{"id":17854778,"url":"https://github.com/mathiaskandelborg/automated-server-configuration","last_synced_at":"2025-04-02T17:24:59.061Z","repository":{"id":117350223,"uuid":"136468848","full_name":"MathiasKandelborg/automated-server-configuration","owner":"MathiasKandelborg","description":"By following this guide, you'll to get a secure Ubuntu 18.04 server running and ready for use. This can be done from any environment.","archived":false,"fork":false,"pushed_at":"2018-06-07T12:14:28.000Z","size":12,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-02-08T08:12:37.694Z","etag":null,"topics":["automation","cloud-init","hypervisor","security-automation","ssh","vagrant"],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/MathiasKandelborg.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-06-07T11:41:20.000Z","updated_at":"2024-08-23T15:09:33.000Z","dependencies_parsed_at":"2023-04-17T20:32:41.859Z","dependency_job_id":null,"html_url":"https://github.com/MathiasKandelborg/automated-server-configuration","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MathiasKandelborg%2Fautomated-server-configuration","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MathiasKandelborg%2Fautomated-server-configuration/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MathiasKandelborg%2Fautomated-server-configuration/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MathiasKandelborg%2Fautomated-server-configuration/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/MathiasKandelborg","download_url":"https://codeload.github.com/MathiasKandelborg/automated-server-configuration/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246858094,"owners_count":20845239,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["automation","cloud-init","hypervisor","security-automation","ssh","vagrant"],"created_at":"2024-10-28T01:22:23.222Z","updated_at":"2025-04-02T17:24:59.035Z","avatar_url":"https://github.com/MathiasKandelborg.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Automated Ubuntu server configuration\n\n## A Project by [Mathias](https://www.linkedin.com/in/mathias-kandelsdorff/)\n\nBy following this guide, you'll to get a secure Ubuntu 18.04 server running and ready for use. This can be done from any environment.\n\nHere's a list of some of the fancy technologies/software used in the project:\n\n- Git\n- Cloud-init\n- Vagrant\n- VirtualBox\n- SSH\n\n## Getting Started\n\nThis setup is made possible with a [virtual machine](https://en.wikipedia.org/wiki/Virtual_machine)(VM), to ensure that everybody can achieve the same results, without ever worrying about configuring their own environment.\n\n### Prerequisites\n\nMake sure [VirtualBox](https://www.virtualbox.org/) and [Vagrant](https://www.vagrantup.com/downloads.html) are installed. If they aren't installed yet, it's quite easy to get done by going to their websites and following the instructions for your OS.\n\nThe VM used in this project contains the instructions for setting up an Ubuntu 18.04 OS. This is done in order to ensure the possibility of generating secure SSH key-pairs with the `ssh-keygen` command.\n\n### Local environment\n\nOpen a terminal and make a new project folder, then download this repository:\n\n```bash\nmkdir server-setup \u0026\u0026 cd server-setup\ngit clone https://github.com/MathiasKandelborg/server-configuration.git .\n```\n\nNow it's time to setup the VM. This generally takes some time as the computer is downloading, installing _and running_ an entire Operating System, in your current OS. This only needs to be set up once though.\n\n```bash\nvagrant up\n```\n\nWhen the installation processes are done, access the VM with this command:\n\n```bash\nvagrant ssh\n```\n\n#### Create an ssh key-pair and copy the contents of the public key\n\nWe'll create the key-pair with some extra flags for more security. We're also telling the program to create a 4096bit key instead of the standard 2048bit\n\n```bash\nssh-keygen -f ~/generated-keys/server_id -t rsa -b 4096\n```\n\n\u003e press 'enter' twice for no password.\n\nYou can choose a password if you want to, it's not needed for this guide but is good for security. The password is needed every time the key is used.\n\n#### You are the sole possessor of your confidential files. Make sure to handle them that way\n\nNeedless to repeat, this is a secure server setup and you _need_ to figure out how **you** are going to handle your files - in a secure manner.\n\nI cannot give any definitive suggestions to secure file \u0026 password handling, because there's so many situations to take into account - it's best if you take some time to learn about file \u0026 group permissions on computers + proper data-handling practices.\n\nYou might have noticed that two files popped up inside the `generated-keys` folder, the one with the .pub extension is for registering your key-pair. The other is *highly confidential*, if it gets compromised(shared with the real world) you have no defence against someone who has that key. This lack of defence means that your database(s), login credentials, command history and everything else on your server is free to access for _anyone_.\n\n### Server setup with cloud-init\n\nThe cloud-init file is where everything that should get installed and be executed on first boot - is defined.