book

Mastering Ubuntu Server - Third Edition

by Jay LaCroix

December 2020

Beginner

702 pages

18h 33m

English

Packt Publishing

Read now

Unlock full access

Who this book is forWhat this book coversTo get the most out of this bookGet in touch
Technical requirementsDetermining your server's roleSetting up our serverVirtual machinePhysical serverVirtual private serverSpare desktop or laptopRaspberry PiObtaining installation mediaCreating a bootable flash drivePlanning the partitioning layoutInstalling Ubuntu ServerInstalling mediaCustomizing the installationConfiguring the server's diskCreating the initial user accountInstalling Ubuntu on a Raspberry PiSummaryFurther Reading
Understanding users and groupsUnderstanding when to use rootUsing sudo to run privileged commandsCreating and removing usersUsing useraddUsing adduserRemoving usersUnderstanding the /etc/passwd and /etc/shadow filesUsing /etc/passwdUsing /etc/shadowDistributing default configuration files with /etc/skelSwitching usersManaging groupsManaging passwords and password policiesLocking and unlocking user accountsSetting password expiration informationSetting a password policyConfiguring administrator access with sudoSetting permissions on files and directoriesViewing permissionsChanging permissionsChanging the ownership of objectsSummaryFurther reading
Understanding Linux package managementUnderstanding the differences between Debian and Snap packagesDebian packagesSnap packagesInstalling and removing softwareManaging Debian packages with aptManaging Snap packages with snapSearching for packagesManaging package repositoriesAdding additional repositoriesAdding Personal Package ArchivesBacking up and restoring Debian packagesCleaning up orphaned apt packagesTaking advantage of hardware enablement updatesSummaryFurther reading
Learning essential Linux commandsUnderstanding the Linux filesystem layoutViewing the contents of filesViewing application log filesSummaryFurther reading
Copying, moving, and renaming files and directoriesEditing files with the Nano and Vim text editorsEditing with NanoEditing with VimInput and output streamsUsing symbolic and hard linksSummaryFurther reading
Understanding the Linux shellUnderstanding Bash historyLearning some useful command-line tricksUnderstanding variablesWriting simple scriptsPutting it all together – Writing an rsync backup scriptSummaryFurther reading
Managing jobsUnderstanding the ps commandViewing running processes with psConfiguring arguments to psChanging the priority of processesDealing with misbehaving processesManaging system processesScheduling tasks with cronSummaryFurther reading
Viewing disk usageUsing dfDiving deeper into disk usageMonitoring memory usageUnderstanding server memoryManaging swapUnderstanding load averageViewing resource usage with htopSummaryFurther reading
Adding additional storage volumesFormatting and partitioning storage devicesCreating a partitionFormatting partitionsMounting and unmounting volumesUnderstanding the /etc/fstab fileAnalyzing the contents of /etc/fstabAdding to the /etc/fstab fileBacking up and restoring volumesUtilizing LVMGetting started with LVMFormatting logical volumesRemoving volumes with LVMUnderstanding LVM snapshotsSummaryFurther reading

