Server Provisioning

morty.keekles.org

  cat /proc/cpuinfo |grep processor
  processor       : 0
  processor       : 1
  processor       : 2
  processor       : 3

apt-get install ntp ntpdate python vim screen ipsec-tools strongswan fail2ban snmp haveged libacl1-dev python3-dev libssl-dev gcc g++ fio pbzip2 ncdu

sudo systemctl disable systemd-resolved.service
sudo systemctl stop systemd-resolved
rm /etc/resolv.conf 
sudo touch /etc/cloud/cloud-init.disabled
sudo apt-get purge cloud-init

echo "nameserver 1.1.1.1" > /etc/resolv.conf
apt-get install ifupdown

systemctl unmask networking
systemctl enable networking
systemctl restart networking

systemctl stop systemd-networkd.socket systemd-networkd networkd-dispatcher systemd-networkd-wait-online
systemctl disable systemd-networkd.socket systemd-networkd networkd-dispatcher systemd-networkd-wait-online
systemctl mask systemd-networkd.socket systemd-networkd networkd-dispatcher systemd-networkd-wait-online
apt-get --assume-yes purge nplan netplan.io

# The primary network interface
auto eth0
iface eth0 inet6 static
   address 9805:0900:0340:1000::2600/64
   autoconf 0
   accept_ra 2	
iface eth0 inet static
    address 44.103.0.49
    netmask 255.255.255.0
    network 44.103.0.0
    broadcast 44.103.0.255
    gateway 44.103.0.1 
    dns-nameservers 44.103.0.4 1.1.1.1
    dns-search allstarlink.org
    up /etc/network/firewall.sh

   root@server# ifconfig |grep HWaddr
   eth0      Link encap:Ethernet  HWaddr 52:54:00:73:86:06  

   echo 'SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="52:54:00:73:86:06", ATTR{dev_id}=="0x0", ATTR{type}=="1", NAME="eth0"' >/etc/udev/rules.d/70-persistent-net.rules

  vim /etc/default/grub

  GRUB_CMDLINE_LINUX="net.ifnames=0 biosdevname=0"

  sudo grub-mkconfig -o /boot/grub/grub.cfg

  vim /etc/screenrc
  uncomment "termcapinfo xterm|xterms|xs|rxvt ti@:te@"

   vim /etc/bash.bashrc
   uncomment the stuff below 
   # enable bash completion in interactive shells 

   echo "domain.allstarlink.org" >/etc/hostname

   update-alternatives --config editor 
   Then select #3 vim.basic

   #!/bin/bash

   INET_IF=eth0

   #Flush and zero all tables
   modprobe ip_tables
   modprobe ipt_limit
   modprobe iptable_mangle
   modprobe ipt_state
   modprobe ipt_LOG
   modprobe iptable_filter

   iptables -F INPUT
   iptables -F FORWARD
   iptables -t nat -F POSTROUTING
   iptables -t nat -F PREROUTING

   #init the log-and-drop chain
   iptables -F log-and-drop
   iptables -X log-and-drop
   iptables -N log-and-drop
   #init log-and-reject
   iptables -F log-and-reject
   iptables -X log-and-reject
   iptables -N log-and-reject

   echo "all tables flushed and dropped"
   # Specific chain used for logging packets before blocking them
   iptables -A log-and-drop -j LOG --log-prefix "[IPTables] Drop "
   iptables -A log-and-drop -j DROP

   # Specific chain used for logging packets before blocking them
   iptables -A log-and-reject -j LOG --log-prefix "[IPTables] Reject "
   iptables -A log-and-reject -j REJECT
   echo "logging chains setup"

   # The packets having the TCP flags activated are dropped
   # and so for the ones with no flag at all (often used with Nmap scans)
   iptables -A FORWARD -p tcp --tcp-flags ALL ALL -j log-and-drop
   iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j log-and-drop

