# Ubuntu Server - Installation

# Server Install Checklist



# Server

## Server Checklist

<table border="1" id="bkmrk-step-%E2%88%9A-to-do-%C2%A0-%C2%A0-pre" style="border-collapse: collapse; width: 100%; height: 1164px;"><tbody><tr style="height: 28px;"><td style="width: 10%; height: 28px;">Step</td><td style="width: 10%; height: 28px;">√</td><td style="width: 80%; height: 28px;">To Do</td></tr><tr style="height: 68px;"><td style="width: 10%; height: 68px;"> </td><td style="width: 10%; height: 68px;"> </td><td style="width: 80%; height: 68px;">#### Preparation

</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">1</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Install server image](https://docs.azandi.co.za/books/ubuntu-server-installation/page/server-image-installation)</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">2</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Change default shell](https://docs.azandi.co.za/books/ubuntu-server-installation/page/change-the-default-shell)</td></tr><tr><td style="width: 10%;">3</td><td style="width: 10%;"> </td><td style="width: 80%;">[Disable AppArmor and APPort](https://docs.azandi.co.za/books/ubuntu-server-installation/page/disable-apparmor-and-apport)</td></tr><tr style="height: 68px;"><td style="width: 10%; height: 68px;"> </td><td style="width: 10%; height: 68px;"> </td><td style="width: 80%; height: 68px;">#### System Update

</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">4</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Update with the latest updates](https://docs.azandi.co.za/books/ubuntu-server-installation/page/update-with-the-latest-updates)</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">5</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Configure automatic updates](https://docs.azandi.co.za/books/ubuntu-server-installation/page/configure-automatic-updates)</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">6</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Configure network time protocol (NTP)](https://docs.azandi.co.za/books/ubuntu-server-installation/page/configure-network-time-protocol-%28ntp%29)</td></tr><tr style="height: 68px;"><td style="width: 10%; height: 68px;"> </td><td style="width: 10%; height: 68px;"> </td><td style="width: 80%; height: 68px;">#### Process Hardening

</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">7</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Restrict core dumps](https://docs.azandi.co.za/books/ubuntu-server-installation/page/restrict-core-dumps)</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">8</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Enable randomized virtual memory region placement](https://docs.azandi.co.za/books/ubuntu-server-installation/page/enable-randomized-virtual-memory-region-placement)</td></tr><tr style="height: 68px;"><td style="width: 10%; height: 68px;"> </td><td style="width: 10%; height: 68px;"> </td><td style="width: 80%; height: 68px;">#### OS Hardening

</td></tr><tr style="height: 56px;"><td style="width: 10%; height: 56px;">9</td><td style="width: 10%; height: 56px;"> </td><td style="width: 80%; height: 56px;">[Remove legacy services (e.g., telnetserver, rsh, rlogin, rcp, ypserv, ypbind, tftp, tftp-server, talk, talkserver)](https://docs.azandi.co.za/books/ubuntu-server-installation/page/remove-legacy-services)</td></tr><tr style="height: 56px;"><td style="width: 10%; height: 56px;">10</td><td style="width: 10%; height: 56px;"> </td><td style="width: 80%; height: 56px;">[Disable or remove server services that are not going to be utilized (e.g., FTP, DNS, LDAP, SMB, DHCP, NFS, SNMP, etc.)](https://docs.azandi.co.za/books/ubuntu-server-installation/page/disable-or-remove-server-services)</td></tr><tr style="height: 68px;"><td style="width: 10%; height: 68px;"> </td><td style="width: 10%; height: 68px;"> </td><td style="width: 80%; height: 68px;">#### Network Security and Firewall Configuration

</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">11</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Firewall configuration](https://docs.azandi.co.za/books/ubuntu-server-installation/page/firewall-configuration)</td></tr><tr style="height: 68px;"><td style="width: 10%; height: 68px;"> </td><td style="width: 10%; height: 68px;"> </td><td style="width: 80%; height: 68px;">#### Remote Administration Via SSH

