First-Time Linux Server Setup

Overview

This guide walks you through securing and configuring a fresh Linux server installation. Whether you installed via USB, PXE, or in a VM, these steps apply to any Ubuntu/Debian or Fedora/RHEL server.

Step 1: Initial Login and Update

# SSH into your server (from another machine)
ssh username@server-ip

# Or login directly at the console

# Update system packages
sudo apt update && sudo apt upgrade -y        # Ubuntu/Debian
sudo dnf update -y                             # Fedora/RHEL

Step 2: Create a New User (Don't Use Root)

# Add new user
sudo adduser newusername

# Grant sudo privileges
sudo usermod -aG sudo newusername              # Ubuntu/Debian
sudo usermod -aG wheel newusername             # Fedora/RHEL

# Test the new account
su - newusername

Step 3: Set Up SSH Key Authentication

Passwords are vulnerable to brute-force attacks. Use SSH keys instead.

Generate Key Pair (On Your Local Machine)

# Generate a new ED25519 key (most secure)
ssh-keygen -t ed25519 -C "your-email@example.com"

# Or RSA 4096 for older systems:
ssh-keygen -t rsa -b 4096 -C "your-email@example.com"

Copy Public Key to Server

# Easy method (from your local machine):
ssh-copy-id newusername@server-ip

# Manual method:
# Copy the contents of ~/.ssh/id_ed25519.pub
# Then on the server:
mkdir -p ~/.ssh
nano ~/.ssh/authorized_keys
# Paste the public key, save and exit
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Test Key Login

# From your local machine:
ssh newusername@server-ip
# Should login without password prompt

Step 4: Harden SSH Configuration

sudo nano /etc/ssh/sshd_config

Modify these settings:

# Change default port (optional but reduces automated attacks)
Port 2222

# Disable root login
PermitRootLogin no

# Require key authentication only
PasswordAuthentication no
PubkeyAuthentication yes

# Limit login attempts
MaxAuthTries 3

# Set timeout
LoginGraceTime 30

Important: Test your new SSH config before disconnecting!

# Restart SSH service
sudo systemctl restart sshd                    # Ubuntu/Debian
sudo systemctl restart sshd                     # Fedora/RHEL

# Open new terminal and test connection BEFORE closing current session:
ssh -p 2222 newusername@server-ip

Step 5: Configure Firewall

Ubuntu/Debian (UFW)

# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH (use your custom port if changed)
sudo ufw allow 2222/tcp

# Allow HTTP/HTTPS (if running a web server)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable firewall
sudo ufw enable

Fedora/RHEL (firewalld)

# Start and enable firewalld
sudo systemctl enable --now firewalld

# Add rules permanently
sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https

# Reload to apply
sudo firewall-cmd --reload

Verify Firewall Status

sudo ufw status verbose                       # Ubuntu/Debian
sudo firewall-cmd --list-all                   # Fedora/RHEL

Step 6: Install Fail2Ban (Optional but Recommended)

Fail2Ban monitors logs and bans IPs showing malicious behavior.

# Ubuntu/Debian:
sudo apt install fail2ban -y

# Fedora/RHEL:
sudo dnf install fail2ban -y

# Create local config
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

# Edit jail.local to customize ban settings
sudo nano /etc/fail2ban/jail.local

# Enable and start
sudo systemctl enable --now fail2ban

Step 7: Set Up Time Synchronization

# Check time sync status
timedatectl

# Enable NTP synchronization
sudo timedatectl set-ntp true

# Set timezone (if needed)
sudo timedatectl list-timezones
sudo timedatectl set-timezone America/New_York

Step 8: Enable Automatic Security Updates

Ubuntu/Debian

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades
# Select "Yes" to enable automatic updates

Fedora/RHEL

sudo dnf install dnf-automatic -y
sudo nano /etc/dnf/automatic.conf
# Set: apply_updates = yes
sudo systemctl enable --now dnf-automatic.timer

Step 9: Basic Monitoring Setup

# Install htop for interactive process viewer
sudo apt install htop -y        # Ubuntu/Debian
sudo dnf install htop -y        # Fedora/RHEL

# Check disk usage
df -h

# Monitor memory and CPU
free -h
htop

# View system logs
journalctl -xe
tail -f /var/log/syslog         # Ubuntu/Debian
tail -f /var/log/messages       # Fedora/RHEL

Step 10: Set Up Backups

Local Backup with rsync

# Create backup script
nano /usr/local/bin/backup.sh

#!/bin/bash
BACKUP_DIR="/backups/$(date +%Y%m%d)"
mkdir -p $BACKUP_DIR
rsync -avz /etc/ $BACKUP_DIR/etc/
rsync -avz /home/ $BACKUP_DIR/home/
tar czf $BACKUP_DIR/database.sql.gz /path/to/db

# Make executable and add to crontab:
chmod +x /usr/local/bin/backup.sh
crontab -e
# Add: 0 2 * * * /usr/local/bin/backup.sh

Remote Backup

Use rsync over SSH to backup to another server:

rsync -avz -e ssh /important/data/ user@backup-server:/backups/

Server Setup Checklist