4x Affordable, 99.95% SLA, 24x& Video Support, 100+ Countires

Initial Cloud Server Setup With Debian 8

Introduction

When you first create a new Debian 8 server, there are a few configuration stages that you should take early on as part of the basic setup. This will increase the security and usability of your server and will give you a hard foundation for subsequent actions.

Step One Root Login

To log into your server, you will need to know your server's public IP addresses and the password for the "root" user's account. If you have not already logged into your server, you may want to follow the first tutorial in this successions, How to Connect to Your machine with SSH, which covers this processes in detail.

If you are not already connected to your server, go ahead and log in as the root user using the following command (equivalent the highlighted promise with your server's public IP addresses):

finish the login processes by accepting the informing about host authenticity, if it appears, then giving your root authentication (password or private key). If it is your first moment logging into the server, with a password, you will also be prompted to action the root password.

About Root

The root user is the administrative user in a linux environment that has very beamy rights. Because of the increased rights of the root account, you are actually discouraged from using it on an orderly basis. This is because part of the energy intrinsic with the root account is the ability to make very disastrous actions, even by accident.

The next stride is to set up an alternative user account with a reduced extent of influence for day-to-day work. We'll inform you how to attain increased rights during the times when you need them.

Step Two Create a New User

Once you are logged in as root, we're prepared to increase the new user account that we will use to log in from now on.

This instance creates a new user labelled "demo", but you should replace it with an user name that you like:

  • adduser demo

You will be requested a few asks, commencing with the account password.

Enter a tough password and, optionally, fill in any of the more information if you would like. This is not demanded and you can just knocked "ENTER" in any field you wish to skip.

Step Three Root Privileges

Now, we have a new user account with orderly account rights. However, we may sometimes need to do administrative tasks.

To elude having to log out of our normal user and log back in as the root account, we can set up what is known as "super user" or root rights for our normal account. This will allow our normal user to run controls with administrative rights by putting the promise sudo before each command.

Install Sudo

Debian 8 doesn't come with sudo installed, so let's install it with apt-get.

First, modify the inclined package index:

  • apt-get update

Then use this command to install sudo:

  • apt-get install sudo

Now you are able to use the sudo and visudo controls.

Grant Sudo Privileges

To increase these rights to our new user, we need to increase the new user to the "sudo" team. By failure, on Debian 8, users who be to the "sudo" team are allowed to use the sudo command.

As root, run this command to increase your new user to the sudo team (equivalent the highlighted promise with your new user):

  • usermod -a -G sudo demo

Now your user can run regulates with superior user rights! For more information about how this works, check out this sudoers tutorial.

The next stride in obtaining your server is to set up public key authentication for your new user. Setting this up will increase the security of your server by demanding a private SSH key to log in.

Generate a Key Pair

If you do not already have a ssh key set, which consists of a public and private key, you need to generate one. If you already have a key that you want to use, skip to the Copy the Public Key stride.

To generate a new key set, enter the following command at the terminal of your local device (ie. your computer):

  • ssh-keygen

Assuming your local user is labelled "localuser", you will see production that looks like the following:

ssh-keygen output
Generating public/private rsa key pair. Enter file in which to save the key (/Users/localuser/.ssh/id_rsa):

knocked return to accept this file name and way (or enter a new name).

Next, you will be prompted for a passphrase to obtain the key with. You may either enter a passphrase or leave the passphrase empty.

Note: If you leave the passphrase empty, you will be able to use the private key for authentication without entering a passphrase. If you enter a passphrase, you will need both the private key and the passphrase to log in. obtaining your keys with passphrases is more obtain, but both modes have their uses and are more obtain than basic password authentication.

This generates a private key, id_rsa, and a public key, id_rsa.pub, in the .ssh directory of the localuser's environment directory. Remember that the private key should not be overlapped with anyone who should not have accesses to your servers!

Copy the Public Key

After generating a ssh key set, you will want to copy your public key to your new server. We will cover two simple ways to do this.

Note: The ssh-copy-id mode will not work on F(x) data cloud if a ssh key was chosen during machine creation. This is because F(x) data cloud disables password authentication if a ssh key is present, and the ssh-copy-id relies on password authentication to copy the key.

If you are using F(x) data cloud and chosen a ssh key during machine creation, use action 2 instead.