</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">12</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Set SSH protocol to 2](https://docs.azandi.co.za/books/ubuntu-server-installation/page/set-ssh-protocol-to-2)</td></tr><tr style="height: 34px;"><td style="width: 10%; height: 34px;">13</td><td style="width: 10%; height: 34px;"> </td><td style="width: 80%; height: 34px;">[Disable SSH root login](https://docs.azandi.co.za/books/ubuntu-server-installation/page/disable-ssh-root-login)</td></tr><tr style="height: 28px;"><td style="width: 10%; height: 28px;">14</td><td style="width: 10%; height: 28px;"> </td><td style="width: 80%; height: 28px;">[Set SSH permitemptypasswords to no](https://docs.azandi.co.za/books/ubuntu-server-installation/page/set-ssh-permitemptypasswords-to-no)</td></tr><tr style="height: 68px;"><td style="width: 10%; height: 68px;"> </td><td style="width: 10%; height: 68px;"> </td><td style="width: 80%; height: 68px;">#### System Integrity and Intrusion Detection

</td></tr><tr style="height: 28px;"><td style="width: 10%; height: 28px;">14</td><td style="width: 10%; height: 28px;"> </td><td style="width: 80%; height: 28px;">[Install and configure Fail2Ban](https://docs.azandi.co.za/books/ubuntu-server-installation/page/install-and-configure-fail2ban)</td></tr><tr style="height: 28px;"><td style="width: 10%; height: 28px;">15</td><td style="width: 10%; height: 28px;"> </td><td style="width: 80%; height: 28px;">[Install and configure AIDE](https://docs.azandi.co.za/books/ubuntu-server-installation/page/install-and-configure-aide)</td></tr><tr style="height: 68px;"><td style="width: 10%; height: 68px;"> </td><td style="width: 10%; height: 68px;"> </td><td style="width: 80%; height: 68px;">#### Anti-Virus Considerations

</td></tr><tr style="height: 28px;"><td style="width: 10%; height: 28px;">16</td><td style="width: 10%; height: 28px;"> </td><td style="width: 80%; height: 28px;">[Install and enable anti-virus software](https://docs.azandi.co.za/books/ubuntu-server-installation/page/install-and-enable-anti-virus-software)</td></tr><tr style="height: 28px;"><td style="width: 10%; height: 28px;">17</td><td style="width: 10%; height: 28px;"> </td><td style="width: 80%; height: 28px;">[Configure daily scan](https://docs.azandi.co.za/books/ubuntu-server-installation/page/configure-daily-scan)</td></tr></tbody></table>

# Preparation



# Server Image Installation

## Server Image Installation

1. Browse to [**konsoleH**](http://myaccount.hetzner.co.za/) and **log in** at[ Admin level](https://hetzner.co.za/help-centre/accounts-and-payments/konsoleh-access-levels/)
2. Select or search for your Self-Managed server in the **Hosting Service** tab
3. Select **Linux Install** under **Recovery Tools** from the left-hand menu  
    [![01.png](https://docs.azandi.co.za/uploads/images/gallery/2020-04/scaled-1680-/tXAzvF7hyysFmwgM-01.png)](https://docs.azandi.co.za/uploads/images/gallery/2020-04/tXAzvF7hyysFmwgM-01.png)
4. Select the distribution of the **installation** that you wish to activate  
    [![02.png](https://docs.azandi.co.za/uploads/images/gallery/2020-04/scaled-1680-/YuubYLzVdKwgSl5n-02.png)](https://docs.azandi.co.za/uploads/images/gallery/2020-04/YuubYLzVdKwgSl5n-02.png)
5. Select **Activate** on the top right-hand side
6. **Reboot** your server within 10 minutes via the RMM / IPMI device
7. During the server startup process, you have the option to reconfigure your RAID (TruServ Commerce only) via the RAID controller bios.
8. The server will boot into the OS installation environment you selected in step 4
9. Follow the onscreen prompts to install your OS and configure your disks and partition layout
10. Once the install is complete your server will reboot into your installed OS and will be accessible
11. Access your server with the user(s) configured via SSH (some Linux distributions do not allow root logins by default over SSH).

# Change the Default Shell

## Change the Default Shell

/bin/sh is a symlink to /bin/dash, however we need /bin/bash, not /bin/dash

<span class="system">To change do the following</span>

1. <span class="system">Run the command below  
      
    `dpkg-reconfigure dash`  
      
    </span>
2. <span class="system">At the prompt type  
      
    `No`</span>

# Disable AppArmor And Apport

### Disable AppArmor and Apport

Both AppArmor and Apport can can be safely disabled. They cause more problems than solving them

#### Disable AppArmor

1. Run the below commands one after the other

```
service apparmor stop
update-rc.d -f apparmor remove
apt-get remove apparmor apparmor-utils
```

