins ### Install openssh ``` sudo apt install openssh-server ``` ### Setup key generated login ``` ssh-keygen ``` Go to client machine ``` ssh-keygen ssh-copy-d username@ipaddress ``` ### Lockdown Logins Edit the following file in nano on the server: ``` sudo nano /etc/ssh/sshd_config ``` Make the following changes: 1. Change PasswordAuthentication to **no** 2. Change ChallengeResponseAuthentication to **no** Save the file and restart the ssh service ``` sudo systemctl restart sshd ``` ## Static IP ``` sudo nano /etc/netplan/01-netcfg.yaml network: version: 2 renderer: networkd ethernets: ens18: dhcp4: no addresses: - 192.168.5.50/24 gateway: 192.168.5.99 nameservers: addresses: [192.168.5.25] sudo netplan apply ``` ## Fix LVM ``` sudo lvm lvm > lvextend -l +100%FREE /dev/ubuntu-vg/ubuntu-lv exit sudo resize2fs /dev/ubuntu-vg/ubuntu-lv ``` ## Change HOSTNAME ``` sudo hostnamectl set-hostname {hostname} hostnamectl sudo nano /etc/hosts /* change hostname in hosts file */ ``` ## Change timezone ``` timedatectl timedatectl list-timezones sudo timedatectl set-timezone America/Chicago ``` ## Install Guest Agent for Proxmox Applies only if this box is in a Proxmox server 1. Open Proxmox 2. Click Options 3. Turn on QEMU Agent ``` sudo apt install qemu-guest-agent sudo shutdown ``` ## Configure Firewall ``` sudo ufw status sudo ufw default allow outgoing sudo ufw default deny incoming sudo ufw allow ssh sudo ufw enable ``` ## Install fail2ban ``` sudo apt install fail2ban sudo cp /etc/fail2ban/fail2ban.{conf,local} sudo cp /etc/fail2ban/jail.{conf,local} sudo nano fail2ban.local loglevel = INFO logtarget = /var/log/fail2ban.log sudo nano /etc/fail2ban/jail.local bantime = 10m findtime = 10m maxretry = 5 backend = systemd sudo systemctl restart fail2ban sudo fail2ban-client status /* use to review banned */ ```