Linux Post-Installation Configuration and Secure Baseline
You will take a raw Linux install and turn it into a consistent, patched, secure baseline every other server inherits. By the end the host is fully updated, time-synced, and managed through a non-root sudo account.
Learning Objectives
- Patch the system and enable automatic security updates.
- Set hostname, timezone, and time synchronization.
- Create a non-root administrative user.
- Time: ~1 hour · Difficulty: Beginner · Prereqs: a fresh VM with sudo access.
Architecture Overview
Environment Setup
You will need: the VM from the install lab with internet access and sudo.
Before you begin: confirm time and date are roughly correct so package signatures validate.
Prerequisites
- A freshly installed Debian/Ubuntu server (see the install VM lab) with internet access.
- Root or console access for the first login before SSH hardening.
- Know your intended hostname and timezone (America/Toronto used here).
- A username for the daily-driver sudo account.
Step-by-Step Execution
Patching first closes known vulnerabilities before the host does anything else.
sudo apt update && sudo apt full-upgrade -yExpected output:
Reading package lists... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to removeWhat this teaches: Updating the index before upgrading ensures you patch against current metadata; full-upgrade handles dependency changes that plain upgrade would hold back.
Unattended-upgrades applies security patches without manual intervention, shrinking your exposure window.
sudo apt install -y unattended-upgrades && sudo dpkg-reconfigure -plow unattended-upgrades
Expected output:
Updating certificates in /etc/ssl/certs...
(unattended-upgrades configured and enabled)What this teaches: unattended-upgrades applies security patches on a schedule, shrinking the window between disclosure and patching without manual intervention. Note: dpkg-reconfigure writes /etc/apt/apt.conf.d/20auto-upgrades to opt in; the schedule itself lives in the apt-daily-upgrade.timer, not in an enabled service unit.
Consistent identity and accurate time are prerequisites for correlating logs across hosts.
sudo hostnamectl set-hostname srv01 && sudo timedatectl set-timezone America/Toronto && sudo timedatectl set-ntp true
Expected output:
(no output on success; verify with: hostnamectl && timedatectl)What this teaches: hostnamectl sets the static identity; timedatectl sets zone and enables NTP so logs correlate across hosts to the second.
Daily work should never use root directly; a sudo user gives auditable, revocable elevation.
Expected output:
What this teaches: A non-root sudo user gives auditable, revocable elevation; adduser creates the account interactively while usermod -aG appends the sudo group.
How It Works
Post-install hardening follows a simple principle: reduce, then maintain. Patching first closes every known vulnerability before the host takes on a role; automatic security updates keep that posture without relying on human memory. A host that starts fully patched and stays patched is dramatically cheaper to defend than one remediated later.
Identity and time are the two prerequisites for coherent operations. The hostname is how the machine refers to itself in logs, prompts, and monitoring; consistent naming (srv01, not localhost) makes fleet management possible. Accurate time via NTP underpins TLS validation, Kerberos, and cross-host log correlation, which is why timedatectl set-ntp true is non-negotiable.
The non-root user rule exists for accountability. Shared root passwords cannot be revoked per person and leave no audit trail; per-user accounts with sudo log who elevated and when. Disabling direct root SSH later completes the pattern, but creating the sudo user is the step that makes it possible.
Progress So Far
Testing & Validation
Run this final check:
timedatectl status && id taki && systemctl is-enabled apt-daily-upgrade.timer && grep Unattended-Upgrade /etc/apt/apt.conf.d/20auto-upgradesYou should see NTP active, the user in the sudo group, the apt-daily-upgrade.timer reporting enabled, and APT::Periodic::Unattended-Upgrade "1"; in the config. If all checks pass, your baseline is ready. Note: systemctl is-enabled unattended-upgrades reports static because that service has no [Install] section; the timer is the correct thing to verify.
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
| apt update hits 404 errors | Stale mirror entries or a release that moved to old-releases | Check sources.list against the current release codename and pick a working mirror |
| unattended-upgrades never seems to run | Timer disabled or package only half-configured | Verify with systemctl status unattended-upgrades and check /var/log/unattended-upgrades/ |
| timedatectl: NTP not synchronized | UDP 123 blocked or no NTP servers reachable | Open NTP egress and confirm with timedatectl timesync-status |
| New user cannot sudo | Not actually in the sudo group | Confirm with id username and re-add with usermod -aG sudo |
| Hostname reverts after reboot (cloud) | Cloud-init rewrites it from metadata | Set preserve_hostname: true in cloud-init config |
| full-upgrade wants to remove packages | Dependency resolver cleaning up transitions | Review the list; use apt upgrade for conservative runs on critical hosts |
Troubleshooting
- apt update fails with signature errors: the clock is wrong; set time with
sudo timedatectl set-ntp trueand retry. - sudo: user not in sudoers: re-run
usermod -aG sudo takiand start a fresh login. - Held-back packages: run
sudo apt full-upgraderather than plain upgrade.
Extension Ideas
- Harden remote access with SSH Hardening.
- Centralize logs in Log Management & Analysis.
- Automate this baseline with Ansible across many hosts.
Key Results
- Brought a fresh host to a fully patched state in one pass.
- Enabled automatic security updates, reducing the patch gap to under 24 hours.
- Replaced direct root use with an auditable sudo account.
- Standardized hostname, timezone, and NTP for log correlation.
Key Takeaways
- Patch before configuring; a fresh host is at its most vulnerable.
- Automatic security updates shrink the exposure window.
- Hostname plus NTP are prerequisites for sane logs and TLS.
- Daily work happens as a sudo user, never as root.
- Verify each step (id, timedatectl) before moving on.
Practice Challenges
Challenge 1: Reboot-proof identity
Goal: set hostname, timezone, and NTP, reboot, and prove all three persisted.
Hint: hostnamectl and timedatectl status after the reboot.
Challenge 2: SSH lockdown follow-up
Goal: as the new sudo user, disable root SSH login and password auth, then verify you can still get in with your key.
Hint: keep one working session open while testing.