Provisioning

Common Setup

1. Install Ubuntu.
2. Update apt: sudo apt update
3. Update the system kernel: sudo apt upgrade then reboot.
4. Install vim: sudo apt install vim
5. Terminal improvements:
   • Update the configured alias for ls in .bashrc - add the --group-directories-first param to the alias ls configuration.
   • Install Tilix:
     1. sudo apt install tilix
     2. Configure to run as login shell: Preferences -> Default -> Command -> check Run command as login shell.
     3. Configure the Copy on Select for mouse: Preferences -> Global -> check Automatically copy text to clipboard when selecting.
     4. Configure theme: Preferences -> Appearance -> Theme variant -> Dark. Also check the Use a wide handle for splitters checkbox.
6. Install htop: sudo apt install htop
7. Install iftop
8. Install net-tools
9. Install iostat
10. Install curl: sudo apt install curl

Workstation

1. Configure keyboard and mouse. Apple Magic Keyboard and Logitech Mx Master 3S connected via Bluetooth.
2. Attach and configure additional monitor: Linux: * Scale 200%
3. Install Chrome:
   1. Download from https://www.google.com/chrome
   2. sudo apt install <chrome .deb file>
4. Install additional fonts:
   • Linux:
     1. sudo apt install fonts-roboto fonts-cascadia-code fonts-firacode
     2. Install Google Fonts. Needed for VSCode and Chrome.
        1. Download the fonts archive
        2. unzip fonts-main.zip -d google_fonts
        3. Copy fonts to the system fonts directory:

           sudo cp fonts-main/ufl/ubuntu/*.ttf /usr/share/fonts/; 
           sudo cp fonts-main/ufl/ubuntucondensed/*.ttf /usr/share/fonts/;
           sudo cp fonts-main/ufl/ubuntumono/*.ttf /usr/share/fonts/
           

     3. Update the system fonts cache: sudo fc-cache -f -v
   • MacOS: Instal FiraCode fonts: https://github.com/tonsky/FiraCode/releases
5. rkhunter - audit rootkits: tbd
6. ClamAV - the Malware/virus scanner

   sudo apt install clamav
   sudo freshclam          # Update definitions
   sudo clamscan -r /home  # Scan recursively
   

7. Sublime:
   1. Download the .deb archive from https://www.sublimetext.com/download
   2. cd ~/Downloads
      • Linux: dpkg -i sublime-text_build-xxx.deb
      • MacOS: extract the archive and move sublime in the Application directory.
   3. Add Sublime to shell ..zshrc or .bashrc: alias subl='/opt/sublime_text/sublime_text'
8. SSH
   1. Generate SSH keypair: ssh-keygen -t ed25519 -C "andrei@montchik.net"
      • choose the default location in the ~\.ssh directory
      • keep the password empty
   2. Add pubkey to GitHub account: https://github.com/settings/keys
   3. Restart terminal session before using the newly created and registered keypair.
9. Install Git.
10. Increase swap file in case if short on memory.
11. Install Rust and set up Solana Dev env-t
12. Install VS Code

Server

1. Update the root password.
2. Switch to UTC
3. Complete the Common Setup steps.
4. Check out the host hardware:
   • CPU: cat /proc/cpuinfo | grep "model name" | head -1
   • Memory: cat /proc/meminfo | grep "Mem"
   • Disks: sudo lsblk
   • Network:
     1. Identify the network NIC: ip a
     2. Install the ethtool: sudo apt install ethtool
     3. sudo ethtool <NIC> | grep Speed
5. Confirm that the system clock is synchronized: timedatectl status. If not install ntp.
6. Create the andrei user and add it to the sudo group
7. Re-login as andrei.
8. Restrict user access to specific users or groups.
9. Install or update SSH agent:
   • Install SSH
   • Update SSH:
     1. Check the SSH server version: sshd -V 2>&1 | grep "OpenSSH"
     2. sudo apt install --only-upgrade openssh-server
     3. sudo systemctl restart ssh
     4. Check the SSH server version: sshd -V 2>&1 | grep "OpenSSH"
10. Disable root access:
    1. Create the 99-sandbox-init.conf file in the /etc/ssh/sshd_config.d/ directory.

    PermitRootLogin no
    

    1. Restart SSH server: sudo systemctl restart ssh.
    2. Confirm that root cannot login.
11. Enable SSH key authentication.
    1. Propagate the Workstation's SSH key: run ssh-copy-id andrei@<server ip> on Workstation.
    2. Add the PubkeyAuthentication yes parameter to the /etc/ssh/sshd_config.d/99-sandbox-init.conf file.
    3. Restart SSH server: sudo systemctl restart ssh.
    4. Confirm that the SSH key authentication works.
12. Configure the ufw firewall.
13. Disable password authentication:
    1. Add the PasswordAuthentication no parameter to the /etc/ssh/sshd_config.d/99-sandbox-init.conf file.
    2. Restart SSH server: sudo systemctl restart ssh.
14. Install and configure fail2ban
15. Install and configure git
16. Install Rust
17. Install Solana CLI