One place for hosting & domains

      Initial

      Initial Server Setup with CentOS 8


      Introduction

      When you first create a new CentOS 8 server, there are a few configuration steps that you should take early on as part of the basic setup. This will increase the security and usability of your server and will give you a solid foundation for subsequent actions.

      Step 1 — Logging in as Root

      To log into your server, you will need to know your server’s public IP address. You will also need the password or, if you installed an SSH key for authentication, the private key for the root user’s account. If you have not already logged into your server, you may want to follow our documentation on how to connect to your Droplet with SSH, which covers this process in detail.

      If you are not already connected to your server, log in as the root user now using the following command (substitute the highlighted portion of the command with your server’s public IP address):

      Accept the warning about host authenticity if it appears. If you are using password authentication, provide your root password to log in. If you are using an SSH key that is passphrase protected, you may be prompted to enter the passphrase the first time you use the key each session. If this is your first time logging into the server with a password, you may also be prompted to change the root password.

      About Root

      The root user is the administrative user in a Linux environment, and it has very broad privileges. Because of the heightened privileges of the root account, you are discouraged from using it on a regular basis. This is because part of the power inherent with the root account is the ability to make very destructive changes, even by accident.

      As such, the next step is to set up an alternative user account with a reduced scope of influence for day-to-day work. This account will still be able to gain increased privileges when necessary.

      Step 2 — Creating a New User

      Once you are logged in as root, you can create the new user account that we will use to log in from now on.

      This example creates a new user called sammy, but you should replace it with any username that you prefer:

      Next, set a strong password for the sammy user:

      You will be prompted to enter the password twice. After doing so, your user will be ready to use, but first we’ll give this user additional privileges to use the sudo command. This will allow us to run commands as root when necessary.

      Step 3 — Granting Administrative Privileges

      Now, we have a new user account with regular account privileges. However, we may sometimes need to do administrative tasks.

      To avoid having to log out of our normal user and log back in as the root account, we can set up what is known as “superuser” or root privileges for our normal account. This will allow our normal user to run commands with administrative privileges by putting the word sudo before each command.

      To add these privileges to our new user, we need to add the new user to the wheel group. By default, on CentOS 8, users who belong to the wheel group are allowed to use the sudo command.

      As root, run this command to add your new user to the wheel group (substitute the highlighted word with your new username):

      Now, when logged in as your regular user, you can type sudo before commands to perform actions with superuser privileges.

      Step 4 — Setting Up a Basic Firewall

      Firewalls provide a basic level of security for your server. These applications are responsible for denying traffic to every port on your server, except for those ports/services you have explicitly approved. CentOS has a service called firewalld to perform this function. A tool called firewall-cmd is used to configure firewalld firewall policies.

      Note: If your servers are running on DigitalOcean, you can optionally use DigitalOcean Cloud Firewalls instead of the UFW firewall. We recommend using only one firewall at a time to avoid conflicting rules that may be difficult to debug.

      First install firewalld:

      The default firewalld configuration allows ssh connections, so we can turn the firewall on immediately:

      • systemctl start firewalld

      Check the status of the service to make sure it started:

      • systemctl status firewalld

      Output

      ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled) Active: active (running) since Thu 2020-02-06 16:39:40 UTC; 3s ago Docs: man:firewalld(1) Main PID: 13180 (firewalld) Tasks: 2 (limit: 5059) Memory: 22.4M CGroup: /system.slice/firewalld.service └─13180 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid

      Note that it is both active and enabled, meaning it will start by default if the server is rebooted.

      Now that the service is up and running, we can use the firewall-cmd utility to get and set policy information for the firewall.

      First let’s list which services are already allowed:

      • firewall-cmd --permanent --list-all

      Output

      public (active) target: default icmp-block-inversion: no interfaces: eth0 eth1 sources: services: cockpit dhcpv6-client ssh ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules:

      To see the additional services that you can enable by name, type:

      • firewall-cmd --get-services

      To add a service that should be allowed, use the --add-service flag:

      • firewall-cmd --permanent --add-service=http

      This would add the http service and allow incoming TCP traffic to port 80. The configuration will update after you reload the firewall:

      Remember that you will have to explicitly open the firewall (with services or ports) for any additional services that you may configure later.

