Debian Sid server setup cheatsheet

SETUP.md

Debian Sid server setup cheatsheet

1. Generate an SSH key on your local machine (if you don't have one already):

ssh-keygen -t rsa -b 4096 -C "My key"

2. Copy the public key:

cat ~/.ssh/id_rsa.pub

and then copy the output.

3. Authorize the key on your server (if you didn't have to add a key during the server's creation):

# On your server
mkdir -p ~/.ssh && echo your_key >> ~/.ssh/authorized_keys
chmod -R go= ~/.ssh

4. Create an SSH config entry:

# On your machine
nano ~/.ssh/config

Example:

Host myserver
    HostName server_ip
    Port 22
    User root

Ctrl+O, Ctrl+X

5. SSH into your server

ssh myserver

6. Upgrade to debian sid

rm -rf /etc/apt/sources.list.d/*
nano /etc/apt/sources.list

Contents of the file:

deb http://deb.debian.org/debian sid main
deb-src http://deb.debian.org/debian sid main

Ctrl+O, Ctrl+X

7. Install KernelCollector (recommended)

echo "deb https://deb.tohka.us sid main" | sudo tee /etc/apt/sources.list.d/tohka.list
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys E4012B02CD659038

8. Perform an upgrade

apt update && apt -y upgrade

9. Reboot

reboot now

10. Add a new sudo user

adduser newuser
usermod -aG sudo newuser
sudo su - newuser

11. Add your SSH public key to this user

mkdir -p ~/.ssh && echo your_key >> ~/.ssh/authorized_keys
chmod -R go= ~/.ssh

Make sure that on a separate terminal tab on your local machine, you change the User value to the new user's name in your ~/.ssh/config and test the connection.

12. Install necessary tools

sudo apt install git build-essential curl zip unzip wget ufw

13. Enable the firewall

sudo ufw allow 22 # temporary, as we're changing ports later
sudo ufw enable

14. Secure your SSH

sudo nano /etc/ssh/sshd_config

Do the following changes:

• Uncomment Port and set it to an arbitrary number (I prefer 2xxxx)
• Uncomment PermitRootLogin and set it to no
• Uncomment PubkeyAuthentication and set it to yes
• Uncomment PasswordAuthentication and set it to no

15. Save your changes, allow the new port, and restart the SSH daemon

sudo ufw allow [new_port_number]
sudo service sshd restart

16. Test the connection

On your local machine, open a new terminal tab and test your connection by modifying the port number in ~/.ssh/config.

Extras

Creating a server SSH key (for git)

ssh-keygen -t rsa -b 4096 -C "My server"
cat ~/.ssh/id_rsa.pub

You should add this to your Github profile.

Installing Node.js

curl -sL https://deb.nodesource.com/setup_10.x | sudo -E bash - # or whatever version you prefer
sudo apt install -y nodejs

Making Node.js binaries work on the user account

echo "prefix = ${HOME}/.npm/node_modules" >> ~/.npmrc
echo "export PATH=$HOME/.npm/node_modules/bin:$PATH" >> ~/.bashrc
source ~/.bashrc

Installing nginx

sudo apt install nginx

Reverse proxy example

Create the configuration file

sudo nano /etc/nginx/sites-available/mysite.conf

mysite.conf:

server {
  listen 80;
  server_name your_domain;

  location / {
    proxy_pass http://127.0.0.1:8080;
    proxy_set_header Host      $host;
    proxy_set_header X-Real-IP $remote_addr;
  }
}

(replace 8080 with your desired port)

Enable the virtual host

sudo ln -s /etc/nginx/sites-available/mysite.conf /etc/nginx/sites-enabled/mysite.conf
sudo service nginx restart

Installing MySQL

sudo apt install mysql-server
sudo mysql_secure_installation

(note: I don't recommend using the validate password plugin, so say no to that)

Installing PHP

sudo apt install php-fpm

Example PHP nginx config

upstream php {
  server unix:/var/run/php/php7.3-fpm.sock;
  server 127.0.0.1:9000;
}

server {
  listen 80;
  server_name myphpwebsite.com;
  root /home/myuser/php-project/;
  index index.php index.html;

  location = /favicon.ico {
    log_not_found off;
    access_log off;
  }

  location = /robots.txt {
    allow all;
    log_not_found off;
    access_log off;
  }

  location / {
    # This is cool because no php is touched for static content.
    # include the "?$args" part so non-default permalinks doesn't break when using query string
    try_files $uri $uri/ /index.php?$args;
  }

  location ~ \.php$ {
    #NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
    include fastcgi.conf;
    fastcgi_intercept_errors on;
    fastcgi_pass php;
  }

  location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
    expires max;
    log_not_found off;
  }
}

Installing Certbot

sudo apt install certbot python3-certbot-nginx

Running Certbot

sudo certbot --nginx