Is there any benefit to host my own instance?

  • JCreazy@midwest.social
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    Thank you for the information. I’ve signed up for a 2GB shared linode and it’s running Debian 11. I assume I need to ssh into it, then run the ansible stuff. I have very basic knowledge of Linux and command line. I am not entirely sure how to fill out the config but I will cross that bridge when I come to it.

    • UselesslyBrisk@infosec.pub
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      1 year ago

      Yeah how familiar are you with linux?

      You dont run the ansible stuff on the instance itself. You do it from your personal machine or something with ansible installed.

      Though I guess in theory you could run it on itself if you dont have another linux box, or something with ansible installed. https://www.middlewareinventory.com/blog/run-ansible-playbook-locally/

      But I am happy to walk you though the basics of setting up a securing the box.

      • JCreazy@midwest.social
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        I’m not super familiar with Linux, I’ve installed it on machines in the past, I know some very basic command line stuff. I’ve done raspberry pi stuff. I have a mini PC running Ubuntu right now that I am not using for anything so I can use that to run ansible. I probably won’t be able to work on it until after this weekend but once I get an moment to set down and do it I will shoot you a message if I have any questions. I really appreciate your help and I am excited to be a part of the fediverse.

        • UselesslyBrisk@infosec.pub
          link
          fedilink
          English
          arrow-up
          1
          ·
          edit-2
          1 year ago

          that would be perfect.

          WIth Debian I would install UFW for a firewall. Set SSH to whatever your home IP is. You can always use the Linode SSH console for external access.

          UFW is easy to configure and just translates iptables.

          sudo ufw allow from any to any port 80 proto tcp
          sudo ufw allow from any to any port 443 proto tcp
          sudo ufw allow from HOMEIP to any port 22 tcp
          

          If you want leave SSH open. Then i would probably only do Key based auth in /etc/ssh/sshd_config

          you also want to edit that file (sshd_config) to disable root access once setup. I often turn on the following

          LoginGraceTime 2m
          PermitRootLogin no
          StrictModes yes
          MaxAuthTries 6
          MaxSessions 10
          AllowGroups somegroupname
          

          then create a user and a group and add the user to the group. This ensures only that user has SSH access.

          sudo adduser someusername
          sudo addgroup somegroupname 
          sudo usermod -aG somegroupname someusername
          

          You can also use visudo to edit sudoers. The first like will require a password. If you use the second line, you can sudo without a password. I would only do the latter if you only use key-based auth though.

          
          someuser   ALL=(ALL:ALL) ALL
          someuser ALL=(ALL) NOPASSWD: ALL
          
          

          I also edit /etc/hostname to my server name. Update and reboot. From there run through ansible instructions and make edits as necessary.