|
<< Click to Display Table of Contents >> Navigation: Linux - Ubuntu 24.04 > Linux Allgemein |
The next step is to update the package system and install all pending updates:
sudo apt-get update
sudo apt-get upgrade
After that you should consider, which ports should be opened. Here is a list of ports you may need for your system:
•80 - normally used or http
•443 - normally used for https
•22 - normally used for ssh, we use this in the beginning, but we will switch to port x at the end of the installation
•3000 - Grafana (wenn genutzt)
•5432 - PostgreSQL - perhaps you can close it, because you access the database only within the computer
•5671 - RabbitMQ AMQ TLS port
•5672 - RabbitMQ AMQ port
•1883 - RabbitMQ MQTT (Non-TLS) Port
•8883 - RabbitMQ MQTT (TLS) Port
•15671 - RabbitMQ Management UI TLS
•15672 - RabbitMQ Management
•15676 - RabbitMQ Web MQTT Plugin
•x - new port for ssh at the end of this installation process
•y - example for for development under Gemstone/S64
You login as root and open the file /etc/ssh/sshd_config. You will find the line for the port (contains 22) and change that to the new port. After that you should restart the ssh service via
service ssh restart
but do not close the current session. Instead create a new putty session and try to connect to the computer using the new port. If this works - fine.
In the next step you add a new user you use as the main user for your work.
useradd -g users -d /home/[username] -m -s /bin/bash [username]
and you enter a new password for this user:
passwd [username]
You add the user to the sudo, kvm, libvirtd group:
usermod -aG sudo [username]
usermod -aG kvm [username]
usermod -aG libvirt [username]
And then you allow the user to execute sudo statements. You set the tool visudo to add the specifications. Under "user privilege specification" you add a new user like:
[username] ALL=(ALL) ALL
Then you test this by executing
sudo su
In the next step you disable the root account to login directly into the system via a password:
You edit the file /etc/ssh/sshd_config via
nano /etc/ssh/sshd_config
and you activate the following entry (depending what the default is ok n... sometimes the default is hat you want):
PermitRootLogin prohibit-password
and again, restart the ssh via "service ssh restart". Test if it works.
By the way - root actually can still login into your system - but the user has to use the private key way.
For the following services you should enable local mail delivery. You install the package via
sudo apt-get install mailutils
and then via
sudo dpkg-reconfigure postfix
and set the delivery mode to "Satellite" and configure it according to the article under Reference in this section. Please notice, that some of the configuration settings are already set in the configuration file.
As you can read in the reference, testing is quite easy to do:
echo "This is a test email body." | mail -s "Subject" -a "From: you@your-domain-dot-com" you@example-dot-com
Security or not. Well, if you have problems it may be nice to have tools on your system. Install the RootKit Hunter and update the its knowledge base via:
sudo apt-get install rkhunter
sudo rkhunter --propupd
Run the first check:
sudo rkhunter -c
Add the job as cron-job unter /etc/crontab (as root). Insert the following command:
10 3 * * * root /usr/bin/rkhunter --cronjob
Change the rkhunter configuration (via sudo gedit /etc/default/rkhunter) to:
CRON_DAILY_RUN="true"
CRON_DB_UPDATE="true"
DB_UPDATE_EMAIL="true"
REPORT_EMAIL="<username>@localhost" # <username> durch den Login-Namen des Haupt-Benutzers ersetzen (ermitteln z. B. mit dem Befehl "whoami")
APT_AUTOGEN="true"
Check the cronjob via "sudo /etc/cron.daily/rkhunter"
You may install the rootkit check via
sudo apt-get install chkrootkit
and install it as a cron job in /etc/crontab (root):
0 3 * * * root (cd /usr/sbin; ./chkrootkit 2>&1 | mail -s "chkrootkit output" [username]@localhost)
sudo timedatectl set-timezone Europe/Berlin
As a next step, one forwards all eMail to the local [username] user, by editing /root/.forward. Simply insert [username]@localhost there or a different address, if you have setup postfix correctly.
No real sense to repeat it here again. Have a look at the following address how to do it.
The next installation is the management software for PostgreSQL via:
sudo curl https://www.pgadmin.org/static/packages_pgadmin_org.pub | sudo apt-key add
sudo sh -c 'echo "deb https://ftp.postgresql.org/pub/pgadmin/pgadmin4/apt/$(lsb_release -cs) pgadmin4 main" > /etc/apt/sources.list.d/pgadmin4.list'
Make an installation via:
sudo apt install pgadmin4
and configure the apache setup via:
sudo /usr/pgadmin4/bin/setup-web.sh
After the installation of the certificate (following in the next chapter) you check this:
https://[your-domain]/pgadmin4
So, next is a very important point - login into the system only via your private key.
First you have to add a directory in the local directory of [username]:
mkdir –p $HOME/.ssh
chmod 0700 $HOME/.ssh
Then we create in this directory an empty file named "authorized_keys" and paste the public key into this file and save it.
For you local putty shell you need the according private key - perhaps you need to convert it into a ppk format. You can do this via:
puttygen [filename] -o [filename].ppk
The ppk file can be used and entered on the Auth Tab of putty in the UI. If all that is done, you can check if that works. Remember, that you can do the same stuff with sftp transfer tools like filezilla. So, all stuff is working - then we turn off the login via password.
For that you open /etc/ssh/sshd_config and and change the following line to:
PasswordAuthentication no
You have to restart the ssh service via:
sudo service ssh restart
Just again a hint: the public key, you defined with the installation, was put as the public key for the root account. Its the same as used here for your new account.
Scan the machine for all open ports now. Install nmap via"sudo apt-get install nmap" and then make a "nmap |address]" scan of this machine. To get help with the output, try to run "netstat -tnlp" for understanding, which process is optional holding an open port.
Do not work as root - as simple as it is.
Have a look at /var/log/auth.log ! Look at the correct file and directory permissions of the .ssh folder and the home directory of a user.