Configuring a New Cloud Server

The goal is simple: keep the server from being compromised and turned into someone else’s bot.

Notes

Host: Vultr Japan. System: Ubuntu 12.04 64-bit.

After logging in as root for the first time, install Vim to make the remaining changes easier:

apt-get install vim

Change the default SSH port and disable root login

Edit /etc/ssh/sshd_config, choose a non-default port, and disable direct root access:

Port 23333
PermitRootLogin no

Restart SSH after saving the file:

service ssh restart
# or
/etc/init.d/ssh restart

Add a separate login user

useradd testuser
passwd testuser

Change the user’s default shell from /bin/sh to /bin/bash in /etc/passwd; otherwise command completion will not work as expected.

vim /etc/passwd

Grant administrator privileges

Use visudo so concurrent edits cannot corrupt the sudoers file. Its default editor is vi; set EDITOR=vim for this invocation if preferred:

EDITOR=vim visudo

Add the user and allow passwordless sudo if that is appropriate for the server:

testuser ALL=(ALL) NOPASSWD:ALL
# or
testuser ALL=(root) NOPASSWD:ALL

Finally, add familiar aliases and terminal colors to the new user’s shell configuration. Key-based SSH login can also be configured, although I did not consider it necessary for this server. These steps reduce routine SSH risk, but they do not protect a server against DDoS attacks.

Originally published on SegmentFault.