Essential Best Practices for Setting Up a New Linux Server

Поделиться
HTML-код
  • Опубликовано: 16 дек 2024

Комментарии • 98

  • @Brutus34100
    @Brutus34100 Год назад +39

    I’ve been a system engineer in and Windows environment for 17 years. My goal is to be a DevOps engineer by 2024. Your videos and books make learning Linux simple besides I love technology and have a passion for it. I really enjoy your content. Please keep the videos coming sir.

    • @madkvideo
      @madkvideo Год назад

      True, Jay is the man

    • @buenogoodlive
      @buenogoodlive Год назад

      Hey, I know this is random but any advice to someone wanting to be a system engineer/admin for Windows? Got 4 years experience as Helpdesk, Desktop Tech & App Analyst Sys Admin. Never been an OS admin professionally though, but doing research and testing in my own VMs and studying for the AZ-900 to start.

  • @Anthony-Webb
    @Anthony-Webb Год назад +6

    What a great video! I thought I had a good routine for setting up servers, but man was I wrong.
    Thanks so much, Jay!

  • @RandallLWeedJr
    @RandallLWeedJr 6 месяцев назад +6

    A year latter and the video still kicks ass ;~o

  • @paul.phillips
    @paul.phillips Год назад +39

    I've been a linux guy for over 20 years and I didn't know about copy-ssh-id.. I've been copy/pasting my RSA keys into ~/.ssh/authorized_keys like a dummy this entire time. I assume the command appends, so as not to remove existing keys, if so I'm gonna have to start using that!

    • @noxrimor1340
      @noxrimor1340 Год назад +10

      This command does several things that are useful. It’ll create the ~/.ssh directory and the authorized_keys file and sets their permissions appropriately. If they already exist, then it’ll just append the key to the authorized_keys file after performing a check to see if the key is already authorized for the specified user.

    • @rodrigito78
      @rodrigito78 Год назад

      Really? Copying pub keys by hand is no fun. Glad you found out about it. Generally those are baked into a holden image so you don't have to set a password. Remember that ssh-copy-id requires a password, which kinda feats the purpose for automation accounts. Although the cmd is useful for users. But if users are mountingn their homedir then not needed...😊 excellent 101 stuff nonetheless....

    • @rodrigito78
      @rodrigito78 Год назад

      Good basics video. Thanks.

    • @akb468
      @akb468 11 месяцев назад

      ​@@rodrigito7833 33 33😢😢èrr4444 44 33 hai 44rr

    • @lalitrathi1785
      @lalitrathi1785 11 месяцев назад

      ​qa@aaC gt

  • @devdude7607
    @devdude7607 2 месяца назад

    Wow! This channel is a gem! What a time to discover this. Thank you so much! 🙌

  • @navidan2093
    @navidan2093 Год назад +1

    What a great timing. I am about to build my first server and of course I'm going to install Linux on it. Just waiting for a motherboard, everything else already arrived.

  • @rayjaymor8754
    @rayjaymor8754 Год назад +2

    Your videos are so amazing, thank you Jay!

  • @AlbandAquino
    @AlbandAquino Год назад +7

    Again, when upgrading your packages, don't do it blindly. Read the list of upgraded packages.
    If you see something you were not expecting, press "n". "Just like that." 😉

    • @vexy1987
      @vexy1987 3 месяца назад +1

      When you say something you're not expecting, do you mean malicious packages? As a new user, with a fresh install, do we need to research every package update? Seems overkills.

    • @AlbandAquino
      @AlbandAquino 3 месяца назад

      @@vexy1987 Let me add a little context. My comment was "bare" at minimum 🥲
      What I mean is something of the sort : Let's say you're using a specific library, software and so you're accustomed to its update cycle, version, sub versions etc ...
      When you see in your apt update list a software jumping from version "10.6.5~1dev12u9" to "11.0.0-ofac89087" but all previous version where named "10.6.5~1dev12uX". It only takes a minute to cancel the update and go check that specific package version changes (and/or code) for anything that is out of the ordinary and could ultimately compromise your system(s).
      Same for any software that your eye lands on. It only takes a minute to check what it is and what you need it for.
      Do that for years, and that's when you're able to "see" when a version update "might" be suspicious. It is ESPECIALLY important if you're using non distro official repos (Docker, Terraform, etc) like so many of us.

