7.4 KiB
Linux Installation
Table of Contents
Introduction
This guide focuses on installing Linux on a hypervisor of some sort. At least, that is how I most often use this guide: as a checklist for building out a server, dev environment, or something else Linux related. That said, these steps are valid for building out a box as well.
As far as a hypervisor, I have an old HP Proliant server that is running Windows Server 2019 with Hyper-V installed and I have a newer Proliant that is running Proxmox. This guide doesn't have the specifics of installing on either hypervisor, but I may add that later.
Pre Install
Select distro
Asking which distro of linux is the best one is like asking which super-hero is the best in a comic shop. The selection of linux distro hinges upon your requirements and what you intend to accomplish with it.
The following four are a handful of distros that have remained popular for more than a couple of years. Finding tutorials, YouTube channels, and other assistance is easy for all of these.
Download ISO
When downloading the OS, select an ISO file and try to find the latest stable release or an LTS (Long Term Support) version of the OS. You may select the niche options but these assume that you know what you are doing.
Store the ISO in a place that is accessible to the hypervisor where you will install Linux. I tend to keep a file-share with all of my ISOs.
Installation
This section should have two parts. The first would outline the steps for creating a virtual machine on your hypervisor onto which you will install your Linux distro. The second part would outline how to install your distro onto the VM.
Lacking those, I recomment hitting YouTube and the distro's documentation for the step by step to install Linux. It's actually quite easy.
Post Install
Update && Upgrade
Always run these two command immediately after completing the installation because fixes have likely been released since the ISO was created. You should also run these two commands immediately before installing a major piece of software on your instance. Lastly, you should run these on a regular basis to keep your box up to date.
apt update
apt upgrade
Automatic Updates
Some hot fixes and security patches should not wait around until you finally decide to actually run the update and upgrade commands above. For this reason, setup unattended upgrades for the important stuff.
apt install unattended-upgrades
dpkg-reconfigure --priority=low unattended-upgrades
Static IP
sudo nano /etc/netplan/01-netcfg.yaml
network:
version: 2
renderer: networkd
ethernets:
ens18:
dhcp4: no
addresses: [192.168.5.50/24]
nameservers:
addresses: [192.168.5.25,8.8.8.8]
routes:
- to: default
via: 192.168.5.99
sudo netplan apply
Install openssh
You can select this during Ubuntu install
sudo apt install openssh-server
ssh-keygen
SSH on Client machine
LINUX client machine
ssh-keygen
ssh-copy-id username@ipaddress
Windows client
ssh-keygen
Get-Content $env:USERPROFILE\.ssh\id_rsa.pub | ssh <user>@<hostname> "cat >> .ssh/authorized_keys"
Lockdown Logins to SSH only
sudo nano /etc/ssh/sshd_config
Make the following changes:
- Change PasswordAuthentication to no
- Change ChallengeResponseAuthentication to no
Save the file and restart the ssh service
sudo systemctl restart sshd
Fix LVM
This seems to be an Ubuntu thing. Most of the other distros don't need this but it doesn't hurt to check your volumes. Basically, you are making sure that Linux is using the whole hard drive rather than part of it.
sudo lvm
lvm > lvextend -l +100%FREE /dev/ubuntu-vg/ubuntu-lv
exit
sudo resize2fs /dev/ubuntu-vg/ubuntu-lv
Change timezone
timedatectl
timedatectl list-timezones
sudo timedatectl set-timezone America/Chicago
Configure Firewall
sudo ufw status
sudo ufw default allow outgoing
sudo ufw default deny incoming
sudo ufw allow ssh
sudo ufw enable
Install fail2ban
sudo apt install fail2ban
sudo cp /etc/fail2ban/fail2ban.{conf,local}
sudo cp /etc/fail2ban/jail.{conf,local}
sudo nano fail2ban.local
loglevel = INFO
logtarget = /var/log/fail2ban.log
sudo nano /etc/fail2ban/jail.local
bantime = 10m
findtime = 10m
maxretry = 5
backend = systemd
sudo systemctl restart fail2ban
sudo fail2ban-client status /* use to review banned */
Optional Maintenance
Create new sudo account
Ubuntu Server does this by default
sudo adduser {username}
sudo usermod -aG sudo {username}
Disable root
Ubuntu Server does this by default
sudo passwd -l root
Change HOSTNAME
sudo hostnamectl set-hostname {hostname}
hostnamectl
sudo nano /etc/hosts
/* change hostname in hosts file */
Optional Services
Install xRDP
If you need to use RDP to access a desktop environment
sudo apt install xrdp
sudo systemctl enable xrdp
Install GIT
sudo apt install git
Install Guest Agent for Proxmox
Applies only if this box is in a Proxmox server
- Open Proxmox
- Click Options
- Turn on QEMU Agent
sudo apt install qemu-guest-agent
sudo shutdown
Install Webmin
sudo apt install software-properties-common apt-transport-https
sudo wget -q http://www.webmin.com/jcameron-key.asc -O- | sudo apt-key add -
sudo add-apt-repository "deb [arch=amd64] http://download.webmin.com/download/repository sarge contrib"
sudo apt install webmin
sudo ufw allow 10000/tcp
sudo ufw reload
bind9 DNS
sudo apt install -y bind9 bind9utils bind9-doc dnsutils
sudo systemctl start named
sudo systemctl enable named
sudo ufw allow 53
sudo ufw reload
Gitea (GitHub alternative)
sudo apt install git
sudo apt install mariadb-server
# Login to MySQL
sudo mysql -u root -p
# Add the git database
CREATE DATABASE gitea;
GRANT ALL PRIVILEGES ON gitea.* TO 'gitea'@'localhost' IDENTIFIED BY "Root";
FLUSH PRIVILEGES;
QUIT;
# Install gitea
sudo wget -O /usr/local/bin/gitea https://dl.gitea.io/gitea/1.16.7/gitea-1.16.7-linux-amd64
sudo chmod +x /usr/local/bin/gitea
gitea --version
# Create gitea user
sudo adduser --system --shell /bin/bash --gecos 'Git Version Control' --group --disabled-password --home /home/git git
sudo mkdir -pv /var/lib/gitea/{custom,data,log}
sudo chown -Rv git:git /var/lib/gitea
sudo chown -Rv git:git /var/lib/gitea
sudo mkdir -v /etc/gitea
sudo chown -Rv root:git /etc/gitea
sudo chmod -Rv 770 /etc/gitea
sudo chmod -Rv 770 /etc/gitea
# Append code to the service file
sudo nano /etc/systemd/system/gitea.service
[Unit]
Description=Gitea
After=syslog.target
After=network.target
[Service]
RestartSec=3s
Type=simple
User=git
Group=git
WorkingDirectory=/var/lib/gitea/
ExecStart=/usr/local/bin/gitea web --config /etc/gitea/app.ini
Restart=always
Environment=USER=git HOME=/home/git GITEA_WORK_DIR=/var/lib/gitea
[Install]
WantedBy=multi-user.target
# Start gitea
sudo systemctl start gitea
sudo systemctl status gitea
sudo systemctl enable gitea
# Access gitea
http://localhost:3000
# If you ever need to change settings like DOMAIN
sudo nano /etc/gitea/app.ini