97 lines
3.1 KiB
Markdown
97 lines
3.1 KiB
Markdown
|
# Lessons Learned & Challenges
|
||
|
|
|
||
|
|
## Network Configuration
|
||
|
|
|
||
|
|
### Lessons Learned
|
||
|
|
1. **Network Adapters**
|
||
|
|
- NAT adapter is essential for internet access
|
||
|
|
- Host-only adapter enables direct communication with host machine
|
||
|
|
- Each adapter serves a specific purpose in the VM setup
|
||
|
|
|
||
|
|
2. **IP Addressing**
|
||
|
|
- NAT adapter typically gets 10.0.2.15/24 in VirtualBox
|
||
|
|
- Host-only adapter uses 169.254.x.x range (link-local addressing)
|
||
|
|
- Understanding different IP ranges helps with troubleshooting
|
||
|
|
|
||
|
|
### Challenges Faced
|
||
|
|
1. **Host-only Network Issues**
|
||
|
|
- Initial "state DOWN" on enp0s8 interface
|
||
|
|
- Required proper netplan configuration to resolve
|
||
|
|
- Solution: Explicitly configure network interfaces in netplan
|
||
|
|
|
||
|
|
## Security Setup
|
||
|
|
|
||
|
|
### Lessons Learned
|
||
|
|
1. **User Management**
|
||
|
|
- Creating admin user first ensures backup access
|
||
|
|
- Group membership (especially sudo) is crucial for administration
|
||
|
|
- Verify permissions immediately after changes
|
||
|
|
|
||
|
|
2. **SSH Configuration**
|
||
|
|
- Always backup sshd_config before modifications
|
||
|
|
- Test SSH access before disabling password authentication
|
||
|
|
- Key order of operations:
|
||
|
|
1. Set up SSH keys
|
||
|
|
2. Test key-based login
|
||
|
|
3. Only then disable password authentication
|
||
|
|
|
||
|
|
3. **Firewall Configuration**
|
||
|
|
- Always allow SSH before enabling UFW
|
||
|
|
- Default deny incoming, allow outgoing is a secure baseline
|
||
|
|
- Document all allowed ports/services for future reference
|
||
|
|
|
||
|
|
### Challenges Faced
|
||
|
|
1. **SSH Key Setup**
|
||
|
|
- Proper file permissions are critical (700 for .ssh, 600 for authorized_keys)
|
||
|
|
- Windows line endings can cause issues with key files
|
||
|
|
- Solution: Use proper chmod commands and verify permissions
|
||
|
|
|
||
|
|
2. **UFW Configuration**
|
||
|
|
- Risk of losing SSH access when enabling firewall
|
||
|
|
- Solution: Always add SSH rule before enabling UFW
|
||
|
|
- Remember to allow both IPv4 and IPv6 traffic if needed
|
||
|
|
|
||
|
|
## Best Practices Discovered
|
||
|
|
1. **Documentation**
|
||
|
|
- Document commands as you execute them
|
||
|
|
- Keep track of configuration changes
|
||
|
|
- Note IP addresses and network settings
|
||
|
|
|
||
|
|
2. **Testing**
|
||
|
|
- Test each change immediately
|
||
|
|
- Have a backup plan (like VirtualBox GUI access)
|
||
|
|
- Verify services after system changes
|
||
|
|
|
||
|
|
3. **Security**
|
||
|
|
- Follow principle of least privilege
|
||
|
|
- Use key-based authentication over passwords
|
||
|
|
- Keep system updated and maintain secure configurations
|
||
|
|
|
||
|
|
## Quick Reference Commands
|
||
|
|
```bash
|
||
|
|
# Network Verification
|
||
|
|
ip addr show # Check network interfaces
|
||
|
|
ping -c 4 8.8.8.8 # Test internet connectivity
|
||
|
|
ss -tulpn # List listening ports
|
||
|
|
|
||
|
|
# SSH Security
|
||
|
|
ssh-keygen -t rsa -b 4096 # Generate SSH key
|
||
|
|
ssh-copy-id user@host # Copy SSH key to server
|
||
|
|
chmod 700 ~/.ssh # Set correct permissions
|
||
|
|
|
||
|
|
# UFW Management
|
||
|
|
sudo ufw status numbered # List rules with numbers
|
||
|
|
sudo ufw delete NUMBER # Remove specific rule
|
||
|
|
sudo ufw reload # Apply changes without disable/enable
|
||
|
|
```
|
||
|
|
|
||
|
|
## Future Considerations
|
||
|
|
1. **Monitoring**
|
||
|
|
- Consider setting up basic system monitoring
|
||
|
|
- Implement log monitoring
|
||
|
|
- Regular security audits
|
||
|
|
|
||
|
|
2. **Maintenance**
|
||
|
|
- Regular backup strategy
|
||
|
|
- Update management plan
|
||
|
|
- Documentation maintenance
|