Linux Cheatsheet 20 — Production Server Setup

# 1. Update
apt update && apt upgrade -y
apt install -y vim git curl wget htop tmux fail2ban ufw \
              unattended-upgrades zsh

# 2. Hostname
hostnamectl set-hostname myserver.example.com

# 3. Time
timedatectl set-timezone UTC
timedatectl status

# 4. Create admin user
useradd -m -s /bin/bash -G sudo alice
echo 'alice ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/alice
mkdir -p /home/alice/.ssh
cp ~/.ssh/authorized_keys /home/alice/.ssh/
chown -R alice:alice /home/alice/.ssh
chmod 700 /home/alice/.ssh

# 5. SSH lockdown (see hardening cheatsheet)
# 6. Firewall
ufw allow OpenSSH
ufw allow http
ufw allow https
ufw enable

# 7. fail2ban
systemctl enable --now fail2ban

# 8. Disable root login
passwd -l root

/boot          1G
/              30G (root)
/var           50G
/home          10G+
swap           4G (or zram)
/data          remaining (LVM)

# /etc/sysctl.d/99-server.conf
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 65535
net.ipv4.tcp_max_syn_backlog = 65535
net.ipv4.ip_local_port_range = 1024 65535
net.ipv4.tcp_tw_reuse = 1
fs.file-max = 2097152
vm.swappiness = 10
kernel.dmesg_restrict = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1

# /etc/security/limits.conf
* soft nofile 65536
* hard nofile 65536
* soft nproc 32768

apt install unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades

timedatectl set-ntp on
timedatectl status

curl -L https://github.com/prometheus/node_exporter/releases/latest/download/node_exporter-1.8.0.linux-amd64.tar.gz | tar xz
mv node_exporter*/node_exporter /usr/local/bin/

cat > /etc/systemd/system/node_exporter.service <<EOF
[Unit]
Description=Node Exporter
[Service]
User=nobody
ExecStart=/usr/local/bin/node_exporter
Restart=always
[Install]
WantedBy=multi-user.target
EOF

systemctl enable --now node_exporter

0 2 * * * /opt/backup.sh

curl -fsSL https://get.docker.com | sh
usermod -aG docker alice
systemctl enable --now docker

{
  "log-driver": "json-file",
  "log-opts": { "max-size": "10m", "max-file": "3" },
  "live-restore": true
}

apt install certbot
certbot certonly --webroot -w /var/www -d example.com --email [email protected] --agree-tos

apt install caddy

cat > /etc/caddy/Caddyfile <<EOF
example.com {
    reverse_proxy localhost:8000
}
EOF

systemctl reload caddy

# Show authorized keys for each user
for u in $(getent passwd | cut -d: -f1); do
    f=/home/$u/.ssh/authorized_keys
    [ -r "$f" ] && echo "=== $u ===" && cat "$f"
done

alias ll='ls -lah'
alias ..='cd ..'
alias ...='cd ../..'
alias g='git'
alias k='kubectl'
alias d='docker'
alias dcu='docker compose up'
alias dcd='docker compose down'

export EDITOR=vim
export HISTSIZE=10000
export HISTFILESIZE=10000
shopt -s histappend

# Better history
HISTCONTROL=ignoredups:erasedups
PROMPT_COMMAND='history -a'

apt install -y \
    htop btop ncdu mtr-tiny \
    rsync restic \
    jq yq \
    ripgrep fd-find bat fzf \
    vim neovim tmux \
    iotop sysstat dstat \
    net-tools dnsutils whois nmap tcpdump \
    apt-transport-https ca-certificates \
    gpg curl wget

#cloud-config
users:
  - name: alice
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    ssh_authorized_keys:
      - ssh-ed25519 AAAA...

package_update: true
package_upgrade: true
packages:
  - fail2ban
  - ufw
  - htop

runcmd:
  - ufw allow OpenSSH
  - ufw allow http
  - ufw allow https
  - ufw enable
  - systemctl enable --now fail2ban