Adding a Key to Your Server for SSH Login

Using Ubuntu

An authentication key allows your server to authenticate the computer you are using has the right key and should be granted access. This lets you use the key instead of a username and password when using ssh.

If you don’t already have a key on your local machine (look for a file named id_rsa.pub in your user home directory under the .ssh folder

[bash]cd /.ssh[/bash]

will get you to the right directory) then you need to generate the key pair. On your desktop machine use:

[bash]ssh-keygen[/bash]

Next you copy the file to your server. scp ~/.ssh/id_dsa.pub [user]@[server]:.ssh/

[bash]scp ~/.ssh/id_dsa.pub username@servername:.ssh/[/bash]

Rename the file on the server to authorized_keys2
[bash]mv id_rsa.pub authorized_keys2[/bash]

The key is for to authenticate your computer. But on the ssh login Ubuntu will look in the user folder. So if you also had user2 access to the server and tried to ssh into the server you would not be authenticated because it would look in user2/.ssh for the authorized key file and not find it. You can put the same key in any user folder on your server to have that user also be automatically authenticated.

Checklist: Setting Up a New Domain on VPS

Two great hosts for Ruby on Rails are Slicehost and Linode. With these hosts you fully manager your virtual private server, installing the operating system, modifying apache (on Ning…), etc.. I use Ubuntu as the operating system and Apache as the web server.

If you are moving a domain from elsewhere it can be wise to reduce the TTL time to say 5 minutes a few days before you make the switch. This is make the change propagate across the internet more quickly.

  1. And DNS entry on your profile (login to your, for example, Linode account)
  2. Add a new file for /etc/apache2/sites-available/your_site_name.com
  3. [bash]sudo nano /etc/apache2/sites-available/example.com[/bash]

    The file would look something like this: with your ip in place of 8.8.8.8

    ServerAdmin is the address Apache will use to send error messages to. Using gmail and the + option lets you use one gmail account and just use rules to filter all your sites.

  4. create the directories needed on your server
  5. enable the site (for apache)

    [bash]sudo a2ensite example.com[/bash]

  6. You should see the file you created /etc/apache2/sites-available/example.com now also at /etc/apache2/sites-enabled/example.com

  7. Test the site out to make sure the setup is working properly. Create a index.html page and just verify the page is displayed. Change your local hosts file to point to your server IP address for the new domain you created. If not, take steps to get this to work, before continuing with the rest of the checklist.
  8. copy over the site – if you are moving the site from elsewhere
  9. remember to move the database over, if the site relies on a database
  10. restart apache
    [bash]sudo /etc/init.d/apache2 restart[/bash]
  11. You can test the site out, before updating the DNS, by changing your local hosts file to point to your server IP address for the new domain you created.

    Resources: Install the Apache 2 Web Server on Ubuntu 10.04 LTS (Lucid)

Replace Text in Files Recursively (Linux)

To replace text in all the files in a directory, recursively, you can use grep.

sudo grep -rl texttoreplace /somedirectory/ | sudo xargs sed -i ‘s/repacethis/withthis/g’

[bash]sudo grep -rl oldtext /example/directory/ | sudo xargs sed -i ‘s/oldtext/newtext/g'[/bash]

The g on the end, lets it replace all the instances of the text in each file.

More ubuntu and linux tips and code samples

WordPress error: Image could not be processed. Please go back and try again.

If you get an error saying

Image could not be processed. Please go back and try again.

when you try to put a new custom header image for WordPress theme 2010 on a server using Ubuntu the following may help:

[bash]apt-get install php5-gd[/bash]
once it installs then
[code]invoke-rc.d apache2 restart[/code]

This will provide php the ability to manipulate images that WordPress is trying to use.

Replacing a Host Key

Host keys are used to security log into remote servers (such as Virtual Private Servers – VPS). With Ubuntu if you are using host keys to sign into servers securely and have asked for strict checking, if you make a change (such as rebuilding your VPS) the host key will change and you cannot login and will get a message like:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is

Please contact your system administrator.

RSA host key for 128.0.0.128 has changed and you have requested strict checking.
Host key verification failed.

if that happens you need to remove your local host key. Then you can sign back in and you will be able to save a new copy of the host key. If you don’t know why the key has changed you should figure that out first as it maybe be an indication of an important security problem. To remove you local key, you can use ssh-keygen -R [ip address of server with the bad key] for example: ssh-keygen -R 128.0.0.128

Then when you try to sign in you will get

The authenticity of host '128.0.0.128 (128.0.0.128)' can't be established.

RSA key fingerprint is ed:...:ea.
Are you sure you want to continue connecting (yes/no)?

And if you know why (such as you made changes to the server) you can say yes and connect and save the new known host key.

