HOWTO: Set up Ubuntu 9.10 Server with SSH and Static IP

If you read earlier I have strange requirements for my FTP needs. While I'm still working out the kinks I have solved many problems with Samba, shared access, groups and more using Pure-FTP and Ubuntu Server. All of this is now running on my new mini server which I built last week for $219 shipped.

I'm not going to jump into any particular step in too much detail (it would make a book) but I will try to note on a few things. Other steps are just listed.

Install Ubuntu Server edition.
Start the server install and on many of the prompts, just choose the logical or default choice. However here are a few that some may get confused with.

• For the disk partitioning Choose Guided - Use Entire Disk. Do not choose the default LVM option unless you know what it is. LVM disks are harder to clone and some disk utilities do not work with them.
• For proxy settings Leave blank unless you know this for sure.
• For Automatic Updates Choose Manual Updates
• For Packages Choose SSH Server and no others. You can always add more later, but get this working first.

After installation is finished reboot the system.

Logging In via SSH
I choose to keep the server headless (no monitor, keyboard, mouse, etc.) So all that is plugged into the computer is a network cable and power. It can help the computer boot faster if you go into the bios and turn off booting to other devices except for the primary drive. It also helps improve the physical security a little. Using this computer headless means that we need to connect via SSH. To do this you can download putty for free. If you have Ubuntu as your desktop you can find putty in your Add remove Programs.

The next step is to find out what the IP of the server is. I simply go to my router and it lists it.
Using Putty, just type in the IP of the server. You will accept the certificate then you are connected. Now log in with the name and password you created during the install.

Commands/text that should be typed will be italicized. Perform all actions in sequence.

Switch to root/administrator:  
sudo su

Upgrade your System
You will want to do this when ever you login via putty and you see packages are ready to be installed.
apt-get upgrade
If you see some packages are bypassed then you need to use this also.
apt-get dist-upgrade

I recommend rebooting if you used apt-get dist-upgrade. There are other ways to apply certain settings instead of rebooting, but I just default to a reboot elsewhere.
reboot now

Don't forget to switch to root if you rebooted
sudo su

Change to a Static IP. I only have one network interface. Yours may be different. Your network IP settings may be different too.
nano /etc/network/interfaces

Change the last line dhcp to static. Mine is now iface eth0 inet static

Then add the following lines to the end.
    address 192.168.1.99
    netmask 255.255.255.0
    broadcast 192.168.1.255
    network 192.168.1.0
    gateway 192.168.1.1
Then press control-o to save and press enter to keep the current name.
Then press control-x to exit
From now on it is assumed you will save and exit nano on your own.

nano /etc/hosts
Change the ip on the second line to the address you used above. My hosts file starts like this (atom is the name of the computer):
127.0.0.1   local host


192.168.1.99   atom
At the bottom, add any ip's for any file servers or other network resources you may need to access followed by the system name.
192.168.1.97 worldbook-work
192.168.1.98 worldbook-media
save and exit.

/etc/init.d/networking restart

At this point your putty window should stop working. close putty and start a new window for the new IP. You will need to accept the certificate again.

Congrats. You now have a server setup and ready to work. Now you need to give it something to do. In this case I'm going to make mine serve FTP. Check out the next post where I install and configure Pure FTP with security settings and passive NAT support.

HOWTO: Set up a versatile FTP server with Pure-FTP and Ubuntu 9.10 Server

Over the next several posts I am going to give you the steps I used to setup my Pure FTP server. I have some requirements that others may have and I feel you could benefit from parts of it too. Here are the broad details with hypothetical names and purposes to make explaining the situation easier.

I have two network shared devices called worldbook-work and worldbook-media. I will refer to these as work and media respectively. Work is used by my company as an information store. Users will need to read and write to it. Media has two separate shares on it. One for music and one for videos. I have this to allow family access remotely. There is no need to write to this remotely so the share account on the device only allows reading as another layer of security. Finally I need to support a dropbox for a photography group I am in. The photographers will drop their pictures off and the administrator will log in, download the pictures and put them on another website, the administrator will delete the files once retrieved. Photographers should not be able to see or modify another photographer's files. I am just using local server disk for this since the files are transitory and the original photographer can send another copy if a problem arises.
Work users will need full access to work. Family will need read access to media. I will need full access to work and read access to media. and I have users who need to use the dropbox as described above. All while most shares are over a SMB mount.

