Skip to content

basic-os-setup.md

Latest commit

 

History

History
72 lines (57 loc) · 3.56 KB

basic-os-setup.md

File metadata and controls

72 lines (57 loc) · 3.56 KB
Raw

Basic OS Setup

This document outlines the initial OS setup.

OS

Ubuntu Server (minimized) 26.04 LTS is chosen for its stability, security, and long-term support. The minimal installation reduces the attack surface and resource usage, providing a clean slate for the server setup.

User Management

A non-root user with sudo privileges is created for daily administration tasks. This enhances security by preventing direct root access and allows for better control over permissions.

Setting Timezone

The timezone is set to Europe/Berlin to ensure that all logs and scheduled tasks are in the correct local time. This is done using the following command:

sudo timedatectl set-timezone Europe/Berlin

SSH

Connecting to the server is done via SSH on port with key-based authentication. Root login and password authentication are disabled for security reasons.

A key pair is generated on the local machine using ssh-keygen and the public key is added to the server's ~/.ssh/authorized_keys file for the non-root sudo user.

Connecting

To connect to the server I use the following configuration in ~/.ssh/config:

Host homeserver
    HostName [domain-to-ssh.com]
    User [username]
    IdentityFile ~/.ssh/id_ed25519
    ProxyCommand cloudflared access ssh --hostname %h

This allows for a simplified connection command, ssh homeserver, which uses the specified hostname, user, and key without needing to enter them each time. The ProxyCommand is used to route the SSH connection through Cloudflare Access for added security. For this to work, cloudflared must be installed on the local machine.

Hardening SSH

To further harden SSH, the following settings are applied in /etc/ssh/sshd_config:

UsePAM no                                   # Disable PAM to prevent password authentication fallback
Port <ssh-port>                                   # Change SSH port to non-standard
PermitRootLogin no                          # Disable root login
PasswordAuthentication no                   # Disable password authentication (key-only login)
PubkeyAuthentication yes                    
AuthorizedKeysFile .ssh/authorized_keys     # Default location for authorized keys
X11Forwarding no                            # Disable X11 forwarding for security

Laptop as Server

As I'm using my laptop as a server, there are some additional considerations:

Lid Behavior

The laptop is configured to not suspend or hibernate when the lid is closed: Change the following settings in /etc/systemd/logind.conf:

HandleLidSwitch=ignore
HandleLidSwitchExternalPower=ignore
HandleLidSwitchDocked=ignore

Battery Management

To preserve battery health, the laptop is set to charge only up to 80% when plugged in. This can be configured using the tlp tool or through the BIOS/UEFI settings if supported by the hardware. My settings in /etc/tlp.conf:

START_CHARGE_THRESH_BAT0=0
STOP_CHARGE_THRESH_BAT0=1

To check battery status and thresholds, use tlp-stat -b to see current battery information and charging thresholds.

Another option would be to completely remove the battery and run the laptop on AC power only, but this may not be feasible for all laptop models and can have implications for power stability. For my own reference, I will track the battery health over time to see if it degrades significantly.

Further Basic Security Setup

See Fail2Ban, Automatic Security Updates, and UFW Firewall for details on their setup.