Ubuntu初期設定

adduser cardano

New password:           # パスワードを設定
Retype new password:    # 確認のため再入力

Enter the new value, or press ENTER for the default
        Full Name []:   # フルネーム等の情報を設定（不要であればブランクでも問題ありません）
        Room Number []:
        Work Phone []:
        Home Phone []:
        Other []:
Is the information correct? [Y/n] : y

usermod -aG sudo cardano

exit

grep -qxF 'set enable-bracketed-paste off' ~/.inputrc 2>/dev/null || echo 'set enable-bracketed-paste off' >> ~/.inputrc

echo "\$nrconf{restart} = 'a';" | sudo tee /etc/needrestart/conf.d/50local.conf

echo "\$nrconf{blacklist_rc} = [qr(^cardano-node\\.service$) => 0, qr(^cnode-blocknotify\\.service$) => 0, qr(^cnode-cncli-sync\\.service$) => 0,];" | sudo tee -a /etc/needrestart/conf.d/50local.conf

mkdir -p ~/.ssh

chown -R "$USER:$USER" ~/.ssh
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

PORT_NUM=""

sudo tee /etc/ssh/sshd_config.d/01-custom-ssh.conf > /dev/null << EOF
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
PermitEmptyPasswords no
Port ${PORT_NUM}
EOF

sudo sshd -t

sudo sshd -T | grep -iE 'passwordauthentication|kbdinteractiveauthentication|permitrootlogin|port'

port xxxxx
permitrootlogin no
passwordauthentication no
kbdinteractiveauthentication no
gatewayports no

sudo systemctl status ssh.socket

● ssh.socket - OpenBSD Secure Shell server socket
~~~
     Active: active (running) 

sudo systemctl daemon-reload

sudo systemctl restart ssh.socket

sudo ss -tlnp | grep ssh

LISTEN 0 4096 0.0.0.0:<設定したSSH Port>  
LISTEN 0 4096 [::]:<設定したSSH Port>  

SSH_PORT=$(sudo sshd -T | awk '$1=="port"{print $2}')

echo "有効なSSHポート: ${SSH_PORT}"

sudo ufw allow ${SSH_PORT}/tcp

sudo ufw --force enable

sudo ufw status

Status: active

sudo apt update && sudo apt full-upgrade -y

sudo apt autoremove -y

sudo apt autoclean -y

sudo apt install unattended-upgrades -y

sudo dpkg-reconfigure --priority=low unattended-upgrades

echo 'tmpfs /run/shm tmpfs ro,noexec,nosuid 0 0' | sudo tee -a /etc/fstab

tail -n 1 /etc/fstab

tmpfs /dev/shm tmpfs ro,noexec,nosuid 0 0

sudo apt install nano fail2ban -y

sudo nano /etc/fail2ban/jail.local

[sshd]
enabled = true
port = (SSHポートを入力してください)
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 24h
findtime = 10m
backend = systemd

sudo systemctl enable --now fail2ban

sudo systemctl status fail2ban --no-pager

● fail2ban.service - Fail2Ban Service
~~~
     Active: active (running)

sudo apt install chrony -y

sudo mv /etc/chrony/chrony.conf /etc/chrony/chrony-bk.conf

cat > $HOME/chrony.conf << EOF
pool time.google.com       iburst minpoll 2 maxpoll 2 maxsources 3 maxdelay 0.3
pool time.facebook.com     iburst minpoll 2 maxpoll 2 maxsources 3 maxdelay 0.3
pool time.euro.apple.com   iburst minpoll 2 maxpoll 2 maxsources 3 maxdelay 0.3
pool time.apple.com        iburst minpoll 2 maxpoll 2 maxsources 3 maxdelay 0.3
pool ntp.ubuntu.com        iburst minpoll 2 maxpoll 2 maxsources 3 maxdelay 0.3

# This directive specify the location of the file containing ID/key pairs for
# NTP authentication.
keyfile /etc/chrony/chrony.keys

# This directive specify the file into which chronyd will store the rate
# information.
driftfile /var/lib/chrony/chrony.drift

# Uncomment the following line to turn logging on.
#log tracking measurements statistics

# Log files location.
logdir /var/log/chrony

# Stop bad estimates upsetting machine clock.
maxupdateskew 5.0

# This directive enables kernel synchronisation (every 11 minutes) of the
# real-time clock. Note that it can’t be used along with the 'rtcfile' directive.
rtcsync

# Step the system clock instead of slewing it if the adjustment is larger than
# one second, but only in the first three clock updates.
makestep 0.1 -1

# Get TAI-UTC offset and leap seconds from the system tz database
leapsectz right/UTC

# Serve time even if not synchronized to a time source.
local stratum 10
EOF

sudo mv $HOME/chrony.conf /etc/chrony/chrony.conf

sudo ufw allow 123/udp

sudo systemctl reload-or-restart chrony.service

sudo sysctl --system