   #Global blocks
   #iptables -t filter -A INPUT -j DROP -s 119.118.232.185/24

   # allow IPSEC from other boxes
   IPSECsrc='199.47.174.150,44.98.254.151,44.103.0.48,44.103.0.49,44.98.254.145,44.72.21.13,44.72.21.12'
   #Technically the next two are not needed as we have the policy
   iptables -A INPUT -i $INET_IF -p 50 -j ACCEPT --src "$IPSECsrc"
   iptables -A INPUT -i $INET_IF -p 51 -j ACCEPT --src "$IPSECsrc"
   iptables -A INPUT -i $INET_IF -p udp --dport 500 -j ACCEPT --src "$IPSECsrc"
   # this is needed to allow all ipsec packets when it's host to host
   iptables -A INPUT -m policy --dir in --pol ipsec -j ACCEPT --src "$IPSECsrc" 

   # allow all ssh in
   iptables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 22

   #allow http and https
   #iptables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 80
   #iptables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 443
   # allow asterisk 4569
   #iptables -t filter -A INPUT -j ACCEPT --protocol udp --dport 4569
   # allow DNS
   #iptables -t filter -A INPUT -j ACCEPT --protocol tcp --dport 53
   #iptables -t filter -A INPUT -j ACCEPT --protocol udp --dport 53

   echo "end of services"
   # allow ping at 2 per sec
    iptables -t filter -A INPUT -j ACCEPT --in-interface $INET_IF --protocol icmp --icmp-type echo-request --match limit --limit 4/s --limit-burst 3
    iptables -t filter -A INPUT -j log-and-drop  --in-interface $INET_IF --protocol icmp --icmp-type echo-request
   # allow responces to local initated connections
   #iptables -A INPUT -i  $INET_IF --match state --state NEW,INVALID -j log-and-drop
   #iptables -A FORWARD -i $INET_IF  --match state --state NEW,INVALID -j log-and-drop
   iptables -t filter -A INPUT -j ACCEPT --match state --state RELATED,ESTABLISHED
   # Set rp_filter to 2
   for i in `find /proc/sys/net/ipv*/conf -name rp_filter`
   do
           echo "2" >$i
   done
   # setup a default deny rule for outside traffic
   iptables -t filter -A INPUT --in-interface $INET_IF -j log-and-drop

   vi /etc/fail2ban/jail.conf
   ignoreip = 127.0.0.1/8 199.47.172.0/22 44.98.254.0/24 44.72.21.0/24 44.103.0.0/24
   bantime  = 3600
   # A host is banned if it has generated "maxretry" during the last "findtime"
   # seconds.
   findtime  = 3600
   # "maxretry" is the number of failures before a host get banned.
   maxretry = 2
   banaction = route

   sudo timedatectl set-timezone UTC

   example:
   stats             IN      PTR     stats.allstarlink.org.

   /etc/ipsec.conf
   conn one-to-two
           authby=secret
           #auto=start enabled the tunnel to come up even if there is not traffic for it.  
           auto=start
           keyexchange=ike
           left=4.1.1.1
           right=4.2.2.2
           leftikeport=500
           rightikeport=500   
           type=transport
           esp=aes128gcm16!
           dpddelay=5
           dpdtimeout=20
           dpdaction=restart

   vim /etc/ipsec.secrets
   44.1.1.1 44.2.2.2 : PSK "This is the AllStarLink PSK"

   conn two-to-one
           authby=secret
           #auto=start enabled the tunnel to come up even if there is not traffic for it.  
           auto=start
           keyexchange=ike
           left=4.2.2.2
           right=4.1.1.1
           leftikeport=500
           rightikeport=500   
           type=transport
           esp=aes128gcm16!
           dpddelay=5
           dpdtimeout=20
           dpdaction=restart

   vim /etc/ipsec.secrets
   44.2.2.2 44.1.1.1 : PSK "This is the AllStarLink PSK"

   root@server# ipsec status
   two-to-one[839]: ESTABLISHED 98 minutes ago, 44.1.1.1[44.1.1.1]...44.2.2.2[44.2.2.2]
   two-to-one{13209}:  INSTALLED, TRANSPORT, reqid 695, ESP SPIs: c824e4db_i c1e4bf5c_o
   two-to-one{13209}:   44.1.1.1/32 === 44.2.2.2/32

Server Provisioning

Contents

Server Overview

Basic Requirements

Install guide

Mandatory Software

Mandatory Configs

Ubuntu 18 Config

Network Config

Persistent Interface Names

UDEV method

Grub method

Other required config items

Configure IPSEC

Server 1

Server 2

Verify IPsec

Configure Postfix

Verification

Items to check

Network Monitoring

Navigation menu

Search