Secure your new server

All our commands are for AlmaLinux 9 and Ubuntu 24.04 only

Open Your ssh and start typing the following commands

Update System

# AlmaLinux 9
dnf update

# Ubuntu 22.04
apt update

Set Time Zone

# Asia/Riyadh
# Africa/Cairo
timedatectl set-timezone 'Asia/Kuwait'

Checking timezone

date
# Mon Aug  1 12:08:29 +03 2022

Configure a Custom Hostname

hostnamectl set-hostname my-new-hostname

you must logout and login again to see updated hostname

Checking Hostname

hostname
# my-new-hostname

you must logout and login again to see updated hostname

Update Hosts file

vi /etc/hosts

Add your public ip alongside hostname after defined entries

# IPv4
...
127.0.0.1 localhost.localdomain localhost

# Add following Line
100.100.100.100 my-new-hostname.example.com my-new-hostname

# IPv6
2600:3c01::a123:b456:c789:d012 my-new-hostname.example.com my-new-hostname

Limit Users Account

Create the user, replacing example_user with your desired username

1. Create New User and assign password

# AlmaLinux 9
useradd example_user && passwd example_user

# Ubunut 22.04
adduser example_user && passwd example_user

2. Add the user to the wheel group for sudo privileges

# AlmaLinux 9
usermod -aG wheel example_user

# Ubunut 22.04
usermod -aG sudo example_user

3. Add public ssh keys if want (Optional if want to use ssh keys)

# Create the .ssh directory for example_user
mkdir -p /home/example_user/.ssh
chown example_user:example_user /home/example_user/.ssh
chmod 700 /home/example_user/.ssh

# Copy the SSH public key into authorized_keys

# Example command if you have the public key ready:
echo "your-ssh-public-key-here" >> /home/example_user/.ssh/authorized_keys
# or
nano /home/example_user/.ssh/authorized_keys

# Set the correct permissions for the authorized_keys file
chmod 600 /home/example_user/.ssh/authorized_keys
chown example_user:example_user /home/example_user/.ssh/authorized_keys

4. Logout and in as the New User

exit

5. Logout and in as the New User

ssh [email protected]

6. Try Sudo

sudo su
# [example_user@my-new-hostname #]

7. In case sudo faild because sudoers file

   this mean the server is configred to prevent wheel group users

sudo su
# example_user is not in the sudoers file.  This incident will be reported.

8. fix sudoers file issue by allowing the user

   You must login as root user to allow your user

# After Login as root go to sudoers users
vi /etc/sudoers
# Then add the next line after root ALL=(ALL) ALL
example_user ALL=(ALL)  ALL

9. fix sudoers file issue by allowing wheel group or sudo group

   you must login as root user

# After Login as root go to sudoers users
vi /etc/sudoers
# In AlmaLinux 97 If the wheel group is commented remove the leading '#' to allow it or add it if not found in the file
%wheel ALL=(ALL)       ALL

# In ubunut 22.04 If the wheel group is commented remove the leading '#' to allow it or add it if not found in the file
%sudo ALL=(ALL:ALL)       ALL

10. logout and login as example_user and try one more time step number 5

Now you can administer your Compute Instance from your new user account instead of root

Harden SSH Access

1. You can use SSH keys if you want i will continue with password

   To create an ssh key please follow this article

2. Disallow root logins over SSH

sudo vi /etc/ssh/sshd_config

Search for PermitRootLogin under Authentication and change to no

# Authentication:
...

# Default is PermitRootLogin yes
PermitRootLogin no

3. Disallow all users to connect by password but only login with SSH keys

   • Search for PasswordAuthentication in the file and if not found or it was commented please add or uncomment it by removing leading # then change to no
   • Search for PubkeyAuthentication in the file and if not found or it was commented please add or uncomment it by removing leading # then change to yes

PubkeyAuthentication yes

# Default is PasswordAuthentication yes
PasswordAuthentication no

4. Listen on only one internet protocol

   The SSH daemon listens for incoming connections over both IPv4 and IPv6 by default, if you need both protocols leave this step if not please disable what you don't need

This does not disable the protocol system-wide, it is only for the SSH daemon

Search for AddressFamily in the file and if not found or it was commented please add or uncomment it by removing leading # then change to inet for IPv4 or inet6 for IPv6

...
# Port 22
# Default is AddressFamily any
AddressFamily inet

5. Restart the SSH service to load the new configuration.

# AlmaLinux 9
sudo systemctl restart sshd

# Ubuntu 22.04
sudo systemctl restart ssh

6. try login with root and it will not login again