Setting the hostnameManaging network interfacesAssigning static IP addressesUnderstanding Linux name resolutionGetting started with OpenSSHInstalling OpenSSHIssuing commands with OpenSSHGetting started with SSH key managementGenerating public and private keysCopying your public key to a remote serverUtilizing an SSH agentChanging the passphrase of an OpenSSH keySimplifying SSH connections with a config fileSummaryFurther reading
Planning your IP address schemeSetting up a DHCP server for serving IP addressesAdding a DNS serverSetting up external DNS with bindSetting up internal DNS and adding hostsSetting up an internet gatewayKeeping your clock in sync with NTPSummaryFurther reading
File server considerationsSharing files with Windows users via SambaSetting up NFS sharesTransferring files with rsyncTransferring files with SCPMounting remote directories with SSHFSSummaryFurther reading
Preparations for setting up a database serverInstalling MariaDBUnderstanding the MariaDB configuration filesManaging MariaDB databasesSetting up a secondary database serverSummaryFurther reading
Installing and configuring ApacheInstalling additional Apache modulesSecuring Apache with TLSInstalling and configuring NGINXSetting up failover with keepalivedSetting up and configuring NextcloudSummaryFurther reading
Understanding the need for configuration managementWhy Ansible?Creating a Git repositoryGetting started with AnsibleMaking your servers do your biddingSetting up an inventory file and configuring Ansible settingsConfiguring client serversPutting it all together – automating web server deploymentUsing Ansible's pull methodSummaryFurther reading
Prerequisites and considerationsSetting up a virtual machine serverCreating virtual machinesBridging the virtual machine networkSimplifying virtual machine creation with cloningManaging virtual machines via the command lineSummaryFurther reading
What is containerization?Understanding the differences between Docker and LXDInstalling DockerManaging Docker containersAutomating Docker image creation with DockerfilesManaging LXD containersSummaryFurther reading
Container orchestrationPreparing a lab environment for Kubernetes testingUtilizing MicroK8sInstalling MicroK8s on LinuxInstalling MicroK8s on macOSInstalling MicroK8s on WindowsInteracting with MicroK8sSetting up a Kubernetes clusterConfiguring DockerTesting DockerInstalling KubernetesDeploying containers via KubernetesSummaryFurther reading
Understanding the difference between on-premises and cloud infrastructureImportant considerations when considering cloud computing as a potential solutionBecoming familiar with some basic AWS conceptsCreating an AWS account Signing up for AWSImplementing basic user securityChoosing a regionDeploying Ubuntu as an AWS EC2 instanceSetting up an IAM Role for Session ManagerCreating an Ubuntu Server instance in AWSCreating and deploying Ubuntu AMI imagesAutomatically scaling Ubuntu EC2 deployments with Auto ScalingCreating a launch templateCreating an Auto Scaling groupCreating a load balancerKeeping costs down: understanding how to save money and make cost-effective decisionsViewing billing informationAdding a billing alertRemoving unneeded backupsRunning EC2 instances only when they're neededStopping or terminating unneeded EC2 instancesTaking cloud further: additional resources to grow your knowledgeOnline training and labsCertificationKeep experimenting and learningAWS documentationSummaryFurther reading
Why it's important to automate your infrastructureIntroduction to Terraform and how it can fit within your workflowInstalling TerraformAutomating an EC2 instance deploymentManaging security groups with TerraformUsing Terraform to destroy unused resourcesCombining Ansible with Terraform for a full deployment solutionSummary
Lowering your attack surfaceUnderstanding and responding to CVEsInstalling security updatesAutomatically installing patches with the Canonical Livepatch serviceMonitoring Ubuntu servers with Canonical's Landscape serviceSecuring OpenSSHInstalling and configuring Fail2banMariaDB best practices for secure database serversSetting up a firewallEncrypting and decrypting disks with LUKSLocking down sudoSummaryFurther reading
Evaluating the scopeConducting a root cause analysisViewing system logsTracing network issuesTroubleshooting resource issuesDiagnosing defective RAMSummaryFurther reading
Preventing disastersUtilizing Git for configuration managementImplementing a backup planReplacing failed RAID disksUtilizing bootable recovery mediaSummaryFurther reading

Content preview from Mastering Ubuntu Server - Third Edition

21 Securing Your Server

It seems like every month there are new reports about companies getting their servers compromised. In some cases, entire databases end up freely available on the internet, which may even include sensitive user information that can aid miscreants in stealing identities. Linux is a very secure platform, but it's only as secure as the administrator who sets it up. Security patches are made available on a regular basis, but they offer no value unless you install them. OpenSSH is indispensable for remote administration, but it's also a popular target for threat actors trying to break into servers. Backups are a must-have but are potentially useless if they're not tested regularly or they fall into the wrong hands. In some ...