AWS

aws-lightsail-launchscript.sh

sudo timedatectl set-timezone "Asia/Kuala_Lumpur"

# update OS & install necessary stuff 
sudo apt update -y && sudo apt install byobu multitail htop iftop screen -y

#vim environment to be windows friendly colorscheme
echo "syntax on
colorscheme desert" > ~/.vimrc

# check date adn time
date

# enable UFW 
ufw enable
# allow a set of default ports - ssh from office IP range and web ports
ufw allow 80
ufw allow 443

# reload configuration
ufw reload
exit
#########################

from https://gist.github.com/bradwright/825038/c9acb03eb402c8fd613c0537b60d1057fb978f0a

# linode stackscripts https://techdocs.akamai.com/cloud-computing/docs/write-a-custom-script-for-use-with-stackscripts'

# add a non-root user

# add user non-interactively
system_add_user "$USER_USERNAME" "$USER_PASSWORD" "sudo"
# add user to correct Ubuntu groups for SSH
usermod -a -G ssh $USER_USERNAME
# remove requirement for password to sudo
echo -e "\n$USER_USERNAME ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

# install SSH key and fix permissions on user SSH keys
USER_HOME="/home/$USER_USERNAME"
mkdir "$USER_HOME/.ssh"
echo $USER_SSHKEY > "$USER_HOME/.ssh/authorized_keys"
chmod "$USER_HOME/.ssh/" 600
chmod "$USER_HOME/.ssh" 700
chown -r "$USER_HOME/.ssh" $USER_USERNAME:$USER_USERNAME

passwd --expire samqi

Ubuntu way:

adduser samqi
#or sudo useradd -m linda -s /bin/bash
usermod -a -G sudo samqi
passwd --expire samqi

for ssh keys :

# install SSH key and fix permissions on user SSH keys
USER_HOME="/home/samqi"
sudo mkdir "$USER_HOME/.ssh"

#echo $USER_SSHKEY > "$USER_HOME/.ssh/authorized_keys"

sudo chmod 600 "$USER_HOME/.ssh/" 
sudo chmod 700 "$USER_HOME/.ssh" 
sudo touch "$USER_HOME/.ssh/authorized_keys" && sudo chmod 600 "$USER_HOME/.ssh/authorized_keys"

sudo chown -R samqi:samqi "$USER_HOME/.ssh" 

for ubuntu 24.04, to harden SSHd

cd /etc/ssh
sudo cp -rfp sshd_config.ucf-old ssh_config.d/sshd_config
# Disallow root logins over SSH & Disable SSH password authentication
PermitRootLogin no
# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no


# restart sshd
sudo systemctl enable --now ssh.service