  • @brotaque
    @brotaque Год назад +1

    Great video! One of the most valuable channels that I ever subscribed to.

  • @altan_duman
    @altan_duman 5 месяцев назад

    This is the only channel I keep checking.

  • @wisteela
    @wisteela 2 месяца назад

    Excellent guide. I'll being doing all that with ssh when I set my server up.

  • @model.citizen.ps3
    @model.citizen.ps3 Год назад +2

    Great video amigo! Keep up the good content 🤩

  • @AndersJackson
    @AndersJackson Год назад

    To add a user in Debian I use adduser(8) or addgroup(8) instead of usermod(8) to add secondary group to an account, as that has less switch and easier to remember.
    Usually one change configurations for the sshd by adding files into /etc/ssh/sshd_config.d/ direcotory instead of editing /etc/ssh/sshd_config.

  • @meme5887
    @meme5887 4 месяца назад

    14:47 I'm so lost on pasting the IP address. The one you made was xxx1.1. The one you pasted is xxxx.242.... where did that come from? The only time I saw that up address was the closing out text when you logged out with ctrl+D

  • @davemeech
    @davemeech Год назад

    This is amazing stuff. I'm going to be referencing this when starting my homelab projects for sure.

  • @jojobobbubble5688
    @jojobobbubble5688 Год назад +1

    Thats some nice looking Fedora swag!

  • @CowCatwithafancyHat
    @CowCatwithafancyHat Год назад

    This channel is gold!

  • @pivot3india
    @pivot3india Год назад +2

    Can you make a video about analysing linux metrics and logs in Grafana and Loki ?

  • @AdrianGoodyer
    @AdrianGoodyer Год назад +1

    Great video.
    - Next steps would be to configure your firewall (ufw on Debian) and setup and VPN connections etc.
    - then automating everything (e.g. via Ansible) for repeatable infrastructure

  • @VirendraBG
    @VirendraBG Год назад

    I am your old subscriber.
    Your all videos are gold mines.
    👍🏻👌🏻

  • @HaroldCrews
    @HaroldCrews Месяц назад

    If in Debian/Ubuntu and you get a "Failed to restart sshd.service: Unit sshd.service not found" when entering "sudo systemctl restart sshd" command, try "sudo systemctl restart ssh" instead.

  • @vinvvinv7460
    @vinvvinv7460 Год назад +2

    Hi, can you please make a video explaining when and why these files are used in simple terms /etc/nsswitch.conf and /etc/named.conf if you can show a practical usage it will be great. Please it's a request. Please do reply

  • @marcususa
    @marcususa Год назад

    2:28 Ok, but how do you get your Ubuntu server connected to the internet? When I start up my installation it says it is waiting to be configured. I don't see the steps to configure the internet to update from the "~$" (in the video it is "~#"). Where's the tutorial on this?

  • @wyfyj
    @wyfyj Год назад

    Love the new Intro. Don't remember if I said

  • @demus8757
    @demus8757 Год назад

    Thanks for this video. I do have a question though: when you install updates on a server do you need to reboot afterwards or is the system so intelligent that updates can be installed on the fly? When a server is in a production environment reboots are not something you want to do.

  • @asdf51501
    @asdf51501 Год назад

    Useful video! I will be going through this shortly once I finish building this 7900 (non-x) PC that I plan to put Mint Cinnamon on.

    • @aytviewer2421
      @aytviewer2421 Год назад +1

      My daily driver is a custom built Ryzen 5900x rig with 32 GB of ram and two SSD NVME drives. Drive one is my default boot and I usually run Zorin OS 16.2. (Drive two is Win 10 Pro). I have absolutely no complaints with my 5900x machine. It just runs and is dead silent thanks to an giant (overkill) beefy heatsink with a 140mm fan in the middle and two large 140mm front intake fans. I love this machine. It is rock solid with my Linux install. I usually upgrade every other processor generations, so I will likely build my next rig with Zen 5 (or Zen 4+) and will look for an "9900x" or equivalent.
      The only thing I use Windows 10 for these days is playing SC II and Diablo III along with a few other Windows games. I also have an RTX 3080 TI in it. Oh one more things --for some reason some streaming services will not display 4K or even 1080p content in Linux regardless of the browser I try to use with it.

    • @user-lg4le8xr4s
      @user-lg4le8xr4s Год назад

      @aytviewer2421 the services won't stream higher resolution video on Linux clients because it's harder for them to restrict you with the usual DRM tools. It's a super shady/malicious practice of the big streaming services.

