Category: OS

This is my personal note list for preparing a root server. The list is not complete and may contain errors.

Network setup

• Install OS as usual or use image from Control Panel

Network setup

• Set/check fixed ip
• Set the "Reverse DNS" entry in Control Panel
• Add local user

  
  usermod -aG sudo <username>```

• Set hostname
  sudo hostnamectl set-hostname <hostname>
• Edit the /etc/hosts file
• Edit the /etc/cloud/cloud.cfg file if exists (preserve_hostname: false to true)
• Edit the /etc/netplan/50-cloud-init.yaml to add/set fixed IPv4/IPv6 adresses

SSH

• Add pubkey to ~/.ssh/authorized_keys
• Disable SSH login with password and permit root login in /etc/ssh/sshd_config file

  PasswordAuthentication no
  PubkeyAuthentication yes
  PermitRootLogin no

• Restart SSH Daemon
  service sshd restart

VIM

• VIM Color open ~/.vimrc and add

  colorsheme desert
  syntax on

Enable unattended upgrades

sudo apt-get install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades

Docker

• Install docker-ce here
• Install docker-compose
  sudo apt-get install docker-compose-plugin
• Install docker-compose here
• Install docker-compose command completion here
• add username to docker group (source)
  sudo usermod -aG docker $USER

Logrotate for Docker

• Create Logrotate config file for Docker containers under /etc/logrotate.d/docker-container with the following content:

  /var/lib/docker/containers/*/*.log {
  rotate 8
  weekly
  compress
  missingok
  delaycompress
  copytruncate
  }

• Test it with: logrotate -fv /etc/logrotate.d/docker-container

Docker Compose aliases

• Create or append to ~/.bash_aliases:

  alias dc='docker compose'
  alias dcl='docker compose logs -f --tail=200'
  alias dce='docker compose exec'
  alias dcb='docker compose up --build -d'
  alias dcu='docker compose up -d'
  alias dcul='docker compose up -d && docker-compose logs -f --tail=50'
  alias dcd='docker compose down --remove-orphans'
  alias dcdu='docker compose down --remove-orphans && docker compose up -d'
  alias dcdul='docker compose down --remove-orphans && docker compose up -d && docker compose logs -f --tail=50' 
  alias dcdb='docker compose down --remove-orphans && docker compose up --build -d'
  alias dcdbl='docker compose down --remove-orphans && docker compose up --build -d && docker compose logs -f --tail=50'

Docker after dist upgrade

• Update key
  curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
• Re-enable repo

  
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null```

• update the package database with the Docker packages from the newly added repo:
  sudo apt-get update
• Make sure you are install from the Docker repo instead of the default Ubuntu repo:
  apt-cache policy docker-ce
• upgrade packes
  sudo apt-get install docker-ce docker-ce-cli containerd.io
• reboot

fail2ban

• Install fail2ban with sudo apt-get install fail2ban
• Create config file /etc/fail2ban/jail.local and add a jail for the SSH Deamon

  
  [sshd]
  enabled = true
  port = <ssh port>
  filter = sshd
  logpath = /var/log/auth.log
  maxretry = 3

[traefik]
enabled = true
filter = traefik
logpath = /var/lib/docker/containers//-json.log
banaction = docker-action
maxretry = 3
findtime = 900
bantime = 86400

[wplogin]
enabled = true
filter = wplogin
logpath = /var/lib/docker/containers//-json.log
banaction = docker-action
maxretry = 3
findtime = 900
bantime = 86400

[unifi]
enabled = true
filter = unifi
logpath = /var/lib/docker/containers//-json.log
banaction = docker-action
maxretry = 3
bantime = 86400
findtime = 900

* Creat filter for traefik /etc/fail2ban/filter.d/traefik.conf

[Definition]
failregex = ^{"log":"<HOST> - \S+ [.*] \"(GET|POST|HEAD) .+\" 401 .+$
ignoreregex =

* Create filter for wplogin /etc/fail2ban/filter.d/wplogin.conf

[Definition]
failregex = ^{"log":"<HOST> -.POST.wp-login.php.*
ignoreregex =

* Create filter for unifi /etc/fail2ban/filter.d/unifi.conf

[Definition]
failregex = ^{"log":"<HOST> - \S+ [.*] \"POST \/api\/login.+\" 400 .+$

* Create action /etc/fail2ban/action.d/docker-action.conf
Unlike the out-of-the-box action, "actionban" and "actionunban" do not affect the INPUT chain, but the docker FORWARD chain "DOCKER".

