Adjusted the repo as migrated from pagure to the new specialized content.
This commit is contained in:
Peter Boy
parent
3bb3e63c82
commit
9d056cb00e
217 changed files with 140 additions and 4928 deletions
|
|
@ -0,0 +1,9 @@
|
|||
// Text excerpt about installing fail2ban
|
||||
// consumer postinstallation-tasks.adoc (main), hetzner-dc.adoc
|
||||
//
|
||||
Open Cockpit in your desktops browser
|
||||
`https://host.example.com:9090`. Accept the security warning of your browser. Cockpit uses a self signed certificate.
|
||||
|
||||
If you disabled root access during installation (recommended), login as root is not possible.
|
||||
|
||||
Login with your administrative user account. At the top you will see a warning that the Web Console is running with limited permissions. Enable administrator access so that all administrative privileges are automatically available after login.
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
// Text excerpt about installing fail2ban
|
||||
// consumer postinstallation-tasks.adoc (main), hetzner-dc.adoc
|
||||
There are several ways to improve the security of Cockpit axxess. All of them are based on permanently withdrawing access to Cockpit in the firewall. So, reconfigure the firewall permanently.
|
||||
|
||||
[source,]
|
||||
----
|
||||
[…]# firewall-cmd --permanent --remove-service=cockpit
|
||||
[…]# firewall-cmd --reload
|
||||
----
|
||||
|
||||
Use one of the following alternatives to access Cockpit.
|
||||
|
||||
a. Access Cockpit via ssh tunnel
|
||||
* Login to the server via ssh and setup a tunnel in one go
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
ssh host.example.com -L 9090:host.example.com:9090
|
||||
----
|
||||
* While you remain logged in, open in your local browser _localhost:9090_
|
||||
|
||||
b. Add Cockpit service temporarily on demand
|
||||
* Login to the server and reconfigure firewall
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
firewall-cmd –add-service=cockpit
|
||||
----
|
||||
* When finished remove cockpit again
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
firewall-cmd –remove-service=cockpit
|
||||
----
|
||||
|
||||
c. Use a secure local proxy
|
||||
+
|
||||
* Install Cockpit on your local Fedora workstation or on a lab server shielded by a firewall. Configure this instance to access any of your remote Cockpit instances using Cockpits remote administration capability. It uses a protected ssh connection in the public network.
|
||||
+
|
||||
* In the upper left corner of Cockpit you will see the name of the logged in user and the desktop rsp. the (local) lab server name, along with an expand icon. This opens a box where you can switch to another server or add a new one.
|
||||
+
|
||||
* The `Add new host` link opens a simple form to fill in hostname and user. Use your administrative user name on the (remote) server. And you can assign a color. Select automatic login via ssh keyfile. Cockpit will create one for you if none exists or otherwise uses an existing one. For a newly created key, Cockpit installs the public key on the remote server, too.
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
// Text excerpt about setting up a comfortable, key-based user login
|
||||
// consumer postinstallation-tasks.adoc (main), hetzner-dc.adoc
|
||||
//
|
||||
A key file for SSH saves the annoying and error-prone typing of the hopefully secure and sufficiently long password. Additionally, you may prepare your local desktop to use a short name instead of having to type in a complete FQN hostname.
|
||||
|
||||
a. On your desktop (Linux or macOS), create a SSH keyfile if not already available. It should not be secured by password to enable automatic processing.
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# mkdir ~/.ssh
|
||||
[…]# cd ~/.ssh
|
||||
[…]# ssh-keygen -b 4096 -C <YOUR_ACCOUNT>@example.com" -f id_<outputkeyfile>
|
||||
----
|
||||
b. Transfer the key file to your server.
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]$ ssh-copy-id -i $outputkeyfile.pub <YOUR_ACCOUNT>@host.example.com
|
||||
----
|
||||
|
||||
c. Create a config file on your desktop with a convenient host name for your server.
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]$ vi ~/.ssh/config
|
||||
Host <MYHOST>
|
||||
Hostname host.example.com
|
||||
User <YOUR_ACCOUNT>
|
||||
ProxyCommand none
|
||||
ForwardAgent no
|
||||
ForwardX11 no
|
||||
Port 22
|
||||
KeepAlive yes
|
||||
IdentityFile ~/.ssh/$outputkeyfile
|
||||
----
|
||||
|
||||
d. Test the configuration
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]$ ssh <MYHOST>
|
||||
----
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
// Text excerpt about system-wide disabling password login
|
||||
// consumer postinstallation-tasks.adoc (main), hetzner-dc.adoc
|
||||
a. On the server, create a configuration file and edit
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# vi /etc/ssh/sshd_config.d/60-local.conf
|
||||
|
||||
# Local custimization: disable password login except for
|
||||
# one (optionally add some more) user as a fallback option.
|
||||
PasswordAuthentication no
|
||||
|
||||
Match User hostmin
|
||||
PasswordAuthentication yes
|
||||
#Match User hostmin2
|
||||
# PasswordAuthentication yes
|
||||
----
|
||||
b. Reload the sshd daemon
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# systemctl reload sshd
|
||||
----
|
||||
|
||||
c. Test that everything works as expected
|
||||
+
|
||||
* Is an authorised user able to log in?
