Digital Ocean - steps

Initial Server Setup with Ubuntu 16.04

https://www.digitalocean.com/community/tutorials/initial-server-setup-with-ubuntu-16-04

https://www.digitalocean.com/community/tutorials/additional-recommended-steps-for-new-ubuntu-14-04-servers

Purpose: To increase the security and usability of your server.

You need ip address of your server & password.

1. Create a New User to prevent using ROOT everyday

ROOT is too powerful to use everyday.

$ ssh root@your_server_ip // login as root

$ adduser UserName
$ usermod -aG sudo UserName // add user to sudo group

2. Add Public Key Authentication

set up public key authentication for your new user.

$ ssh-copy-id UserName@your_server_ip

3. Disable Password Authentication

New user can only use SSH keys to log in, not password.

sudo nano /etc/ssh/sshd_config

# in `sshd_config`
PasswordAuthentication no
# the following lines are needed, but they should already be a default.
PubkeyAuthentication yes
ChallengeResponseAuthentication no

4. Test

Test it before you logout!!!

Open new command line and try to login again.

$ ssh UserName@your_server_ip

5. Set Up a Basic Firewall

https://www.digitalocean.com/community/tutorials/how-to-setup-a-firewall-with-ufw-on-an-ubuntu-and-debian-cloud-server

Ubuntu 16.04 servers can use the UFW firewall to make sure only connections to certain services are allowed.

UFW: Uncomplicated Firewall, is a front-end to iptables.

Ｆirewall denies traffic to every port except for ports/services you have approved.

# see a list of allowed connections.
$ sudo ufw app list

# check status
$ sudo ufw status

# add service to ufw
$ sudo ufw allow OpenSSH
$ sudo ufw enable

# SSH - port 22
$ sudo ufw allow ssh
# conventional HTTP web server - port 80
$ sudo ufw allow 80/tcp
# web server with SSL/TLS enabled - port 443
$ sudo ufw allow 443/tcp
# SMTP email enabled - port 25
$ sudo ufw allow 25/tcp

# review your selections
$ sudo ufw show added

# If everything looks good, you can enable the firewall by:
$ sudo ufw disable
$ sudo ufw enable

https://www.digitalocean.com/community/tutorials/ufw-essentials-common-firewall-rules-and-commands

https://www.digitalocean.com/community/tutorials/how-to-setup-a-firewall-with-ufw-on-an-ubuntu-and-debian-cloud-server

When needing IP restriction: sudo ufw allow from 192.168.255.255.

6. Configure Timezones and Network Time Protocol

https://www.digitalocean.com/community/tutorials/how-to-set-up-time-synchronization-on-ubuntu-12-04

It may begin to cause issues if the virtual server has to work with external machines.

• Emails sent out from a misconfigured server may arrive 3 minutes in another.

• users granted access only at certain times of the day, may find themselves blocked because of a time mismatch.

Servers can be synced using the NTP protocol.

• ntp daemon: automatically, slowly shift the server clock to match.

• To run ntpdate which automatically matches the time. ntpdate is not an action that should be taken regularly, but one time only.

# Configure Timezones
$ sudo dpkg-reconfigure tzdata

# Configure NTP Synchronization
$ sudo apt-get update
$ sudo apt-get install ntp

7. create swap

see swap section.

8. Take a Snapshot of your Current Configuration

case by case scenario.

SWAP

https://www.digitalocean.com/community/tutorials/how-to-add-swap-on-ubuntu-14-04

To increase the responsiveness of your server and guarding against out of memory errors => to add some swap space.

Swap = an area on a HD that can temporarily store data when RAM is no longer sufficient for data.

Use Swap on spinning HDs, not SSD. (SSD will be degraded by Swap.)

Check information

# shows system memory usage
$ free -m

# available space
$ df -h

Suggested Swap sapce ~= 1 ~ 2 * RAM

Create a Swap File

# allocate 4G for SWAP
$ sudo fallocate -l 4G /swapfile

# check status
$ ls -lh /swapfile # => -rw-r--r--

# SWAP should only be used by system
$ sudo chmod 600 /swapfile
$ ls -lh /swapfile # => -rw-------

# set up the swap space
$ sudo mkswap /swapfile

# enable SWAP
$ sudo swapon /swapfile

# check
$ free -m

Make the Swap File Permanent

...