  • @GrindAlchemyNation
    @GrindAlchemyNation Год назад

    Thank you for all you are doing sir! 💪🏾👽👌🏽

  • @YasarHabib
    @YasarHabib 8 месяцев назад

    Can these steps be tied in with your Ansible series? Can I automate the part where I generate a public SSH key on my workstation, send it to the server, have Ansible verify that I can connect to the server with the keys, then update the sshd_config to prevent root login?
    Great video, btw!

  • @stanislavtodorov8705
    @stanislavtodorov8705 9 месяцев назад

    I was wondering how you ended up without having user other than root on the fresh installation if the installer requires to create one?

  • @salmankhan-tm6ch
    @salmankhan-tm6ch Год назад

    Jay, can you please make some video on linux IAM including ldap and sssd with AD?

  • @aytviewer2421
    @aytviewer2421 Год назад +5

    Why do some people use "apt dist-upgrade" instead of "apt upgrade"? Does it matter?

    • @aytviewer2421
      @aytviewer2421 Год назад +2

      @@RiverLiffey23 Many thanks Ahmad!

    • @javabeanz8549
      @javabeanz8549 Год назад +1

      @@RiverLiffey23 that is incorrect... do-release-upgrade does that. For the differences, try "man apt" and "man apt-get" for full details. But dist-upgrade does some dependency handling that upgrade does not.

    • @RiverLiffey23
      @RiverLiffey23 Год назад +1

      @@javabeanz8549 @AYTViewer You are right. I was wrong. I confused do-release-upgrade with apt dist-upgrade. Sorry my bad. I am removing previous comment to not confuse others.

  • @hoatranquang8376
    @hoatranquang8376 Год назад

    Dear Learn Linux TV,
    Current, i has Dell server run Os Ubuntu 22.04.
    in the future, I will setup one more server run Os Ubuntu 22.04 to run in parallel, for the purpose of redundancy and backup. If the first dies server, there is still second replace.
    but, I don't know the steps how to configure, set up and synchronize data for the two servers.
    May can you and everyone help me.
    Thank you so much.

  • @gjkrisa
    @gjkrisa Год назад

    what do you use to have a local linux repo for your proxmox server?

  • @ralphtaylor5328
    @ralphtaylor5328 Год назад +1

    You used the root account for both distros. I thought that Ubuntu by default disabled the root account and the account used to install was a sudo user. Did I miss something?

    • @javabeanz8549
      @javabeanz8549 Год назад

      Not on the Server version. The Desktop version disables root login by default, as I remember, as I switched to Mint some time ago for my Desktops. I believe Mint does as well, as during install, you are only asked to created a regular user, and not asked to set the root password. I have done MANY server installs over the years, from Ubuntu 8.04 on, and always have root user, and have to add any other users.

    • @oscs4556
      @oscs4556 Год назад +1

      There is an option to disable the root account on new Ubuntu server installs.

    • @javabeanz8549
      @javabeanz8549 Год назад

      @@oscs4556 during installation?

    • @oscs4556
      @oscs4556 Год назад +1

      @@javabeanz8549 yes,

  • @sbaidya1023
    @sbaidya1023 9 месяцев назад

    Very helpful content sir. Please make a video on how to set up PBS job submission in ubuntu server.

  • @jeffschroeder4805
    @jeffschroeder4805 Год назад +1

    I am always paranoid about being locked out of a device. How and where could you save the key that you now have on your remote computer so that you could use it to access the server in the event your remote computer died? I realize that having a usb drive or ..... with all sorts of passwords, keys, and credentials introduces a security risk but I think of people with a fortune in bitcoin that they can't access it because they forgot or lost the key.

    • @javabeanz8549
      @javabeanz8549 Год назад

      Jay copied the public key from his local machine up to each server. So, he still has the local copy. If you put it on a flash drive, but want to prevent unauthorized access, you can encrypt the flash drive.

    • @paultruzzi911
      @paultruzzi911 Год назад +1

      I print out the private key and put it in my gun safe. Same thing with QR codes for 2FA generators. It would be a pain to enter a key by hand, but not impossible.

