71.1 Project 1: Set up a Linux server with users, sudo and SSH keys

Example 1: Read the OS pretty name

Type this:

cat /etc/os-release | grep PRETTY_NAME

You will see:

PRETTY_NAME="Ubuntu 24.04.1 LTS"

What it means: This server runs Ubuntu 24.04 LTS. LTS means long-term support, which companies prefer.

Example 2: Read the kernel version

Type this:

uname -r

You will see:

6.8.0-1015-aws

What it means: The kernel is the heart of Linux. AWS images often have -aws in the name.

Example 3: See who you are and whether you are root

Type this:

whoami; id

You will see:

ubuntu
uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu),27(sudo)

What it means: The default cloud user is often ubuntu or ec2-user. It already has sudo. We will add named users next.

Example 4: See the current hostname

Type this:

hostnamectl --static

You will see:

ip-172-31-12-4

What it means: This is the default AWS name. We will replace it.

Example 5: Set a new hostname

Type this:

sudo hostnamectl set-hostname prod-badge-01 && hostnamectl --static

You will see:

prod-badge-01

What it means: The static hostname is now prod-badge-01. New shells will show it in the prompt.

Example 6: Put it in /etc/hosts for local name lookup

Type this:

grep -q 'prod-badge-01' /etc/hosts || echo '127.0.1.1 prod-badge-01' | sudo tee -a /etc/hosts; grep prod-badge-01 /etc/hosts

You will see:

127.0.1.1 prod-badge-01

What it means: Some tools resolve the hostname locally. This line keeps them happy.

Example 7: Refresh the package list

Type this:

sudo apt-get update -y | tail -3

You will see:

Get:24 http://security.ubuntu.com/ubuntu noble-security InRelease [126 kB]
Fetched 8,412 kB in 2s
Reading package lists... Done

What it means: apt now knows about the newest versions.

Example 8: Upgrade installed packages

Type this:

sudo DEBIAN_FRONTEND=noninteractive apt-get upgrade -y | tail -5

You will see:

Setting up openssl ...
Processing triggers for man-db ...
0 upgraded, 0 newly installed, 0 to remove

What it means: noninteractive skips questions. On a fresh image you may see many packages upgrade.

Example 9: Install tools we need for this project

Type this:

sudo apt-get install -y openssh-server sudo curl ca-certificates | tail -3

You will see:

openssh-server is already the newest version.
sudo is already the newest version.
0 upgraded, 0 newly installed

What it means: These packages are usually present. The command is safe to repeat.

Example 10: Create user ananya for a developer

Type this:

sudo useradd -m -s /bin/bash ananya && getent passwd ananya

You will see:

ananya:x:1001:1001::/home/ananya:/bin/bash

What it means: User id 1001, home /home/ananya, shell bash. The x means the password hash is in /etc/shadow.

Example 11: Create user rohit for another developer

Type this:

sudo useradd -m -s /bin/bash rohit && ls -ld /home/rohit

You will see:

drwxr-x--- 2 rohit rohit 4096 Oct 28 10:01 /home/rohit

What it means: Only rohit (and root) can enter this home folder. That is the default safe mode.

Example 12: List human users with a home under /home

Type this:

getent passwd | awk -F: '$6 ~ /^\/home\// {print $1,$3,$6,$7}'

You will see:

ubuntu 1000 /home/ubuntu /bin/bash
ananya 1001 /home/ananya /bin/bash
rohit 1002 /home/rohit /bin/bash

What it means: Three human users. Service accounts like www-data are not listed because their home is not under /home.

Example 13: Set a temporary password for ananya

Type this:

echo 'ananya:ChangeMe-Now-1' | sudo chpasswd && echo set

You will see:

set

What it means: Password is set. This is a practice value. In real life use a password manager and share it through a secure channel, never Slack.

Example 14: Force password change on next login

Type this:

sudo chage -d 0 ananya && sudo chage -l ananya | head -3

You will see:

Last password change                : password must be changed
Password expires                : never
Password inactive               : never

What it means: -d 0 marks the password as expired, so the next login asks for a new one.

Example 15: Lock a user who left the company

Type this:

sudo usermod -L rohit && sudo passwd -S rohit

You will see:

rohit L 2026-10-28 0 99999 7 -1

What it means: L means locked. The account still exists for file ownership, but password login is blocked. Remove SSH keys too when someone leaves.

Example 16: Create the ops group

Type this:

sudo groupadd ops && getent group ops

You will see:

ops:x:1003:

What it means: Group id 1003. Empty for now.

