\n
\n<\/div>\n
3. Configuring the Network<\/h2>\nStep 1: Assign a Static IP<\/h3>\n
Edit the Netplan configuration:<\/p>\n
sudo nano \/etc\/netplan\/50-cloud-init.yaml<\/code><\/pre>\nExample configuration:<\/p>\n
network:\r\n version: 2\r\n ethernets:\r\n eno8403:\r\n dhcp4: false\r\n addresses:\r\n - 192.168.0.10\/24\r\n gateway4: 192.168.0.1\r\n nameservers:\r\n addresses:\r\n - 8.8.8.8\r\n - 8.8.4.4<\/code><\/pre>\nApply the configuration:<\/p>\n
sudo netplan apply<\/code><\/pre>\n\n
\n<\/div>\n
4. Setting Up Nextcloud<\/h2>\nStep 1: Install Nextcloud<\/h3>\n\n- Use the Snap package for ease of installation:\n
sudo snap install nextcloud<\/code><\/pre>\n<\/li>\n<\/ol>\nStep 2: Configure External Storage<\/h3>\n\n- Create a storage mount point:\n
sudo mkdir \/mnt\/nextcloud_data<\/code><\/pre>\n<\/li>\n- Mount additional storage:\n
sudo mkfs.ext4 \/dev\/sdb1\r\n sudo mount \/dev\/sdb1 \/mnt\/nextcloud_data<\/code><\/pre>\n<\/li>\n- Update
\/etc\/fstab<\/code> for persistent mounting:\n\/dev\/sdb1 \/mnt\/nextcloud_data ext4 defaults 0 0<\/code><\/pre>\n<\/li>\n<\/ol>\nStep 3: Set Permissions<\/h3>\n
Ensure Nextcloud has access:<\/p>\n
sudo chown -R www-data:www-data \/mnt\/nextcloud_data\r\n sudo chmod -R 770 \/mnt\/nextcloud_data<\/code><\/pre>\n\n
\n<\/div>\n
5. Securing the Server<\/strong><\/h2>\nStep 1: Configure SSH<\/strong><\/h2>\nOne of the first steps in securing your server is to change the default SSH port, which helps reduce the risk of automated attacks that target common ports (like port 22). By changing the SSH port and applying additional restrictions, you can significantly improve your server’s security.<\/p>\n
\n- Open the SSH configuration file:\n
\n
<\/div>\n
sudo nano \/etc\/ssh\/sshd_config
\n<\/code><\/div>\n<\/div>\n<\/li>\n- Update the following settings:\n
\n- Disable root login:\n
\n
<\/div>\n
PermitRootLogin no
\n<\/code><\/div>\n<\/div>\n<\/li>\n- Disable password authentication (use SSH keys instead):\n
\n
<\/div>\n
PasswordAuthentication no
\n<\/code><\/div>\n<\/div>\n<\/li>\n- Restrict SSH access to specific users:\n
\n
<\/div>\n
AllowUsers <your-username>
\n<\/code><\/div>\n<\/div>\n<\/li>\n- Change the default SSH port to 3387<\/strong> (or a port of your choice):\n
\n
<\/div>\n
Port 3387
\n<\/code><\/div>\n<\/div>\n<\/li>\n<\/ul>\n<\/li>\n- Save the file and restart the SSH service:\n
\n
<\/div>\n
sudo systemctl restart sshd
\n<\/code><\/div>\n<\/div>\n<\/li>\n<\/ol>\n
\nStep 2: Enable Firewall<\/strong><\/h2>\nNext, configure the Uncomplicated Firewall (UFW)<\/strong> to allow traffic on your new SSH port and block unnecessary connections:<\/p>\n\n- Install UFW:\n
\n
<\/div>\n
sudo apt install ufw -y
\n<\/code><\/div>\n<\/div>\n<\/li>\n- Allow only essential ports:\n
\n- SSH on the new port (3387):\n
\n
<\/div>\n
sudo ufw allow 3387\/tcp
\n<\/code><\/div>\n<\/div>\n<\/li>\n- HTTP and HTTPS for web traffic:\n
\n
<\/div>\n
sudo ufw allow http
\nsudo ufw allow https
\n<\/code><\/div>\n<\/div>\n<\/li>\n<\/ul>\n<\/li>\n- Enable the firewall:\n
\n
<\/div>\n
sudo ufw enable<\/span>
\n<\/code><\/div>\n<\/div>\n<\/li>\n<\/ol>\n
\nStep 3: Install Fail2Ban<\/strong><\/h2>\nTo further protect your server against brute-force attacks, use Fail2Ban<\/strong>, which blocks IP addresses that repeatedly fail to log in.<\/p>\n\n- Install Fail2Ban:\n
\n
<\/div>\n
sudo apt install fail2ban -y
\n<\/code><\/div>\n<\/div>\n<\/li>\n- Configure SSH protection:\n
\n- Edit or create the Fail2Ban jail configuration file:\n
\n
<\/div>\n
sudo nano \/etc\/fail2ban\/jail.local
\n<\/code><\/div>\n<\/div>\n<\/li>\n- Add the following settings for SSH:\n
\n
<\/div>\n
[sshd]
\nenabled = true
\nport = 3387
\nlogpath = \/var\/log\/auth.log
\nbantime = 3600
\nmaxretry = 3
\n<\/code><\/div>\n<\/div>\n<\/li>\n<\/ul>\n<\/li>\n- Save the file and restart Fail2Ban:\n
\n
<\/div>\n
sudo systemctl restart fail2ban
\n<\/code><\/div>\n<\/div>\n<\/li>\n<\/ol>\n
\nWhy Change the Default SSH Port?<\/strong><\/h3>\nChanging the default SSH port (from the commonly used port 22) helps obscure your server from bots and automated scripts that scan for open ports on default settings. Coupled with a strong firewall and brute-force protection, this step forms the foundation of a robust security strategy for your server.<\/p>\n
\n
\n<\/div>\n
6. Automating Backups<\/h2>\nStep 1: Install Rsync<\/h3>\n
Rsync is a robust tool for backups:<\/p>\n
sudo apt install rsync -y<\/code><\/pre>\nStep 2: Create a Backup Script<\/h3>\n\n- Write a script to sync data to
\/mnt\/backup<\/code>:\nsudo nano \/usr\/local\/bin\/backup.sh<\/code><\/pre>\nExample:<\/p>\n
#!\/bin\/bash\r\n rsync -av \/mnt\/nextcloud_data \/mnt\/backup<\/code><\/pre>\n<\/li>\n- Make the script executable:\n
![\"Dell](\"https:\/\/www.thexyz.com\/blog\/wp-content\/uploads\/t150office-min.png\")
<\/p>\n