      Step 5 — Enabling External Access for Your Regular User

      Now that we have a regular non-root user for daily use, we need to make sure we can use it to SSH into our server.

      Note: Until verifying that you can log in and use sudo with your new user, we recommend staying logged in as root. This way, if you have problems, you can troubleshoot and make any necessary changes as root. If you are using a DigitalOcean Droplet and experience problems with your root SSH connection, you can log into the Droplet using the DigitalOcean Console.

      The process for configuring SSH access for your new user depends on whether your server’s root account uses a password or SSH keys for authentication.

      If the Root Account Uses Password Authentication

      If you logged in to your root account using a password, then password authentication is enabled for SSH. You can SSH to your new user account by opening up a new terminal session and using SSH with your new username:

      After entering your regular user’s password, you will be logged in. Remember, if you need to run a command with administrative privileges, type sudo before it like this:

      You will be prompted for your regular user password when using sudo for the first time each session (and periodically afterwards).

      To enhance your server’s security, we strongly recommend setting up SSH keys instead of using password authentication. Follow our guide on setting up SSH keys on CentOS 8 to learn how to configure key-based authentication.

      If the Root Account Uses SSH Key Authentication

      If you logged in to your root account using SSH keys, then password authentication is disabled for SSH. You will need to add a copy of your public key to the new user’s ~/.ssh/authorized_keys file to log in successfully.

      Since your public key is already in the root account’s ~/.ssh/authorized_keys file on the server, we can copy that file and directory structure to our new user account.

      The simplest way to copy the files with the correct ownership and permissions is with the rsync command. This will copy the root user’s .ssh directory, preserve the permissions, and modify the file owners, all in a single command. Make sure to change the highlighted portions of the command below to match your regular user’s name:

      Note: The rsync command treats sources and destinations that end with a trailing slash differently than those without a trailing slash. When using rsync below, be sure that the source directory (~/.ssh) does not include a trailing slash (check to make sure you are not using ~/.ssh/).

      If you accidentally add a trailing slash to the command, rsync will copy the contents of the root account’s ~/.ssh directory to the sudo user’s home directory instead of copying the entire ~/.ssh directory structure. The files will be in the wrong location and SSH will not be able to find and use them.

      • rsync --archive --chown=sammy:sammy ~/.ssh /home/sammy

      Now, back in new terminal on your local machine, open up a new SSH session with your non-root user:

      You should be logged in to the new user account without using a password. Remember, if you need to run a command with administrative privileges, type sudo before it like this:

      You will be prompted for your regular user password when using sudo for the first time each session (and periodically afterwards).

      Conclusion

      At this point, you have a solid foundation for your server. You can install any of the software you need on your server now.



      Source link

      Initial Server Setup with Debian 10


      Introduction

      When you first create a new Debian 10 server, there are a few configuration steps that you should take early on as part of the basic setup. This will increase the security and usability of your server and will give you a solid foundation for subsequent actions.

      In this tutorial, we will learn how to log into our server as the root user, create a new user with admin privileges, and set up a basic firewall.

      Step 1 — Logging in as Root

      To log into your server, you will need to know your server’s public IP address. You will also need the password or, if you installed an SSH key for authentication, the private key for the root user’s account. If you have not already logged into your server, you may want to follow our guide on how to connect to your Droplet with SSH, which covers this process in detail.

      If you are not already connected to your server, go ahead and log in as the root user using the following command (substitute the highlighted portion of the command with your server’s public IP address):

      Accept the warning about host authenticity if it appears. If you are using password authentication, provide your root password to log in. If you are using an SSH key that is passphrase protected, you may be prompted to enter the passphrase the first time you use the key each session. If this is your first time logging into the server with a password, you may also be prompted to change the root password.

      About Root

      The root user is the administrative user in a Linux environment that has very broad privileges. Because of the heightened privileges of the root account, you are discouraged from using it on a regular basis. This is because part of the power inherent with the root account is the ability to make very destructive changes, even by accident.

      The next step is to set up an alternative user account with a reduced scope of influence for day-to-day work. Later, we'll explain how to gain increased privileges for those times when you need them.