\n\nThis setup is quite bare-bones but this is a guide to a secure server setup, not a complete one. ;)\n\nHere's an overlook of the instructions defined in the file:\n\n- Set the main user to 'admin'\n\n- Disable running admin commands without sudo\n- Disable root login functionality\n- Define authorized SSH keys for user 'admin'\n- Change the default SSH port to defer generic hacking attempts\n- Disable password login on server\n- Enable login for new user' admin' only\n- Setup a firewall using the UFW\n  - Opt-in on ingoing connections instead of opt-out\n  - Disable default SSH connection\n  - Enable default web hosting ports\n- Set timezone to UTC\n\n#### Configuring cloud-init / server setup\n\nAt this point we want to edit the cloud-init file to suit our environment.\n\nThe only thing we need to do right now, is input the newly generated SSH key:\n\n- Copy the contents of server_id.pub\n- Open up the `cloud-init` file in your text-editor/IDE\n\u003e cloud-init is a [yaml](https://en.wikipedia.org/wiki/YAML) file and indentation is really important\n- Input *all* the contents of server_id.pub on line 8, from column 9\n\n\u003e If you choose to change the name of the user, remember to change it on line 12 as well. This is where we tell the server which users are allowed to connect to the server via SSH.\n\n___\n\n### Server environment\n\nIf you don't have an account at [Digital Ocean](https://www.digitalocean.com/) already, go make one right now [(here's my referral link, if, you know..)](https://m.do.co/c/acc19c3cd28f).\n\n- Log into your account\n\n- Press the green button with the words 'create' in the top-right corner\n- Choose the 'Droplets' option\n- At the start in the images dropdown-menu choose `Ubuntu 18.04 x64`\n- Choose your preferred server size (the smallest is fine)\n- Skip the sections about enabling backups and adding volumes\n- Chose a data-center region closest to your location\n- Select the following additional options:\n  - IPv6\n  - Monitoring\n  - User data\n\nAfter having chosen 'user data', a big text-box show up. Let's put something in that box!\n\nThis box is actually where most of the 'magic' happens.\nIn here, we'll input our cloud-init file, which sets up the server, with a pre-defined firewall and **one** user, that has access _only_ with our new SSH key.\n\nLet's continue:\n\n- Copy the contents of your customized cloud-init file\n- Paste the file contents into the 'user data' text-box\n\n\u003e You can happily skip the SSH key section, as that functionality is what we've just done. We're just storing the key in our own, local environment. That is, not on a server somewhere we don't have control over it.\n\nIn the last section, you can define how many droplets you want and an optional hostname.\n\nNow for the last and hardest part of setting up a server, I'm not sure any of us are ready for this:\n\n- Click create!\n\nIt'll take a minute or two before the droplet is accessible with the custom configuration. In the meantime, let's go back to the terminal and access our VM.\n\n___\n\n### Accessing the remote server\n\nIn order to access the remote server, the fast way is to go to our project folder.\n\n- Access the terminal with the VM running or run `vagrant up \u0026\u0026 vagrant ssh`\n\n- Connect to the server\n\n#### Alternatively, you can use any SSH program of your choice, as long as you can define the locations of your keys.\n\n```bash\nssh -p 2222 admin@ip.to.customized.server -i ~/generated-keys.pub\n```\n\n**If you choose to use other software than provided, remember to change the connection port to 2222 instead of 22.** You can change the port on line 10. Change the `2222` part to the port of your choice. Remember to change the corresponding port on line 16.\n\nFor [some clarification on why or why not, read this](https://www.quora.com/Is-changing-the-SSHD-default-port-a-good-practice).\n\n#### E.g. changing SSH port by editing Line 10 \u0026 16\n\n```bash\nsed -i -e '/^#Port 22/s/^.*$/Port 9001/' /etc/ssh/sshd_config\n\n ...\n ...\n\nufw allow 9001/tcp\n```\n\nThis would result in having to use port 9001, when connecting to this host.\n\n## Built With\n\n- [VSCode](https://code.visualstudio.com/) - The IDE \u0026 Text editor\n- [VirtualBox](https://www.virtualbox.org/) - [VMM](https://en.wikipedia.org/wiki/Hypervisor)\n- [Vagrant](https://www.vagrantup.com/) - [Fantastic tool for building and managing automated environments](https://www.vagrantup.com/intro/index.html)\n- [Cloud-init](cloudinit.readthedocs.io) - The defacto multi-distribution package that handles early initialization of a cloud instance\n\n## License\n\nThis project is licensed under the MIT License - see the [LICENSE.md](LICENSE.md) file for details\n\n## Author\n\n- **Mathias Wøbbe** - *Initial work* - [MathiasKandelborg](https://github.com/MathiasKandelborg)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmathiaskandelborg%2Fautomated-server-configuration","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmathiaskandelborg%2Fautomated-server-configuration","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmathiaskandelborg%2Fautomated-server-configuration/lists"}