|
||||
* Are other users rejected with the message "Permission denied (publickey,gssapi-keyex,gssapi-with-mic)"?
|
||||
* If this does not work and/or other users are able to log in with a password besides your known authorized user,
|
||||
** install the latest updates.
|
||||
** check the file _/etc/ssh/sshd_config.d/50-redhat.conf_ to make sure that it does not include the line "PasswordAuthentication yes" (as this is already the default and should not be repeated or else it could hinder other configurations).
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
// Text excerpt about installing fail2ban
|
||||
// consumer postinstallation-tasks.adoc (main), hetzner-dc.adoc
|
||||
The software monitors the log files for authentication errors. In case of multiple retries from the same IP address, it reconfigures the firewall on the fly to block the source IP This is to prevent brute force methods for cracking passwords and bots checking for weak passwords. However, a system administrator may also lock himself out, if if they happen to make a mistake. Therefore, you can exclude destinct IP addresses, e.g. the administrators desktop, from blocking.
|
||||
|
||||
a. Installation of the software and the required Postfix
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# dnf install fail2ban
|
||||
----
|
||||
b. Create and fill configuration file
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# vi /etc/fail2ban/jail.local
|
||||
# Jail configuration additions for local installation
|
||||
|
||||
# Adjust the default configuration's default values
|
||||
[DEFAULT]
|
||||
# Optional enter an trusted IP never to ban
|
||||
#ignoreip = www.xxx.yyy.zzz/32
|
||||
bantime = 6600
|
||||
backend = auto
|
||||
|
||||
# The main configuration file defines all services but
|
||||
# deactivates them by default. We have to activate those neeeded
|
||||
[sshd]
|
||||
enabled = true
|
||||
----
|
||||
c. Activate software
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# systemctl enable fail2ban --now
|
||||
----
|
||||
d. Control in the log
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# tail -f /var/log/fail2ban.log
|
||||
----
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
// Text excerpt about managing system updates.
|
||||
// consumer postinstallation-tasks.adoc (main), hetzner-dc.adoc
|
||||
Fedora includes a tool, dnf-automatic, which supports several modes of update automation:
|
||||
do not apply, notify admin, apply and notify admin, apply without notification. In particular, alternatives 2 and 3 are definitely worth considering. A general principle might be: Alternative 2 is the minimum choice for almost any system, alternative 3 is not at all suitable for critical systems that must not fail under any circumstances.
|
||||
|
||||
We recommend to install at least alternative 2:
|
||||
[source,]
|
||||
----
|
||||
[…]# dnf install dnf-automatic
|
||||
|
||||
[…]# vi /etc/dnf/automatic.conf
|
||||
##emit_via = stdio
|
||||
emit_via = email
|
||||
##email_from = root@example.com
|
||||
email_from = root@host.example.com
|
||||
##
|
||||
|
||||
[…]# vi /etc/aliases
|
||||
...
|
||||
# Person who should get root's mail
|
||||
#root: marc
|
||||
root: real@address.for.root
|
||||
|
||||
[…]# newaliases
|
||||
[…]# systemctl enable --now dnf-automatic-notifyonly.timer
|
||||
----
|
||||
|
||||
If you want to automatically install, activate the corresponding timer instead.
|
||||
|
||||
[source,]
|
||||
----
|
||||
[…]# systemctl enable --now dnf-automatic-install.timer
|
||||
----
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
// setup-esmtp
|
||||
// User configurable send-only Mail Transfer Agent, see http://esmtp.sourceforge.net/
|
||||
// Alternatives ssmtp (Debian) msmtp (https://marlam.de)
|
||||
|
|
@ -0,0 +1,206 @@
|
|||
|
||||
An update must bring the system up to date. In addition, the network configuration has to be completed.
|
||||
|
||||
[arabic]
|
||||
. Immediately after rebooting, update and install a decent editor. Do not reboot yet.
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# dnf update +
|
||||
[…]# dnf install vim
|
||||
----
|
||||
. Control of the IP addresses
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# ip a
|
||||
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc n
|
||||
…
|
||||
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER
|
||||
…
|
||||
[…]# nmcli con +
|
||||
NAME UUID TYPE DEVICE
|
||||
enp3s0 ccdabaa33b-25b0-3bfd-8a74-b6b40847a7a4 ethernet enp3s0
|
||||
----
|
||||
+
|
||||
Usually, only a local address is configured (fe80::...) for IPv6 after
|
||||
installation. A fixed public address must be explicitly set up.
|
||||
|
||||
. Set up a fixed IPv6 address.
|
||||
+
|
||||
It is set up for the physical interface, enp3s0 in the above example. By
|
||||
convention, [ ...::2] is used for this address.
