You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 

2.5 KiB

Linux Stuff

Install distro

Post install

apt update
apt upgrade

Automatic Updates

To do updates manually. Don't do this on Production servers because you should have better planning to upgrade you key servers.

apt update
apt upgrade

Install a utility that will perform auto-upgrades

apt install unattended-upgrades

Configure the utility

dpkg-reconfigure --priority=low unattended-upgrades

Create new sudo account

sudo adduser {username}
sudo usermod -aG sudo {username}

Disable root

sudo passwd -l root

SSH Logins

Install openssh

sudo apt install openssh-server

Setup key generated login

ssh-keygen

Go to client machine

ssh-keygen
ssh-copy-d username@ipaddress

Lockdown Logins

Edit the following file in nano on the server:

sudo nano /etc/ssh/sshd_config

Make the following changes:

  1. Change PasswordAuthentication to no
  2. Change ChallengeResponseAuthentication to no

Save the file and restart the ssh service

sudo systemctl restart sshd

Static IP

sudo nano /etc/netplan/01-netcfg.yaml

network:
  version: 2
  renderer: networkd
  ethernets:
    ens18:
        dhcp4: no
        addresses:
          - 192.168.5.50/24
        gateway: 192.168.5.99
        nameservers:
            addresses: [192.168.5.25]

sudo netplan apply

Fix LVM

sudo lvm
lvm > lvextend -l +100%FREE /dev/ubuntu-vg/ubuntu-lv
exit

sudo resize2fs /dev/ubuntu-vg/ubuntu-lv

Change HOSTNAME

sudo hostnamectl set-hostname {hostname}
hostnamectl

sudo nano /etc/hosts
/* change hostname in hosts file */

Change timezone

timedatectl
timedatectl list-timezones
sudo timedatectl set-timezone America/Chicago

Install Guest Agent for Proxmox

Applies only if this box is in a Proxmox server

  1. Open Proxmox
  2. Click Options
  3. Turn on QEMU Agent
sudo apt install qemu-guest-agent
sudo shutdown 

Configure Firewall

sudo ufw status
sudo ufw default allow outgoing
sudo ufw default deny incoming
sudo ufw allow ssh
sudo ufw enable

Install fail2ban

sudo apt install fail2ban
sudo cp /etc/fail2ban/fail2ban.{conf,local}
sudo cp /etc/fail2ban/jail.{conf,local}
sudo nano fail2ban.local

loglevel = INFO
logtarget = /var/log/fail2ban.log

sudo nano /etc/fail2ban/jail.local

bantime = 10m
findtime = 10m
maxretry = 5
backend = systemd

sudo systemctl restart fail2ban

sudo fail2ban-client status /* use to review banned */