www.bonsaiframework.com
Page tree
Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 157 Next »

Introduction

Describes production proven Bonsai Framework approach to setup of a Ubuntu Server version 22.

Bash script version is also maintained for quick setup.

Initial Setup

To follow through these tutorials you should have basic understanding of networks and know how to edit files on Ubuntu through terminal or sftp.

For security reasons may want to replace the account names in this tutorial especially setupadmin with something else of your choosing.

Download

If you are working for a large organization, it is recommended to use the LTS (Long Term Support) version,

https://www.ubuntu.com/download/server

Hosting at Home

Before paying for hosting, practice on your desktop using virtualization technology. If you have minimal needs, you might want to host from home. Follow this article for Home Server Virtualization.

Installing from Scratch in a Virtual Environment

Boot up your Virtual Server.

Be default, "*Try or Install Ubuntu Server" will be selected. Hit "Enter".

Language selection : Use the Up/Down arrow keys to select your language and then hit "Enter".

Installer update available : If you have a fast connection use "Update to the new installer". "Enter".

Keyboard configuration : "Enter" unless you have a special keyboard.

Choose type of install :

  1. Use your up arrow to move the cursor to "Search for third-party drivers" and hit space-bar to enable, it will select it like this "[X]"
  2. Go back down to "Done" and hit "Enter".

Network connections : You should see something under NAME adjacent to DHCPv4. Record it. In my case, ens33 and 10.0.0.211/24. "Enter".

Configure proxy : You should not be using a proxy for home use. "Enter".

Configure Ubuntu archive mirror : Some values will start showing up. You should see somethign like "Hit:1 http://...". Once you see "Reading package lists...", hit "Enter".

Guided storage confguration : Move to Done and "Enter".

Storage configuration : "Enter".

Confirm destruction action : select "Continue", "Enter"

Profile setup :

  • Your name: Setup Admin
  • Your server's name: tin (whatever you want, but don't use spaces or strange charcters)
  • Pick a username: setupadmin
  • Choose a password: The Bonsai Framework password standard should suffice.
  • Done

Upgrade to Ubuntu Pro : We won't need so "Enter".

SSH Setup : Hit space-bar to select then select "Done", "Enter".

Third-party driver : You may see "No applicable third-part drivers are available locally or online". That is fine. "Continue".

Featured Server Snaps : Navigate to "Done", "Enter".

Stuck : At this point you'll see the Ubuntu OS being installed and and when complete you'll see "Reboot Now", select and "Enter", you might see some messages,

  • [FAILED] Failed unmounting /cdrom
  • Please remove the installation medium, then press ENTER:

Go ahead and press "Enter" and you may love your mouse control for a bit. That's ok, just wait.

Reboot Complete : Due to quirk in virtual machines, you may not see your prompt to login. Instead you might see "[ OK ] Reached target Cloud-init target. That's ok, just hit "Enter" and then you'll see the login prompt. IN my case, "tin login: ".

Hosting Company

When using a hosting company, currently KVM based solutions the most cost effective where 1GB of RAM is required. See the Bonsai Framework discussion on Hosting for further details.

Cloud

You may also consider using Cloud with instructions here,

  • Azure (to write though it's pretty point and click)
  • AWS

Starting from a Server Hosted Solution

With most Virtual Server Hosting solutions you will be asked to select a virtual server image operating system which is then built as defined by the hosting provider. Some providers also allow you to install from a linked iso image which provides the most fined grained control and security.

Some hosting providers modify the Ubuntu Setup or only let you load a pre-configured image. In that case they are just asking for credentials.

With older hosting provider they may ask for a root password. Make sure to select a VERY complex password for the root account. It might be a little annoying, but as you walk through the article you will find that we actually stop using root altogether.

Modern Cloud servers like Microsoft Azure will create a default user account or provide option to provide your public ssh keys. For now choose password. SSH keys with how to load them into your OS will be covered later.

Login

The very first thing to do is to log into the server. There are two main types of login, remote and console.

With a remote login, you are not physically at the machine. This is often accomplished using SSH. By default following these instructions SSH login will not be enabled.

With a console login, you are for all intents and purposes physically at the server. Most hosted solution provide a web based interface to simulate this type of behaviour.

We'll start with console login in your virtual machine and you'll see something like below. Note your IPv4 address, in my case 10.0.0.211.

Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-91-generic x86_64)


 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage


  System information as of Thu Dec 21 06:18:18 AM UTC 2023


  System load:            0.009765625
  Usage of /:             8.4% of 57.77GB
  Memory usage:           19%
  Swap usage:             0%
  Processes:              201
  Users logged in:        1
  IPv4 address for ens33: 10.0.0.211
  IPv6 address for ens33: 2607:fea8:52a1:ce00::a5c2
  IPv6 address for ens33: 2607:fea8:52a1:ce00:20c:29ff:fe64:cfb1




Expanded Security Maintenance for Applications is not enabled.


44 updates can be applied immediately.
To see these additional updates run: apt list --upgradable


Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status




Last login: Thu Dec 21 06:14:05 2023
setupadmin@tin:~$

Security First

I usually immediately install fail2ban,

sudo apt-get install fail2ban

You don't need to know what it does right away (other than it blocks a user from logging for a period of time after too many incorrect passwords) but it makes your box much safer.

If your system is on the Internet and you only have SSH login with a user name and password, make sure it is strong. Your password can be broken in within minutes.

You also want to go straight to SSH RSA Key Based Authentication.

Synchronize Server Time

The ntp daemon calculates the drift of your system clock and continuously adjusts it. 

Determine the systems current timezone,

date # determine current timezone

If you did a fresh setup, you should have the correct time zone and you can skip this step. If your timezone is incorrect, change it,

sudo dpkg-reconfigure tzdata # sets the timezone

Before proceeding to below instructions, please do an update on ubuntu setup

sudo apt-get update # updates your basic installation

Install the ntp daemon,

sudo apt-get install ntp

If you do not want to spare the processing power and memory, consider using other approaches documented by the Ubuntu Community or the traditional cron approach.

Select a Locale

If you used a hosting company like Slice or Rackspace chances are the server image provided is minimal with no locale set. This will cause problems with Perl (used to install quite a few things) and in my case, it caused me head-aches setting up PostgreSQL.

locale # Look at your current locale.
LANG=en_CA.UTF-8
LC_CTYPE="en_CA.UTF-8"
LC_NUMERIC="en_CA.UTF-8"
LC_TIME="en_CA.UTF-8"
LC_COLLATE="en_CA.UTF-8"
LC_MONETARY="en_CA.UTF-8"
LC_MESSAGES="en_CA.UTF-8"
LC_PAPER="en_CA.UTF-8"
LC_NAME="en_CA.UTF-8"
LC_ADDRESS="en_CA.UTF-8"
LC_TELEPHONE="en_CA.UTF-8"
LC_MEASUREMENT="en_CA.UTF-8"
LC_IDENTIFICATION="en_CA.UTF-8"
LC_ALL=
setupadmin@tinman:~$

If the results show an error or the locale is not set up for UTF-8 as shown above, then run the following commands,

If you are not from Canada, you can choose another language, just make sure to use UTF-8.

sudo locale-gen en_CA.UTF-8
sudo update-locale LANG=en_CA.UTF-8

If you changed the locale, log off and then back on.

Finally, verify the locale changes took effect,

setupadmin@tinman:~$ locale
LANG=en_CA.UTF-8
LC_CTYPE="en_CA.UTF-8"
LC_NUMERIC="en_CA.UTF-8"
LC_TIME="en_CA.UTF-8"
LC_COLLATE="en_CA.UTF-8"
LC_MONETARY="en_CA.UTF-8"
LC_MESSAGES="en_CA.UTF-8"
LC_PAPER="en_CA.UTF-8"
LC_NAME="en_CA.UTF-8"
LC_ADDRESS="en_CA.UTF-8"
LC_TELEPHONE="en_CA.UTF-8"
LC_MEASUREMENT="en_CA.UTF-8"
LC_IDENTIFICATION="en_CA.UTF-8"
LC_ALL=
setupadmin@tinman:~$

Update Repositories

Check if you're up to date,

sudo update

Update Server

General Upgrades

Next perform a dist-upgrade. 

sudo apt-get dist-upgrade # upgrade to the newest kernel

Once you have applications and software running and stable, it is advisable to only perform incremental upgrades and judiciously perform dist-upgrades as appropriate.

During the update, all the update installers are downloaded to your system and kept there for future reference in case you need to re-install. With fast connections, this is not necessary. Clean up,

sudo apt-get autoclean # use this if you only want to clean out nolonger used packages
sudo apt-get clean # clean out all downloaded packages - I usually use this one
sudo apt-get autoremove # cleans out unused packages

Read Upgrading Ubuntu Packages for more in depth details.

Since this is still a fresh system, restart the system,

sudo reboot

Next Steps

Continue to Ubuntu Firewall Software.


  • No labels