#### Disable Apport

1. Run the command below to disable Apport

```
systemctl disable apport.service
```

# System Update



# Update With The Latest Updates

### Updating the server with the latest updates

#### Adding additional repositories

1. Enable any additional and necessary software repositories by editing /etc/apt/sources.list

```
Open /etc/apt/sources.list
==========================

vi /etc/apt/sources.list

Enable repository by removing the # sign i.e.
=============================================

#deb http://de.archive.ubuntu.com/ubuntu/ xenial main restricted

to

deb http://de.archive.ubuntu.com/ubuntu/ xenial main restricted
```

#### Updating the server

1. Run the below commands one after the other, accepting the prompts

```
apt-get update

apt-get upgrade
```

# Configure Automatic Updates

### Setting up automatic updates

#### Installing <span class="app application">unattended-upgrades</span> package

1. Install unattended-upgrades package  
      
    `apt-get install unattended-upgrades`

#### Configuring unattended-upgrades

1. Edit <span class="file filename">/etc/apt/apt.conf.d/50unattended-upgrades</span> and adjust the following

```
Unattended-Upgrade::Allowed-Origins {
        "${distro_id}:${distro_codename}";
        "${distro_id}:${distro_codename}-security";
//      "${distro_id}:${distro_codename}-updates";
//      "${distro_id}:${distro_codename}-proposed";
//      "${distro_id}:${distro_codename}-backports";
};
```

#### Enable automatic updates

1. Edit <span class="file filename">/etc/apt/apt.conf.d/20auto-upgrades</span> and set the appropriate <span class="app application">apt</span> configuration options

```
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "7";
APT::Periodic::Unattended-Upgrade "1";
```

# Configure Network Time Protocol (NTP)

### Network Time Protocol (NTP) configuration

1. Synchronize the system clock with the command below

```
apt-get -y install ntp ntpdate
```

# Process Hardening



# Restrict Core Dumps

### Restricting Core Dumps

1. Add the below to the end of /etc/security/limits.conf  
      
    `root hard core 0`
2. Add the below to /etc/sysctl.d/60-own.conf  
      
    `fs.suid_dumpable=0`
3. Lastly, add the below to /etc/systemd/system.conf  
      
    `DumpCore=no`

# Enable Randomized Virtual Memory Region Placement

### Randomized virtual memory region placement

1. Add the below line to /etc/sysctl.conf  
      
    `kernel.randomize_va_space = 2`

# OS Hardening



# Remove Legacy Services

### The removal of legacy services

#### Check for legacy services

1. To check for legacy services, use the command the below

```
chkconfig --list
```

You should get an output similar to

[![03.PNG](https://docs.azandi.co.za/uploads/images/gallery/2020-04/scaled-1680-/r6RJro8aFj6SXYaW-03.PNG)](https://docs.azandi.co.za/uploads/images/gallery/2020-04/r6RJro8aFj6SXYaW-03.PNG)

#### Disable legacy services

1. Confirm the necessity of the service and disable if not necessary with the below command

```
chkconfig "service name" off

I.e to disable netconsole
=========================

chkconfig netconsole off
```

# Disable Or Remove Server Services

### Disable or remove server services that are not going to be utilized (e.g. FTP, DNS, LDAP, SMB, DHCP, NFS, SNMP, etc.)

#### Display a list of services available

1. To display a list of services available use the command the below

```
systemctl -t service
```

This will display something similar to

[![04.PNG](https://docs.azandi.co.za/uploads/images/gallery/2020-04/scaled-1680-/aBmv3MhEvlgAvkAf-04.PNG)](https://docs.azandi.co.za/uploads/images/gallery/2020-04/aBmv3MhEvlgAvkAf-04.PNG)

#### Disable unnecessary services

1. Stop and turn OFF auto-start services not needed

```
systemctl stop "service name"
systemctl disable "service name"

I.e. to stop and disable the Postfix service
============================================

systemctl stop postfix
systemctl disable postfix
```

# Network Security and Firewall Configuration



# Firewall Configuration

### Installing and configuring UFW (Uncomplicated Firewall)

<p class="callout info">Add sudo in front of the commands if you are using a normal account with sudo privileges</p>

#### Installing UFW

1. Use the command below to ensure that UFW is installed

```
apt-get install ufw
```

#### Setting up default policies

1. Use the commands the below to set/reset the firewall policies to default

```
ufw default deny incoming
ufw default allow outgoing
```

