updated project 1
This commit is contained in:
Hugh Ratsch
@@ -21,15 +21,36 @@ linux-sysadmin-journey/
|
||||
|
||||
|
||||
## 🚀 Current Focus
|
||||
- Setting up home lab environment
|
||||
- Installing VirtualBox/VMware
|
||||
- Creating Ubuntu Server 22.04 LTS VM
|
||||
- Configuring network settings
|
||||
- Learning basic Linux commands and system navigation
|
||||
- File system navigation
|
||||
- Text manipulation
|
||||
- Process management
|
||||
- Documenting first project setup
|
||||
- [x] Setting up home lab environment
|
||||
- [x] Installing VirtualBox/VMware
|
||||
- [x] Creating Ubuntu Server 22.04 LTS VM
|
||||
- [x] Configuring network settings
|
||||
- [x] Learning basic Linux commands and system navigation
|
||||
- [x] File system navigation
|
||||
- [x] Text manipulation
|
||||
- [x] Process management
|
||||
- [x] Implementing basic security measures
|
||||
- [x] User management
|
||||
- [x] SSH configuration
|
||||
- [x] Firewall setup
|
||||
|
||||
### Next Focus Areas
|
||||
- [ ] System Monitoring and Maintenance
|
||||
- [ ] Setting up monitoring tools
|
||||
- [ ] Log management
|
||||
- [ ] Backup strategies
|
||||
- [ ] Maintenance scheduling
|
||||
|
||||
### Upcoming
|
||||
- [ ] Service Deployment
|
||||
- [ ] Web server setup
|
||||
- [ ] Database configuration
|
||||
- [ ] Automation and Scripting
|
||||
- [ ] Shell scripting
|
||||
- [ ] Scheduled tasks
|
||||
- [ ] Advanced Networking
|
||||
- [ ] DNS configuration
|
||||
- [ ] Network services
|
||||
|
||||
## 📊 Progress Tracker
|
||||
### Completed
|
||||
@@ -38,19 +59,16 @@ linux-sysadmin-journey/
|
||||
- [x] Created project documentation structure
|
||||
|
||||
### In Progress
|
||||
- [ ] Home lab setup
|
||||
- [ ] Hypervisor installation
|
||||
- [ ] First VM creation
|
||||
- [ ] Network configuration
|
||||
- [x] Home lab setup
|
||||
- [x] Hypervisor installation
|
||||
- [x] First VM creation
|
||||
- [x] Network configuration
|
||||
|
||||
- [ ] Basic command line proficiency
|
||||
- [ ] File system navigation
|
||||
- [ ] User management
|
||||
- [ ] Package management
|
||||
|
||||
### Upcoming
|
||||
- [ ] User and permission management
|
||||
- [ ] System monitoring
|
||||
|
||||
## 🛠️ Projects
|
||||
1. **Home Lab Setup** (In Progress)
|
||||
- Hypervisor: VirtualBox/VMware setup
|
||||
|
||||
@@ -0,0 +1,77 @@
|
||||
# Project Documentation Template
|
||||
|
||||
## Project Structure
|
||||
```
|
||||
project-name/
|
||||
├── README.md # Main project documentation
|
||||
├── docs/ # Detailed documentation
|
||||
│ ├── setup.md # Setup and installation steps
|
||||
│ ├── configuration.md # Configuration details
|
||||
│ └── lessons-learned.md # Learning outcomes and challenges
|
||||
├── scripts/ # Any automation scripts
|
||||
└── resources/ # Additional resources and references
|
||||
```
|
||||
|
||||
## Documentation Guidelines
|
||||
|
||||
### 1. Main README.md Structure
|
||||
- Project Overview
|
||||
- Environment Details
|
||||
- Setup Steps (with status indicators ✅)
|
||||
- Current Status
|
||||
- Next Steps
|
||||
- Configuration Details
|
||||
- Additional Documentation Links
|
||||
|
||||
### 2. Required Documentation Files
|
||||
- Setup documentation (detailed steps)
|
||||
- Configuration details (with examples)
|
||||
- Lessons learned & challenges
|
||||
- Quick reference guides
