107 lines
1.9 KiB
Markdown
107 lines
1.9 KiB
Markdown
|
# Security Setup Documentation
|
||
|
|
|
||
|
|
## User Management
|
||
|
|
|
||
|
|
### New Admin User Creation
|
||
|
|
```bash
|
||
|
|
# Create new admin user 'sysadmin'
|
||
|
|
sudo adduser sysadmin
|
||
|
|
|
||
|
|
# Add to sudo group
|
||
|
|
sudo usermod -aG sudo sysadmin
|
||
|
|
|
||
|
|
# Verify sudo access
|
||
|
|
sudo -l -U sysadmin
|
||
|
|
```
|
||
|
|
|
||
|
|
### Existing User (hugh) Security Enhancement
|
||
|
|
```bash
|
||
|
|
# Verify current groups
|
||
|
|
groups hugh
|
||
|
|
|
||
|
|
# Ensure proper sudo access
|
||
|
|
sudo usermod -aG sudo hugh
|
||
|
|
```
|
||
|
|
|
||
|
|
## SSH Key Configuration
|
||
|
|
|
||
|
|
### Existing Windows SSH Key
|
||
|
|
1. Display public key content on Windows:
|
||
|
|
```powershell
|
||
|
|
# In PowerShell/Command Prompt
|
||
|
|
type C:\Users\YourUsername\.ssh\id_rsa.pub
|
||
|
|
```
|
||
|
|
|
||
|
|
2. Add public key to authorized_keys:
|
||
|
|
```bash
|
||
|
|
# On Ubuntu Server
|
||
|
|
mkdir -p ~/.ssh
|
||
|
|
chmod 700 ~/.ssh
|
||
|
|
nano ~/.ssh/authorized_keys
|
||
|
|
# Paste your public key here
|
||
|
|
chmod 600 ~/.ssh/authorized_keys
|
||
|
|
```
|
||
|
|
|
||
|
|
## SSH Server Hardening
|
||
|
|
```bash
|
||
|
|
# Backup original config
|
||
|
|
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
|
||
|
|
|
||
|
|
# Edit SSH config
|
||
|
|
sudo nano /etc/ssh/sshd_config
|
||
|
|
```
|
||
|
|
|
||
|
|
Required SSH configurations:
|
||
|
|
```conf
|
||
|
|
# Security settings
|
||
|
|
PermitRootLogin no
|
||
|
|
PasswordAuthentication no
|
||
|
|
PubkeyAuthentication yes
|
||
|
|
AllowUsers hugh sysadmin
|
||
|
|
|
||
|
|
# Additional hardening
|
||
|
|
Protocol 2
|
||
|
|
X11Forwarding no
|
||
|
|
MaxAuthTries 3
|
||
|
|
```
|
||
|
|
|
||
|
|
## Applied Security Measures
|
||
|
|
- [x] Created sysadmin user
|
||
|
|
- [x] Enhanced hugh user security
|
||
|
|
- [x] Configured SSH key authentication
|
||
|
|
- [x] Applied SSH hardening settings
|
||
|
|
- [x] Tested SSH access
|
||
|
|
- [x] Configured UFW firewall
|
||
|
|
|
||
|
|
## Firewall Setup (UFW) ✅
|
||
|
|
|
||
|
|
### Current UFW Configuration
|
||
|
|
```bash
|
||
|
|
Status: active
|
||
|
|
|
||
|
|
# Allowed incoming connections:
|
||
|
|
1. SSH (22/tcp)
|
||
|
|
2. HTTP (80/tcp)
|
||
|
|
3. HTTPS (443/tcp)
|
||
|
|
4. All traffic from host (169.254.167.242)
|
||
|
|
|
||
|
|
# Default policies:
|
||
|
|
- Incoming: deny (default)
|
||
|
|
- Outgoing: allow (default)
|
||
|
|
```
|
||
|
|
|
||
|
|
### Applied Rules
|
||
|
|
```bash
|
||
|
|
sudo ufw default deny incoming
|
||
|
|
sudo ufw default allow outgoing
|
||
|
|
sudo ufw allow ssh
|
||
|
|
sudo ufw allow http
|
||
|
|
sudo ufw allow https
|
||
|
|
sudo ufw allow from 169.254.167.242
|
||
|
|
```
|
||
|
|
|
||
|
|
### Verification
|
||
|
|
```bash
|
||
|
|
# Current firewall status
|
||
|
|
sudo ufw status numbered
|
||
|
|
```
|