Things to do on a fresh linux installation

Create new sudo user

First we create the user

sudo adduser madman

Then add it to sudoers

sudo usermod -aG sudo madman

Now we check if the user can run all commands

sudo -l -U madman

Disable root login

We can disable root logins with this command

sudo passwd -l root 

This will lock the password for the root user and you won’t be able to access the root account with its password until a new one is set.

Update and Upgrade the system

sudo apt-get update -y && sudo apt-get upgrade -y

It’s important to reboot the server after this step.

Configure Automatic Upgrades

First install unattended-upgrades

sudo apt-get install unattended-upgrades

Then we reconfigure it

sudo dpkg reconfigure --priority=low unattended-upgrades

Then we can check the config file

sudo nano /etc/apt/apt.conf.d/20auto-upgrades

Install SSH server & configure key-based authentication

Install ssh server

We use openssh-server as our ssh-server

sudo apt-get install openssh-server

Configure key based authentication

Now we have to create an ssh key-pair on the client machine. to do that we have to run this command:

ssh-keygen -t ed25519

If the client machine is a legacy system that doesn’t support the Ed25519 algorithm, use:

ssh-keygen -t rsa -b 4096

Basically the key based authentication works by copying the client’s ssh public key to the server’s authorized_keys file.

To do this the easy way we just run this simple command:

ssh-copy-id <user>@<server-address>

This will automatically copy the client’s public key to the server’s trusted keys over ssh connection.

If we want to do this manually we have to copy the contents of the client’s public key to the server’s authorized_keys file.

On the client machine:

cat ~/.ssh/id_rsa.pub

and we copy the output. Then on the server:

nano ~/.ssh/authorized_keys

paste and we’re done.

Disable password based authentication

Now that we have enabled key-based authentication it’s logical that we disable password-based authentication for extra security.

To do this have to edit the ssh daemon configuration file.

sudo nano /etc/ssh/sshd_config

Uncomment these 2 fields and set them to no:

PasswordAuthentication no
ChallengeResponseAuthentication no

Also to disable root account login:

PermitRootLogin no

Now we restart ssh daemon

sudo systemctl restart sshd

Configure Static IP

sudo nano /etc/netplan/01-netcfg.yaml

network:
  version: 2
  renderer: networkd
  ethernets:
    ens18:
     dhcp4: no
     addresses:
        - 192.168.0.222/24
     gateway4: 192.168.0.1
     nameservers:
       addresses: [192.168.0.4]

apply the settings

sudo netplan apply

Hostname

Check the current hostname:

hostnamectl

Change hostname to rocketship

sudo hostnamectl set-hostname rocketship

Must also change in this file:

sudo nano /etc/hosts

Timezone

Check timezone:

timedatectl

Change the timezone:

sudo timedatectl set-timezone America/Chicago

Change with menu:

sudo dpkg-reconfigure tzdata 

Firewall

Allow outgoing traffic by default:

sudo ufw default allow outgoing

Deny incoming traffic by default:

sudo ufw default deny incoming

Allow ssh service:

sudo ufw allow ssh

Enable the firewall:

sudo ufw enable

Check status:

sudo ufw status