updated project 1

2025-02-08 23:27:46 -06:00
parent 8cd21899e4
commit b5a57c1cf6
6 changed files with 450 additions and 66 deletions
@@ -0,0 +1,97 @@
+# Lessons Learned & Challenges
+
+## Network Configuration
+
+### Lessons Learned
+1. **Network Adapters**
+   - NAT adapter is essential for internet access
+   - Host-only adapter enables direct communication with host machine
+   - Each adapter serves a specific purpose in the VM setup
+
+2. **IP Addressing**
+   - NAT adapter typically gets 10.0.2.15/24 in VirtualBox
+   - Host-only adapter uses 169.254.x.x range (link-local addressing)
+   - Understanding different IP ranges helps with troubleshooting
+
+### Challenges Faced
+1. **Host-only Network Issues**
+   - Initial "state DOWN" on enp0s8 interface
+   - Required proper netplan configuration to resolve
+   - Solution: Explicitly configure network interfaces in netplan
+
+## Security Setup
+
+### Lessons Learned
+1. **User Management**
+   - Creating admin user first ensures backup access
+   - Group membership (especially sudo) is crucial for administration
+   - Verify permissions immediately after changes
+
+2. **SSH Configuration**
+   - Always backup sshd_config before modifications
+   - Test SSH access before disabling password authentication
+   - Key order of operations:
+     1. Set up SSH keys
+     2. Test key-based login
+     3. Only then disable password authentication
+
+3. **Firewall Configuration**
+   - Always allow SSH before enabling UFW
+   - Default deny incoming, allow outgoing is a secure baseline
+   - Document all allowed ports/services for future reference
+
+### Challenges Faced
+1. **SSH Key Setup**
+   - Proper file permissions are critical (700 for .ssh, 600 for authorized_keys)
+   - Windows line endings can cause issues with key files
+   - Solution: Use proper chmod commands and verify permissions
+
+2. **UFW Configuration**
+   - Risk of losing SSH access when enabling firewall
+   - Solution: Always add SSH rule before enabling UFW
+   - Remember to allow both IPv4 and IPv6 traffic if needed
+
+## Best Practices Discovered
+1. **Documentation**
+   - Document commands as you execute them
+   - Keep track of configuration changes
+   - Note IP addresses and network settings
+
+2. **Testing**
+   - Test each change immediately
+   - Have a backup plan (like VirtualBox GUI access)
+   - Verify services after system changes
+
+3. **Security**
+   - Follow principle of least privilege
+   - Use key-based authentication over passwords
+   - Keep system updated and maintain secure configurations
+
+## Quick Reference Commands
+```bash
+# Network Verification
+ip addr show                # Check network interfaces
+ping -c 4 8.8.8.8          # Test internet connectivity
+ss -tulpn                  # List listening ports
+
+# SSH Security
+ssh-keygen -t rsa -b 4096  # Generate SSH key
+ssh-copy-id user@host      # Copy SSH key to server
+chmod 700 ~/.ssh           # Set correct permissions
+
+# UFW Management
+sudo ufw status numbered   # List rules with numbers
+sudo ufw delete NUMBER     # Remove specific rule
+sudo ufw reload           # Apply changes without disable/enable
+```
+
+## Future Considerations
+1. **Monitoring**
+   - Consider setting up basic system monitoring
+   - Implement log monitoring
+   - Regular security audits
+
+2. **Maintenance**
+   - Regular backup strategy
+   - Update management plan
+   - Documentation maintenance