Category: OS

This is my personal note list for preparing a root server. The list is not complete and may contain errors.

Network setup

• Install OS as usual or use image from Control Panel

Network setup

• Set/check fixed ip
• Set the "Reverse DNS" entry in Control Panel
• Add local user
  useradd <username>
usermod -aG sudo <username>
• Set hostname
  sudo hostnamectl set-hostname <hostname>
• Edit the /etc/hosts file
• Edit the /etc/cloud/cloud.cfg file if exists (preserve_hostname: false to true)
• Edit the /etc/netplan/50-cloud-init.yaml

SSH

• Add pubkey to ~/.ssh/authorized_keys
• Disable SSH login with password and permit root login in /etc/ssh/sshd_config file

PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin no

• Restart SSH Daemon
  service sshd restart

VIM

• VIM Color open ~/.vimrc and add

colorsheme desert
syntax on

Enable unattended upgrades

sudo apt-get install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades

Docker

• Install docker-ce here
• Install docker-compose
  sudo apt-get install docker-compose-plugin
• Install docker-compose here
• Install docker-compose command completion here
• add username to docker group (source)
  sudo usermod -aG docker $USER

Logrotate for Docker

• Create Logrotate config file for Docker containers under /etc/logrotate.d/docker-container with the following content:

/var/lib/docker/containers/*/*.log {
  rotate 8
  weekly
  compress
  missingok
  delaycompress
  copytruncate
}

• Test it with: logrotate -fv /etc/logrotate.d/docker-container

Docker Compose aliases

• Create or append to ~/.bash_aliases:

alias dc='docker compose'
alias dcl='docker compose logs -f --tail=200'
alias dce='docker compose exec'
alias dcb='docker compose up --build -d'
alias dcu='docker compose up -d'
alias dcul='docker compose up -d && docker-compose logs -f --tail=50'
alias dcd='docker compose down --remove-orphans'
alias dcdu='docker compose down --remove-orphans && docker compose up -d'
alias dcdul='docker compose down --remove-orphans && docker compose up -d && docker compose logs -f --tail=50' 
alias dcdb='docker compose down --remove-orphans && docker compose up --build -d'
alias dcdbl='docker compose down --remove-orphans && docker compose up --build -d && docker compose logs -f --tail=50'

Docker after dist upgrade

• Update key
  curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
• Re-enable repo
  echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
$(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
• update the package database with the Docker packages from the newly added repo:
  sudo apt-get update
• Make sure you are install from the Docker repo instead of the default Ubuntu repo:
  apt-cache policy docker-ce
• upgrade packes
  sudo apt-get install docker-ce docker-ce-cli containerd.io
• reboot

fail2ban

• Install fail2ban with sudo apt-get install fail2ban
• Create config file /etc/fail2ban/jail.local and add a jail for the SSH Deamon

[sshd]
enabled = true
port = <ssh port>
filter = sshd
logpath = /var/log/auth.log
maxretry = 3

[traefik]
enabled = true
filter = traefik
logpath = /var/lib/docker/containers/*/*-json.log
banaction = docker-action
maxretry = 3
findtime = 900
bantime = 86400

[wplogin]
enabled = true
filter = wplogin
logpath = /var/lib/docker/containers/*/*-json.log
banaction = docker-action
maxretry = 3
findtime = 900
bantime = 86400

[unifi]
enabled  = true
filter   = unifi
logpath = /var/lib/docker/containers/*/*-json.log
banaction = docker-action
maxretry = 3
bantime = 86400
findtime = 900

• Creat filter for traefik /etc/fail2ban/filter.d/traefik.conf

[Definition]
failregex = ^{"log":"<HOST> - \S+ \[.*\] \\"(GET|POST|HEAD) .+\" 401 .+$
ignoreregex =

• Create filter for wplogin /etc/fail2ban/filter.d/wplogin.conf

[Definition]
failregex = ^{"log":"<HOST> -.*POST.*wp-login.php.*
ignoreregex =

• Create filter for unifi /etc/fail2ban/filter.d/unifi.conf

[Definition]
failregex = ^{"log":"<HOST> - \S+ \[.*\] \\"POST \/api\/login.+\\" 400 .+$

• Create action /etc/fail2ban/action.d/docker-action.conf
  Unlike the out-of-the-box action, "actionban" and "actionunban" do not affect the INPUT chain, but the docker FORWARD chain "DOCKER".

[Definition]
actionstart = iptables -N f2b-docker
              iptables -A f2b-docker -j RETURN
              iptables -I FORWARD -p tcp -j f2b-docker

actionstop = iptables -D FORWARD -p tcp -j f2b-docker
             iptables -F f2b-docker
             iptables -X f2b-docker

actioncheck = iptables -n -L FORWARD | grep -q 'f2b-docker[ \t]'

actionban = iptables -I f2b-docker -s <ip> -j DROP

actionunban = iptables -D f2b-docker -s <ip> -j DROP

[via]https://www.the-lazy-dev.com/en/install-fail2ban-with-docker/[/via]

Here is a list of useful unix commands or code parts. Who does not know it? You have a problem and looking for a solution where you find at stack overflow or similar pages? Here I collect all the commands that I have encountered over time or whose switch I simply can not remember (or want).

• How do I find all files containing specific text?

grep -rnw '/path/to/somewhere/' -e 'pattern'

• How i change the default file permissions (mask that controls file permissions)

umask

• Untar (unzip) file/folder

tar -zxvf archive.tar.gz

• Tar (zip) file/folders

tar -cvzf archive.tar.gz file1 file2

• Copy files via rsync from one host to another

rsync -avz [USER@]HOST:SOURCE [USER@]HOST:DEST
rsync -avz [USER@]HOST:SOURCE rsync://[USER@]HOST[:PORT]/DEST
rsync -avz -e "ssh -p 12345" LOCAL/SOURCE [USER@]HOST:DEST

• Using rsync with sudo on the destination machine
  1. Find out the path to rsync: which rsync
  2. Edit the /etc/sudoers file: sudo visudo
  3. Add the line <username> ALL=NOPASSWD:<path to rsync>, where username is the login name of the user that rsync will use to log on. That user must be able to use sudo

Then, on the source machine, specify that sudo rsync shall be used:

rsync -avz --rsync-path="sudo rsync" SOURCE [USER@]HOST:DEST

• Preserve SSH_AUTH_SOCK (Environment Variables) When Using sudo

sudo --preserve-env=SSH_AUTH_SOCK -s

• nslookup missing? Install dig

sudo apt-get install dnsutils

• find without "Permission denied"

find / -name 'filename.ext' 2>&1 | grep -v "Permission denied"

• flush dns cache

sudo systemd-resolve --flush-caches

• show open ports

netstat -tulpn

• Directory size

du -sh /var
du -shc /var/*
du -h --max-depth=1 /var
du -sh /var/lib/docker/containers/*/*.log

• Search multiple PDF files for a "needle"

pdfgrep -i needle haystack*.pdf

• Show hidden files with ls

ls -lar

• Redirect STDOUT and STDERR to a file

nice-command > out.txt 2>&1

• Installs your SSH public key to a remote host

sh-copy-id 'user@remotehost'

• A command-line system information tool

neofetch

• Show disk usage, folder size, items per folder, find big directorys, ... with ncdu

ncdu

• Display Network usage

iftop or iptraf

• Cleanup Docker

docker system prune --help

• Find and repair disk errors on ext (ext2, ext3 and ext4) filesystems

sudo e2fsck -f </dev/sda2>