Linux Server Setup: Complete Ubuntu Tutorial for Beginners

sudo apt update
sudo apt install xubuntu-desktop -y

sudo systemctl start lightdm

sudo systemctl start sddm

sudo systemctl set-default graphical.target

sudo systemctl set-default multi-user.target

# Update package lists
sudo apt update

# Upgrade installed packages
sudo apt upgrade -y

# Install essential packages
sudo apt install -y curl wget git vim htop tree unzip

# Generate RSA key pair (4096 bits for extra security)
ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

# When prompted:
# - Press Enter for default location (~/.ssh/id_rsa)
# - Enter a passphrase for extra security (optional but recommended)

# Add to GitHub/GitLab
cat ~/.ssh/id_rsa.pub

# Copy to server
ssh-copy-id user@server.com

ssh-copy-id username@your-server-ip

# Display your public key
cat ~/.ssh/id_rsa.pub

# Copy the output, then on your server:
mkdir -p ~/.ssh
nano ~/.ssh/authorized_keys
# Paste the public key, save and exit

# Set proper permissions
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

# Backup original config
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup

# Edit SSH configuration
sudo nano /etc/ssh/sshd_config

# Make these changes:
Port 2222 # Change from default port 22
PermitRootLogin no # Disable root login
PasswordAuthentication no # Require key-based auth
PubkeyAuthentication yes # Enable key authentication
MaxAuthTries 3

sudo systemctl restart ssh
sudo systemctl status ssh # Verify it's running

ssh -p 2222 username@your-server-ip

# Install UFW (usually pre-installed)
sudo apt install ufw

# Check current status
sudo ufw status

# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH (use your custom port)
sudo ufw allow 2222/tcp
# Critical: Do this BEFORE enabling UFW to avoid lockout

# Allow HTTP (web server)
sudo ufw allow 80/tcp

# Allow HTTPS (secure web)
sudo ufw allow 443/tcp

# Enable UFW
sudo ufw enable

# Check status
sudo ufw status verbose

# Allow specific IP for SSH (more secure)
sudo ufw allow from YOUR_HOME_IP to any port 2222

# Rate limiting for SSH (prevent brute force)
sudo ufw limit 2222/tcp

# Allow ping (ICMP)
sudo ufw allow in on eth0 from any to any port 22 proto icmp

# Create new user
sudo adduser webdev

# Add to specific groups (without sudo)
sudo usermod -aG www-data webdev  # For web server access

# Create user with home directory
sudo useradd -m -s /bin/bash developer
sudo passwd developer

# Create admin user
sudo adduser sysadmin

# Add to sudo group (Ubuntu)
sudo usermod -aG sudo sysadmin

# Test sudo access (switch to user first)
su - sysadmin
sudo whoamisudo systemcl   # Should return 'root'

# View user groups
groups username
id username

# Remove from group
sudo deluser username groupname

# Set file ownership
sudo chown -R webdev:www-data /var/www/html/

# Set directory permissions
sudo chmod 755 /var/www/html/
sudo chmod 644 /var/www/html/index.html

# Install Apache
sudo apt update
sudo apt install apache2 -y

# Enable and start service
sudo systemctl enable apache2
sudo systemctl start apache2

# Check status
sudo systemctl status apache2

# Allow through firewall
sudo ufw allow 'Apache Full'

# Test installation
curl localhost
# Or visit http://your-server-ip in browser

# Main config file
# Edit the default virtual host configuration for Apache
# This file controls how Apache serves websites on port 80
sudo nano /etc/apache2/sites-available/000-default.conf

# Enable required modules
# Enable URL rewriting module - allows clean URLs and redirects
# Essential for WordPress, Laravel, and modern web frameworks
sudo a2enmod rewrite

# Enable SSL/TLS module - adds HTTPS support for secure connections
# Required for serving websites over encrypted HTTPS protocol
sudo a2enmod ssl

# Restart Apache
# Apply configuration changes by completely restarting the web server
# This loads the new modules and updated virtual host configuration
sudo systemctl restart apache2

# Install Nginx
sudo apt update
sudo apt install nginx -y

# Enable and start
sudo systemctl enable nginx
sudo systemctl start nginx
sudo systemctl status nginx

# Configure firewall
sudo ufw allow 'Nginx Full'

# Test installation
curl localhost

# Main config
sudo nano /etc/nginx/sites-available/default

# Test configuration
sudo nginx -t

# Restart Nginx
sudo systemctl restart nginx

# Create simple HTML page
sudo nano /var/www/html/index.html

# Add content:
<!DOCTYPE html>
<html>
<head>
    <title>My Ubuntu Server</title>
</head>
<body>
    <h1>Welcome to Ubuntu Server!</h1>
    <p>Server setup completed successfully.</p>
</body>
</html>