      Step 2 — Creating a New User

      Once you are logged in as root, we're prepared to add the new user account that we will use to log in from now on.

      This example creates a new user called sammy, but you should replace it with a username that you like:

      You will be asked a few questions, starting with the account password.

      Enter a strong password and, optionally, fill in any of the additional information you would like. This is not required and you can just hit ENTER in any field you wish to skip.

      Next, we'll set up this new user with admin privileges.

      Step 3 — Granting Administrative Privileges

      Now, we have created a new user account with regular account privileges. However, we may sometimes need to do administrative tasks with it.

      To avoid having to log out of our normal user and log back in as the root account, we can set up what is known as superuser or root privileges for our normal account. This will allow our normal user to run commands with administrative privileges by putting the word sudo before the command.

      To add these privileges to our new user, we need to add the new user to the sudo group. By default, on Debian 10, users who belong to the sudo group are allowed to use the sudo command.

      As root, run this command to add your new user to the sudo group (substitute the highlighted word with your new user):

      Now, when logged in as your regular user, you can type sudo before commands to run the command with superuser privileges.

      Step 4 — Setting Up a Basic Firewall

      Debian servers can use firewalls to make sure only certain connections to specific services are allowed. In this guide, we will install and use the UFW firewall to help set firewall policies and manage exceptions.

      We can use the apt package manager to install UFW. Update the local index to retrieve the latest information about available packages and then install the UFW firewall software by typing:

      • apt update
      • apt install ufw

      Note: If your servers are running on DigitalOcean, you can optionally use DigitalOcean Cloud Firewalls instead of the UFW firewall. We recommend using only one firewall at a time to avoid conflicting rules that may be difficult to debug.

      Firewall profiles allow UFW to manage named sets of firewall rules for installed applications. Profiles for some common software are bundled with UFW by default and packages can register additional profiles with UFW during the installation process. OpenSSH, the service allowing us to connect to our server now, has a firewall profile that we can use.

      You list all available application profiles by typing:

      Output

      Available applications: . . . OpenSSH . . .

      We need to make sure that the firewall allows SSH connections so that we can log back in next time. We can allow these connections by typing:

      Afterwards, we can enable the firewall by typing:

      Type y and press ENTER to proceed. You can see that SSH connections are still allowed by typing:

      Output

      Status: active To Action From -- ------ ---- OpenSSH ALLOW Anywhere OpenSSH (v6) ALLOW Anywhere (v6)

      As the firewall is currently blocking all connections except for SSH, if you install and configure additional services, you will need to adjust the firewall settings to allow acceptable traffic in. You can learn some common UFW operations in our UFW essentials guide.

      Step 5 — Enabling External Access for Your Regular User

      Now that we have a regular user for daily use, we need to make sure we can SSH into the account directly.

      Note: Until verifying that you can log in and use sudo with your new user, we recommend staying logged in as root. This way, if you have problems, you can troubleshoot and make any necessary changes as root. If you are using a DigitalOcean Droplet and experience problems with your root SSH connection, you can also log into the Droplet using the DigitalOcean Console.

      The process for configuring SSH access for your new user depends on whether your server's root account uses a password or SSH keys for authentication.

      If the Root Account Uses Password Authentication

      If you logged in to your root account using a password, then password authentication is enabled for SSH. You can SSH to your new user account by opening up a new terminal session and using SSH with your new username:

      After entering your regular user's password, you will be logged in. Remember, if you need to run a command with administrative privileges, type sudo before it like this:

      You will be prompted for your regular user password when using sudo for the first time each session (and periodically afterwards).

      To enhance your server's security, we strongly recommend setting up SSH keys instead of using password authentication. Follow our guide on setting up SSH keys on Debian 10 to learn how to configure key-based authentication.

      If the Root Account Uses SSH Key Authentication

      If you logged in to your root account using SSH keys, then password authentication is disabled for SSH. You will need to add a copy of your local public key to the new user's ~/.ssh/authorized_keys file to log in successfully.

      Since your public key is already in the root account's ~/.ssh/authorized_keys file on the server, we can copy that file and directory structure to our new user account in our existing session with the cp command. Afterwards, we can adjust ownership of the files using the chown command.