Example 17: Add an operator named meera to ops

Type this:

sudo useradd -m -s /bin/bash -G ops meera && id meera

You will see:

uid=1003(meera) gid=1003(meera) groups=1003(meera),1004(ops)

What it means: -G adds a supplementary group. meera is in ops.

Example 18: See who is in ops

Type this:

getent group ops

You will see:

ops:x:1004:meera

What it means: Only meera. Developers stay out of this group.

Example 19: Create a sudoers drop-in for ops

Type this:

printf '%s\n' '%ops ALL=(ALL:ALL) ALL' | sudo tee /etc/sudoers.d/ops >/dev/null && sudo chmod 440 /etc/sudoers.d/ops && ls -l /etc/sudoers.d/ops

You will see:

-r--r----- 1 root root 24 Oct 28 10:05 /etc/sudoers.d/ops

What it means: Mode 440 means only root can read it. Never use a world-writable mode on sudoers files.

Example 20: Check the file with visudo

Type this:

sudo visudo -cf /etc/sudoers.d/ops

You will see:

/etc/sudoers.d/ops: parsed OK

What it means: visudo -cf checks syntax without opening an editor. Always run this after a change.

Example 21: Prove meera can sudo and ananya cannot

Type this:

sudo -u meera sudo -n true && echo meera_ok; sudo -u ananya sudo -n true 2>&1 | head -1

You will see:

meera_ok
sudo: a password is required

What it means: meera is in ops so sudo works. ananya is not in ops. -n means non-interactive, so it fails fast without asking.

Example 22: Generate an ed25519 key with a comment

Type this:

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_badge -C 'ananya@infosys-badge' -N '' && ls -l ~/.ssh/id_ed25519_badge*

You will see:

-rw------- 1 ananya ananya 399 Oct 28 10:10 /home/ananya/.ssh/id_ed25519_badge
-rw-r--r-- 1 ananya ananya 104 Oct 28 10:10 /home/ananya/.ssh/id_ed25519_badge.pub

What it means: Private key mode 600. Public key is safe to copy. -N '' means empty passphrase for the lab; at work use a passphrase or an agent.

Example 23: Show the public key

Type this:

cat ~/.ssh/id_ed25519_badge.pub

You will see:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExampleKeyMaterialOnly ananya@infosys-badge

What it means: This one line is what we paste into the server. It is not a secret.

Example 24: See the fingerprint

Type this:

ssh-keygen -lf ~/.ssh/id_ed25519_badge.pub

You will see:

256 SHA256:AbCdEfGhIjKlMnOpQrStUvWxYz0123456789abcd ananya@infosys-badge (ED25519)

What it means: Fingerprints help you confirm you copied the right key.

Example 25: Prepare .ssh for ananya on the server

Type this:

sudo mkdir -p /home/ananya/.ssh && sudo chmod 700 /home/ananya/.ssh && sudo chown -R ananya:ananya /home/ananya/.ssh && ls -ld /home/ananya/.ssh

You will see:

drwx------ 2 ananya ananya 4096 Oct 28 10:12 /home/ananya/.ssh

What it means: Only ananya can enter this folder.

Example 26: Append the public key

Type this:

printf '%s\n' 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExampleKeyMaterialOnly ananya@infosys-badge' | sudo tee -a /home/ananya/.ssh/authorized_keys >/dev/null && sudo chmod 600 /home/ananya/.ssh/authorized_keys && sudo chown ananya:ananya /home/ananya/.ssh/authorized_keys && wc -l /home/ananya/.ssh/authorized_keys

You will see:

1 /home/ananya/.ssh/authorized_keys

What it means: One key installed. Replace the example key with your real public key from the laptop.

Example 27: Test from the laptop (dry run of auth)

Type this:

ssh -i ~/.ssh/id_ed25519_badge -o BatchMode=yes -o ConnectTimeout=5 ananya@prod-badge-01 'echo login_ok && whoami'

You will see:

login_ok
ananya

What it means: BatchMode refuses password prompts. If you see login_ok, the key works.

Example 28: Write a drop-in config

Type this:

printf '%s\n' 'PasswordAuthentication no' 'PermitRootLogin no' 'PubkeyAuthentication yes' 'ChallengeResponseAuthentication no' | sudo tee /etc/ssh/sshd_config.d/99-harden.conf && cat /etc/ssh/sshd_config.d/99-harden.conf

You will see:

PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
ChallengeResponseAuthentication no

What it means: Drop-in files are easier to review than editing the main config.

