Drislock VPS (DigitalOcean Droplet)

TODO
- [2019-03-13 Wed] Some basic notes from first time setup
- [2022-06-30 Thu] Migrating to smaller droplet

TODO revamp this one more time

TODO

point domain name servers at digitalocean's nameserver (currently using namesilo)
add a CAA record for letsencrypt
gen an ssh key add to DO web config
spin up a debian droplet
Debian setup
- remove default editors (joe - wtf???)
- create a user, add to sudoers
- disable password ssh logins, root login
- lock root account password
- copy vim and shell configs
- install nginx
- enable auto updates
letsencrypt
- enable backports (uncomment DO mirrors)
- install certbot python-certbot-nginx
- sudo certbot –nginx
- backup /etc/letsencrypt
- (this autorenews via a systemd timer)
other DNS records
- AAAA - IPv6
- A - IPv4
- CAA - letsencrypt
- TXT - reject mail
- NS - digitalocean nameservers

ipv6 https://docs.digitalocean.com/products/networking/ipv6/how-to/enable/ enable ipv6 on your droplet (requires a shutdown) modify /etc/network/interfaces for inet6 address reboot create an AAAA dns record https://docs.digitalocean.com/products/networking/dns/how-to/manage-records/#aaaa-records

probably make sure apps listen on ipv6 address like nginx, znc maybe, identd, ssh some infos https://www.digitalocean.com/community/tutorials/how-to-configure-tools-to-use-ipv6-on-a-linux-vps but it's mostly just adding listen statements to config files

firewall install iptables and ufw allow ssh allow https allow http allow 113/tcp (ident) allow 43025 (znc) enable ufw

[2019-03-13 Wed] Some basic notes from first time setup

Overview

point domain name servers at digitalocean's nameserver (currently using enom)
add a CAA record for letsencrypt
gen an ssh key add to DO web config
spin up a debian droplet
- remove default editors (joe - wtf???)
- create a user, add to sudoers
- disable password ssh logins, root login
- lock root account password
- copy vim and shell configs
- install nginx
- enable auto updates
letsencrypt
- enable backports (uncomment DO mirrors)
- install certbot python-certbot-nginx
- sudo certbot –nginx
- backup /etc/letsencrypt
- (this autorenews via a systemd timer)

drislock setup commands

Missing a lot of stuff see future entries for a better reference.

vim .ssh/authorized_keys
passwd -l <username>
sudo vim /etc/ssh/sshd_config
sudo systemctl restart ssh
sudo apt purge lighttpd
sudo apt install nginx
sudo vim /etc/apt/sources.list
sudo apt update
sudo apt install certbot unattended-upgrades apt-listchanges rxvt-unicode-256color
sudo unattended-upgrades -d

nginx config commands

sudo apt-get install certbot -t stretch-backports
sudo apt autoremove
systemctl status nginx
sudo vim /etc/apt/apt.conf.d/50unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades
sudo apt-get install certbot python-certbot-nginx -t stretch-backports
sudo certbot --nginx
sudo certbot renew --dry-run
sudo scp -r /etc/letsencrypt <username>@<hostname>:/path/to/backup/configs/
systemctl show certbot.timer
sudo vim /etc/nginx/nginx.conf
sudo systemctl restart nginx
journalctl -xe
sudo journalctl -xe
apt show nginx
vim /etc/nginx/nginx.conf
sudo vim /etc/nginx/nginx.conf
sudo systemctl restart nginx

znc config commands

sudo apt install znc
znc --makeconf
znc --help
vim .znc/configs/znc.conf
cd .znc/users/Username/networks/OFTC/moddata/cert/
mv ~/OFTC.pem user.pem
cd ~/.znc
cat configs/znc.conf
cd .znc/users/Username/networks/freenode/
mkdir ./freenode/moddata/cert/
openssl req -x509 -new -newkey rsa:4096 -sha256 -days 1460 -nodes -out freenode.pem -keyout freenode.pem
cp freenode.pem freenode/moddata/cert/user.pem
# backup
mv .znc/users/Username/networks/freenode.pem ~/freenode.pem
cp .znc/users/Username/networks/OFTC/moddata/cert/user.pem ~/OFTC.pem
# Compact the key fingerprint. Dunno what wanted them in this format, but here you go.
openssl x509 -sha1 -noout -fingerprint -in user.pem | sed -e 's/^.*=//;s/://g;y/ABCDEF/abcdef/'
openssl x509 -sha1 -noout -fingerprint -in .znc/users/Username/networks/freenode/moddata/cert/user.pem | sed -e 's/^.*=//;s/://g;y/ABCDEF/abcdef/'
vim .znc/configs/
znc --makepass

[2022-06-30 Thu] Migrating to smaller droplet

DO increased prices on their minimal droplet while adding a new worse one. I decided to migrate and take the chance to document things a bit more in depth.

