An update must bring the system up to date. In addition, the network configuration has to be completed.

[arabic]
. Immediately after rebooting, update and install a decent editor. Do not reboot yet.
+
[source,]
----
[…]# dnf update +
[…]# dnf install vim
----
. Control of the IP addresses
+
[source,]
----
[…]# ip a 
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc n 
… 
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER 
…  
[…]# nmcli con +
NAME   UUID                                   TYPE      DEVICE 
enp3s0 ccdabaa33b-25b0-3bfd-8a74-b6b40847a7a4 ethernet  enp3s0
----
+
Usually, only a local address is configured (fe80::...) for IPv6 after
installation. A fixed public address must be explicitly set up.

. Set up a fixed IPv6 address. 
+
It is set up for the physical interface, enp3s0 in the above example. By
convention, [ ...::2] is used for this address.
+
[source,]
----
[…]# nmnmcli con mod 'enp3s0' ipv6.method manual \
ipv6.addresses <YOUR_IPv6>::2/64 \ 
ipv6.gateway fe80::1 \ 
ipv6.dns "2a01:4f8:0:1::add:1010 2a01:4f8:0:1::add:9999" +
[…]# nmnmcli con up <NAME> 
[…]# nmnmcli con reload
----
+
Check on the local desktop if a ping6 works:
+
[source,]
----
[…]# ping6 <YOUR_IPv6_PRAEFIX>::2 
[…]# # e.g. ping6 2a01:4f8:191:6494::2
----
. Optional: Static reconfiguration of IPv4
+
[source,]
----
[…]# nmnmcli con mod 'enp3s0' ipv4.method manual \ 
ipv4.addresses <YOUR_IPv4> / 27 \ 
ipv4.gateway \ +
ipv6.dns "213.133.98.98 213.133.99.99 213.133.100.100" 
[…]# nmnmcli con up <_NAME> 
[…]# nmnmcli con reload
----
+
Check from the local desktop if a ping6 works:
+
[source,]
----
[…]# ping <YOUR_IPv4>
----
. The NetworkManager configuration file must contain the entries made above:
+
[source,]
----
[…]# less /etc/NetworkManager/system-connections/enp3s0.nmconnection
----
. Perform a reboot. If the server is then accessible via ssh with IPv4 and IPv6, return the KVM console.
+
[source,]
----
[…]# reboot
----


==========================

=== Set up login for root via key file 

[arabic]
. Create a directory .ssh on the server in /root/ and transfer the created key. As a login from outside via sftp as root is not possible, the easiest way to do this is via copy&paste.
+
Execute on the server: 
+
[source,]
----
[…]# mkdir /root/.ssh 
[…]# cd /root/.ssh
[…]# vi /root/.ssh/authorized_keys
----
+
Alternatively, transfer the key via sftp to the home directory of the unprivileged administration account and copy it over.
+
[source,]
----
[…]# mkdir /root/.ssh
[…]# cd /root/.ssh 
[…]# mv /home/hostmin/id
----
. Updating the privileges of the .ssh directory
+
[source,]
----
[…]# chown -R root.root  /root/.ssh 
[…]# chmod 700 /root/.ssh 
[…]# chmod 600 ~/.ssh/ 
[…]# /sbin/restorecon -R -vF /root/.ssh
----
. Testing access as root with key
+
Execute from your desktop:


=================


=== Installation fail2ban

[arabic]
. Installation of the software and the required Postfix 
+
[source,]
----
[…]# dnf install fail2ban postfix
----

. Create and fill configuration file: 
+
[source,]
----
[…]# vi /etc/fail2ban/jail.local
# Jail configuration additions for local installation 

# Adjust the default configuration's default values 
[DEFAULT] 
# Optional enter an trusted IP never to ban 
#ignoreip = www.xxx.yyy.zzz/32 
bantime = 6600 
backend = auto 

# The main configuration file defines all services but 
# deactivates them by default. We have to activate those neeeded 
[sshd] 
enabled = true
----
. Activate  
+
[source,]
----
[…]# systemctl enable postfix --now
[…]# systemctl enable fail2ban --now
----

. Control in the log 
+
[source,]
----
[…]# tail -f /var/log/fail2ban.log 
----


======================

=== Refining and Ensuring Various Features

[arabic]
. Checking the correct hostname
+
[source,]
----
[…]# hostnamectl
----
+
Set hostname if required:
+
[source,]
----
[…]# hostnamectl set-hostname <FWDN>
----
. Control time, time zone, time synchronisation
+
[source,]
----
[…]# timedatectl
----
+
If necessary, activate time synchronisation:
+
[source,]
----
[…]# timedatectl set-ntp true
----
+
Correct time if necessary:
+
[source,]
----
[…]# timedatectl set-time <TIME>
----