|
||||
|
||||
### 3. Best Practices
|
||||
- Use markdown formatting
|
||||
- Include command examples
|
||||
- Document both successes and failures
|
||||
- Add status indicators (✅, ⚠️, ❌)
|
||||
- Link related documents
|
||||
- Include timestamps for major changes
|
||||
|
||||
### 4. Portfolio Considerations
|
||||
- Clear project objectives
|
||||
- Technical skills demonstrated
|
||||
- Problems solved
|
||||
- Best practices implemented
|
||||
- Security considerations
|
||||
- Documentation quality
|
||||
|
||||
## Prompt for Future Projects
|
||||
|
||||
When starting a new project, ask the assistant:
|
||||
|
||||
"I'm starting a new project [project-name]. Please help me:
|
||||
|
||||
1. Create the initial project structure
|
||||
2. Set up documentation templates following the portfolio standard
|
||||
3. Track progress with:
|
||||
- Setup steps and verification
|
||||
- Configuration details
|
||||
- Lessons learned
|
||||
- Best practices
|
||||
- Security considerations
|
||||
- Quick reference guides
|
||||
|
||||
Please maintain:
|
||||
- Clear documentation
|
||||
- Professional formatting
|
||||
- Learning-focused approach
|
||||
- Portfolio-ready structure
|
||||
- Security best practices
|
||||
- Practical examples and commands
|
||||
- Troubleshooting guides
|
||||
|
||||
Current project status:
|
||||
[Describe where you are in the project]
|
||||
|
||||
Next steps needed:
|
||||
[Describe what you need help with]"
|
||||
@@ -28,68 +28,136 @@ This project documents the setup of a basic home lab environment using VirtualBo
|
||||
- [x] Basic system configuration
|
||||
- [x] Network setup
|
||||
|
||||
### 3. Network Configuration (In Progress)
|
||||
- [ ] Configure NAT adapter for internet access
|
||||
1. Verify IP address configuration:
|
||||
### 3. Network Configuration ✅
|
||||
- [x] Configure NAT adapter for internet access
|
||||
1. Verify IP address configuration ✅
|
||||
2. Test internet connectivity ✅
|
||||
```bash
|
||||
ip addr show
|
||||
```
|
||||
2. Test internet connectivity:
|
||||
```bash
|
||||
ping 8.8.8.8
|
||||
ping google.com
|
||||
ping 8.8.8.8 # Success
|
||||
ping google.com # Success
|
||||
```
|
||||
|
||||
- [ ] Configure Host-only adapter for direct host communication
|
||||
1. Verify second network interface:
|
||||
- [x] Configure Host-only adapter for direct host communication
|
||||
1. Verify second network interface ✅
|
||||
```bash
|
||||
ip addr show
|
||||
ip addr show enp0s8
|
||||
# Output shows:
|
||||
# inet 169.254.0.2/16 brd 169.254.255.255 scope global enp0s8
|
||||
```
|
||||
2. Test host connectivity:
|
||||
2. Test host connectivity ✅
|
||||
```bash
|
||||
# From Ubuntu VM - ping your Windows host IP
|
||||
ping <windows-host-ip>
|
||||
|
||||
# From Windows host - ping your Ubuntu VM IP
|
||||
ping <ubuntu-vm-ip>
|
||||
# Successfully pinged host (169.254.167.242)
|
||||
# Round-trip time (RTT) avg: 2.846ms
|
||||
```
|
||||
|
||||
- [ ] Document network configuration:
|
||||
- NAT adapter IP: _____________
|
||||
- Host-only adapter IP: _____________
|
||||
- Default gateway: _____________
|
||||
- DNS servers: _____________
|
||||
- [x] Document network configuration:
|
||||
- NAT adapter IP (enp0s3): 10.0.2.15/24
|
||||
- Host-only adapter IP (enp0s8): 169.254.0.2/16
|
||||
- Default gateway: 10.0.2.2
|
||||
