206 lines
4.1 KiB
Text
206 lines
4.1 KiB
Text
|
|
An update must bring the system up to date. In addition, the network configuration has to be completed.
|
|
|
|
[arabic]
|
|
. Immediately after rebooting, update and install a decent editor. Do not reboot yet.
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# dnf update +
|
|
[…]# dnf install vim
|
|
----
|
|
. Control of the IP addresses
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# ip a
|
|
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc n
|
|
…
|
|
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER
|
|
…
|
|
[…]# nmcli con +
|
|
NAME UUID TYPE DEVICE
|
|
enp3s0 ccdabaa33b-25b0-3bfd-8a74-b6b40847a7a4 ethernet enp3s0
|
|
----
|
|
+
|
|
Usually, only a local address is configured (fe80::...) for IPv6 after
|
|
installation. A fixed public address must be explicitly set up.
|
|
|
|
. Set up a fixed IPv6 address.
|
|
+
|
|
It is set up for the physical interface, enp3s0 in the above example. By
|
|
convention, [ ...::2] is used for this address.
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# nmnmcli con mod 'enp3s0' ipv6.method manual \
|
|
ipv6.addresses <YOUR_IPv6>::2/64 \
|
|
ipv6.gateway fe80::1 \
|
|
ipv6.dns "2a01:4f8:0:1::add:1010 2a01:4f8:0:1::add:9999" +
|
|
[…]# nmnmcli con up <NAME>
|
|
[…]# nmnmcli con reload
|
|
----
|
|
+
|
|
Check on the local desktop if a ping6 works:
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# ping6 <YOUR_IPv6_PRAEFIX>::2
|
|
[…]# # e.g. ping6 2a01:4f8:191:6494::2
|
|
----
|
|
. Optional: Static reconfiguration of IPv4
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# nmnmcli con mod 'enp3s0' ipv4.method manual \
|
|
ipv4.addresses <YOUR_IPv4> / 27 \
|
|
ipv4.gateway \ +
|
|
ipv6.dns "213.133.98.98 213.133.99.99 213.133.100.100"
|
|
[…]# nmnmcli con up <_NAME>
|
|
[…]# nmnmcli con reload
|
|
----
|
|
+
|
|
Check from the local desktop if a ping6 works:
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# ping <YOUR_IPv4>
|
|
----
|
|
. The NetworkManager configuration file must contain the entries made above:
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# less /etc/NetworkManager/system-connections/enp3s0.nmconnection
|
|
----
|
|
. Perform a reboot. If the server is then accessible via ssh with IPv4 and IPv6, return the KVM console.
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# reboot
|
|
----
|
|
|
|
|
|
==========================
|
|
|
|
=== Set up login for root via key file
|
|
|
|
[arabic]
|
|
. Create a directory .ssh on the server in /root/ and transfer the created key. As a login from outside via sftp as root is not possible, the easiest way to do this is via copy&paste.
|
|
+
|
|
Execute on the server:
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# mkdir /root/.ssh
|
|
[…]# cd /root/.ssh
|
|
[…]# vi /root/.ssh/authorized_keys
|
|
----
|
|
+
|
|
Alternatively, transfer the key via sftp to the home directory of the unprivileged administration account and copy it over.
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# mkdir /root/.ssh
|
|
[…]# cd /root/.ssh
|
|
[…]# mv /home/hostmin/id
|
|
----
|
|
. Updating the privileges of the .ssh directory
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# chown -R root.root /root/.ssh
|
|
[…]# chmod 700 /root/.ssh
|
|
[…]# chmod 600 ~/.ssh/
|
|
[…]# /sbin/restorecon -R -vF /root/.ssh
|
|
----
|
|
. Testing access as root with key
|
|
+
|
|
Execute from your desktop:
|
|
|
|
|
|
=================
|
|
|
|
|
|
=== Installation fail2ban
|
|
|
|
[arabic]
|
|
. Installation of the software and the required Postfix
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# dnf install fail2ban postfix
|
|
----
|
|
|
|
. Create and fill configuration file:
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# vi /etc/fail2ban/jail.local
|
|
# Jail configuration additions for local installation
|
|
|
|
# Adjust the default configuration's default values
|
|
[DEFAULT]
|
|
# Optional enter an trusted IP never to ban
|
|
#ignoreip = www.xxx.yyy.zzz/32
|
|
bantime = 6600
|
|
backend = auto
|
|
|
|
# The main configuration file defines all services but
|
|
# deactivates them by default. We have to activate those neeeded
|
|
[sshd]
|
|
enabled = true
|
|
----
|
|
. Activate
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# systemctl enable postfix --now
|
|
[…]# systemctl enable fail2ban --now
|
|
----
|
|
|
|
. Control in the log
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# tail -f /var/log/fail2ban.log
|
|
----
|
|
|
|
|
|
======================
|
|
|
|
=== Refining and Ensuring Various Features
|
|
|
|
[arabic]
|
|
. Checking the correct hostname
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# hostnamectl
|
|
----
|
|
+
|
|
Set hostname if required:
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# hostnamectl set-hostname <FWDN>
|
|
----
|
|
. Control time, time zone, time synchronisation
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# timedatectl
|
|
----
|
|
+
|
|
If necessary, activate time synchronisation:
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# timedatectl set-ntp true
|
|
----
|
|
+
|
|
Correct time if necessary:
|
|
+
|
|
[source,]
|
|
----
|
|
[…]# timedatectl set-time <TIME>
|
|
----
|