jasonheecs / ubuntu-server-setup

A setup script for Ubuntu servers

Bash setup script for Ubuntu servers

This is a setup script to automate the setup and provisioning of Ubuntu servers. It does the following:

• Adds or updates a user account with sudo access
• Adds a public ssh key for the new user account
• Disables password authentication to the server
• Deny root login to the server
• Setup Uncomplicated Firewall
• Create Swap file based on machine's installed memory
• Setup the timezone for the server (Default to "Asia/Singapore")
• Install Network Time Protocol

Installation

SSH into your server and install git if it is not installed:

sudo apt-get update
sudo apt-get install git

Clone this repository into your home directory:

cd ~
git clone https://github.com/jasonheecs/ubuntu-server-setup.git

Run the setup script

cd ubuntu-server-setup
bash setup.sh

Setup prompts

When the setup script is run, you will be prompted to enter the username of the new user account.

Following that, you will then be prompted to add a public ssh key (which should be from your local machine) for the new account. To generate an ssh key from your local machine:

ssh-keygen -t ed25519 -a 200 -C "user@server" -f ~/.ssh/user_server_ed25519
cat ~/.ssh/user_server_ed25519.pub

Finally, you will be prompted to specify a timezone for the server. It will be set to 'Asia/Singapore' if you do not specify a value.

Supported versions

This setup script has been tested against Ubuntu 14.04, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04 and Ubuntu 22.04.

Running tests

Tests are run against a set of Vagrant VMs. To run the tests, run the following in the project's directory:
./tests/tests.sh

ubuntu-server-setup's Issues

not using password

In function addUserAccount(), it uses --disabled-password.
So when you call the function, I don't think you need to use the password parameter.

Instead of this:

# in setup.sh line 28
addUserAccount "${username}" "${password}"

Shouldn't it be like this?

addUserAccount "${username}" 

And the function should be:

# Add the new user account
# Arguments:
#   Account Username
#   Flag to determine if user account is added silently. (With / Without GECOS prompt)
function addUserAccount() {
    local username=${1}
    local silent_mode=${2}

    if [[ ${silent_mode} == "true" ]]; then
        sudo adduser --disabled-password --gecos '' "${username}"
    else
        sudo adduser --disabled-password "${username}"
    fi

    echo "${username}" | sudo chpasswd
    sudo usermod -aG sudo "${username}"
}

Let me know if I missed anything.

what is this good for

lad, I do not know about ubuntu server literally nothing especially in comparison with your knowledge. so basically you wrote some script which I copy between my repositories, then I allow shell to change security settings by following your commands create a new login and ssh key provided by you so you can start using my machine? I am here 1st day, trying to configure and understand ubuntu server a little but I do not think that what you suggesting is right. please correct me if I am wrong. thanks

The script breaks if ufw is not installed prior to running script

Here's the output.log

ghost ALL=(ALL) NOPASSWD: ALL
# ssh public key redacted
sudo: ufw: command not found

There might need to be checks to install needed utilities before proceeding, a means to re-run the script if in case a step breaks in the process, as well as a verbose output to reassure the user that all steps were successfully executed. This was ran in a new Ubuntu 20.04 vps.

What user should run this?

If this should be ran as root, wouldn't this break things in the updateUserAccount function?

if [[ $createUser == [nN] ]]; then
        username=$(whoami)
        updateUserAccount "${username}"
    elif [[ $createUser == [yY] ]]; then
        read -rp "Enter the username of the new user account: " username
        addUserAccount "${username}"
    else
	echo 'This is not a valid choice!'
	exit 1
    fi

createSwap limits to 4GB but doesn't use limit

createSwap had a check for swap over 4GB and if it is sets phymem to 4, however, phymem is not used in this function again and the call to fallocate uses (the unaltered) swapmem value.

Permission denied (publickey) when ssh into Ubuntu 20.10 server 64Bits

The Script works very well on Ubuntu 20.04.1 LTS on RPi 4, seems to look me out when executed on a fresh install of Ubuntu 20.10 Server 64 Bits for RPi 4.

ssh to the newel created account or the ubuntu user account alway ends up with "Permission denied (publickey)" from the prompt.

The key works well when used on other devices or on Ubuntu 20.04.1 LTS.

.

.