- Host IP: 169.254.167.242
|
||||
|
||||
### 4. Basic Security Setup (Pending)
|
||||
### Current Status
|
||||
- ✅ NAT adapter: Working (Internet access)
|
||||
- ✅ Host-only adapter: Working (Host communication)
|
||||
- ✅ Network connectivity: Verified
|
||||
|
||||
### Next Steps
|
||||
Now that networking is configured, we can proceed to:
|
||||
1. Basic Security Setup
|
||||
- [ ] Create non-root user with sudo privileges
|
||||
- [ ] Configure SSH access
|
||||
- [ ] Set up UFW firewall
|
||||
- [ ] Implement basic security hardening
|
||||
|
||||
### 4. Basic Security Setup ✅
|
||||
- [x] User Management ✅
|
||||
- Created sysadmin user with sudo privileges
|
||||
- Enhanced hugh user security
|
||||
|
||||
- [x] SSH Configuration ✅
|
||||
- Installed and configured OpenSSH server
|
||||
- Implemented key-based authentication
|
||||
- Disabled password authentication
|
||||
- Applied security hardening settings
|
||||
|
||||
- [x] UFW Firewall Setup ✅
|
||||
- Installed and configured UFW
|
||||
- Set default policies (deny incoming, allow outgoing)
|
||||
- Allowed required services:
|
||||
- SSH (port 22)
|
||||
- HTTP (port 80)
|
||||
- HTTPS (port 443)
|
||||
- Host machine access (169.254.167.242)
|
||||
- Verified connectivity
|
||||
|
||||
### 5. System Monitoring Setup (Next Phase)
|
||||
- [ ] Monitoring Tools
|
||||
- [ ] Install and configure htop
|
||||
- [ ] Set up netdata for system metrics
|
||||
- [ ] Configure log monitoring
|
||||
|
||||
- [ ] Maintenance Planning
|
||||
- [ ] Create backup strategy
|
||||
- [ ] Set up automated updates
|
||||
- [ ] Implement log rotation
|
||||
- [ ] Configure system alerts
|
||||
|
||||
### Current Status
|
||||
- ✅ Basic VM Setup: Complete
|
||||
- ✅ Network Configuration: Complete
|
||||
- ✅ Security Measures: Complete
|
||||
- ⏳ System Monitoring: Not Started
|
||||
|
||||
### Next Steps
|
||||
1. System Monitoring Implementation
|
||||
- Research and select monitoring tools
|
||||
- Plan monitoring strategy
|
||||
- Document monitoring requirements
|
||||
|
||||
2. Maintenance Procedures
|
||||
- Design backup strategy
|
||||
- Create maintenance schedule
|
||||
- Document procedures
|
||||
|
||||
3. Future Enhancements
|
||||
- Service deployment
|
||||
- Automation implementation
|
||||
- Advanced networking features
|
||||
|
||||
## Security Configuration Status
|
||||
- [x] User Management
|
||||
- [x] Admin user created
|
||||
- [x] Sudo privileges configured
|
||||
- [x] SSH Access
|
||||
- [x] SSH server installed
|
||||
- [x] Key-based authentication configured
|
||||
- [x] Root login disabled
|
||||
- [x] Firewall
|
||||
- [x] UFW installed
|
||||
- [x] Basic rules configured
|
||||
- [x] SSH access allowed
|
||||
|
||||
## Commands and Configurations
|
||||
|
||||
### Network Configuration Commands
|
||||
```bash
|
||||
# View network interfaces
|
||||
ip addr show
|
||||
|
||||
# View routing table
|
||||
ip route show
|
||||
|
||||
# View DNS configuration
|
||||
cat /etc/resolv.conf
|
||||
|
||||
# Test connectivity
|
||||
ping -c 4 8.8.8.8 # Test internet connectivity
|
||||
ping -c 4 google.com # Test DNS resolution
|
||||
|
||||
# If needed, restart networking
|
||||
sudo systemctl restart systemd-networkd
|
||||
```
|
||||
|
||||
## Issues and Solutions
|
||||
Any issues encountered and their solutions will be documented here.