      Make sure to change the highlighted portions of the command below to match your regular user's name:

      • cp -r ~/.ssh /home/sammy
      • chown -R sammy:sammy /home/sammy/.ssh

      The cp -r command copies the entire directory to the new user's home directory, and the chown -R command changes the owner of that directory (and everything inside it) to the specified username:groupname (Debian creates a group with the same name as your username by default).

      Now, open up a new terminal session and log in via SSH with your new username:

      You should be logged in to the new user account without using a password. Remember, if you need to run a command with administrative privileges, type sudo before it like this:

      You will be prompted for your regular user password when using sudo for the first time each session (and periodically afterwards).

      Where To Go From Here?

      At this point, you have a solid foundation for your server. You can install any of the software you need on your server now.



      Source link

      Automating Initial Server Setup with Ansible on Ubuntu 18.04


      Introduction

      When you first create a new Ubuntu 18.04 server, there are a few configuration steps that you should take early on as part of the basic setup. This will increase the security and usability of your server, working as a solid foundation for subsequent actions.

      While you can complete these steps manually, automating the process will save you time and eliminate human error. With the popularization of containerized applications and microservices, server automation now plays an essential role in systems administration. It is also a way to establish standard procedures for new servers.

      This guide explains how to use Ansible to automate the steps contained in our Initial Server Setup Guide. Ansible is a modern configuration management tool that can be used to automate the provisioning and configuration of remote systems.

      Pre-Flight Check

      In order to execute the automated setup provided by the playbook we’re discussing in this guide, you’ll need:

      • Ansible installed either on your local machine or on a remote server that you have set up as an Ansible Control Node. You can follow Step 1 of the tutorial How to Install and Configure Ansible on Ubuntu 18.04 to get this set up.
      • Root access to one or more Ubuntu 18.04 servers that will be managed by Ansible.

      Before running a playbook, it’s important to make sure Ansible is able to connect to your servers via SSH and run Ansible modules using Python. The next two sections cover how to set up your Ansible inventory to include your servers and how to run ad-hoc Ansible commands to test for connectivity and valid credentials.

      Inventory File

      The inventory file contains information about the hosts you’ll manage with Ansible. You can include anywhere from one to several hundred of servers in your inventory file, and hosts can be organized into groups and subgroups. The inventory file is also often used to set variables that will be valid for certain hosts and groups only, in order to be used within playbooks and templates. Some variables can also affect the way a playbook is run, like the ansible_python_interpreter variable that we’ll see in a moment.

      To inspect the contents of your default Ansible inventory, open the /etc/ansible/hosts file using your command-line editor of choice, on your local machine or an Ansible Control Node:

      • sudo nano /etc/ansible/hosts

      Note: some Ansible installations won’t create a default inventory file. If the file doesn’t exist in your system, you can create a new file at /etc/ansible/hosts or provide a custom inventory path using the -i parameter when running commands and playbooks.

      The default inventory file provided by the Ansible installation contains a number of examples that you can use as references for setting up your inventory. The following example defines a group named servers with three different servers in it, each identified by a custom alias: server1, server2, and server3:

      /etc/ansible/hosts

      [servers]
      server1 ansible_host=203.0.113.111
      server2 ansible_host=203.0.113.112
      server3 ansible_host=203.0.113.113
      
      [servers:vars]
      ansible_python_interpreter=/usr/bin/python3
      

      The server:vars subgroup sets the ansible_python_interpreter host parameter that will be valid for all hosts included in the servers group. This parameter makes sure the remote server uses the /usr/bin/python3 Python 3 executable instead of /usr/bin/python (Python 2.7), which is not present on recent Ubuntu versions.

      To finish setting up your inventory file, replace the highlighted IPs with the IP addresses of your servers. When you’re finished, save and close the file by pressing CTRL+X then y to confirm changes and then ENTER.

      Now that your inventory file is ready, it’s time to test connectivity to your nodes

      Testing Connectivity

      After setting up the inventory file to include your servers, it’s time to check if Ansible is able to connect to these servers and run commands via SSH. For this guide, we will be using the Ubuntu root account because that’s typically the only account available by default on newly created servers. This playbook will create a new non-root user with sudo privileges that you should use in subsequent interactions with the remote server.

