Small heaps of code

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Ubuntu Server Setup ======

This document should outline a few steps that are useful after a fresh install of an Ubuntu Server.

===== Basic Packages =====

If you are dealing with a minimal installation (meta-package ubuntu-minimal) you may want to beef it up a bit. Check what packages are typically bundled e.g. when installing Ubuntu Server or just select your server style:
<code>
tasksel # ncurses GUI
tasksel --list-tasks
tasksel --task-packages server
</code>

Some additional packages for easier CLI handling:
<code>
sudo apt-get install bash-completion ubuntu-release-upgrader-core software-properties-common
</code>
===== Oracle Java =====

If you need Oracle Java install it from this 3rd party repo (which is updated regularly):
<code bash>
sudo add-apt-repository ppa:webupd8team/java
sudo apt-get update
sudo apt-get install oracle-java8-installer
</code>

[[http://www.webupd8.org/2012/09/install-oracle-java-8-in-ubuntu-via-ppa.html|original source]], [[https://wiki.ubuntuusers.de/Java/Installation/Oracle_Java/Java_8|more info @ ubuntuusers.de]]


===== Lighttpd =====

Their documentation is a little messy, here are the relevant pages:
  * http://redmine.lighttpd.net/projects/lighttpd/wiki/TutorialConfiguration
  * http://redmine.lighttpd.net/projects/1/wiki/HowToSimpleSSL
  * http://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_SSL

===== OpenSSH =====

A good baseline is to only allow logins via public key authentication (disable password authentication), except for a fallback user with a very long and complex password. See these lines in ''/etc/ssh/sshd_config'':
<code>
PasswordAuthentication no

# <snip>
# Match-block at end of file for exceptions:

Match User fallbackuser
  PasswordAuthentication yes
</code>

Ubuntu tutorials:
[[https://help.ubuntu.com/community/SSH/OpenSSH/Keys]] \\
[[https://help.ubuntu.com/community/SSH/OpenSSH/Configuring]]

Further harden OpenSSH according to the [[https://stribika.github.io/2015/01/04/secure-secure-shell.html|secure secure shell guide]]


===== Enable Automatic Security Updates =====

Quickly enable unattended upgrades:
<code bash>
sudo dpkg-reconfigure -plow unattended-upgrades
</code>

Unattended upgrades are configured in ''/etc/apt/apt.conf.d/50unattended-upgrades''

For machines with limited disk space you should also enable automatic removing of unused kernels by setting ''Unattended-Upgrade::Remove-Unused-Dependencies'' to ''true'' (works in Ubuntu 16.04).

FIXME Unattended-Upgrade::Remove-Unused-Dependencies seems to be broken in Ubuntu 14.04! This entry in ''/etc/crontab'' should do the trick by daily executing autoremove:

<code>
0  0    * * *   root    apt-get autoremove -y >> /var/log/autoremovecronjob.log 2>&1
</code>


[[https://help.ubuntu.com/community/AutomaticSecurityUpdates]]\\
[[https://help.ubuntu.com/16.04/serverguide/automatic-updates.html]]

===== Decrease Swappiness =====

Add a line to ''/etc/sysctl.conf'' and override the default swappiness of 60 with a much lower value, e.g. 
<code>
vm.swappiness=10
</code>

[[http://wiki.ubuntuusers.de/Swap]]

===== Root Kit & Intrusion Detection =====

Have a look at at e.g. [[http://wiki.ubuntuusers.de/chkrootkit|chkrootkit]] and tiger [[http://www.nongnu.org/tiger/|tiger]]

===== More Resources =====

[[http://plusbryan.com/my-first-5-minutes-on-a-server-or-essential-security-for-linux-servers]]\\
[[https://www.thefanclub.co.za/how-to/how-secure-ubuntu-1204-lts-server-part-1-basics]]
Small heaps of code

User Tools

Site Tools

Page Tools