|
||||
### SSH Configuration
|
||||
```conf
|
||||
# Key SSH configuration settings (/etc/ssh/sshd_config)
|
||||
PermitRootLogin no
|
||||
PasswordAuthentication no
|
||||
AllowUsers admin
|
||||
```
|
||||
|
||||
## Resources
|
||||
- [Ubuntu Server Download Page](https://ubuntu.com/download/server)
|
||||
- [VirtualBox Documentation](https://www.virtualbox.org/wiki/Documentation)
|
||||
### UFW Rules
|
||||
```bash
|
||||
# View UFW status
|
||||
sudo ufw status verbose
|
||||
|
||||
# Basic allowed services
|
||||
sudo ufw status numbered
|
||||
```
|
||||
|
||||
## Additional Documentation
|
||||
- [Security Setup Details](security-setup.md)
|
||||
- [Lessons Learned & Challenges](lessons-learned.md)
|
||||
@@ -0,0 +1,97 @@
|
||||
# Lessons Learned & Challenges
|
||||
|
||||
## Network Configuration
|
||||
|
||||
### Lessons Learned
|
||||
1. **Network Adapters**
|
||||
- NAT adapter is essential for internet access
|
||||
- Host-only adapter enables direct communication with host machine
|
||||
- Each adapter serves a specific purpose in the VM setup
|
||||
|
||||
2. **IP Addressing**
|
||||
- NAT adapter typically gets 10.0.2.15/24 in VirtualBox
|
||||
- Host-only adapter uses 169.254.x.x range (link-local addressing)
|
||||
- Understanding different IP ranges helps with troubleshooting
|
||||
|
||||
### Challenges Faced
|
||||
1. **Host-only Network Issues**
|
||||
- Initial "state DOWN" on enp0s8 interface
|
||||
- Required proper netplan configuration to resolve
|
||||
- Solution: Explicitly configure network interfaces in netplan
|
||||
|
||||
## Security Setup
|
||||
|
||||
### Lessons Learned
|
||||
1. **User Management**
|
||||
- Creating admin user first ensures backup access
|
||||
- Group membership (especially sudo) is crucial for administration
|
||||
- Verify permissions immediately after changes
|
||||
|
||||
2. **SSH Configuration**
|
||||
- Always backup sshd_config before modifications
|
||||
- Test SSH access before disabling password authentication
|
||||
- Key order of operations:
|
||||
1. Set up SSH keys
|
||||
2. Test key-based login
|
||||
3. Only then disable password authentication
|
||||
|
||||
3. **Firewall Configuration**
|
||||
- Always allow SSH before enabling UFW
|
||||
- Default deny incoming, allow outgoing is a secure baseline
|
||||
- Document all allowed ports/services for future reference
|
||||
|
||||
### Challenges Faced
|
||||
1. **SSH Key Setup**
|
||||
- Proper file permissions are critical (700 for .ssh, 600 for authorized_keys)
|
||||
- Windows line endings can cause issues with key files
|
||||
- Solution: Use proper chmod commands and verify permissions
|
||||
|
||||
2. **UFW Configuration**
|
||||
- Risk of losing SSH access when enabling firewall
|
||||
- Solution: Always add SSH rule before enabling UFW
|
||||
- Remember to allow both IPv4 and IPv6 traffic if needed
|
||||
|
||||
## Best Practices Discovered
|
||||
1. **Documentation**
|
||||
- Document commands as you execute them
|
||||
- Keep track of configuration changes
|
||||
- Note IP addresses and network settings
|
||||
|
||||
2. **Testing**
|
||||
- Test each change immediately
|
||||
- Have a backup plan (like VirtualBox GUI access)
|
||||
- Verify services after system changes
|
||||
|
||||
3. **Security**
|
||||
- Follow principle of least privilege
|
||||
- Use key-based authentication over passwords
|
||||
- Keep system updated and maintain secure configurations
|
||||
|
||||
## Quick Reference Commands
|
||||
```bash
|
||||
# Network Verification
|
||||
ip addr show # Check network interfaces
|
||||
ping -c 4 8.8.8.8 # Test internet connectivity
|
||||
ss -tulpn # List listening ports
|
||||
|
||||
# SSH Security
|
||||
ssh-keygen -t rsa -b 4096 # Generate SSH key
|
||||
ssh-copy-id user@host # Copy SSH key to server
|
||||
chmod 700 ~/.ssh # Set correct permissions
|
||||
|
||||
# UFW Management
|
||||
sudo ufw status numbered # List rules with numbers
|
||||
sudo ufw delete NUMBER # Remove specific rule
|
||||
