# Security Setup Documentation

## User Management

### New Admin User Creation
```bash
# Create new admin user 'sysadmin'
sudo adduser sysadmin

# Add to sudo group
sudo usermod -aG sudo sysadmin

# Verify sudo access
sudo -l -U sysadmin
```

### Existing User (hugh) Security Enhancement
```bash
# Verify current groups
groups hugh

# Ensure proper sudo access
sudo usermod -aG sudo hugh
```

## SSH Key Configuration

### Existing Windows SSH Key
1. Display public key content on Windows:
   ```powershell
   # In PowerShell/Command Prompt
   type C:\Users\YourUsername\.ssh\id_rsa.pub
   ```

2. Add public key to authorized_keys:
   ```bash
   # On Ubuntu Server
   mkdir -p ~/.ssh
   chmod 700 ~/.ssh
   nano ~/.ssh/authorized_keys
   # Paste your public key here
   chmod 600 ~/.ssh/authorized_keys
   ```

## SSH Server Hardening
```bash
# Backup original config
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

# Edit SSH config
sudo nano /etc/ssh/sshd_config
```

Required SSH configurations:
```conf
# Security settings
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers hugh sysadmin

# Additional hardening
Protocol 2
X11Forwarding no
MaxAuthTries 3
```

## Applied Security Measures
- [x] Created sysadmin user
- [x] Enhanced hugh user security
- [x] Configured SSH key authentication
- [x] Applied SSH hardening settings
- [x] Tested SSH access
- [x] Configured UFW firewall

## Firewall Setup (UFW) ✅

### Current UFW Configuration
```bash
Status: active

# Allowed incoming connections:
1. SSH (22/tcp)
2. HTTP (80/tcp)
3. HTTPS (443/tcp)
4. Netdata (19999/tcp)
5. All traffic from host (169.254.167.242)

# Default policies:
- Incoming: deny (default)
- Outgoing: allow (default)
```

### Applied Rules
```bash
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https
sudo ufw allow from 169.254.167.242
```

### Verification
```bash
# Current firewall status
sudo ufw status numbered
```