Create the new droplet

I created a new droplet running Debian 11. Picked the NYC1 datacenter (previous was on NYC3). DO lets you reuse existing SSH keys during droplet creation which is nice. Enabled IPV6.

Security updates are already enabled by default now so we just need to apt update and upgrade.

Install some basics

apt install oidentd nginx certbot python3-certbot-nginx unattended-upgrades apt-listchanges rxvt-unicode-256color znc

Add my default user and give sudo access.

adduser <username>
usermod <username> --append --groups www-data,sudo

Copy authorized key to user account

cp -r /root/.ssh /home/<username>
chown -R <username>:<username> /home/<username>/.ssh

Copy over some basic user config (vim, bash).

Purge bashrc of a few things like yadm nag, HOSTFILE, DEBEMAIL…, keychain, mail. Basically everything after xterm-256color.

scp .vim/vimrc <username>@<host-ip>:/home/<username>/.vim/
scp .bashrc <username>@<host-ip>:/home/<username>/
vim ~/.bashrc

Copy over nginx config, `/var/www/html`, and certbot certs.

generate a ssh key on new host

ssh-keygen -f drislock_transfer

copy it between hosts

scp -3 <username>@<new_host_ip>:/home/<username>/drislock_transfer.pub <username>@<old_host_ip:/home/<username>/

add it to authorized_keys on old host, then tar up the files

cat drislock_transfer.pub >> .ssh/authorized_keys
sudo tar -chvzf certs_nginx_html.tar.gz /etc/nginx/sites-available/default  /etc/letsencrypt/archive/drislock.org /etc/letsencrypt/renewal/drislock.org.conf /var/www/html/

copy them over to the new host and untar

cd /
sudo tar xvf /home/<username>/certs_nginx_html.tar.gz

relink the live folder symlinks (probably use the last number available, certbot seems to keep all copies around)

sudo mkdir -p /etc/letsencrypt/live/drislock.org
sudo ln -s /etc/letsencrypt/archive/drislock.org/cert21.pem /etc/letsencrypt/live/drislock.org/cert.pem
sudo ln -s /etc/letsencrypt/archive/drislock.org/chain21.pem /etc/letsencrypt/live/drislock.org/chain.pem
sudo ln -s /etc/letsencrypt/archive/drislock.org/fullchain21.pem /etc/letsencrypt/live/drislock.org/fullchain.pem
sudo ln -s /etc/letsencrypt/archive/drislock.org/privkey21.pem /etc/letsencrypt/live/drislock.org/privkey.pem
sudo systemctl restart nginx

Update the DNS records in digitalocean's Domain interface to point to the new droplet's IP (both IPV6 and IPV4).

reinit the certbot nginx config, test renewal, renew if necessary (old cert should still be valid)

sudo certbot --nginx --init
sudo letsencrypt renew --dry-run
sudo letsencrypt renew

ZNC setup

Message *status to shutdown from your IRC client.

/msg *status Shutdown

Move the old znc files over:

tar cvfz znc.tar.gz .znc
scp -3 ...
cd
tar xf znc.tar.gz

Oidentd setup

Listing 2: /etc/oidentd.conf

user <username> {
        default {
                allow spoof
                allow spoof_all
        }
}

sudo systemctl restart oidentd.service

Fix your hostname, hosts file, and reverse DNS
Listing 3: /etc/hostname
```
drislock
```
Listing 4: /etc/hosts
```
127.0.1.1 drislock.localdomain drislock
```
Rename your droplet to match the domain name to get reverse DNS working (DO has a 30 minute TTL to wait out before PTR records propagate).
- drislock.org -> drislock-v1
- drislock-v2 -> drislock.org

Other stuff

Change the motd.

Listing 5: /etc/motd

Turn off the machine. See the gnarl. Feel your body.
Release your thoughts. Open your heart. Be amazed.

I set up the digitalocean firewall because why not? Some ports: 22, 80, 113, 443, 43025, ICMP.

Finally verify operation and clean up.

rsync a backup of the old droplet or something.
Reboot the new host at least once to verify functionality.
Delete the old droplet.