# Update system
sudo apt update

# Install MariaDB
sudo apt install mariadb-server mariadb-client -y

# Start and enable service
sudo systemctl start mariadb
sudo systemctl enable mariadb
sudo systemctl status mariadb

# Run security script
sudo mysql_secure_installation

# Follow prompts:
# Set root password? Y
# Remove anonymous users? Y
# Disallow root login remotely? Y
# Remove test database? Y
# Reload privilege tables? Y

# Login to MariaDB
sudo mariadb -u root -p

# Create database
CREATE DATABASE webapp_db;

# Create user with limited privileges
CREATE USER 'webapp_user'@'localhost' IDENTIFIED BY 'secure_password_123';

# Grant specific permissions
GRANT SELECT, INSERT, UPDATE, DELETE ON webapp_db.* TO 'webapp_user'@'localhost';

# Apply changes
FLUSH PRIVILEGES;

# Exit
EXIT;

# Test new user login
mariadb -u webapp_user -p webapp_db

# Show databases (should only see webapp_db)
SHOW DATABASES;
EXIT;

# Install PHP and common modules
sudo apt install php libapache2-mod-php php-mysql php-curl php-gd php-mbstring php-xml php-zip -y

# Check PHP version
php --version

# Restart Apache
sudo systemctl restart apache2

# Create PHP info page (remove after testing)
sudo nano /var/www/html/info.php

# Add content:


# Test: visit http://your-server-ip/info.php
# Remove test file for security:
sudo rm /var/www/html/info.php

# Install Python and pip
sudo apt install python3 python3-pip python3-venv -y

# Install Flask (lightweight web framework)
pip3 install flask

# Create simple Python app
mkdir ~/webapp
cd ~/webapp

# Create app.py
nano app.py

# Add content:
from flask import Flask
app = Flask(__name__)

@app.route('/')
def hello():
    return '<h1>Hello from Python!</h1>'

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000, debug=True)

# Run application
python3 app.py

# Allow port in firewall
sudo ufw allow 5000/tcp

# Install OpenSSL (usually pre-installed)
sudo apt install openssl -y

# Generate certificate valid for 1 year
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /etc/ssl/private/server.key \
  -out /etc/ssl/certs/server.crt

# When prompted, enter:
# Country: US
# State: YourState
# City: YourCity
# Organization: (optional)
# Common Name: localhost or your VM IP
# Email: (optional)

# Enable SSL module
sudo a2enmod ssl
sudo systemctl restart apache2

# Edit default SSL config
sudo nano /etc/apache2/sites-available/default-ssl.conf

# Update SSL certificate paths:
SSLEngine on
SSLCertificateFile /etc/ssl/certs/server.crt
SSLCertificateKeyFile /etc/ssl/private/server.key

# Enable SSL site
sudo a2ensite default-ssl.conf
sudo systemctl reload apache2

# Edit Nginx config
sudo nano /etc/nginx/sites-available/default

server {
    listen 443 ssl;
    server_name localhost;

    ssl_certificate /etc/ssl/certs/server.crt;
    ssl_certificate_key /etc/ssl/private/server.key;

    root /var/www/html;
    index index.html index.php;

    location / {
        try_files $uri $uri/ =404;
    }
}

# Test and restart
sudo nginx -t
sudo systemctl restart nginx

sudo ufw allow 443/tcp
sudo ufw reload

# From server
curl -k https://localhost

# From browser
# Visit: https://192.168.x.x
# Accept certificate warning (expected for self-signed certs)

# Install package (usually pre-installed)
sudo apt install unattended-upgrades -y

# Enable the service
sudo systemctl enable unattended-upgrades
sudo systemctl start unattended-upgrades

# Configure automatic updates
sudo dpkg-reconfigure unattended-upgrades
# Select "Yes" when prompted

# Edit configuration
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

# Uncomment for security updates
"${distro_id}:${distro_codename}-security";

# Enable automatic reboots (optional)
Unattended-Upgrade::Automatic-Reboot "false";

# Reboot time if enabled
Unattended-Upgrade::Automatic-Reboot-Time "02:00";

# Edit auto-update settings
sudo nano /etc/apt/apt.conf.d/20auto-upgrades

# Ensure these settings:
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::AutocleanInterval "7";

APT::Periodic::Update-Package-Lists "1";

APT::Periodic::Unattended-Upgrade "1";

