How to setup up and manage SSH & Setup LAMP to different users
As always, the first thing I do is to update the reposites.
$sudo apt-get update
1. Installing SSHserver + our first user
After that is done, I download the openssh-server so my computer can be host.
$sudo apt-get install openssh-server
The setup is done. Now I need to set up some users. It is important to name your users so you can identify them. Please note – you can only add users if you are sudo. I give myself a test account which includes my name with the command:
$ sudo adduser petertak23
It will ask a password. Insert here a STRONG password. Its recommended to opt your user to change this password in the first login. I chose a stupidly complex password y]H}ZxtvhzBzR8x.
You need to type the password twice, making sure you remember it.
After submitting the password, adduser ask me personal info. All of these are optional but Full Name field is highly advisable. I enter my own name Peter Takacs and press ENTER severals times to insert null to the other information.
2. Connect via SSH
I have now credidentals which I can use to test SSH with. First check my IP-address with ifconfig
$ifconfig
We take IP-address from the eth0 part of the information. My IP in this situation is 84.251.114.155. You can also test your connection with localhost but that would be reduntant. I connected to my ssh server with the command ssh[username]@[remote-server]
$ssh petertak23@84.251.114.155
First time you connect to SSH, it will warn you that the athenicity of the host cant be established. After your first login it will remember the connection from this point on. This is to prevent others pretending to be your server. I answered yes and proceeded to insert the password I just gave myself for my test account.
Now we are connected to the remote server with SSH. In real life, the user should change his password after first login. As a user, this is done by command passwd
$passwd
Repeat the password twice as in the last phase. Once your done, type exit so you can logout from SSH.
3. Installing and configuring apache2
As demonstarted in the last post, you can setup the apache2 web server with ease. I now want for my users to have their own apache2 directories. To do this we use the a2enmod userdir module.
$sudo apt-get install apache2
$sudo a2enmod userdir
$sudo service apache2 restart
The place where apache2 check your public_html folder is now in the users home folder. It is important to make the public_html and all of its content with the user, no sudo. So we connect with SSH to our remoteserver with out testuser
$ssh petertak23@84.251.114.155
Now we make a directory called public_html and place a example html page inside it.
@mkdir public_html
@cd public_html/
@nano index.html
Note – here you can see that I have a habit of checking the contents of the directory I am in with ls. You should too.
Now add a test html-page. I used Tero Karvinen HTML short from terokarvinen.com
<!doctype html> <html> <head> <title>Tero's Test Page</title> <meta charset="utf-8" /> </head> <body> <h1>Tero's Test Page</h1> <p>Let's test UTF-8 with "päivää"</p> </body> </html>
Save and exit. Test that the page is working by typing in your browser field [yourip]/~[user]
4. Priviledges and logs
As I said in the previous chapter, you need to make sure that the public_html folder and it contents are made by the user, not sudo. To check this, use the command ls -l
ls -l
-rw-rw-r– 1 petertak23 petertak23
As you can see, the files is made by out test user ‘petertak23′. This also shows UNIX priviledges. In our case, user and groups can read and write this file. Others can only read this file. For more understanding on UNIX priviledges and chmod, refer to man chmod, or this page.
We need to keep track on what going on in our server. As sudo, navigate to your auth.log. It can be found in /var/log
cd /var/log
I use grep command with optional -i syntax to find upper/lowercase letter. I use grep to see what my test user have been up to.
grep -i petertak23 auth.log
To further explain this, here is a few examples with comments
SSH
Failure
Sep 25 15:55:26 xubuntu sshd[7773]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=dsl-hkibrasgw3-54fb72-155.dhcp.inet.fi user=petertak23
Sep 25 15:55:28 xubuntu sshd[7773]: Failed password for petertak23 from 84.251.114.155 port 43977 ssh2
### WRONG PASSWORD FROM IP 84.251.114.155 USING PORT 43977 VIA ssh2
Sep 25 15:55:37 xubuntu sshd[7773]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=dsl-hkibrasgw3-54fb72-155.dhcp.inet.fi user=petertak23
### PASSWORD WRONG 3 TIMES
Succes
Sep 25 15:57:27 xubuntu sshd[7822]: Accepted password for petertak23 from 84.251.114.155 port 44031 ssh2
### SUCCESFUL LOGIN FROM 84.251.114.155 USING PORT 44031 VIA SSH2
Sep 25 15:57:27 xubuntu sshd[7822]: pam_unix(sshd:session): session opened for user petertak23 by (uid=0)
### STARTED SESSION
Sep 25 16:03:30 xubuntu sshd[7822]: pam_unix(sshd:session): session closed for user petertak23
### USER LOGOUT
Using SUDO
Failure
Sep 25 16:10:06 xubuntu sudo: petertak23 : user NOT in sudoers ; TTY=pts/4 ; PWD=/home/petertak23 ; USER=root ; COMMAND=/usr/bin/apt-get install gedit
### USER PETERTAK23 IS NOT SUDO, CAN’T EXECUTE COMMAND APT-GET INSTALL
Succes
Sep 25 16:15:34 xubuntu sudo: xubuntu : TTY=pts/2 ; PWD=/var/log ; USER=root ; COMMAND=/usr/bin/apt-get install vlc
### COMMAND APT-GET INSTALL, USER SUDO
Sep 25 16:15:34 xubuntu sudo: pam_unix(sudo:session): session opened for user root by xubuntu(uid=0)
### OPENUP SESSION FOR USER SUDO
Sep 25 16:16:04 xubuntu sudo: pam_unix(sudo:session): session closed for user root
### CLOSE SESSION – FINISHED INSTALLING
BONUS
xubuntu@xubuntu$
ssh-keygen
enter
enter
enter
ssh-copy-id -i ~/.ssh/id_rsa.pub 84.251.114.155
ssh petertak23@84.251.114.155
Asymmentric Encryption
http://cheateinstein.com/wp-content/uploads/2012/11/AsymmetricEncryption_March-2010.gif
Sources:
Tero Karvinen’s lessons in Haaga-Helia University of Applied Sciences
torax@IRC for translating Finnish.
NOTE: All images (if any) used on this post were self-taken.
“This document can be copied and modified under the conditions of GNU General Public License. http://www.gnu.org/licenses/gpl.html“