diff --git a/README.md b/README.md index 37c8f08..306291c 100644 --- a/README.md +++ b/README.md @@ -21,15 +21,36 @@ linux-sysadmin-journey/ ## 🚀 Current Focus -- Setting up home lab environment - - Installing VirtualBox/VMware - - Creating Ubuntu Server 22.04 LTS VM - - Configuring network settings -- Learning basic Linux commands and system navigation - - File system navigation - - Text manipulation - - Process management -- Documenting first project setup +- [x] Setting up home lab environment + - [x] Installing VirtualBox/VMware + - [x] Creating Ubuntu Server 22.04 LTS VM + - [x] Configuring network settings +- [x] Learning basic Linux commands and system navigation + - [x] File system navigation + - [x] Text manipulation + - [x] Process management +- [x] Implementing basic security measures + - [x] User management + - [x] SSH configuration + - [x] Firewall setup + +### Next Focus Areas +- [ ] System Monitoring and Maintenance + - [ ] Setting up monitoring tools + - [ ] Log management + - [ ] Backup strategies + - [ ] Maintenance scheduling + +### Upcoming +- [ ] Service Deployment + - [ ] Web server setup + - [ ] Database configuration +- [ ] Automation and Scripting + - [ ] Shell scripting + - [ ] Scheduled tasks +- [ ] Advanced Networking + - [ ] DNS configuration + - [ ] Network services ## 📊 Progress Tracker ### Completed @@ -38,19 +59,16 @@ linux-sysadmin-journey/ - [x] Created project documentation structure ### In Progress -- [ ] Home lab setup - - [ ] Hypervisor installation - - [ ] First VM creation - - [ ] Network configuration +- [x] Home lab setup + - [x] Hypervisor installation + - [x] First VM creation + - [x] Network configuration + - [ ] Basic command line proficiency - [ ] File system navigation - [ ] User management - [ ] Package management -### Upcoming -- [ ] User and permission management -- [ ] System monitoring - ## 🛠️ Projects 1. **Home Lab Setup** (In Progress) - Hypervisor: VirtualBox/VMware setup diff --git a/project-documentation-template.md b/project-documentation-template.md new file mode 100644 index 0000000..dba3187 --- /dev/null +++ b/project-documentation-template.md @@ -0,0 +1,77 @@ +# Project Documentation Template + +## Project Structure +``` +project-name/ +├── README.md # Main project documentation +├── docs/ # Detailed documentation +│ ├── setup.md # Setup and installation steps +│ ├── configuration.md # Configuration details +│ └── lessons-learned.md # Learning outcomes and challenges +├── scripts/ # Any automation scripts +└── resources/ # Additional resources and references +``` + +## Documentation Guidelines + +### 1. Main README.md Structure +- Project Overview +- Environment Details +- Setup Steps (with status indicators ✅) +- Current Status +- Next Steps +- Configuration Details +- Additional Documentation Links + +### 2. Required Documentation Files +- Setup documentation (detailed steps) +- Configuration details (with examples) +- Lessons learned & challenges +- Quick reference guides + +### 3. Best Practices +- Use markdown formatting +- Include command examples +- Document both successes and failures +- Add status indicators (✅, ⚠️, ❌) +- Link related documents +- Include timestamps for major changes + +### 4. Portfolio Considerations +- Clear project objectives +- Technical skills demonstrated +- Problems solved +- Best practices implemented +- Security considerations +- Documentation quality + +## Prompt for Future Projects + +When starting a new project, ask the assistant: + +"I'm starting a new project [project-name]. Please help me: + +1. Create the initial project structure +2. Set up documentation templates following the portfolio standard +3. Track progress with: + - Setup steps and verification + - Configuration details + - Lessons learned + - Best practices + - Security considerations + - Quick reference guides + +Please maintain: +- Clear documentation +- Professional formatting +- Learning-focused approach +- Portfolio-ready structure +- Security best practices +- Practical examples and commands +- Troubleshooting