    • @javabeanz8549
      @javabeanz8549 Год назад

      @@paultruzzi911 You are correct! Hand entry is a pain. I had a site decide not to show the QR Code, so I had to hand input it to my phones. ( Yes, Phones, I don't want one dead phone locking me out of my accounts. )

  • @_sneer_
    @_sneer_ Год назад

    What happens if the workstation we have ssh key on gets corrupted and I cannot use it to log in to the server? Would I be able to log in to my remote server? Or from a different machine?

    • @2720Crypto
      @2720Crypto Год назад

      If you have physical access, you can always log on to the server via direct connection with a monitor and kb to make the required edits on your configuration files. Be careful with key-pair generation, I read a very interesting article on how easily these keys can be manipulated when the proper safeguards are not in place..

  • @sanveersingh3513
    @sanveersingh3513 Год назад

    Hi Everyone,
    I'm new to linux is just created bootable USB today, and installed linux one of my old desktop PC, after installation i bought TP-Link AC600 wifi adapter, but i plugged wifi adapter nothing, then went online to TP link website no drivers for linux only windows and Mac, then installed git, dkms, cloned a git repo to get wifi going, wifi is working but internet speed is slow, at this stage i dont have deep understanding so was just copy pasting things into terminal to fix the internet. now Network manager is not working, i spent quite some time figuring out network, no luck now installing ubuntu again, initial friction is too much please make a video on if you dont have lan connection how to get going.

  • @jojobobbubble5688
    @jojobobbubble5688 Год назад

    Pretty solid video! Thanks much! Is there a concise guide for hardening a Linux Server you would recommend?

  • @CarlosGrillet-fn1lk
    @CarlosGrillet-fn1lk Год назад

    Have you ever try medicat? is a very usefull tool too. You should make a video of it!

  • @aytviewer2421
    @aytviewer2421 Год назад

    OK, this may be a silly question, but: What is the purpose of the "randomart image" for a newly generated SSH key? Is this used somewhere? I should I save this separately for future reference?

    • @ggalland1
      @ggalland1 Год назад +1

      I am in NO WAY and expert, but I believe you are seeing "machine code" or something of the like for the SSH key that was generated. I don't believe you need to copy it anywhere. At least that is my understanding of it.

    • @aytviewer2421
      @aytviewer2421 Год назад

      @@ggalland1 I have never saved it nor used it over the past few years... was wondering why it is even generated and if there is some worthwhile use for it.

    • @aytviewer2421
      @aytviewer2421 Год назад +6

      OK, I spent a little time and did a brief bit of research on the subject. First of all, I now understand that "randomart" is two words: random art. My brain had it as rando mart and thought that "mart" was significant in some way to the function of the image. But it is in fact "art" created as a visual representation of a newly generated public key. My understanding from what I found is that a randomart image's purpose is to make it easier for mere mortals to differentiate one public SSH key from another. As in you see a nice (17x9 ?) grid of characters in place of a 1-2k+ string of ASCII (UTF-8?) characters. I think this likely was a well intended feature. Yet, in reality over the past 15-20 years I personally have never seen a randomart image in the wild except when an SSH key is generated. So in a nutshell, I do not think there is any present day real-world purpose for this feature. Someone PLEASE correct me if I am wrong and thanks in advance if you provide a better explanation and cite a real-world usage example.

  • @enrico3433
    @enrico3433 Год назад

    Thank you, amazing content.

  • @TheChrissutcliffe
    @TheChrissutcliffe Год назад

    Nice Video :) This is my first time owning a VPS and viewing /var/log/auth.log was a little unnerving. I feel a little more confident now. Thanks.

  • @amanye
    @amanye Год назад

    Hello Jay, what to do if you lock yourself?

  • @iz981
    @iz981 Год назад

    Many thanks for extremely useful educational content! I love your channel and have been following it for a while. Question - I have a remote Linode UBUNTU machine and am accessing it via a VM running Mint 21.1 - I followed all your steps here, however, when I try to connect to the cloud server using SSH, Mint asks me to "enter password to enter a private key" for my local account - when I do this, it just ask me to repeat - so I still have to access the cloud Ubuntu server using password... So, I was not able to complete the process and I would be grateful for any hints and help ! Thanking you in advance !

  • @brandon_wallace
    @brandon_wallace Год назад

    I like your Fedora cup.

  • @ryzenforce
    @ryzenforce Год назад +1

    You also need to reboot your Fedora station after the very first update.
    Also, also, using sudo with systemctl is redundant as it will ask your password to make changes.

