Guidelines:SecureOperation - Revision history

Dominic at 19:42, 2 February 2026

2026-02-02T19:42:50Z

← Older revision		Revision as of 19:42, 2 February 2026
Line 7:		Line 7:
	'''''Note:''' this configuration is standard on many clouds, e.g. AWS EC2, so you do not need to do this manually. Check with your cloud service provider for details.''		'''''Note:''' this configuration is standard on many clouds, e.g. AWS EC2, so you do not need to do this manually. Check with your cloud service provider for details.''

	=== Unprivileged Account ===		== Unprivileged Account ==

	You should use an unprivileged user account for SSH login. To do so, login as root and create a new user, e.g. "serveradm":		You should use an unprivileged user account for SSH login. To do so, login as root and create a new user, e.g. "serveradm":
Line 32:		Line 32:
	After that, you should be ''root''.		After that, you should be ''root''.

	=== Key-based Login ===		== Key-based Login ==

	You should use RSA keys for SSH login instead of passwords. To do so, generate a key pair on your local machine:		You should use RSA keys for SSH login instead of passwords. To do so, generate a key pair on your local machine:
Line 60:		Line 60:
	You can repeat this process for a second key pair, as/if required, e.g. for a representative or as backup key. Make sure that all private keys are securely stored, and protected by passphrases.		You can repeat this process for a second key pair, as/if required, e.g. for a representative or as backup key. Make sure that all private keys are securely stored, and protected by passphrases.

	=== Disable Root Login and Password Authentication ===		== Disable Root Login and Password Authentication ==

	If you are not logged-in as ''serveradm'' yet, login now (using the private key):		If you are not logged-in as ''serveradm'' yet, login now (using the private key):

Dominic at 19:42, 2 February 2026

2026-02-02T19:42:21Z

← Older revision		Revision as of 19:42, 2 February 2026
Line 1:		Line 1:
	[[Guidelines:Deployment\|All Deployment Guidelines]]		[[Guidelines:Deployment\|All Deployment Guidelines]]

	== Secure Server Operation ==		= Secure Server Operation =

	The following steps are recommended to secure your Eden server back-end under Debian/Linux.		The following steps are recommended to secure your Eden server back-end under Debian/Linux.

Dominic at 19:41, 2 February 2026

2026-02-02T19:41:30Z

← Older revision		Revision as of 19:41, 2 February 2026
Line 1:		Line 1:
			[[Guidelines:Deployment\|All Deployment Guidelines]]

	== Secure Server Operation ==		== Secure Server Operation ==

Dominic: /* Secure Server Operation */

2026-02-02T19:39:49Z

Secure Server Operation

← Older revision		Revision as of 19:39, 2 February 2026
Line 3:		Line 3:
	The following steps are recommended to secure your Eden server back-end under Debian/Linux.		The following steps are recommended to secure your Eden server back-end under Debian/Linux.

	Note: this configuration is standard on many clouds, e.g. AWS EC2, so you do not need to do this manually. Check with your cloud service provider for details.		'''''Note:''' this configuration is standard on many clouds, e.g. AWS EC2, so you do not need to do this manually. Check with your cloud service provider for details.''

	=== Unprivileged Account ===		=== Unprivileged Account ===

Dominic: /* Secure Server Operation */

2026-02-02T16:36:28Z

Secure Server Operation

← Older revision		Revision as of 16:36, 2 February 2026
Line 1:		Line 1:
	== Secure Server Operation ==		== Secure Server Operation ==

	The following steps are recommended to secure your Eden server back-end.		The following steps are recommended to secure your Eden server back-end under Debian/Linux.

	Note: this configuration is standard on many clouds, e.g. AWS EC2, so you do not need to do this manually. Check with your cloud service provider for details.		Note: this configuration is standard on many clouds, e.g. AWS EC2, so you do not need to do this manually. Check with your cloud service provider for details.