Example 29: Test the config and reload

Type this:

sudo sshd -t && sudo systemctl reload ssh && echo reloaded

You will see:

reloaded

What it means: sshd -t checks syntax. reload applies changes without dropping current sessions.

Example 30: Confirm password login is refused

Type this:

ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no -o BatchMode=yes ananya@prod-badge-01 true 2>&1 | head -1

You will see:

ananya@prod-badge-01: Permission denied (publickey).

What it means: Password path is closed. Only publickey remains. That is what we want.

Example 31: List users with a login shell

Type this:

getent passwd | awk -F: '$7 ~ /bash|sh/ {printf "%s uid=%s home=%s\n",$1,$3,$6}'

You will see:

ubuntu uid=1000 home=/home/ubuntu
ananya uid=1001 home=/home/ananya
rohit uid=1002 home=/home/rohit
meera uid=1003 home=/home/meera

What it means: Quick view of human accounts.

Example 32: Show sudoers drop-ins

Type this:

sudo ls -l /etc/sudoers.d/ && echo '---' && sudo cat /etc/sudoers.d/ops

You will see:

total 4
-r--r----- 1 root root 24 Oct 28 10:05 ops
---
%ops ALL=(ALL:ALL) ALL

What it means: Only the ops group has a drop-in. Good.

Example 33: Show recent sudo use

Type this:

sudo grep -E 'sudo|COMMAND' /var/log/auth.log 2>/dev/null | tail -5 || sudo journalctl -u ssh -n 5 --no-pager

You will see:

Oct 28 10:15:01 prod-badge-01 sudo: meera : TTY=pts/0 ; USER=root ; COMMAND=/usr/bin/apt-get update

What it means: Every sudo command leaves a trail. This is how Priya proved who installed what after the miner incident.

Example 34: Remove meera from ops

Type this:

sudo gpasswd -d meera ops && getent group ops

You will see:

Removing user meera from group ops
ops:x:1004:

What it means: meera no longer has sudo.

Example 35: Remove all SSH keys for a locked user

Type this:

sudo rm -f /home/rohit/.ssh/authorized_keys && sudo ls /home/rohit/.ssh 2>/dev/null || echo 'no keys'

You will see:

no keys

What it means: Even a locked account can log in with a leftover key. Always delete keys.

Example 36: Archive and delete a home folder after backup

Type this:

sudo tar -czf /var/backups/rohit-home.tgz -C /home rohit && sudo userdel -r rohit && echo removed && ls /var/backups/rohit-home.tgz

You will see:

removed
/var/backups/rohit-home.tgz

What it means: -r removes the home folder. The tgz keeps files for 30 days in case something was needed.

Example 37: Allow OpenSSH then enable ufw

Type this:

sudo ufw allow OpenSSH && sudo ufw --force enable && sudo ufw status

You will see:

Rules updated
Firewall is active and enabled on system startup
Status: active
To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere

What it means: SSH stays open. Other ports stay closed until you allow them.

Example 38: See listening ports

Type this:

ss -tulpn | grep -E 'sshd|:22'

You will see:

LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=812,fd=3))

What it means: sshd is listening on port 22. That matches the firewall rule.

Example 39: Fail a bad login and find it in the log

Type this:

sudo grep 'Failed password\|Invalid user\|Connection closed' /var/log/auth.log 2>/dev/null | tail -3 || sudo journalctl -u ssh --since '10 min ago' --no-pager | tail -3

You will see:

Oct 28 10:20:11 prod-badge-01 sshd[2201]: Invalid user admin from 203.0.113.50 port 55122

What it means: Attackers scan the internet. With passwords off and keys on, these attempts fail.

Example 40: Users exist and have homes

Type this:

for u in ananya meera; do getent passwd $u | awk -F: '{print $1,$6,$7}'; done

You will see:

ananya /home/ananya /bin/bash
meera /home/meera /bin/bash

What it means: Both users are present with bash homes.

Example 41: Sudo only for ops

Type this:

sudo cat /etc/sudoers.d/ops; id ananya; id meera

You will see:

%ops ALL=(ALL:ALL) ALL
uid=1001(ananya) ...
uid=1003(meera) ... groups=...,ops

What it means: ananya has no ops. meera has ops.

Example 42: Key login works, password login fails

Type this:

ssh -i ~/.ssh/id_ed25519_badge -o BatchMode=yes ananya@prod-badge-01 'echo key_ok'; echo pass_test; ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no -o BatchMode=yes ananya@prod-badge-01 true 2>&1 | head -1

You will see:

key_ok
pass_test
ananya@prod-badge-01: Permission denied (publickey).

What it means: This is the finish line for Project 1.