<h2 id="install-software">Install software</h2>
<pre><code class="lang-bash">apt update
apt install nginx python3-pip build-essential python3-dev git gcc fail2ban socat -y
unattended-upgrade -d -v
</code></pre>
<h2 id="change-hostname">Change hostname</h2>
<pre><code class="lang-bash">hostname myserver
vim /etc/hostname
<span class="hljs-comment"># change to myserver</span>
</code></pre>
<h2 id="change-root-password">Change root password</h2>
<pre><code class="lang-bash">passwd
</code></pre>
<h2 id="add-user-and-add-ssh-pub-key">Add user and add ssh pub key</h2>
<pre><code class="lang-bash">useradd -m john
<span class="hljs-built_in">cd</span> /home/john
su john
mkdir .ssh
<span class="hljs-built_in">cd</span> .ssh
vim authorized_keys
// put ssh pub key inside
chmod 640 authorized_keys
</code></pre>
<h2 id="change-sshd-config">Change sshd config</h2>
<pre><code><span class="hljs-string">vim</span> <span class="hljs-string">/etc/ssh/sshd_config</span>
<span class="hljs-comment"># set:</span>
<span class="hljs-string">Port</span> <span class="hljs-number">32200</span>
<span class="hljs-string">PermitRootLogin</span> <span class="hljs-literal">no</span>
<span class="hljs-string">PasswordAuthentication</span> <span class="hljs-literal">no</span>
<span class="hljs-string">PubkeyAuthentication</span> <span class="hljs-literal">yes</span>
<span class="hljs-string">ChallengeResponseAuthentication</span> <span class="hljs-literal">no</span>
<span class="hljs-comment"># restart</span>
<span class="hljs-string">service</span> <span class="hljs-string">ssh</span> <span class="hljs-string">restart</span>
</code></pre><h2 id="setup-firewall">Setup Firewall</h2>
<pre><code class="lang-bash">ufw allow 80
ufw allow 443
ufw allow 32200
ufw <span class="hljs-built_in">enable</span>
</code></pre>
<h2 id="install-acme">Install <code>acme</code></h2>
<pre><code>curl  https:<span class="hljs-comment">//get.acme.sh | sh</span>
cd ~/.acme.sh
./acme.sh --upgrade --<span class="hljs-keyword">auto</span>-upgrade
<span class="hljs-meta"># generate cert</span>
<span class="hljs-keyword">export</span> LINODE_V4_API_KEY=<span class="hljs-string">"&lt;your linode token&gt;"</span>
./acme.sh --issue --dns dns_linode_v4 --dnssleep <span class="hljs-number">1200</span> -d <span class="hljs-string">"*.example.com"</span> --<span class="hljs-built_in">log</span>
</code></pre><p><a href="http://acme.sh" class="autolinkedURL autolinkedURL-url" target="_blank">acme.sh</a> will auto set the crontab to renew it.</p>


## Install software

```bash
apt update
apt install nginx python3-pip build-essential python3-dev git gcc fail2ban socat -y
unattended-upgrade -d -v
```

## Change hostname

```bash
hostname myserver
vim /etc/hostname
# change to myserver
```

## Change root password

```bash
passwd
```

## Add user and add ssh pub key

```bash
useradd -m john
cd /home/john
su john
mkdir .ssh
cd .ssh
vim authorized_keys
// put ssh pub key inside
chmod 640 authorized_keys
```

## Change sshd config

```
vim /etc/ssh/sshd_config
# set:
Port 32200
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
ChallengeResponseAuthentication no
# restart
service ssh restart
```

## Setup Firewall

```bash
ufw allow 80
ufw allow 443
ufw allow 32200
ufw enable
```

## Install `acme`

```
curl  https://get.acme.sh | sh
cd ~/.acme.sh
./acme.sh --upgrade --auto-upgrade
# generate cert
export LINODE_V4_API_KEY="<your linode token>"
./acme.sh --issue --dns dns_linode_v4 --dnssleep 1200 -d "*.example.com" --log
```

acme.sh will auto set the crontab to renew it.



0xBF

0xBF

Setup Ubuntu Server Softwares

Install software

Change hostname

Change root password

Add user and add ssh pub key

Change sshd config

Setup Firewall

Install `acme`