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# nmnmcli con mod 'enp3s0' ipv6.method manual \
|
||||
ipv6.addresses <YOUR_IPv6>::2/64 \
|
||||
ipv6.gateway fe80::1 \
|
||||
ipv6.dns "2a01:4f8:0:1::add:1010 2a01:4f8:0:1::add:9999" +
|
||||
[…]# nmnmcli con up <NAME>
|
||||
[…]# nmnmcli con reload
|
||||
----
|
||||
+
|
||||
Check on the local desktop if a ping6 works:
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# ping6 <YOUR_IPv6_PRAEFIX>::2
|
||||
[…]# # e.g. ping6 2a01:4f8:191:6494::2
|
||||
----
|
||||
. Optional: Static reconfiguration of IPv4
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# nmnmcli con mod 'enp3s0' ipv4.method manual \
|
||||
ipv4.addresses <YOUR_IPv4> / 27 \
|
||||
ipv4.gateway \ +
|
||||
ipv6.dns "213.133.98.98 213.133.99.99 213.133.100.100"
|
||||
[…]# nmnmcli con up <_NAME>
|
||||
[…]# nmnmcli con reload
|
||||
----
|
||||
+
|
||||
Check from the local desktop if a ping6 works:
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# ping <YOUR_IPv4>
|
||||
----
|
||||
. The NetworkManager configuration file must contain the entries made above:
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# less /etc/NetworkManager/system-connections/enp3s0.nmconnection
|
||||
----
|
||||
. Perform a reboot. If the server is then accessible via ssh with IPv4 and IPv6, return the KVM console.
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# reboot
|
||||
----
|
||||
|
||||
|
||||
==========================
|
||||
|
||||
=== Set up login for root via key file
|
||||
|
||||
[arabic]
|
||||
. Create a directory .ssh on the server in /root/ and transfer the created key. As a login from outside via sftp as root is not possible, the easiest way to do this is via copy&paste.
|
||||
+
|
||||
Execute on the server:
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# mkdir /root/.ssh
|
||||
[…]# cd /root/.ssh
|
||||
[…]# vi /root/.ssh/authorized_keys
|
||||
----
|
||||
+
|
||||
Alternatively, transfer the key via sftp to the home directory of the unprivileged administration account and copy it over.
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# mkdir /root/.ssh
|
||||
[…]# cd /root/.ssh
|
||||
[…]# mv /home/hostmin/id
|
||||
----
|
||||
. Updating the privileges of the .ssh directory
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# chown -R root.root /root/.ssh
|
||||
[…]# chmod 700 /root/.ssh
|
||||
[…]# chmod 600 ~/.ssh/
|
||||
[…]# /sbin/restorecon -R -vF /root/.ssh
|
||||
----
|
||||
. Testing access as root with key
|
||||
+
|
||||
Execute from your desktop:
|
||||
|
||||
|
||||
=================
|
||||
|
||||
|
||||
=== Installation fail2ban
|
||||
|
||||
[arabic]
|
||||
. Installation of the software and the required Postfix
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# dnf install fail2ban postfix
|
||||
----
|
||||
|
||||
. Create and fill configuration file:
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# vi /etc/fail2ban/jail.local
|
||||
# Jail configuration additions for local installation
|
||||
|
||||
# Adjust the default configuration's default values
|
||||
[DEFAULT]
|
||||
# Optional enter an trusted IP never to ban
|
||||
#ignoreip = www.xxx.yyy.zzz/32
|
||||
bantime = 6600
|
||||
backend = auto
|
||||
|
||||
# The main configuration file defines all services but
|
||||
# deactivates them by default. We have to activate those neeeded
|
||||
[sshd]
|
||||
enabled = true
|
||||
----
|
||||
. Activate
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# systemctl enable postfix --now
|
||||
[…]# systemctl enable fail2ban --now
|
||||
----
|
||||
|
||||
. Control in the log
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# tail -f /var/log/fail2ban.log
|
||||
----
|
||||
|
||||
|
||||
======================
|
||||
|
||||
=== Refining and Ensuring Various Features
|
||||
|
||||
[arabic]
|
||||
. Checking the correct hostname
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# hostnamectl
|
||||
----
|
||||
+
|
||||
Set hostname if required:
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# hostnamectl set-hostname <FWDN>
|
||||
----
|
||||
. Control time, time zone, time synchronisation
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# timedatectl
|
||||
----
|
||||
+
|
||||
If necessary, activate time synchronisation:
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# timedatectl set-ntp true
|
||||
----
|
||||
+
|
||||
Correct time if necessary:
|
||||
+
|
||||
[source,]
|
||||
----
|
||||
[…]# timedatectl set-time <TIME>
|
||||
----
|
||||
Loading…
Add table
Add a link
Reference in a new issue