Be Your Own Cloud code · PART 2 — FOUNDATION

Chapter 5 Installing and Hardening Ubuntu Server

6 blocks · pp. 25–27 in the paperback

Going further than the chapter: Installing Ubuntu Server for a Home Lab , SSH: Key-Only Login and Sensible Hardening

First Boot: A User and a Real Address

# p. 25

File /etc/netplan/00-installer-config.yaml

Your file may have a different name — ls /etc/netplan shows it.

# /etc/netplan/00-installer-config.yaml
network:
  version: 2
  ethernets:
    eth0:
      dhcp4: no
      addresses: [192.168.1.50/24]
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses: [192.168.1.1, 1.1.1.1]

Run Terminal, on the server

sudo netplan apply

Locking Down SSH

# p. 25

Run Terminal, on your own computer — not the server

ssh-keygen -t ed25519
ssh-copy-id [email protected]

# p. 26

Add to /etc/ssh/sshd_config

Set these three lines; leave the rest of the file alone.

# /etc/ssh/sshd_config
PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yes

Run Terminal, on the server

sudo systemctl restart ssh

A Firewall That Actually Does Something

# p. 26

Run Terminal, on the server

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable

Patching Itself, and a Bouncer at the Door

# p. 27

Run Terminal, on the server

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

# p. 27

Run Terminal, on the server

sudo apt install fail2ban -y
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
# Edit jail.local, confirm the [sshd] section is enabled
sudo systemctl enable --now fail2ban

Reproduced exactly from Be Your Own Cloud, Chapter 5. The book explains what each line does and what to do when it doesn't work. About the book

Something here not working as the book describes? Tell the author.