guides + +Current project status: +[Describe where you are in the project] + +Next steps needed: +[Describe what you need help with]" \ No newline at end of file diff --git a/projects/01-homelab-setup/README.md b/projects/01-homelab-setup/README.md index 732c692..4f76827 100644 --- a/projects/01-homelab-setup/README.md +++ b/projects/01-homelab-setup/README.md @@ -28,68 +28,136 @@ This project documents the setup of a basic home lab environment using VirtualBo - [x] Basic system configuration - [x] Network setup -### 3. Network Configuration (In Progress) -- [ ] Configure NAT adapter for internet access - 1. Verify IP address configuration: +### 3. Network Configuration ✅ +- [x] Configure NAT adapter for internet access + 1. Verify IP address configuration ✅ + 2. Test internet connectivity ✅ ```bash - ip addr show - ``` - 2. Test internet connectivity: - ```bash - ping 8.8.8.8 - ping google.com + ping 8.8.8.8 # Success + ping google.com # Success ``` -- [ ] Configure Host-only adapter for direct host communication - 1. Verify second network interface: +- [x] Configure Host-only adapter for direct host communication + 1. Verify second network interface ✅ ```bash - ip addr show + ip addr show enp0s8 + # Output shows: + # inet 169.254.0.2/16 brd 169.254.255.255 scope global enp0s8 ``` - 2. Test host connectivity: + 2. Test host connectivity ✅ ```bash - # From Ubuntu VM - ping your Windows host IP - ping - - # From Windows host - ping your Ubuntu VM IP - ping + # Successfully pinged host (169.254.167.242) + # Round-trip time (RTT) avg: 2.846ms ``` -- [ ] Document network configuration: - - NAT adapter IP: _____________ - - Host-only adapter IP: _____________ - - Default gateway: _____________ - - DNS servers: _____________ +- [x] Document network configuration: + - NAT adapter IP (enp0s3): 10.0.2.15/24 + - Host-only adapter IP (enp0s8): 169.254.0.2/16 + - Default gateway: 10.0.2.2 + - Host IP: 169.254.167.242 -### 4. Basic Security Setup (Pending) -- [ ] Create non-root user with sudo privileges -- [ ] Configure SSH access -- [ ] Set up UFW firewall -- [ ] Implement basic security hardening +### Current Status +- ✅ NAT adapter: Working (Internet access) +- ✅ Host-only adapter: Working (Host communication) +- ✅ Network connectivity: Verified + +### Next Steps +Now that networking is configured, we can proceed to: +1. Basic Security Setup + - [ ] Create non-root user with sudo privileges + - [ ] Configure SSH access + - [ ] Set up UFW firewall + +### 4. Basic Security Setup ✅ +- [x] User Management ✅ + - Created sysadmin user with sudo privileges + - Enhanced hugh user security + +- [x] SSH Configuration ✅ + - Installed and configured OpenSSH server + - Implemented key-based authentication + - Disabled password authentication + - Applied security hardening settings + +- [x] UFW Firewall Setup ✅ + - Installed and configured UFW + - Set default policies (deny incoming, allow outgoing) + - Allowed required services: + - SSH (port 22) + - HTTP (port 80) + - HTTPS (port 443) + - Host machine access (169.254.167.242) + - Verified connectivity + +### 5. System Monitoring Setup (Next Phase) +- [ ] Monitoring Tools + - [ ] Install and configure htop + - [ ] Set up netdata for system metrics + - [ ] Configure log monitoring + +- [ ] Maintenance Planning + - [ ] Create backup strategy + - [ ] Set up automated updates + - [ ] Implement log rotation + - [ ] Configure system alerts + +### Current Status +- ✅ Basic VM Setup: Complete +- ✅ Network Configuration: Complete +- ✅ Security Measures: Complete +- ⏳ System Monitoring: Not Started + +### Next Steps +1. System Monitoring Implementation + - Research and select monitoring tools + - Plan monitoring strategy + - Document monitoring requirements + +2. Maintenance Procedures + - Design backup strategy + - Create maintenance schedule + - Document procedures + +3. Future Enhancements + - Service deployment + - Automation implementation + - Advanced networking features + +## Security Configuration Status +- [x] User Management + - [x] Admin