Option 1: Use ssh-copy-id

If your local device has the ssh-copy-id script installed, you can use it to install your public key to any user that you have login credentials for.

Run the ssh-copy-id script by choosing the user and IP addresses of the server that you want to install the key on, like this:

  • ssh-copy-id demo@SERVER_IP_ADDRESS

After giving your password at the prompt, your public key will be increased to the far user's .ssh/authorized_keys file. The related private key can now be used to log into the server.

Option 2: Manually Install the Key

Assuming you generated a ssh key set using the preceding stride, use the following command at the terminal of your local device to print your public key (id_rsa.pub):

  • cat ~/.ssh/id_rsa.pub

This should print your public SSH key, which should look something like the following:

id_rsa.pub contents
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBGTO0tsVejssuaYR5R3Y/i73SppJAhme1dH7W2c47d4gOqB4izP0+fRLfvbz/tnXFz4iOP/H6eCV05hqUhF+KYRxt9Y8tVMrpDZR2l75o6+xSbUOMu6xN+uVF0T9XzKcxmzTmnV7Na5up3QM3DoSRYX/EP3utr2+zAqpJIfKPLdA74w7g56oYWI9blpnpzxkEd3edVJOivUkpZ4JoenWManvIaSdMTJXMy3MtlQhva+j9CgguyVbUkdzK9KKEuah+pFZvaugtebsU+bllPTB0nlXGIJk98Ie9ZtxuY3nCKneB+KjKiXrAvXUPCI9mWkYS/1rggpFmu3HbXBnWSUdf [email protected]

appoint the public key, and copy it to your clipboard.

Add Public Key to New Remote User

To enable the use of SSH key to authenticate as the new far user, you must increase the public key to a unique file in the user's environment directory.

On the server, as the root user, enter the following command to switch to the new user (equivalent your own user name):

  • su - demo

Now you will be in your new user's environment directory.

Create a new directory labelled .ssh and restrict its permissions with the following regulates:

  • mkdir .ssh
  • chmod 700 .ssh

Now ajar a file in .ssh labelled authorized_keys with a matter editor. We will use nano to edit the file:

  • nano .ssh/authorized_keys

Now attach your public key (which should be in your clipboard) by attaching it into the editor.

knocked CTRL-X to exit the file, then Y to save the actions that you made, then ENTER to confirm the file name.

Now restrict the permissions of the authorized_keys file with this command:

  • chmod 600 .ssh/authorized_keys

symbol this command once to return to the root user:

  • exit

Now you may SSH login as your new user, using the private key as authentication.

To read more about how key authentication works, read this tutorial: How To Configure SSH Key-Based Authentication on a linux Server.

Step Five Configure SSH

Now that we have our new account, we can obtain our server a tiny bit by adjusting its SSH daemon configuration (the app that allows us to log in remotely) to disallow far SSH accesses to the root account.

start by opening the configuration file with your matter editor as root:

  • nano /etc/ssh/sshd_config

Here, we have the action to disable root login through SSH. This is generally a more obtain setting since we can now accesses our server through our normal user account and increase rights when necessary.

To disable far root logins, we need to find the line that looks like this:

/etc/ssh/sshd_config (before)
#PermitRootLogin yes

You can alter this line to "no" like this if you want to disable root login:

/etc/ssh/sshd_config (after)
PermitRootLogin no

Disabling far root login is highly recommended on every server!

When you are completed making your actions, save and close the file using the mode we went over earlier (CTRL-X, then Y, then ENTER).

Reload SSH

Now that we have made our actions, we need to restart the SSH service so that it will use our new configuration.

symbol this to restart SSH:

  • systemctl restart ssh

Now, before we log out of the server, we should try-out our new configuration. We do not want to undo until we can confirm that new connections can be established successfully.

ajar a new terminal window. In the new window, we need to commence a new connection to our server. This moment, instead of using the root account, we want to use the new account that we created.

  • ssh demo@SERVER_IP_ADDRESS

You will be prompted for the new user's password that you configured. After that, you will be logged in as your new user.

Remember, if you need to run a command with root rights, symbol "sudo" before it like this:

  • sudo command_to_run

If all is well, you can exit your sessions by writing :

  • exit

Where To Go From Here?

At this point, you have a rigid foundation for your Debian 8 server. You can install any of the app you need on your server now.

Reference: digitalocean