    • @michaelmcdougal3902
      @michaelmcdougal3902 Год назад +3

      I always use sudo for systemctl commands, because if you're within the sudo timeout window of your last sudo command (defaults to 5 min) you won't have to type it again, whereas authenticating directly with systemd will always require you to type it out.

  • @yevgeni10
    @yevgeni10 Год назад

    What is the best server VMware or Virtual Box.

  • @kamertonaudiophileplayer847
    @kamertonaudiophileplayer847 Год назад

    I'm always scared to do any update, because thousands users using the server.

  • @johnvardy9559
    @johnvardy9559 Год назад

    Do you recommend any cert?

  • @usharanisingamsetty3232
    @usharanisingamsetty3232 11 дней назад

    hi i am system administrator which is the best server in linux server platinum or gold please send me configuration details

  • @AndersJackson
    @AndersJackson Год назад

    I notice you have an IPv6 address on the machines. That is good. Should use that for servers you want to access externally.

  • @MichaelRpdx
    @MichaelRpdx Год назад +1

    You forgot "install vim" make it the default.
    ;)

  • @cientifiko
    @cientifiko Год назад

    would you do a video teaching slurm for linux?

    • @aytviewer2421
      @aytviewer2421 Год назад

      I'm fully of silly questions today -- but what is "slurm"? I've never heard of this.

    • @javabeanz8549
      @javabeanz8549 Год назад

      @@aytviewer2421 "The Slurm Workload Manager, formerly known as Simple Linux Utility for Resource Management, or simply Slurm, is a free and open-source job scheduler for Linux and Unix-like kernels, used by many of the world's supercomputers and computer clusters." I hadn't heard of it either, so I Duck Duck Go'd it ;o)

  • @bobkoss280
    @bobkoss280 Год назад

    Some minor changes in /etc/ssh/sshd_config since this video was made.

  • @johnnycoding1423
    @johnnycoding1423 Год назад

    Nice tutorial with very clear and detail introduced steps, would be even better with some basic firewall setup steps :D

  • @countermeasuresecurityengi9719

    thx short n simple

  • @donny_bahama
    @donny_bahama 9 месяцев назад

    You say to add the hostname to the hosts file so the server can ping itself - but you don’t explain why the server needs to be able to ping itself…?

  • @alwaha4283
    @alwaha4283 Год назад

    Very good tnx ❤

  • @majstorgile
    @majstorgile Год назад

    👏👏👏

  • @RoyvanLierop
    @RoyvanLierop Год назад +1

    Step 1 always: apt install ncdu

  • @rchakerrchaker6362
    @rchakerrchaker6362 Год назад

    i use those command sudo apt update && sudo apt full-upgrade && sudo apt dist-upgrade && sudo apt autoremove && sudo dpkg --configure -a && sudo apt install -f && do-release-upgrade && sudo apt upgrade -y && apt install ubuntu-release-upgrader-core && sudo apt --fix-broken install && sudo apt clean && sudo at autoclean && sudo apt-get dist-upgrade -y

  • @tralphstreet
    @tralphstreet Год назад +1

    I like this channel but why does it always cover so, so basic concepts? For anyone above beginner level it's downright boring to watch this stuff.
    Like, no offense, but half the video explains how to do things that would likely be already done in a regular installation, updating packages is obvious, and it's not exclusive to new installations, that's something you just do for maintenance from time to time, and disabling root and password access on SSH is good to know, but also expected.
    Maybe I'm not the target audience.

    • @aytviewer2421
      @aytviewer2421 Год назад +5

      From what he said in the video, the purpose for posting this is for a "reference" video that he can point to for future videos on setting up installs and more. Rather than repeat these basic things in every video going forward he will instead refer people to view this video. This will allow other videos to be more in-depth and focused on the topic at hand.

  • @RHTORAS
    @RHTORAS Год назад +1

    The only problem is you are a systemD guy... apart that your videos are very good. I wonder what's gonna be when we destroy systemD and Microsoft's plans to destroy Linux.

  • @marysebastian1316
    @marysebastian1316 Год назад

    B

  • @AxiomofDiscord
    @AxiomofDiscord 8 месяцев назад

    I wonder how long it will take for me to learn Linux or at what time I should just call it quits and give up. It reminds me a lot of the internet frontend of Retroarch. In that it does what it wants and I just have to put up with the randomness if today I will get to use the computer or be used by the computer.