Here are the coming posts to show you what I did.

• Setting up Ubuntu Server with Static IP, network device aliases, and SSH support.
• Setting up Pure-FTP server with Passive NAT support, and proper security precautions
• Setting up a directory structure with permissions and virtual users with bandwidth control
• Setting up mounts with credential files for added security and binding to share mounts amoung many folders.
• Setting up TLS security to enable encrypted FTP. Referred to as FTPS.

To do/desires:

• Force TLS for all users except dropbox users.
• send an email after a file is sent to dropbox, but no other share
• (Not possible without a separate server process from what I can tell.)
• Refine directory management and permissions. Perhaps have a virtual layer of permissions on top of existing directory permissions.
• (Not possible without a software change. Though it should be possible to code with dot files in folders.)
• Allow each virtual user to have a virtual private folder.
• (I have no clue or even a suggestion for this)

Check out the coming posts in this series to see the way I solved this task.

Jailbreaking the Iphone

I love my iPhone and the last thing I thought I would do would be to Jailbreak the iPhone. I wasn't even sure what it really meant. However my computer lost my itunes library for the second time in a row which left me totally unprepared without any kind of backup (it's a long story). I am so tired of rebuilding my itunes library and fiddling with the stuff that would be so much easier without all this 'protection'. I'm certain I have lost several games and music purchases. But what really gets me is loosing my app data. All those wasted hours on games with accomplishments I'm certain I will not be able to do again are very important to me. Ohh yeah, I've had to fill in data a couple of times into mSecure and I sure don't want to do that again either.

Well it turns out there is an easy way to backup your app data. But it's only available in Jailbreak land. It's called Chronos. Why apple doesn't provide some means of backing up just app data is beyond me. A full restore can be destructive to certain things when all you need is to backup your app data, sync with a new itunes library, and restore app data. There are other great improvements available for Jailbroken iphones which I may explore in a future post.

The amazing thing for Jail Breaking the iphone is it is surprisingly easy and very low risk. Simply download the utility. Plug in your Iphone, and click one button. As far as risk, Jailbreaking doesn't modify the phone, it just gives you a means to install new applications. The applications you choose to install would bear the risk, much like installing applications on your computer. In the worse case scenario, you would have to restore the iPhone, but very few have had that issue.

If you want to learn more, post a comment and I'll try to write about it.

Ten Tips for Keeping Windows Fast and Secure (Part 3 of 3)

If you missed the first two parts, please go read them now.

8. Use an active virus scanner and spyware blocker.
    There isn't much of an explanation for needed this. In the windows world this is required. On Ubuntu, virus scanners and spyware scanners are not needed due to other measures in place to help prevent infections. However, for Windows, ensure the definitions are updated daily and don't let your scanners expire. You need to stay up to date.

9. Don't click links in emails even if you know the source.
    This is true for any OS, but even more so with Windows. In every OS, links in emails can trick you to reveal your passwords and other private data to bad guys. In windows, they can also infect your computer easily. Also watch out for attachments. If you get a file from someone you know, it can still be bad. If it's a video, or a picture ask them to put it on a popular site like youtube, flikr, or facebook. Then go view it there. All it takes is a new virus which infects that type of file to get in their system, then it will be in your system. Using a known third party doesn't eliminate the risk completely, but it reduces the risk.

10. Don't be an administrator.
    Many of us share a computer with family. It can be a pain in the butt, but to help keep the bad guys out of the computer give each family member their own account. Make sure your family member is not also an administrator. In fact, it's better if you create a separate account for yourself too which isn't an administrator. When you need to install a new application, switch to the administrator account and run the install. Some applications won't play nicely with this and expect administrator privileges. Really if they can't get these security requirements right, do you expect them to get it right in other ways?

If you enjoy this blog, please click the follow button!