Changes for page Configuring a VPS machine from scratch

Last modified by Alexandru Pentilescu on 2024/07/22 21:37

From 2.1 to 1.1 From 4.3 to 4.2

From version 4.2

edited by Alexandru Pentilescu
on 2022/11/13 22:08

Change comment: There is no comment for this version

To version 2.1

edited by Alexandru Pentilescu
on 2022/11/13 21:11

Change comment: There is no comment for this version

Raw
Rendered

Summary

Page properties (1 modified, 0 added, 0 removed)

Details

Page properties

Content

@@ -8,11 +8,6 @@
  )))
  )))
--(% class="col-xs-12 col-sm-4" %)
--(((
--{{box title="**Contents**"}}{{toc /}}{{/box}}
--)))
--
  (% class="row" %)
  (((
  (% class="col-xs-12 col-sm-8" %)
@@ -22,95 +22,50 @@
  If you don't have an active user just yet, please do the following:
  {{code language="bash"}}
--sudo adduser <newuser>
++sudo adduser newuser
  {{/code}}
--Please replace <newuser> with your username.
  Then, to make them part of the sudoers file, just do:
  {{code language="bash"}}
--sudo usermod -aG sudo <newuser>
++sudo usermod -aG sudo newuser
  {{/code}}
--== Using root vs. using a sudoers user ==
++== Sub-paragraph ==
--There's an argument to be made between just logging in as root on the system directly or using a separate users which is part of the sudoers file.
--Both are viable options for administrators to make configuration changes on the target system.
--Some people argue that adding other users to a system is just adding complexity and, especially if you plan to be the sole administrator of the VPS, it makes little sense not to use the already built-in root user. After all, root starts out with all the priviliges and, most importantly, you'll never have to remember to keep invoking "sudo" whenever you need to run administrative commands in the terminal. Because of this, this is seen as the superior approach.
++Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
--However, others make the argument that constantly running as root is a security risk for the system as a whole. When running as root, any terminal command issued will also run with absolute privileges, which runs the risk of amplifying any human error to disastruous proportions.
--Granted, this risk also exists for sudoers users too, but only with the commands which are ran with "sudo". Having the extra step of manually prefixing each command with "sudo" is seen as a preventative measure of avoiding system damage.
--Moreover, if the administrator is diligent, they may retroactively change the sudoers users' permissions manually to only allow privilege escalation for commands which they deem safe to run, effectively blocking any risk for overly dangerous commands such as "dd" or "rm -Rf".
++== Sub-paragraph ==
--Ultimately, the argument for or against using root access is mostly a philosophical one, rather than a technical one. There is no right or wrong answer to this question. Rather, each answer brings its own advantages and disadvantages to the table. What really matters is what you're more comfortable with using in the end.
--Moreover, using a sudoers user rather than root is not inherently a guarantee for system safety either and should not be taken as a leeway for running suspicious executable files from the internet either, as privilege escalation bugs have existed in the Linux kernel since its own inception.
++Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
--= Setting up automatic updates =
++=== Sub-sub paragraph ===
--System updates are a necessity for modern day operating systems and on linux, especially, there's a constant need to run such updates regurarly to avoid the risk of running vulnerable software that can be exploited by rogue malware.
++Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
--Linux, in particular, is an attractive target for malware writers in recent years, due to the fact that corporate servers owned by renowned companies are seen as a more profitable compromise target for malicious actors who may wish to extort money from unpatched systems.
--After all, large corporations running unpatched systems are more likely to pay significant amounts of money than lone private users if their systems were to be compromised.
++= Paragraph 2 =
--As such, it's imperative to protect our systems from such damage by preventing the attacks in the first place. The first step in achieving this goal is by constantly patching the system. And a good way to do this without requiring manual intervention is setting up automatic updates.
++Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
--Debian based systems have an official package known as unattended-upgrades which can do just this. To install this package, please run the following command:
++== Sub-paragraph ==
--{{code language="bash"}}
--sudo apt-get install unattended-upgrades
--{{/code}}
++Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
--This will install the package from the official repositories. After this, the package should be configurable to the administrator by editing the /etc/apt/apt.conf.d/50unattended-upgrades file. This file should be generated automatically after installing the package.
++== Sub-paragraph ==
--There's a lot of stuff which can be configured in this file. Some of the options which I personally prefer to activate by uncommenting are the following:
++Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
++)))
--{{code language="none"}}
--// This option controls whether the development release of Ubuntu will be
--// upgraded automatically. Valid values are "true", "false", and "auto".
--Unattended-Upgrade::DevRelease "auto";
++(% class="col-xs-12 col-sm-4" %)
++(((
++{{box title="**Contents**"}}{{toc /}}{{/box}}
--// Send email to this address for problems or packages upgrades
--// If empty or unset then no email is sent, make sure that you
--// have a working mail setup on your system. A package that provides
--// 'mailx' must be installed. E.g. "user@example.com"
--Unattended-Upgrade::Mail "Alexandru.Pentilescu@disroot.org";
--{{/code}}
++[[image:Templates.Article.Template.WebHome@image1.jpg||style="width: 100%"]]
++//Figure 1: [[Sea>>https://commons.wikimedia.org/wiki/File:Isle_of_Icacos_II.jpg]]//
--This lets the system know that I want for email notifications with respect to updates need to be delivered to that specific email address. This is important because, every time updates occur, this lets me know via email. Of course, you need to have an SMTP server running locally, as described in the previous step.
--
--Then:
--
--{{code language="none"}}
--// Remove unused automatically installed kernel-related packages
--// (kernel images, kernel headers and kernel version locked tools).
--Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
--
--// Do automatic removal of newly unused dependencies after the upgrade
--Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
--{{/code}}
--
--These configuration options will instruct the package to remove obsolete files which become stale as updates come in.
--
--{{code language="none"}}
--// Automatically reboot *WITHOUT CONFIRMATION* if
--//  the file /var/run/reboot-required is found after the upgrade
--Unattended-Upgrade::Automatic-Reboot "true";
--{{/code}}
--
--This will instruct the package to automatically reboot the system. This is necessary after specific kernel updates are installed that need to be installed in memory and replace the old ones.
--
--Finally:
--
--{{code language="none"}}
--// If automatic reboot is enabled and needed, reboot at the specific
--// time instead of immediately
--//  Default: "now"
--Unattended-Upgrade::Automatic-Reboot-Time "02:00";
--{{/code}}
--
--This instructs the package to reboot the whole system, automatically, whenever an update requires it, the next time the system clock reaches this specific configured time. I set mine to reboot the system, whenever an update requires it, at 2AM. You may change the time to whichever fits your needs.
--
--
++[[image:Templates.Article.Template.WebHome@image2.jpg||style="width: 100%"]]
++//Figure 2: [[Waves>>https://commons.wikimedia.org/wiki/File:Culebra_-_Playa_de_Flamenco.jpg]]//
  )))
++)))