Recently I’ve had the opportunity of setting up a Linux instance on Amazon EC2 for use with Ruby on Rails, MySQL, Nginx and Rabbit MQ. I suspect much of what I will document is obvious to many but hopefully some of you may find it useful, especially, if like me, you are totally inexperienced with setting up a Linux server.
As it turns out I’ll probably document this over a couple of posts as it took up a bit more time and space than I first anticipated. In this first part I will cover, logging in as the root user, adding a new user, generating their ssh key, adding the user to the list of sudoers, and finally disabling root login via ssh. I’ll update this article with links to the other parts as I create them (Part 2).
Right, first things first, some background info. Rightly or wrongly we required the server to do more than one thing, hence the list of items to install. So to reduce this number I picked an image with RabbitMQ pre-installed – as setup of this was uncharted territory for me. A consequence of this choice was that it pushed us down the path of Ubuntu and the latest version which is currently 9.10. So let’s get to it.
The goal here is to disable remote root login, and in doing so we need to create a new user, and give him the ability to sudo commands. To do that we first need to login to our new EC2 image – which took me a little time to figure out! This can be done from Windows using putty. However, we must first use puttygen to generate a putty ssh auth key (putty doesn’t understand the key generated by Amazon) from your Amazon keypair which can be found in the AWS Management Console under Key Pairs. Check out this link for further information.
Now on to the real work.
Adding a user and generating their ssh key
Follow the process below to add a new user and generate an ssh key for this user.
- Login as root using method described above
- Run
adduser webuser
– wherewebuser
is the name of the user we are adding. Fill in the details including the password of this user. - Type
su webuser
– to run a shell as this user without logging out - Execute
ssh-keygen -t dsa
from this users home directory - Rename the file
~/.ssh/id_dsa.pub
to~/.ssh/authorized_keys
- Take a copy of the generated private key (should be in
~/.ssh/id_dsa
) and copy it to your local machine - Now use puttygen to generate the ssh key from
id_dsa
- Finally login using putty and the new key – you should only have to specify your username when logging in.
Adding your new user to the list of sudoers
This is a very basic sudoers setup as we are only adding a single sudo user to the /etc/sudoers
file. I know you can do way more complicated things with this but what is documented here was sufficient for our needs. So let’s get on with it.
- Login as
root
- Run
visudo
– this is an editor for the sudoers file to stop multiple people editing the file at the same time - Locate the lines below in the editor
# User privilege specification
root ALL=(ALL) ALLand change this to
# User privilege specification
root ALL=(ALL) ALL
webuser ALL=(ALL) ALL - If you would like to allow the user to sudo without having to supply a password then you need to add the following line as well:
webuser ALL=NOPASSWD: ALL
- Now save the file and exit – ensure that the changes are saved to
/etc/sudoers
Disabling root login
- Login as
webuser
- Run
sudo vi /etc/ssh/sshd_config
– you can replacevi
with another editor if you please, I’ve heardnano
might be a little more friendly to windows users! - Find the line
PermitRootLogin
and change it to:
PermitRootLogin no
If I remember correctly in the instance I was using there was more than one line with
PermitRootLogin
so it may be worth check for this yourself. - As a side note, should you wish to allow login using passwords rather than using a ssh key (this maybe what users familiar with shared hosting are used to) you can enable this by changing the relevant line in
sshd_config
to:
PasswordAuthentication yes
- Finally, restart
sshd
by runningsudo /etc/init.d/ssh restart
You should now be able to login in using webuser
, and sudo
commands as webuser
that require to be run as root
. Additionally, root
login from a remote server has also been disabled.
There may be better ways to do the above, but what I’ve documented works. I may also be missing stuff, if so, let me know and I will update this. Well, that’s it for now. Check back soon for Part 2 which will be on it’s way shortly.
Nice post! We have also just been through this with our own AMIs. It would be great to ‘compare notes’. See http://www.rabbitmq.com/ec2.html if you are interested.
Cheers,
alexis
Thanks for this post. I’m trying to make the most of it, but I don’t think it’s “dummy” enough. I could not follow steps E and F for adding a new user. I’m not sure what you mean by “Rename the file ~/.ssh/id_dsa.pub to ~/.ssh/authorized_keys”; also, I can’t figure out how to download the generated key file to my machine. I tried several commands, but nothing worked.
A much more unix proper way to handle adding sudoers is to run visudoers and uncomment the line which grants access to users in the wheel group. Then edit /etc/group and add the users who need sudo access to wheel.
if this is an idiots guide then why you dont say how to SAVE AND EXIT visudo????????????