APT::Periodic::AutocleanInterval "7";

# Daily: Check for updates
sudo apt update

# Install security updates
sudo apt upgrade

# Weekly: Clean up
sudo apt autoremove
sudo apt autoclean

sudo nano /etc/apt/apt.conf.d/20auto-upgrades

# Daily update checks (Every day)
APT::Periodic::Update-Package-Lists "1";

# Auto-install security updates
APT::Periodic::Unattended-Upgrade "1";

# Weekly cleanup (Every 7 day)
APT::Periodic::AutocleanInterval "7";

# Download upgradeable packages (optional)
APT::Periodic::Download-Upgradeable-Packages "1";

# Check if auto-updates are enabled
sudo cat /etc/apt/apt.conf.d/20auto-upgrades

# View update logs
sudo tail -f /var/log/unattended-upgrades/unattended-upgrades.log

# Check when updates last ran
sudo cat /var/lib/apt/periodic/update-stamp

# Test dry run
sudo unattended-upgrades --dry-run --debug

# Check logs
sudo tail -f /var/log/unattended-upgrades/unattended-upgrades.log

# Check service status
sudo systemctl status unattended-upgrades

# Install htop
sudo apt install htop -y

# Run htop
htop

# Key shortcuts in htop:
# F5: Tree view
# F6: Sort options
# F9: Kill process
# F10: Exit

# Install Fail2ban
sudo apt install fail2ban -y

# Copy default configuration
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

# Edit local configuration
sudo nano /etc/fail2ban/jail.local

[DEFAULT]
bantime = 3600        # Ban for 1 hour
findtime = 600        # Look for failures in 10 minutes
maxretry = 3          # Ban after 3 failures

[sshd]
enabled = true
port = 2222           # Your custom SSH port
logpath = /var/log/auth.log
maxretry = 3

sudo systemctl enable fail2ban
sudo systemctl start fail2ban
sudo systemctl status fail2ban

# Check banned IPs
sudo fail2ban-client status sshd

# Install system monitoring tools
sudo iotop

# Monitor disk I/O
sudo iotop

# Monitor network connections
sudo netstat -tulnp

# Monitor network traffic
sudo iftop

# Create backup directory
sudo mkdir -p /backups

# Create compressed backup
sudo tar -czf /backups/website-backup-$(date +%Y%m%d).tar.gz /var/www/html/

# Create database backup
sudo mysqldump -u root -p webapp_db | sudo tee /backups/database-backup-$(date +%Y%m%d).sql > /dev/ls

# List backups
ls -lah /backups/

# Create backup script
sudo nano /usr/local/bin/backup.sh

# Add content:
#!/bin/bash
DATE=$(date +%Y%m%d)
BACKUP_DIR="/backups"

# Create directories
mkdir -p $BACKUP_DIR/daily

# Backup website files
tar -czf $BACKUP_DIR/daily/website-$DATE.tar.gz /var/www/html/

# Backup database
mysqldump -u root -p'your_password' --all-databases > $BACKUP_DIR/daily/database-$DATE.sql

# Remove old backups (keep 7 days)
find $BACKUP_DIR/daily/ -name "*.tar.gz" -mtime +7 -delete
find $BACKUP_DIR/daily/ -name "*.sql" -mtime +7 -delete

echo "Backup completed: $DATE" >> $BACKUP_DIR/backup.log

# Make executable
sudo chmod +x /usr/local/bin/backup.sh

# Edit crontab
sudo crontab -e

# Add backup job (runs daily at 2 AM)
0 2 * * * /usr/local/bin/backup.sh

# Check cron logs
sudo tail -f /var/log/cron.log

# Restore website files
sudo tar -xzf /backups/daily/website-20241016.tar.gz -C /

# Restore database
mysql -u root -p < /backups/daily/database-20241016.sql

# Set proper permissions after restore
sudo chown -R www-data:www-data /var/www/html/

# Download and run setup script
curl -o webmin-setup.sh https://raw.githubusercontent.com/webmin/webmin/master/setup-repos.sh

sudo bash webmin-setup.sh

# Install Webmin
sudo apt install --install-recommends webmin -y

# Allow through firewall
sudo ufw allow 10000/tcp
sudo ufw reload

# Access Webmin
# Visit: https://your-server-ip:10000
# Login with your sudo user credentials
# Use -k flag to ignore certificate warnings
curl -Ik https://localhost:10000

# Add Docker GPG key
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg

# Add Docker repository
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install Docker
sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io -y

# Add user to docker group
sudo usermod -aG docker $USER

# Test installation
sudo docker run hello-world