user created + - [x] Sudo privileges configured +- [x] SSH Access + - [x] SSH server installed + - [x] Key-based authentication configured + - [x] Root login disabled +- [x] Firewall + - [x] UFW installed + - [x] Basic rules configured + - [x] SSH access allowed ## Commands and Configurations ### Network Configuration Commands -```bash -# View network interfaces -ip addr show - -# View routing table -ip route show - -# View DNS configuration -cat /etc/resolv.conf - -# Test connectivity -ping -c 4 8.8.8.8 # Test internet connectivity -ping -c 4 google.com # Test DNS resolution - -# If needed, restart networking -sudo systemctl restart systemd-networkd ``` -## Issues and Solutions -Any issues encountered and their solutions will be documented here. +### SSH Configuration +```conf +# Key SSH configuration settings (/etc/ssh/sshd_config) +PermitRootLogin no +PasswordAuthentication no +AllowUsers admin +``` -## Resources -- [Ubuntu Server Download Page](https://ubuntu.com/download/server) -- [VirtualBox Documentation](https://www.virtualbox.org/wiki/Documentation) \ No newline at end of file +### UFW Rules +```bash +# View UFW status +sudo ufw status verbose + +# Basic allowed services +sudo ufw status numbered +``` + +## Additional Documentation +- [Security Setup Details](security-setup.md) +- [Lessons Learned & Challenges](lessons-learned.md) \ No newline at end of file diff --git a/projects/01-homelab-setup/lessons-learned.md b/projects/01-homelab-setup/lessons-learned.md new file mode 100644 index 0000000..20d93a0 --- /dev/null +++ b/projects/01-homelab-setup/lessons-learned.md @@ -0,0 +1,97 @@ +# Lessons Learned & Challenges + +## Network Configuration + +### Lessons Learned +1. **Network Adapters** + - NAT adapter is essential for internet access + - Host-only adapter enables direct communication with host machine + - Each adapter serves a specific purpose in the VM setup + +2. **IP Addressing** + - NAT adapter typically gets 10.0.2.15/24 in VirtualBox + - Host-only adapter uses 169.254.x.x range (link-local addressing) + - Understanding different IP ranges helps with troubleshooting + +### Challenges Faced +1. **Host-only Network Issues** + - Initial "state DOWN" on enp0s8 interface + - Required proper netplan configuration to resolve + - Solution: Explicitly configure network interfaces in netplan + +## Security Setup + +### Lessons Learned +1. **User Management** + - Creating admin user first ensures backup access + - Group membership (especially sudo) is crucial for administration + - Verify permissions immediately after changes + +2. **SSH Configuration** + - Always backup sshd_config before modifications + - Test SSH access before disabling password authentication + - Key order of operations: + 1. Set up SSH keys + 2. Test key-based login + 3. Only then disable password authentication + +3. **Firewall Configuration** + - Always allow SSH before enabling UFW + - Default deny incoming, allow outgoing is a secure baseline + - Document all allowed ports/services for future reference + +### Challenges Faced +1. **SSH Key Setup** + - Proper file permissions are critical (700 for .ssh, 600 for authorized_keys) + - Windows line endings can cause issues with key files + - Solution: Use proper chmod commands and verify permissions + +2. **UFW Configuration** + - Risk of losing SSH access when enabling firewall + - Solution: Always add SSH rule before enabling UFW + - Remember to allow both IPv4 and IPv6 traffic if needed + +## Best Practices Discovered +1. **Documentation** + - Document commands as you execute them + - Keep track of configuration changes + - Note IP addresses and network settings + +2. **Testing** + - Test each change immediately + - Have a backup plan (like VirtualBox GUI access) + - Verify services after system changes + +3. **Security** + - Follow principle of least privilege + - Use key-based authentication over passwords + - Keep system updated and maintain secure configurations + +## Quick Reference Commands +```bash +# Network Verification +ip addr