[Definition]
actionstart = iptables -N f2b-docker
iptables -A f2b-docker -j RETURN
iptables -I FORWARD -p tcp -j f2b-docker

actionstop = iptables -D FORWARD -p tcp -j f2b-docker
iptables -F f2b-docker
iptables -X f2b-docker

actioncheck = iptables -n -L FORWARD | grep -q 'f2b-docker[ \t]'

actionban = iptables -I f2b-docker -s <ip> -j DROP

actionunban = iptables -D f2b-docker -s <ip> -j DROP

[via]https://www.the-lazy-dev.com/en/install-fail2ban-with-docker/[/via]

Here is a list of useful unix commands or code parts. Who does not know it? You have a problem and looking for a solution where you find at stack overflow or similar pages? Here I collect all the commands that I have encountered over time or whose switch I simply can not remember (or want).

• How do I find all files containing specific text?

  grep -rnw '/path/to/somewhere/' -e 'pattern'

• How i change the default file permissions (mask that controls file permissions)

  umask

• Untar (unzip) file/folder

  tar -zxvf archive.tar.gz

• Tar (zip) file/folders

  tar -cvzf archive.tar.gz file1 file2

• Copy files via rsync from one host to another

  rsync -avz [USER@]HOST:SOURCE [USER@]HOST:DEST
  rsync -avz [USER@]HOST:SOURCE rsync://[USER@]HOST[:PORT]/DEST
  rsync -avz -e "ssh -p 12345" LOCAL/SOURCE [USER@]HOST:DEST

• Using rsync with sudo on the destination machine
  1. Find out the path to rsync: which rsync
  2. Edit the /etc/sudoers file: sudo visudo
  3. Add the line <username> ALL=NOPASSWD:<path to rsync>, where username is the login name of the user that rsync will use to log on. That user must be able to use sudo

Then, on the source machine, specify that sudo rsync shall be used:

rsync -avz --rsync-path="sudo rsync" SOURCE [USER@]HOST:DEST

• Preserve SSH_AUTH_SOCK (Environment Variables) When Using sudo

  sudo --preserve-env=SSH_AUTH_SOCK -s

• nslookup missing? Install dig

  sudo apt-get install dnsutils

• find without "Permission denied"

  find / -name 'filename.ext' 2>&1 | grep -v "Permission denied"

• flush dns cache

  sudo systemd-resolve --flush-caches

• show open ports

  netstat -tulpn

• Directory size

  du -sh /var
  du -shc /var/*
  du -h --max-depth=1 /var
  du -sh /var/lib/docker/containers/*/*.log

• Search multiple PDF files for a "needle"

  pdfgrep -i needle haystack*.pdf

• Show hidden files with ls

  ls -lar

• Redirect STDOUT and STDERR to a file

  nice-command > out.txt 2>&1

• Installs your SSH public key to a remote host

  sh-copy-id 'user@remotehost'

• A command-line system information tool

  neofetch

• Show disk usage, folder size, items per folder, find big directorys, ... with ncdu

  ncdu

• Fancy resource monitor

  btop

• Display disk activity

  iotop

• Display network activity

  iftop or iptraf

• Cleanup Docker

  docker system prune --help

• Find and repair disk errors on ext (ext2, ext3 and ext4) filesystems

  sudo e2fsck -f </dev/sda2> 

• Forward TCP/UDP ports with socat

  socat TCP-LISTEN:8080,fork,reuseaddr TCP:homeserver.local:8080

• Traceroute and ping in one, visual console tool

  mtr <host>