nadnerB's CloudatCost Project Journal

nadnerB

Righto, so the firewall (enabled and on but no custom configs yet) and fail2ban are done.

nadnerB

So, today I'd like to set up SSH but I'll check on the fail2ban that I did yesterday.

Logged in as my non-root user account
fail2ban-client status sshd ... looks like it requires use of sudo to check
Apparently my non-root account requires listing in a 'sudoers file'... righto.

One goes the lab coat as I step into the research mode...

nadnerB

I think I'll do this by group permissions instead of individual permissions.
New group created groupadd <group name>
User added usermod <user> -G <groupname>
Check members of the group grep ^<group name> /etc/group

success

nadnerB

Righto, so it looks like the Sudoers file, that I need to edit, is read only.
However, I have found what looks like a good set of instructions here: https://www.digitalocean.com/community/tutorials/how-to-edit-the-sudoers-file-on-ubuntu-and-centos
EDIT: This initial setup guide has a slightly different (I think) way of doing it (step 4) https://www.digitalocean.com/community/tutorials/initial-server-setup-with-ubuntu-12-04

nadnerB

Hmmm, perhaps editing the Sudoers file is not a good idea...
Should I edit the file and add my username or just use su?
Comments @JaredBusch, @thecreativeone91, @scottalanmiller or @thanksajdotcom ?
EDIT: I'll hold off on deploying this for now.

thanksajdotcom

@nadnerB said:

Hmmm, perhaps this is not a good idea...
Comments @JaredBusch, @thecreativeone91, @scottalanmiller or @thanksajdotcom ?
EDIT: I'll hold off on deploying this for now.

I log in as root directly to all my servers.

A Former User

@nadnerB said:

Hmmm, perhaps this is not a good idea...
Comments @JaredBusch, @thecreativeone91, @scottalanmiller or @thanksajdotcom ?
EDIT: I'll hold off on deploying this for now.

You don't edit the file You'd gpasswd -a nadnerb wheel where nadnerb is the username you wish to give sudo privileges too.

A Former User

@thanksajdotcom said:

@nadnerB said:

Hmmm, perhaps this is not a good idea...
Comments @JaredBusch, @thecreativeone91, @scottalanmiller or @thanksajdotcom ?
EDIT: I'll hold off on deploying this for now.

I log in as root directly to all my servers.

I personally would disable root access over SSH after the initial setup.

nadnerB

@thanksajdotcom said:

@nadnerB said:

Hmmm, perhaps this is not a good idea...
Comments @JaredBusch, @thecreativeone91, @scottalanmiller or @thanksajdotcom ?
EDIT: I'll hold off on deploying this for now.

I log in as root directly to all my servers.

Thanks for your input but I won't be doing this

nadnerB

@thecreativeone91 said:

@nadnerB said:

Hmmm, perhaps this is not a good idea...
Comments @JaredBusch, @thecreativeone91, @scottalanmiller or @thanksajdotcom ?
EDIT: I'll hold off on deploying this for now.

You don't edit the file You'd gpasswd -a nadnerb wheel where nadnerb is the username you wish to give sudo privileges too.

Fantastic! Thanks!

nadnerB

@thecreativeone91 said:

@thanksajdotcom said:

@nadnerB said:

Hmmm, perhaps this is not a good idea...
Comments @JaredBusch, @thecreativeone91, @scottalanmiller or @thanksajdotcom ?
EDIT: I'll hold off on deploying this for now.

I log in as root directly to all my servers.

I personally would disable root access over SSH after the initial setup.

On the secret To-Do list

A Former User

@nadnerB said:

@thecreativeone91 said:

@nadnerB said:

Hmmm, perhaps this is not a good idea...
Comments @JaredBusch, @thecreativeone91, @scottalanmiller or @thanksajdotcom ?
EDIT: I'll hold off on deploying this for now.

You don't edit the file You'd gpasswd -a nadnerb wheel where nadnerb is the username you wish to give sudo privileges too.

Fantastic! Thanks!

No Problem. It's just a group you add it to, as the group has sudo premissions (sudoers file) .

scottalanmiller

@thanksajdotcom said:

I log in as root directly to all my servers.

Why?

scottalanmiller

@nadnerB said:

Righto, so it looks like the Sudoers file, that I need to edit, is read only.

Just means you have to tell the editor that you "mean it" when you save. In vi that means :w! instead of :w

nadnerB

Righto, I've blocked root access via SSH and renamed the server to something more useful (for ron... later on)

nadnerB

Hmmm, attempting to install htop is proving to be more difficult than yum -y install htop.
I can't seem to connect to any of the mirrors.
*http://mirror.netflash.net/centos/7.0.1406/updates/x86_64/repodata/repomd.xml: [Errno 14] curl#6 - "Could not *resolve host: mirror.netflash.net; Unknown error"
Trying other mirror.

scottalanmiller

Often that means that DNS isn't set up. Can you lookup addresses in general?

A Former User

You might need to set dns in resolv.conf

coliver

If the DNS issue doesn't resolve it you may have to refresh your YUM cache. I think a yum -clean all or yum -clean headers will do that.

nadnerB

Excellent suggestions! I'll check that out when I get home