Dominic at 16:35, 2 February 2026

2026-02-02T16:35:45Z

← Older revision		Revision as of 16:35, 2 February 2026
Line 7:		Line 7:
	=== Unprivileged Account ===		=== Unprivileged Account ===

	You should use an unprivileged user account for SSH login. To do so, login as root and create a new user, e.g. "~~serveradmin~~":		You should use an unprivileged user account for SSH login. To do so, login as root and create a new user, e.g. "serveradm":

	<code>		<code>
	adduser ~~serveradmin~~		adduser serveradm
	</code>		</code>

Line 18:		Line 18:

	<syntaxhighlight lang="bash" line>		<syntaxhighlight lang="bash" line>
	# User rules for ~~serveradmin~~		# User rules for serveradm
	~~serveradmin~~ ALL=(ALL) NOPASSWD:ALL		serveradm ALL=(ALL) NOPASSWD:ALL
	</syntaxhighlight>		</syntaxhighlight>

Line 35:		Line 35:

	<code>		<code>
	ssh-keygen -t rsa -m PEM -b 4096 -f ~~serveradmin~~ -C "~~serveradmin~~"		ssh-keygen -t rsa -m PEM -b 4096 -f serveradm -C "serveradm"
	</code>		</code>

Line 43:		Line 43:

	<code>		<code>
	cat ~~serveradmin~~.pub \| ssh ~~serveradmin~~@[server-public-ip] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"		cat serveradm.pub \| ssh serveradm@[server-public-ip] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
	</code>		</code>

	...replacing [server-public-ip] with the public IP address of the server. You will be prompted for the password of the ''~~serveradmin~~'' user.		...replacing [server-public-ip] with the public IP address of the server. You will be prompted for the password of the ''serveradm'' user.

	Next, login to the server using the newly installed key:		Next, login to the server using the newly installed key:

	<code>		<code>
	ssh -i ~~serveradmin serveradmin~~@[server-public-up]		ssh -i serveradm serveradm@[server-public-up]
	</code>		</code>

Line 60:		Line 60:
	=== Disable Root Login and Password Authentication ===		=== Disable Root Login and Password Authentication ===

	If you are not logged-in as ''~~serveradmin~~'' yet, login now (using the private key):		If you are not logged-in as ''serveradm'' yet, login now (using the private key):

	<code>		<code>
	ssh -i ~~serveradmin serveradmin~~@[server-public-up]		ssh -i serveradm serveradm@[server-public-up]
	</code>		</code>

Line 85:		Line 85:
	</code>		</code>

	Now, you can no longer SSH-login as ''root'', but only as ''~~serveradmin~~'' - and you must use a private key, as passwords will no longer be accepted.		Now, you can no longer SSH-login as ''root'', but only as ''serveradm'' - and you must use a private key, as passwords will no longer be accepted.

Dominic: /* Secure Server Operation */

2026-02-02T16:32:51Z

Secure Server Operation

← Older revision		Revision as of 16:32, 2 February 2026
Line 3:		Line 3:
	The following steps are recommended to secure your Eden server back-end.		The following steps are recommended to secure your Eden server back-end.

	Note: this configuration is standard on many clouds, e.g. AWS EC2, so you do not need to do this manually. Check with your cloud service provider for details.		Note: this configuration is standard on many clouds, e.g. AWS EC2, so you do not need to do this manually. Check with your cloud service provider for details.

	=== Unprivileged Account ===		=== Unprivileged Account ===

Dominic: /* Secure Server Operation */

2026-02-02T16:32:37Z

Secure Server Operation

← Older revision		Revision as of 16:32, 2 February 2026
Line 3:		Line 3:
	The following steps are recommended to secure your Eden server back-end.		The following steps are recommended to secure your Eden server back-end.

	Note: this configuration is standard on many clouds, e.g. AWS EC2.		Note: this configuration is standard on many clouds, e.g. AWS EC2, so you do not need to do this manually. Check with your cloud service provider for details.

	=== Unprivileged Account ===		=== Unprivileged Account ===

Dominic: /* Secure Server Operation */

2026-02-02T16:31:05Z

Secure Server Operation

← Older revision		Revision as of 16:31, 2 February 2026
Line 1:		Line 1:
	== Secure Server Operation ==		== Secure Server Operation ==

	The following steps are recommended to secure your Eden server back-end:		The following steps are recommended to secure your Eden server back-end.

			Note: this configuration is standard on many clouds, e.g. AWS EC2.

	=== Unprivileged Account ===		=== Unprivileged Account ===

Dominic: /* Secure Server Operation */

2026-02-02T16:27:43Z

Secure Server Operation

← Older revision		Revision as of 16:27, 2 February 2026
Line 1:		Line 1:
	== Secure Server Operation ==		== Secure Server Operation ==

	The following steps are recommended to secure your Eden server:		The following steps are recommended to secure your Eden server back-end:

	=== Unprivileged Account ===		=== Unprivileged Account ===