sudo ufw reload # Apply changes without disable/enable
|
||||
```
|
||||
|
||||
## Future Considerations
|
||||
1. **Monitoring**
|
||||
- Consider setting up basic system monitoring
|
||||
- Implement log monitoring
|
||||
- Regular security audits
|
||||
|
||||
2. **Maintenance**
|
||||
- Regular backup strategy
|
||||
- Update management plan
|
||||
- Documentation maintenance
|
||||
@@ -0,0 +1,107 @@
|
||||
# Security Setup Documentation
|
||||
|
||||
## User Management
|
||||
|
||||
### New Admin User Creation
|
||||
```bash
|
||||
# Create new admin user 'sysadmin'
|
||||
sudo adduser sysadmin
|
||||
|
||||
# Add to sudo group
|
||||
sudo usermod -aG sudo sysadmin
|
||||
|
||||
# Verify sudo access
|
||||
sudo -l -U sysadmin
|
||||
```
|
||||
|
||||
### Existing User (hugh) Security Enhancement
|
||||
```bash
|
||||
# Verify current groups
|
||||
groups hugh
|
||||
|
||||
# Ensure proper sudo access
|
||||
sudo usermod -aG sudo hugh
|
||||
```
|
||||
|
||||
## SSH Key Configuration
|
||||
|
||||
### Existing Windows SSH Key
|
||||
1. Display public key content on Windows:
|
||||
```powershell
|
||||
# In PowerShell/Command Prompt
|
||||
type C:\Users\YourUsername\.ssh\id_rsa.pub
|
||||
```
|
||||
|
||||
2. Add public key to authorized_keys:
|
||||
```bash
|
||||
# On Ubuntu Server
|
||||
mkdir -p ~/.ssh
|
||||
chmod 700 ~/.ssh
|
||||
nano ~/.ssh/authorized_keys
|
||||
# Paste your public key here
|
||||
chmod 600 ~/.ssh/authorized_keys
|
||||
```
|
||||
|
||||
## SSH Server Hardening
|
||||
```bash
|
||||
# Backup original config
|
||||
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
|
||||
|
||||
# Edit SSH config
|
||||
sudo nano /etc/ssh/sshd_config
|
||||
```
|
||||
|
||||
Required SSH configurations:
|
||||
```conf
|
||||
# Security settings
|
||||
PermitRootLogin no
|
||||
PasswordAuthentication no
|
||||
PubkeyAuthentication yes
|
||||
AllowUsers hugh sysadmin
|
||||
|
||||
# Additional hardening
|
||||
Protocol 2
|
||||
X11Forwarding no
|
||||
MaxAuthTries 3
|
||||
```
|
||||
|
||||
## Applied Security Measures
|
||||
- [x] Created sysadmin user
|
||||
- [x] Enhanced hugh user security
|
||||
- [x] Configured SSH key authentication
|
||||
- [x] Applied SSH hardening settings
|
||||
- [x] Tested SSH access
|
||||
- [x] Configured UFW firewall
|
||||
|
||||
## Firewall Setup (UFW) ✅
|
||||
|
||||
### Current UFW Configuration
|
||||
```bash
|
||||
Status: active
|
||||
|
||||
# Allowed incoming connections:
|
||||
1. SSH (22/tcp)
|
||||
2. HTTP (80/tcp)
|
||||
3. HTTPS (443/tcp)
|
||||
4. All traffic from host (169.254.167.242)
|
||||
|
||||
# Default policies:
|
||||
- Incoming: deny (default)
|
||||
- Outgoing: allow (default)
|
||||
```
|
||||
|
||||
### Applied Rules
|
||||
```bash
|
||||
sudo ufw default deny incoming
|
||||
sudo ufw default allow outgoing
|
||||
sudo ufw allow ssh
|
||||
sudo ufw allow http
|
||||
sudo ufw allow https
|
||||
sudo ufw allow from 169.254.167.242
|
||||
```
|
||||
|
||||
### Verification
|
||||
```bash
|
||||
# Current firewall status
|
||||
sudo ufw status numbered
|
||||
```
|
||||
@@ -0,0 +1,17 @@
|
||||
Please help me maintain consistent documentation standards as established in my Linux home lab project. Key files to reference:
|
||||
project-documentation-template.md - Base template for all projects
|
||||
projects/01-homelab-setup/ - Example of implemented standards:
|
||||
README.md - Main project documentation
|
||||
security-setup.md - Component-specific details
|
||||
lessons-learned.md - Learning outcomes and challenges
|
||||
Documentation requirements:
|
||||
Use markdown formatting
|
||||
Include status indicators (✅, ⚠️, ❌)
|
||||
Document commands with examples
|
||||
Track both successes and challenges
|
||||
Maintain separate files for:
|
||||
Main project documentation
|
||||
Detailed setup/configuration
|
||||
Lessons learned
|
||||
Quick reference guides
|
||||
Please help ensure any new documentation follows these established patterns for portfolio consistency.
|
||||
Reference in New Issue
Block a user