Getting started on a fresh UNIX server

Question

I am not an experienced system administrator. However, my company distributes software remotely to customers which means that I occasionally have to make adjustments to or install small scripts or services on UNIX machines. These servers (virtual or physical) are usually fresh out-of-the-box which always costs a lot time getting started.

Therefore, my question is: What are your first steps on a fresh "virgin" machine? What tools are particularly helpful and in what order? Also, is there any harm in installing "too much" (I am thinking why not install all the popular packages just-in-case (Java, mySQL, Apache, Tomcat, etc.)? What is good practice to make life easier for later administrators?

Here is what I do so far:

* Find out release: cat /etc/*-release
* Kernel info: uname -a
* Complier version: gcc -v
* cpuinfo: cat /proc/cpuinfo
* try out by hand whether apt-get, yum, up2date or fink exist

Answer 1

I prefer to keep things as simple as possible. That means I first prep the new install, then, once the machine is locked down and secure, install the applications that I need. I prefer to do a base / minimal install of the OS then add packages as I need them rather than installing everything at the start.

1) Set hostname / timezone 2) Turn off un-wanted services 3) Configure networking 4) Configure firewall to drop everything (in and out) 5) Configure package manager to point at local repo 6) Package manager update (yum update / apt-get upgrade) 7) Create user accounts / setup SUDO 8) Configure SSHD, enable through firewall 9) Configure sendmail / outbound email, enable through firewall 10) Roll-out private/public keys where required 11) Install monitoring / logwatch

At this point I'd try and leave the system (if it's new hardware) for some burn in.

Then I'd go on to install Apache / MySQL whatever is required.

Answer 2

The very first thing I do is setup the firewall so only ssh is available. This is opened up to more services as I install and configure them.

The first tools I install are, if they are not already installed:

• Screen
• Wget
• Sudo
• Vim

Then I take an archive copy of /etc so I can refer back to the system state at install.

There is harm in installing "too much" - it increases your potential scope for attack, more services installed and running means more things to patch, more things to miss, more things to configure et al.

If you are looking at setting up many near-identical systems, why not setup one system and ghost it. You can write a script so usernames, passwords, hostnames et al are changed after you deploy the ghost image to make the system unique. Also, take a look at 'puppet' for automated centralised administrative tasks.

Answer 3

If it is linux you most of the distributions ship with *ls_release* and it will give you some intrersting information:

user@rocket:~$ lsb_release -a
Distributor ID: Ubuntu
Description:    Ubuntu 8.04.3 LTS
Release:        8.04
Codename:      hardy

Answer 4

Who is installing these servers? Has your company a minimum requirement on the needed software, libraries, etc. for the application you deliver?

I would suggest to make a base of a master server that could be used as a template to have all customer servers installed in the same way, like with kickstart under RH or Fedora. That template could include all software that you would require useful.

Otherwise, reduce services and software on the server to a minimum - just have the things that are really needed.

Configure ssh with keys. Disable root login via ssh. Use sudo for administration of the server. Have the firewall (iptables) configured.