Server config¶

2018

Linux installation¶

File system mount:

  • / : ro,suid,dev,exec,auto,nouser,async

  • /home : rw,suid,dev,noexec,auto,nouser,async

  • /tmp : rw,suid,dev, noexec,auto,nouser,async

  • /var : rw,suid,dev,noexec,auto,nouser,async

Be careful for the root directory, a read-only mount (ro) makes it impossible to modify the files. This may be intended in production, note that updates will not be possible. To modify the assembly, it is necessary to modify the fstab file in rescue mode.

Root access management¶

  • Installing sudo

su
apt install sudo

  • Sudo configuration, edit the /etc/sudoers file. For example ‘user’ can have access to all root rights on the server add the following line:

user      ALL=(ALL) ALL

Authentication with a public/private key¶

It is recommended to have a unique public/private key for each machine and each user. The private and public key is located in the ~/.ssh/ directory. Sine OpenSSH version 6.5, it is necessary to use the ed25519 algorithm.

Generating ed25519 Key:

ssh-keygen -o -a 100 -t ed25519 -f ~/.ssh/id_ed25519 -C "john@example.com"

Copy public key to file ~/.ssh/authorized_keys

Add a new machine to your ~/.ssh/config file to enable automatic authentication.

Host newyork
    HostName 127.0.0.1
    Port 2222
    User jdoe
    IdentityFile ~/.ssh/id_ed25519
    RequestTTY yes
    RemoteCommand tmux -u attach || tmux -u new

This configuration enables SSH connection multiplexing, allowing multiple sessions to the same host to share a single network connection, which speeds up subsequent connections and reduces repeated authentication prompts.

Host dev-server*
    ControlMaster auto
    ControlPath ~/.ssh/cm-%r@%h:%p
    ControlPersist 10m

Configuring sshd¶

Edit the /etc/ssh/sshd_config file to configure sshd.

  • Prohibit password authentication

# To disable tunneled clear text passwords both PasswordAuthentication and
# ChallengeResponseAuthentication must be set to "no".
PasswordAuthentication no

  • Prohibit root user authentication:

PermitRootLogin no

  • Disable Empty Passwords

PermitEmptyPasswords no

fail2ban¶

apt install fail2ban

WireGuard Setup Guide¶

  1. Install the WireGuard package on your system:

sudo apt install wireguard

  1. Key generation

Generate the cryptographic keys for each machine:

cd /etc/wireguard/
umask 077
wg genkey | tee private.key | wg pubkey > public.key

  1. Server Configuration

Create the file /etc/wireguard/wg0.conf on the server

[Interface]
# The server's private key
PrivateKey = <YOUR_SERVER_PRIVATE_KEY>
# Internal VPN IP address for the server
Address = 10.0.0.1/24
# Port to listen on
ListenPort = 51820

# Optional: NAT rules for internet access (ensure net.ipv4.ip_forward=1 is enabled)
# Replace 'eth0' with your actual public network interface
PostUp = iptables -t nat -I POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE

# Peer configuration (Repeat this block for each client)
[Peer]
# The client's public key
PublicKey = <CLIENT_PUBLIC_KEY>
# Authorized internal IP for this client
AllowedIPs = 10.0.0.2/32

  1. Client Configuration

On the client (e.g., a Linux PC), create /etc/wireguard/wg0.conf:

[Interface]
# The client's private key
PrivateKey = <CONTENU_DE_LA_PRIVATEKEY_CLIENT>
Address = 10.0.0.2/24

[Peer]
# The server's public key
PublicKey = <CONTENU_DE_LA_PUBLICKEY_SERVEUR>
# Your server's public IP address and port
Endpoint = <IP_PUBLIQUE_SERVEUR>:51820
# 0.0.0.0/0 routes all traffic through the VPN
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

  1. Managing the Interface

Start the VPN interface manually:

sudo wg-quick up wg0

Enable the service to start automatically at boot:

sudo systemctl enable wg-quick@wg0

  1. SSH over WireGuard

Service Dependency

To ensure SSH starts only after the VPN is up, create an override configuration:

sudo systemctl edit ssh

Add these lines to the editor:

[Unit]
After=wg-quick@wg0.service
Wants=wg-quick@wg0.service

Apply the changes:

sudo systemctl daemon-reload

  • Restrict SSH Access to VPN

To ensure SSH is only accessible via the VPN interface, edit /etc/ssh/sshd_config on the server and update the ListenAddress:

In /etc/ssh/sshd_config

ListenAddress 10.0.0.1