216 lines
4.8 KiB
Markdown
216 lines
4.8 KiB
Markdown
# Fedora Server
|
|
|
|
- [Fedora Server](#fedora-server)
|
|
- [Installation](#installation)
|
|
- [Setup SSH](#setup-ssh)
|
|
- [DNF](#dnf)
|
|
- [Fail2Ban](#fail2ban)
|
|
- [Automatic Updates](#automatic-updates)
|
|
- [Disable Swap](#disable-swap)
|
|
- [Selinux](#selinux)
|
|
- [Firewalld](#firewalld)
|
|
- [Extras](#extras)
|
|
- [Downgrading Kernel](#downgrading-kernel)
|
|
|
|
<https://docs.fedoraproject.org/en-US/fedora-server/installation/postinstallation-tasks/#_manage_system_updates>
|
|
|
|
Note these instructions differentiate between an `operator` and a `server`. The operator can be
|
|
any machine that configure the server. A pipeline, laptop, dedicated server, etc. are all options.
|
|
The server can be its own operator, though that's not recommended since servers should be ephemeral
|
|
and the operator will store information about each server.
|
|
|
|
## Installation
|
|
|
|
1. Make sure to use `custom` disk partitioner and select `btrfs`.
|
|
2. Create an administrator. We'll give ssh root access later, but this gives you a cockpit user.
|
|
3. Ensure IPV6 connection is set to "eui64".
|
|
4. Set hostname
|
|
|
|
## Setup SSH
|
|
|
|
On the operator:
|
|
|
|
```bash
|
|
export SSH_HOST=kube
|
|
ssh-keygen -t rsa -b 4096 -C ducoterra@"$SSH_HOST".reeselink.com -f ~/.ssh/id_"$SSH_HOST"_rsa
|
|
|
|
# Note: If you get "too many authentication failures" it's likely because you have too many private
|
|
# keys in your ~/.ssh directory. Use `-o PubkeyAuthentication` to fix it.
|
|
ssh-copy-id -o PubkeyAuthentication=no -i ~/.ssh/id_"$SSH_HOST"_rsa.pub ducoterra@"$SSH_HOST".reeselink.com
|
|
|
|
cat <<EOF >> ~/.ssh/config
|
|
|
|
Host ${SSH_HOST}
|
|
Hostname ${SSH_HOST}.reeselink.com
|
|
User root
|
|
ProxyCommand none
|
|
ForwardAgent no
|
|
ForwardX11 no
|
|
Port 22
|
|
KeepAlive yes
|
|
IdentityFile ~/.ssh/id_${SSH_HOST}_rsa
|
|
EOF
|
|
```
|
|
|
|
On the server:
|
|
|
|
```bash
|
|
# Copy authorized_keys to root
|
|
sudo cp ~/.ssh/authorized_keys /root/.ssh/authorized_keys
|
|
|
|
# Change your password
|
|
passwd
|
|
|
|
sudo su -
|
|
echo "PasswordAuthentication no" > /etc/ssh/sshd_config.d/01-prohibit-password.conf
|
|
echo '%wheel ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/01-nopasswd-wheel
|
|
systemctl restart sshd
|
|
```
|
|
|
|
On the operator:
|
|
|
|
```bash
|
|
# Test if you can SSH with a password
|
|
ssh -o PubkeyAuthentication=no ducoterra@${SSH_HOST}.reeselink.com
|
|
|
|
# Test that you can log into the server with ssh config
|
|
ssh $SSH_HOST
|
|
```
|
|
|
|
## DNF
|
|
|
|
Configure dnf to use the fastest mirror:
|
|
|
|
```bash
|
|
echo 'fastestmirror=1' >> /etc/dnf/dnf.conf
|
|
dnf clean all
|
|
dnf update
|
|
```
|
|
|
|
## Fail2Ban
|
|
|
|
On the server:
|
|
|
|
```bash
|
|
dnf install -y fail2ban
|
|
|
|
# Setup initial rules
|
|
cat <<EOF > /etc/fail2ban/jail.local
|
|
# Jail configuration additions for local installation
|
|
|
|
# Adjust the default configuration's default values
|
|
[DEFAULT]
|
|
# Optional enter an trusted IP never to ban
|
|
# ignoreip = 2600:1700:1e6c:a81f::0/64
|
|
bantime = 6600
|
|
backend = auto
|
|
|
|
# The main configuration file defines all services but
|
|
# deactivates them by default. We have to activate those neeeded
|
|
[sshd]
|
|
enabled = true
|
|
EOF
|
|
|
|
systemctl enable fail2ban --now
|
|
tail -f /var/log/fail2ban.log
|
|
```
|
|
|
|
## Automatic Updates
|
|
|
|
On the server:
|
|
|
|
```bash
|
|
dnf install dnf-automatic -y
|
|
|
|
systemctl enable --now dnf-automatic.timer
|
|
```
|
|
|
|
Edit the configuration to only do security updates.
|
|
|
|
## Disable Swap
|
|
|
|
```bash
|
|
swapoff -a
|
|
zramctl --reset /dev/zram0
|
|
dnf -y remove zram-generator-defaults
|
|
```
|
|
|
|
## Selinux
|
|
|
|
By default selinux will be enforcing. You can set it to permissive with
|
|
|
|
```bash
|
|
setenforce 0
|
|
```
|
|
|
|
And then make it permanent by editing `/etc/selinux/config` and inserting `SELINUX=permissive`.
|
|
|
|
## Firewalld
|
|
|
|
Set the default firewalld zone to `public`
|
|
|
|
```bash
|
|
firewall-cmd --set-default-zone=public
|
|
```
|
|
|
|
Firewalld will be on and blocking by default. You can check the zone and allowed ports with:
|
|
|
|
```bash
|
|
firewall-cmd --zone=public --list-ports
|
|
firewall-cmd --zone=public --list-services
|
|
```
|
|
|
|
Allow Cockpit with
|
|
|
|
```bash
|
|
firewall-cmd --permanent --zone=public --add-port=9090/tcp
|
|
firewall-cmd --reload
|
|
```
|
|
|
|
## Extras
|
|
|
|
On the server:
|
|
|
|
```bash
|
|
# Set vim as the default editor
|
|
dnf install -y vim-default-editor --allowerasing
|
|
|
|
# Install glances for system monitoring
|
|
dnf install -y glances
|
|
|
|
# Install zsh with autocomplete and suggestions
|
|
dnf install -y zsh zsh-autosuggestions zsh-syntax-highlighting
|
|
|
|
cat <<EOF > ~/.zshrc
|
|
# Basic settings
|
|
autoload bashcompinit && bashcompinit
|
|
autoload -U compinit; compinit
|
|
zstyle ':completion:*' menu select
|
|
|
|
# Prompt settings
|
|
autoload -Uz promptinit
|
|
promptinit
|
|
prompt redhat
|
|
PROMPT_EOL_MARK=
|
|
|
|
# Syntax Highlighting
|
|
source /usr/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
|
|
source /usr/share/zsh-autosuggestions/zsh-autosuggestions.zsh
|
|
|
|
### Custom Commands and Aliases ###
|
|
EOF
|
|
|
|
chsh -s $(which zsh) && chsh -s $(which zsh) ducoterra
|
|
```
|
|
|
|
## Downgrading Kernel
|
|
|
|
```bash
|
|
dnf install koji
|
|
|
|
# Note: format is kernel-version.fedora-version
|
|
cd $(mktemp -d) && koji download-build --arch=x86_64 --arch=noarch kernel-6.11.3-300.fc41 && dnf install ./*
|
|
|
|
reboot
|
|
```
|