      From your local machine or Ansible Control Node, run:

      • ansible -m ping all -u root

      This command will use the built-in ping Ansible module to run a connectivity test on all nodes from your default inventory, connecting as root. The ping module will test:
      if hosts are accessible;
      if you have valid SSH credentials;
      if hosts are able to run Ansible modules using Python.

      If instead of key-based authentication you’re using password-based authentication to connect to remote servers, you should provide the additional parameter -k to the Ansible command, so that it will prompt you for the password of the connecting user.

      • ansible -m ping all -u root -k

      Note: Keep in mind that some servers might have additional security measures against password-based authentication as the root user, and in some cases you might be required to manually log in to the server to change the initial root password.

      You should get output similar to this:

      Output

      server1 | SUCCESS => { "changed": false, "ping": "pong" } server2 | SUCCESS => { "changed": false, "ping": "pong" } server3 | SUCCESS => { "changed": false, "ping": "pong" }

      If this is the first time you’re connecting to these servers via SSH, you’ll be asked to confirm the authenticity of the hosts you’re connecting to via Ansible. When prompted, type yes and then hit Enter to confirm.

      Once you get a “pong” reply back from a host, it means you’re ready to run Ansible commands and playbooks on that server.

      What Does this Playbook Do?

      This Ansible playbook provides an alternative to manually running through the procedure outlined in the Ubuntu 18.04 initial server setup guide and the guide on setting up SSH keys on Ubuntu 18.04.

      Running this playbook will cause the following actions to be performed:

      1. The administrative group wheels is created and then configured for passwordless sudo.
      2. A new administrative user is created within that group, using the name specified by the create_user variable.
      3. A public SSH key is copied from the location defined by the variable copy_local_key, and added to the authorized_keys file for the user created in the previous step.
      4. Password-based authentication is disabled for the root user.
      5. The local apt package index is updated and basic packages defined by the variable sys_packages are installed.
      6. The UFW firewall is configured to allow only SSH connections and deny any other requests.

      For more information about each of the steps included in this playbook, please refer to our Ubuntu 18.04 initial server setup guide.

      Once the playbook has finished running, you’ll be able to log in to the server using the newly created sudo account.

      How to Use this Playbook

      To get started, we’ll download the contents of the playbook to your Ansible Control Node. This can be either your local machine, or a remote server where you have Ansible installed and your inventory set up.

      For your convenience, the contents of the playbook are also included in a further section of this guide.

      To download this playbook from the command-line, you can use curl:

      • curl -L https://raw.githubusercontent.com/do-community/ansible-playbooks/master/initial_server_setup/ubuntu1804.yml -o initial_server_setup.yml

      This will download the contents of the playbook to a file named initial_server_setup.yml on your current local path. You can examine the contents of the playbook by opening the file with your command-line editor of choice:

      • sudo nano initial_server_setup.yml

      Once you’ve opened the playbook file, you should notice a section named vars with three distinct variables that require your attention:

      • create_user: The name of the non-root user account to create and grant sudo privileges to. Our example uses sammy, but you can use whichever username you’d like.
      • copy_local_key: Local path to a valid SSH public key to set up as an authorized key for the new non-root sudo account. The default value points to the current local user’s public key located at ~/.ssh/id_rsa.pub.
      • sys_packages: A list of basic system packages that will be installed using the package manager tool apt.

      Once you’re done updating the variables inside initial_server_setup.yml, save and close the file.

