linux-sysadmin-journey/projects/01-homelab-setup/security-setup.md

Security Setup Documentation

User Management

New Admin User Creation

# Create new admin user 'sysadmin'
sudo adduser sysadmin

# Add to sudo group
sudo usermod -aG sudo sysadmin

# Verify sudo access
sudo -l -U sysadmin

Existing User (hugh) Security Enhancement

# Verify current groups
groups hugh

# Ensure proper sudo access
sudo usermod -aG sudo hugh

SSH Key Configuration

Existing Windows SSH Key

1. Display public key content on Windows:

   # In PowerShell/Command Prompt
   type C:\Users\YourUsername\.ssh\id_rsa.pub
   

2. Add public key to authorized_keys:

   # On Ubuntu Server
   mkdir -p ~/.ssh
   chmod 700 ~/.ssh
   nano ~/.ssh/authorized_keys
   # Paste your public key here
   chmod 600 ~/.ssh/authorized_keys
   

SSH Server Hardening

# Backup original config
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

# Edit SSH config
sudo nano /etc/ssh/sshd_config

Required SSH configurations:

# Security settings
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers hugh sysadmin

# Additional hardening
Protocol 2
X11Forwarding no
MaxAuthTries 3

Applied Security Measures

• Created sysadmin user
• Enhanced hugh user security
• Configured SSH key authentication
• Applied SSH hardening settings
• Tested SSH access
• Configured UFW firewall

Firewall Setup (UFW) ✅

Current UFW Configuration

Status: active

# Allowed incoming connections:
1. SSH (22/tcp)
2. HTTP (80/tcp)
3. HTTPS (443/tcp)
4. Netdata (19999/tcp)
5. All traffic from host (169.254.167.242)

# Default policies:
- Incoming: deny (default)
- Outgoing: allow (default)

Applied Rules

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https
sudo ufw allow from 169.254.167.242

Verification

# Current firewall status
sudo ufw status numbered