These commands set the defaults to deny incoming and allow outgoing connections

#### Allowing SSH connections

1. Allow SSH connections with the following command

```
ufw allow ssh
```

#### Enabling UFW

1. To enable UFW, use this command

```
ufw enable
```

You will receive a warning that says the command may disrupt existing SSH connections. We already set up a firewall rule that allows SSH connections, so it should be fine to continue. Respond to the prompt with y

#### Allowing other connections (examples)

##### Specific services

```
ufw allow http
```

##### Specific ports

```
ufw allow 80
```

##### Port ranges

```
ufw allow 6000:6007/tcp
ufw allow 6000:6007/udp
```

#### Denying connections

```
Denying services
================

ufw deny http

Denying a port
============

ufw deny 80
```

#### Checking UFW Status and Rules

```
ufw status verbose
```

The output should look similar to

```
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
```

# Remote Administration Via SSH



# Set SSH Protocol To 2

### Set SSH protocol to 2

SSH has two protocols it may use, protocol 1 and protocol 2. The older protocol 1 is less secure and should be disabled unless you know that you specifically require it.

1. Open the sshd config  
    `vi /etc/ssh/sshd_config`
2. Add or amend as shown below  
    `# Protocol 2,1<br></br>Protocol 2`
3. Restart the sshd service  
    `systemctl restart sshd.service`

# Disable SSH Root Login

### Disabling root login via SSH

Disabling SSH root login will add an extra layer of security. It would be more secure to brute force  
attacks or in case your password is stolen.

1. Create a non-root user  
      
    `adduser username`  
    `passwd username`
2. Open the ssh configuration file with your editor.  
      
    `vi /etc/ssh/sshd_config`
3. Add the line “PermitRootLogin no.” Or uncomment the line "#PermitRootLogin yes" and  
    change yes to no.  
      
    `#LoginGraceTime 2m`  
    `#PermitRootLogin yes`  
    `#StrictModes yes`  
    `#MaxAuthTries 6`  
    `#MaxSessions 10`  
    `PermitRootLogin no`
4. Save and exit the file.
5. Restart the ssh service  
      
    `systemctl restart sshd.service`

# Set SSH permitemptypasswords to no

### Set SSH permitemptypasswords to no

1. Open the ssh configuration file with your editor.  
      
    `<span role="presentation" style="padding-right: 0.1px;">vi /etc/ssh/sshd_config</span>`
2. Add or amend as shown below  
      
    `PermitEmptyPasswords no`
3. Restart the sshd service  
      
    `systemctl restart sshd.service`

# System Integrity and Intrusion Detection



# Install And Configure Fail2Ban

<p class="callout info">Add sudo in front of the commands if you are using a normal account with sudo privileges</p>

### Installation

1. Run the command below to install Fail2Ban

```
apt-get install fail2ban -y
```

#### Configuration

1. Copy the “jail.conf” file and re-save it with the name “jail.local”  
      
    `cp -pf /etc/fail2ban/jail.conf /etc/fail2ban/jail.local`
2. Edit the jail.local and add your local IP address onto the ***ignoreip*** line

```
[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1

# Override /etc/fail2ban/jail.d/00-firewalld.conf:
banaction = iptables-multiport

# "bantime" is the number of seconds that a host is banned.
bantime  = 600

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 600

# "maxretry" is the number of failures before a host get banned.
maxretry = 5
```

### Add a jail file to protect SSH access

1. Create a new file called sshd.local  
      
    `touch /etc/fail2ban/jail.d/sshd.local && chmod +x /etc/fail2ban/jail.d/sshd.local`
2. Edit the file and add the lines below

```
vi /etc/fail2ban/jail.d/sshd.local

Add these lines to the file
===========================

[sshd]
enabled = true
port = ssh
#action = firewallcmd-ipset
logpath = %(sshd_log)s
maxretry = 5
bantime = 86400
```

### Enable and start the FAIL2BAN service

1. Run the following commands to enable and start the Fail2Ban service

```
systemctl enable fail2ban
systemctl start fail2ban
```

# Install And Configure AIDE

<p class="callout info">Add sudo in front of the commands if you are using a normal account with sudo privileges</p>

### Install and configure Host Based IDS (Intrusion Detection System) "AIDE"

1. Install AIDE  
      
    `apt-get install aide -y`
2. Configure AIDE and initialize database. It's possible to use AIDE with default config but if you'd like to customize settings, change configuration file like follows. Setting rules are written near 26-84 lines, refer to them.  
      
