Initial Server Setup with Ubuntu

Introduction

In this tutorial you’ll see first things you have to do on Ubuntu server before you really build and setup a working web server to host your files and databases in it. There are a few initial configuration steps that you should take on as part of the basic setup. This will increase the security and usability of your server and will give you a solid foundation for subsequent actions.

Step One — Root Login

You can either use Terminal on your Linux or Mac computer. But if you are like me running Windows, read my previous Using PuTTy to SSH to your server. Complete the login process by accepting the warning about host authenticity, if it appears, then providing your root authentication (password or private key). If it is your first time logging into the server, with a password, you will also be prompted to change the root password.

About Root

The root user is the administrative user in a Linux environment that has very broad privileges. Because of the heightened privileges of the root account, you are actually discouraged from using it on a regular basis. This is because part of the power inherent with the root account is the ability to make very destructive changes, even by accident.

Step Two — Change Default Root Password

If your is created with automatically generated root password emailed to you once the server was created, then you should do this step: changing default root password. You may not do this if you’ve defined the root password during OS install.

passwd

Use the command above, then you have to enter the new password twice. Upon typing your new password you may not see it on screen.

Step Three — Create a New User

root is default user with all admin privileges. All new servers have the same default admin username which is “root” so hackers can simply force to crack the password since they already knew there is always a user called “root” there. Hence, it is very recommended for each server admin to add additional users to login and to disable root login as well.

Once you are logged in as root, we’re prepared to add the new user account that we will use to log in from now on.

This example creates a new user called “demo“, but you should replace it with a user name that you like:

adduser demo

You will be asked a few questions, starting with the account password.

Enter a strong password and, optionally, fill in any of the additional information if you would like. This is not required and you can just hit “ENTER” in any field you wish to skip.

Step Four — Root Privileges

Now, we have a new user account with regular account privileges. However, we may sometimes need to do administrative tasks.

To avoid having to log out of our normal user and log back in as the root account, we can set up what is known as “super user” or root privileges for our normal account. This will allow our normal user to run commands with administrative privileges by putting the word sudo before each command.

To add these privileges to our new user, we need to add the new user to the “sudo” group. By default, on Ubuntu 14.04, users who belong to the “sudo” group are allowed to use the sudo command.

As root, run this command to add your new user to the sudo group (substitute the highlighted word with your new user):

gpasswd -a demo sudo

To make sure you have sudo package installed on your Ubuntu server ( since sudo package aren’t installed by default on some server ) use the command below

apt-get install sudo

Meet SSH Key Pairs! Secure SHell (aka SSH) is not as secure as its name. Although passwords are sent to the server in a secure manner, they are generally not complex or long enough to be resistant to repeated, persistent attackers. Crackers who know your server’s IP can simply use advanced brute force tool to try login to your server using any possible password combination.

But now you can bring that basic level to one level up by switching to passwordless SSH login using key pairs. Shortly, it is a method to access your server via SSH without entering any password. Although there are other methods of adding additional security (fail2ban, etc.), SSH keys prove to be a reliable and secure alternative.

I’ve split the tutorial for Linux and Windows (Putty) user, you can pass the step to the OS you use to remote connect to your Ubuntu server.

Linux

Generate a Key Pair

If you do not already have an SSH key pair, which consists of a public and private key, you need to generate one. If you already have a key that you want to use, skip to the Copy the Public Key step.

To generate a new key pair, enter the following command at the terminal of your local machine (ie. your computer):

ssh-keygen

Assuming your local user is called “localuser”, you will see output that looks like the following:
ssh-keygen output

Generating public/private rsa key pair.
Enter file in which to save the key (/Users/localuser/.ssh/id_rsa):

Hit return to accept this file name and path (or enter a new name).

Next, you will be prompted for a passphrase to secure the key with. You may either enter a passphrase or leave the passphrase blank.

Note: If you leave the passphrase blank, you will be able to use the private key for authentication without entering a passphrase. If you enter a passphrase, you will need both the private key and the passphrase to log in. Securing your keys with passphrases is more secure, but both methods have their uses and are more secure than basic password authentication.

This generates a private key, id_rsa, and a public key, id_rsa.pub, in the .ssh directory of the localuser‘s home directory. Remember that the private key should not be shared with anyone who should not have access to your servers!

Copy the Public Key

After generating an SSH key pair, you will want to copy your public key to your new server. We will cover two easy ways to do this.

Option 1: Use ssh-copy-id

If your local machine has the ssh-copy-id script installed, you can use it to install your public key to any user that you have login credentials for.

Run the ssh-copy-id script by specifying the user and IP address of the server that you want to install the key on, like this:

ssh-copy-id demo@SERVER_IP_ADDRESS

After providing your password at the prompt, your public key will be added to the remote user’s .ssh/authorized_keys file. The corresponding private key can now be used to log into the server.