      You’re now ready to run this playbook on one or more servers. Most playbooks are configured to be executed on all servers from your inventory, by default. We can use the -l flag to make sure that only a subset of servers, or a single server, is affected by the playbook. To execute the playbook only on server1, you can use the following command:

      • ansible-playbook initial_server_setup.yml -l server1

      You will get output similar to this:

      Output

      PLAY [all] *************************************************************************************************************************************** TASK [Make sure we have a 'wheel' group] ********************************************************************************************************* changed: [server1] TASK [Allow 'wheel' group to have passwordless sudo] ********************************************************************************************* changed: [server1] TASK [Create a new regular user with sudo privileges] ******************************************************************************************** changed: [server1] TASK [Set authorized key for remote user] ******************************************************************************************************** changed: [server1] TASK [Disable password authentication for root] ************************************************************************************************** changed: [server1] TASK [Update apt] ******************************************************************************************************************************** changed: [server1] TASK [Install required system packages] ********************************************************************************************************** ok: [server1] TASK [UFW - Allow SSH connections] *************************************************************************************************************** changed: [server1] TASK [UFW - Deny all other incoming traffic by default] ****************************************************************************************** changed: [server1] PLAY RECAP *************************************************************************************************************************************** server1 : ok=9 changed=8 unreachable=0 failed=0

      Once the playbook execution is finished, you’ll be able to log in to the server with:

      • ssh sammy@server_domain_or_IP

      Remember to replace sammy with the user defined by the create_user variable, and server_domain_or_IP with your server’s hostname or IP address.

      In case you have set a custom public key with the copy_local_key variable, you’ll need to provide an extra parameter specifying the location of its private key counterpart:

      • ssh sammy@server_domain_or_IP -i ~/.ssh/ansible_controller_key

      After logging in to the server, you can check the UFW firewall’s active rules to confirm that it’s properly configured:

      You should get output similar to this:

      Output

      Status: active To Action From -- ------ ---- OpenSSH ALLOW Anywhere OpenSSH (v6) ALLOW Anywhere (v6)

      This means that the UFW firewall has successfully been enabled. Since this was the last task in the playbook, it confirms that the playbook was fully executed on this server.

      The Playbook Contents

      You can find the initial server setup playbook in the ansible-playbooks repository in the DigitalOcean Community GitHub organization. To copy or download the script contents directly, click the Raw button towards the top of the script, or click here to view the raw contents directly.

      The full contents are also included here for convenience:

      initial_server_setup.yml

      ---
      - hosts: all
        remote_user: root
        gather_facts: false
        vars:
          create_user: sammy
          copy_local_key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/id_rsa.pub') }}"
          sys_packages: [ 'curl', 'vim', 'git', 'ufw' ]
      
        tasks:
          - name: Make sure we have a 'wheel' group
            group:
              name: wheel
              state: present
      
          - name: Allow 'wheel' group to have passwordless sudo
            lineinfile:
              path: /etc/sudoers
              state: present
              regexp: '^%wheel'
              line: '%wheel ALL=(ALL) NOPASSWD: ALL'
              validate: '/usr/sbin/visudo -cf %s'
      
          - name: Create a new regular user with sudo privileges
            user:
              name: "{{ create_user }}"
              groups: wheel
              shell: /bin/bash
      
          - name: Set authorized key for remote user
            authorized_key:
              user: "{{ create_user }}"
              state: present
              key: "{{ copy_local_key }}"
      
          - name: Disable password authentication for root
            lineinfile:
              path: /etc/ssh/sshd_config
              state: present
              regexp: '^PermitRootLogin'
              line: 'PermitRootLogin prohibit-password'
      
          - name: Update apt
            apt: update_cache=yes
      
          - name: Install required system packages
            apt: name={{ sys_packages }} state=latest
      
          - name: UFW - Allow SSH connections
            ufw:
              rule: allow
              name: OpenSSH
      
          - name: UFW - Deny all other incoming traffic by default
            ufw:
              state: enabled
              policy: deny
              direction: incoming
      
      

      Feel free to modify this playbook or include new tasks to best suit your individual needs within your own workflow.

      Conclusion

      Automating the initial server setup can save you time, while also making sure your servers will follow a standard configuration that can be improved and customized to your needs. With the distributed nature of modern applications and the need for more consistency between different staging environments, automation like this becomes a necessity.

      In this guide, we demonstrated how to use Ansible for automating the initial tasks that should be executed on a fresh server, such as creating a non-root user with sudo access, enabling UFW and disabling remote root login.

      If you'd like to include new tasks in this playbook to further customize your initial server setup, please refer to our introductory Ansible guide Configuration Management 101: Writing Ansible Playbooks.



      Source link