    [![011.PNG](https://docs.azandi.co.za/uploads/images/gallery/2020-04/scaled-1680-/5pu8grfAPwGzoNoc-011.PNG)](https://docs.azandi.co.za/uploads/images/gallery/2020-04/5pu8grfAPwGzoNoc-011.PNG)
3. Execute checking

```
[root@dlp ~]# aide --check
# if thete is no unmatch, it displayed "Okay"

AIDE, version 0.15.1

### All files match AIDE database. Looks okay!

# try to change a file and check again
[root@dlp ~]# chmod 640 /root/anaconda-ks.cfg
[root@dlp ~]# aide --check
# detected differences like follows
AIDE 0.15.1 found differences between database and filesystem!!
Start timestamp: 2015-06-17 19:55:20

Summary:
  Total number of files:        39039
  Added files:                  0
  Removed files:                0
  Changed files:                1


---------------------------------------------------
Changed files:
---------------------------------------------------

changed: /root/anaconda-ks.cfg

---------------------------------------------------
Detailed information about changes:
---------------------------------------------------


File: /root/anaconda-ks.cfg
 Perm     : -rw-------                       , -rw-r-----
 Ctime    : 2015-05-24 02:22:04              , 2015-06-19 11:55:15
 ACL      : old = A:
----
user::rw-
group::---
other::---
----
                  D: <NONE>
            new = A:
----
user::rw-
group::r--
other::---
----
                  D: <NONE>
```

#### Update AIDE database

1. If there is no ploblem even if some differences are detected, then update database like follows

```
[root@dlp ~]# aide --update
AIDE 0.15.1 found differences between database and filesystem!!
Start timestamp: 2015-06-17 19:56:31

Summary:
  Total number of files:        39039
  Added files:                  0
  Removed files:                0
  Changed files:                1


---------------------------------------------------
Changed files:
---------------------------------------------------

changed: /root/anaconda-ks.cfg
.....
.....

# update database
[root@dlp ~]# cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
```

#### Add Cron job and email logs

1. Add in Cron if check regulary. Log file \[/var/log/aide/aide.log\] is updated every time and if there is no difference, it is updated with zero byte, so if you's like to save log files, it needs to create a shell script or send results via email or others

```
# for example, add daily check in Crontab and send results via email

[root@dlp ~]# vi /etc/cron.d/aide
00 01 * * * /usr/sbin/aide --update | mail -s 'Daily Check by AIDE' root
```

# Anti-Virus Considerations



# Install And Enable Anti-Virus Software

### Installation of ClamAV

1. Execute the command below to install Clamav and a tool to send email notifications  
      
    `apt-get update && apt-get install clamav clamav-freshclam heirloom-mailx`
2. Enable FreshClam for automatic virus definitions updates  
      
    `service ClamAV-freshclam start`
3. Do a manual update of the virus definition  
      
    `freshclam -v`

# Configure Daily Scan

### Configure ClamAV for daily scans

1. Create and edit the file clamscan\_daily in the folder /etc/cron.daily

```
Create clamscan_daily
=====================

vi /etc/cron.daily

=====================================
Add below to file changing the option

EMAIL_FROM="from email address";
EMAIL_TO="to email address";
DIRTOSCAN="list of directories";

as required
=====================================

#!/bin/bash
LOGFILE="/var/log/clamav/clamav-$(date +'%Y-%m-%d').log";
EMAIL_MSG="Please see the log file attached.";
EMAIL_FROM="from email address";
EMAIL_TO="to email address";
DIRTOSCAN="list of directories";

for S in ${DIRTOSCAN}; do
 DIRSIZE=$(du -sh "$S" 2>/dev/null | cut -f1);

 echo "Starting a daily scan of "$S" directory.
 Amount of data to be scanned is "$DIRSIZE".";

 clamscan -ri "$S" >> "$LOGFILE";

 # get the value of "Infected lines"
 MALWARE=$(tail "$LOGFILE"|grep Infected|cut -d" " -f3);

 # if the value is not equal to zero, send an email with the log file attached
 if [ "$MALWARE" -ne "0" ];then
 # using heirloom-mailx below
 echo "$EMAIL_MSG"|mail -a "$LOGFILE" -s "Malware Found" -r "$EMAIL_FROM" "$EMAIL_TO";
 fi
done

exit 0

```