Option 2: Manually Install the Key

Assuming you generated an SSH key pair using the previous step, use the following command at the terminal of your local machine to print your public key (id_rsa.pub):

cat ~/.ssh/id_rsa.pub

This should print your public SSH key, which should look something like the following:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBGTO0tsVejssuaYR5R3Y/i73SppJAhme1dH7W2c47d4gOqB4izP0+fRLfvbz/tnXFz4iOP/H6eCV05hqUhF+KYRxt9Y8tVMrpDZR2l75o6+xSbUOMu6xN+uVF0T9XzKcxmzTmnV7Na5up3QM3DoSRYX/EP3utr2+zAqpJIfKPLdA74w7g56oYWI9blpnpzxkEd3edVJOivUkpZ4JoenWManvIaSdMTJXMy3MtlQhva+j9CgguyVbUkdzK9KKEuah+pFZvaugtebsU+bllPTB0nlXGIJk98Ie9ZtxuY3nCKneB+KjKiXrAvXUPCI9mWkYS/1rggpFmu3HbXBnWSUdf localuser@machine.local

Select the public key, and copy it to your clipboard.

Add Public Key to New Remote User

To enable the use of SSH key to authenticate as the new remote user, you must add the public key to a special file in the user’s home directory.

On the server, as the root user, enter the following command to switch to the new user (substitute your own user name):

su - demo

Now you will be in your new user’s home directory.

Create a new directory called .ssh and restrict its permissions with the following commands:

mkdir .ssh

chmod 700 .ssh

Now open a file in .ssh called authorized_keys with a text editor. We will use nano to edit the file:

nano .ssh/authorized_keys

Now insert your public key (which should be in your clipboard) by pasting it into the editor.

Hit CTRL-X to exit the file, then Y to save the changes that you made, then ENTER to confirm the file name.

Now restrict the permissions of the authorized_keys file with this command:

chmod 600 .ssh/authorized_keys

Type this command once to return to the root user:

exit

Now you may SSH login as your new user, using the private key as authentication.

Windows (PuTTY)

Download additional software called PuTTYgen a.k.a PuTTY key generator from its official page here.

Launch up PuTTYgen tool up. If you are on Windows 7 or upper version, right-click on it and select Run as Administrator.

Now hit the Generate button.

puttygen

When the progress is the phase like pic above, make sure you move your mouse over and over again to boost the generator.

Once done, you’ll see something like this:

puttygen-generated

Normally, to create a new key, you have to select the parameters at the bottom that match your requirements. But however the default values will work great so for this example leave it as it is. The key point is make sure you select SSH-2 RSA because it is better and more secure than SSH-1 and SSH-2 DSA. You can also increase the value in “Number of bits in a generated key” from 2048 to 4096 for stronger key – make it harder to crack.

Login back to your server 2 (remote server / vps) and issue following lines of command:

mkdir -p .ssh
chmod 700 .ssh
nano .ssh/authorized_keys

then copy the generated public key in PuttyGen:

puttygen-copy

and paste it in Nano editor:

puttygen-nano

Save and exit Nano by hitting CTRL+O then CTRL+X on or CTRL+X then Y your keyboard. Next, change its permission to 644:

chmod 644 .ssh/authorized_keys

Now exit and go back to Puttygen. Next, you’ll need to save the Private Key and Public Key (to use later). Simply hit Both Private and Public Key Save button. Make sure you save Public Key as .txt while Private Key as .ppk. When saving Private key you’ll be asked to confirm saving without Passprhase, choose Yes.

Let’s configure Putty to use that newly generated key. So open it up and go to Connection > SSH > Auth.

puttygen-puttyauth

Now go back to main page on Putty and login as usual. That’s it. Upon clicking the Open button Putty will logging you in without asking for password. If you got problem that Server is refusing your key then you will need to start over the tutorial, you may miss some step.

Change SSH Default Port

Normally and commonly, new server created should use port 22 for its SSH connection. That’s making your servers vulnerable to get hacked via brute-force mechanism since the attackers already knew that there is a user called “root” and the port used for accessing SSH is 22. Hence, it is strongly recommended for you to change that default port. To do so:

nano /etc/ssh/sshd_config

then find this section

# What ports, IPs and protocols we listen for
Port 22

You can change Port 22 to any number between 1025 and 65536. In this example I will use port 22000. Please note down or remember the new port you defined as if you forget it, you’ll not be able to login to your server.

Port 22000

Once done, hit CTRL+O to save then CTRL+X to exit Nano editor.

Disable Root Login

Now that we have our new account, we can secure our server a little bit by modifying its SSH daemon configuration (the program that allows us to log in remotely) to disallow remote SSH access to the root account.

Begin by opening the configuration file with your text editor as root:

nano /etc/ssh/sshd_config

Next, we need to find the line that looks like this:

/etc/ssh/sshd_config (before)
PermitRootLogin yes

Here, we have the option to disable root login through SSH. This is generally a more secure setting since we can now access our server through our normal user account and escalate privileges when necessary.

Modify this line to “no” like this to disable root login:

/etc/ssh/sshd_config (after)
PermitRootLogin no

Disabling remote root login is highly recommended on every server!

When you are finished making your changes, save and close the file using the method we went over earlier (CTRL-X, then Y, then ENTER).

Leave a Reply

Your email address will not be published. Required fields are marked *