show # Check network interfaces +ping -c 4 8.8.8.8 # Test internet connectivity +ss -tulpn # List listening ports + +# SSH Security +ssh-keygen -t rsa -b 4096 # Generate SSH key +ssh-copy-id user@host # Copy SSH key to server +chmod 700 ~/.ssh # Set correct permissions + +# UFW Management +sudo ufw status numbered # List rules with numbers +sudo ufw delete NUMBER # Remove specific rule +sudo ufw reload # Apply changes without disable/enable +``` + +## Future Considerations +1. **Monitoring** + - Consider setting up basic system monitoring + - Implement log monitoring + - Regular security audits + +2. **Maintenance** + - Regular backup strategy + - Update management plan + - Documentation maintenance \ No newline at end of file diff --git a/projects/01-homelab-setup/security-setup.md b/projects/01-homelab-setup/security-setup.md new file mode 100644 index 0000000..e858db7 --- /dev/null +++ b/projects/01-homelab-setup/security-setup.md @@ -0,0 +1,107 @@ +# Security Setup Documentation + +## User Management + +### New Admin User Creation +```bash +# Create new admin user 'sysadmin' +sudo adduser sysadmin + +# Add to sudo group +sudo usermod -aG sudo sysadmin + +# Verify sudo access +sudo -l -U sysadmin +``` + +### Existing User (hugh) Security Enhancement +```bash +# Verify current groups +groups hugh + +# Ensure proper sudo access +sudo usermod -aG sudo hugh +``` + +## SSH Key Configuration + +### Existing Windows SSH Key +1. Display public key content on Windows: + ```powershell + # In PowerShell/Command Prompt + type C:\Users\YourUsername\.ssh\id_rsa.pub + ``` + +2. Add public key to authorized_keys: + ```bash + # On Ubuntu Server + mkdir -p ~/.ssh + chmod 700 ~/.ssh + nano ~/.ssh/authorized_keys + # Paste your public key here + chmod 600 ~/.ssh/authorized_keys + ``` + +## SSH Server Hardening +```bash +# Backup original config +sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak + +# Edit SSH config +sudo nano /etc/ssh/sshd_config +``` + +Required SSH configurations: +```conf +# Security settings +PermitRootLogin no +PasswordAuthentication no +PubkeyAuthentication yes +AllowUsers hugh sysadmin + +# Additional hardening +Protocol 2 +X11Forwarding no +MaxAuthTries 3 +``` + +## Applied Security Measures +- [x] Created sysadmin user +- [x] Enhanced hugh user security +- [x] Configured SSH key authentication +- [x] Applied SSH hardening settings +- [x] Tested SSH access +- [x] Configured UFW firewall + +## Firewall Setup (UFW) ✅ + +### Current UFW Configuration +```bash +Status: active + +# Allowed incoming connections: +1. SSH (22/tcp) +2. HTTP (80/tcp) +3. HTTPS (443/tcp) +4. All traffic from host (169.254.167.242) + +# Default policies: +- Incoming: deny (default) +- Outgoing: allow (default) +``` + +### Applied Rules +```bash +sudo ufw default deny incoming +sudo ufw default allow outgoing +sudo ufw allow ssh +sudo ufw allow http +sudo ufw allow https +sudo ufw allow from 169.254.167.242 +``` + +### Verification +```bash +# Current firewall status +sudo ufw status numbered +``` \ No newline at end of file diff --git a/prompt-for-chat.md b/prompt-for-chat.md new file mode 100644 index 0000000..c619d07 --- /dev/null +++ b/prompt-for-chat.md @@ -0,0 +1,17 @@ +Please help me maintain consistent documentation standards as established in my Linux home lab project. Key files to reference: +project-documentation-template.md - Base template for all projects +projects/01-homelab-setup/ - Example of implemented standards: +README.md - Main project documentation +security-setup.md - Component-specific details +lessons-learned.md - Learning outcomes and challenges +Documentation requirements: +Use markdown formatting +Include status indicators (✅, ⚠️, ❌) +Document commands with examples +Track both successes and challenges +Maintain separate files for: +Main project documentation +Detailed setup/configuration +Lessons learned +Quick reference guides +Please help ensure any new documentation follows these established patterns for portfolio consistency. \ No newline at end of file