|
| 1 | +sudo apt-get update |
| 2 | +sudo apt-get install -y build-essential gcc screen git htop lsof strace \ |
| 3 | + emacs-nox nano patch libcap-dev python3-pip \ |
| 4 | + python3-setuptools python3-dev postgresql \ |
| 5 | + python-is-python3 |
| 6 | +sudo setcap cap_net_admin=eip $(realpath $(which python3)) |
| 7 | + |
| 8 | + |
| 9 | +# DOCKER INSTALL |
| 10 | +sudo apt-get install -y ca-certificates curl gnupg |
| 11 | + |
| 12 | +sudo install -m 0755 -d /etc/apt/keyrings |
| 13 | +sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc |
| 14 | +sudo chmod a+r /etc/apt/keyrings/docker.asc |
| 15 | + |
| 16 | +sudo tee /etc/apt/sources.list.d/docker.sources <<EOF |
| 17 | +Types: deb |
| 18 | +URIs: https://download.docker.com/linux/ubuntu |
| 19 | +Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") |
| 20 | +Components: stable |
| 21 | +Architectures: $(dpkg --print-architecture) |
| 22 | +Signed-By: /etc/apt/keyrings/docker.asc |
| 23 | +EOF |
| 24 | + |
| 25 | +sudo apt-get update |
| 26 | +sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin |
| 27 | + |
| 28 | +# Enable and start Docker |
| 29 | +sudo systemctl --now enable docker |
| 30 | + |
| 31 | +# Generate a safe random high port (between 49152 and 65535) |
| 32 | +SSHport=$(shuf -i 49152-65535 -n 1) |
| 33 | +#echo "Your randomized SSH port is: $SSHport" |
| 34 | + |
| 35 | +# Update sshd_config |
| 36 | +sudo sed -i -e "s/^#\?Port 22/Port $SSHport/" -e "s/^#\?GatewayPorts.*/GatewayPorts yes/" /etc/ssh/sshd_config |
| 37 | + |
| 38 | +# CRITICAL FOR UBUNTU since 22.10 : Disable systemd socket activation for SSH so it honors sshd_config |
| 39 | +if systemctl is-active --quiet ssh.socket; then |
| 40 | + echo "Disabling SSH socket activation and switching to standard SSH service..." |
| 41 | + sudo systemctl disable --now ssh.socket |
| 42 | + sudo systemctl enable --now ssh.service |
| 43 | +fi |
| 44 | +# OR |
| 45 | +# sudo systemctl daemon-reload |
| 46 | +# sudo systemctl restart ssh.socket |
| 47 | + |
| 48 | +sudo apt-get install -y nftables |
| 49 | +nft list ruleset |
| 50 | + |
| 51 | +# Write the rules to Ubuntu's default configuration path |
| 52 | +nano /etc/nftables.conf |
| 53 | +``` |
| 54 | +table inet filter { |
| 55 | + chain input { |
| 56 | + type filter hook input priority filter; policy drop; |
| 57 | + iif "lo" accept |
| 58 | + ct state established,related accept |
| 59 | + # Allow ping |
| 60 | + icmp type echo-request limit rate 5/second accept |
| 61 | + tcp dport $SSHport accept |
| 62 | + tcp dport 80 accept |
| 63 | + tcp dport 443 accept |
| 64 | + } |
| 65 | +} |
| 66 | +``` |
| 67 | + |
| 68 | +# Load the newly written rules immediately |
| 69 | +sudo nft -f /etc/nftables.conf |
| 70 | +# OR |
| 71 | +# nft add rule inet filter input tcp dport $SSHport accept |
| 72 | +# nft add rule inet filter input icmp type echo-request limit rate 5/second accept |
| 73 | + |
| 74 | +# Add custom TILEDVIZ tables and chains |
| 75 | +sudo nft add table ip filter |
| 76 | +sudo nft add chain ip filter TILEDVIZ |
| 77 | +sudo nft add rule ip filter TILEDVIZ tcp dport $SSHport accept |
| 78 | + |
| 79 | +# Enable and start nftables service on boot |
| 80 | +sudo systemctl --now enable nftables.service |
| 81 | + |
| 82 | +# Restart SSH to apply the randomized port |
| 83 | +sudo systemctl restart ssh |
| 84 | + |
| 85 | +USER="myuser" |
| 86 | +sudo usermod -a -G docker $USER |
| 87 | +# User must logout and login again. |
| 88 | + |
| 89 | +# copy SSL keys from local machine to VPS: |
| 90 | +rootVPS> chown $USER /path_to_keys/domain.my |
| 91 | +localUSER> rsync -e "ssh -T -p $SSHport " /local/SSLpath/domain.my/* $USER@host.docmain.my:/path_to_keys/domain.my |
| 92 | +rootVPS> chown root:root -R /path_to_keys/domain.my |
| 93 | +rootVPS> chmod o-rx /path_to_keys/domain.my |
| 94 | + |
| 95 | +localUSER> rsync -e "ssh -T -p $SSHport " $TILEDVIZPATH/InstalOS/daemon.json $USER@host.docmain.my:./ |
| 96 | +rootVPS> mv ~$USER/tmp/daemon.json /etc/docker/ |
| 97 | +rootVPS> chown root:root /etc/docker/daemon.json |
| 98 | +rootVPS> systemctl restart docker |
| 99 | + |
| 100 | + |
| 101 | +rootVPS> apt-get install -y fail2ban |
| 102 | +#nginx |
| 103 | + |
| 104 | +#rootVPS> mv /etc/nginx/nginx.conf /etc/nginx/nginx.conf_00 |
| 105 | +#rootVPS> cp $TILEDVIZ/TVWeb/nginx/nginx.conf /etc/nginx |
| 106 | +#rootVPS> systemctl enable --now nginx |
| 107 | +rootVPS> mkdir /var/log/nginx |
| 108 | +rootVPS> touch /var/log/nginx/access.log /var/log/nginx/upstream.log /var/log/nginx/error.log |
| 109 | + |
| 110 | +rootVPS> cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local |
| 111 | + |
| 112 | +rootVPS> sed -e 's&^\[sshd\]&[sshd]\nenabled=true\nbantime = 3600\nfindtime = 600\nmaxretry = 3&' -i /etc/fail2ban/jail.local |
| 113 | +rootVPS> sed -e "s&^port\ * = ssh&port = $SSHport&" -i /etc/fail2ban/jail.local |
| 114 | +rootVPS> sed -e 's&^\[\(nginx-.*\)\]&[\1]\nenabled=true&' -i /etc/fail2ban/jail.local |
| 115 | +#TODO : |
| 116 | +#* add nginx-botsearch2.conf |
| 117 | +#[nginx-botsearch2] |
| 118 | +#enabled=true |
| 119 | +#port = http,https |
| 120 | +#logpath = %(nginx_access_log)s |
| 121 | +#* Open php-url-fopen |
| 122 | +#[php-url-fopen] |
| 123 | +#enabled=true |
| 124 | + |
| 125 | +rootVPS> mv /etc/logrotate.d/nginx /root |
| 126 | + |
| 127 | +rootVPS> systemctl --now enable fail2ban |
| 128 | + |
| 129 | +# TODO : relaunch fail2ban after TiledViz to see nginx error files mount on host ? |
| 130 | +rootVPS> systemctl restart fail2ban |
| 131 | +rootVPS> fail2ban-client status --all |less |
| 132 | + |
| 133 | +# After TiledViz started : |
| 134 | +rootVPS> nft -nNsta list ruleset |less |
0 commit comments