Managing Users in Ubuntu

add a user: sudo adduser [newuser]
sudo adduser john
then give password, and setup home folder,when prompted

edit the list of super users
visudo

list users
cat /etc/passwd

change password of a user – sudo passwd [username]
sudo passwd john
to change your password you can just use sudo passwd.

delete user

sudo deluser username

This will not delete the home folder (and subfolder) those must be dealt with separately. A new user created with the old user name would have access to those files.

temporarily lock a user account – Simply locking a user account will not prevent a user from logging into your server remotely if they have previously set up RSA public key authentication.

sudo passwd -l username

To unlock the account

sudo passwd -u username

Groups

Groups are used in to control permissions (see file permissions)
add user to a group
usermod -G [group-name] [username]
usermod -G basketball john
using the -G switch ads the group as a supplemental group. Using -g would make the group that users primary group.

see what groups a user is in
id john

add a new group: groupadd [new_group_name]
groupadd ruby_developers

System Monitoring Tools for VPS

Tools for monitoring performance and troubleshooting Ubuntu VPS web servers

  • Munin – graphs of system resources over time. Very nice. Can be a bit difficult to setup.
  • top – system stats
  • iotop – like top, but for io stats. Install [bash]sudo apt-get install iotop[/bash] Useful setup [bash]iotop -b -o -d 30 -t[/bash] -b (batch – so you can keep a running tally of results) -o (only those processes with io) -d (delay and seconds – how often to print out stats) -t (include time in printout)
  • vmstat – stats on memory, io, swap, cpu and system. Example: [bash]vmstat 10[/bash] (prints out stats every ten seconds.
  • iostat

Error logs

  • [bash]sudo nano /var/log/apache2/error.log[/bash]

Apache web server access log statistics

  • Webalizer – [bash]sudo apt-get install webalizer[/bash] GeoIP is required for webalizer [bash]sudo apt-get install geoip-bin[/bash] detailed instructions

Linux/Ubuntu File and Directory Permissions

Linux (and therefore Ubuntu) has file permissions on each file and directory for the owner, group and everyone else. Those permissions determine if the file can be viewed, executed or edited.

Only the owner of a file or directory (or a privileged user, root for example) may change its mode.

Ownership of a file

To change the ownership of the file or directory: chown new_owner_username directory

[bash]chown john public_html[/bash]

to change the ownership of directory (and all the files and folders in the directory) and also the group: chown -R new_owner_username:new_groupname directory

[bash]chown -R john:developers public_html[/bash]

to change the ownership of all the files in the current directory and also the group: chown -R new_owner_username:new_groupname *

[bash]chown john:developers *[/bash]

File permissions

The easiest way to set Linux file permissions is using a 3 digit sequence. The first digit designates owner permission; the second, the group permission; and the third, everyone else’s permission.

Read = 4
Write = 2
Execute = 1

The digit is the sum of those. So if you want to grant only read permission you use 4; read and execute 5; read, write and execute = 7.

[bash]chmod 775 index.html[/bash]

That will set the permissions on index.html so the owner, and a user in the group specified can read, write and execute the file and everyone else can read and execute.

[bash]chmod -R 755 public_html[/bash]

That will set the permissions on files and directories (recursively through all subdirectories) so the owner can read, write and execute; members of the group and everyone else can read and execute (but not write).

[bash]ls – l[/bash]

That will give you a list of files and directories, in a directory, with the owner and group settings and the permissions for all 3 (those 2 and everyone else), which will look something like:

[bash]-rw-r–r– 1 root developers 397 2008-05-25 20:33 index.html
-rw-r–r– 1 mary developers 9177 2010-05-02 22:18 unix_file_permissions.html
…[/bash]

The lines start with the permissions for the owner, group and then everyone else. There are 9 total characters, 3 for each. Taking the top line above:

rw-r--r--
rw-  (means the owner has read and write permission but not execute)
r--  (means the group has only read permission)
r--  (means everyone else has only read permission)

The next column tells you the number of hard links to the file or directory. Then column tells you the owner, then the group. Then the byte size of the file, the date it was last change and then the file name.

root
means the username of this file is named root

developers
group (means those users in the group named developers have the group permissions indicated)

Related: Ubuntu command line interface syntax examples

Using the Host File in Ubuntu

You can use the host file to have your computer route to whatever addresses you desire (instead of using your nameserver). For example, by putting

[bash]sudo nano /etc/hosts[/bash]

Then add a line to the file with the ip address and the name you will use.
[bash]204.11.50.136 wastetime[/bash]

One useful way to use this is to test out a website on a new host prior to changing the nameserver to point to the new host. In this case, if you want to make sure your host file is being read you can ping wastetime and if it is working it will show the results for a ping to 204.11.50.136

Using scp (secure copy) to Copy Files Between Computers

Copy a file from your local computer to a remote host using secure copy, scp (which uses ssh for data transfer and provides the same security as using ssh).

scp [filename] [username]@remotehost:[location]

[bash]scp file_to_copy.txt [email protected]:/some/remote/directory[/bash]

copy a directory to your home computer from the remote computer.

[bash]scp -r directory_to_copy [email protected]:[/bash]

copy a directory from a remote server to the current directory on your computer.

scp -r folder [username]@remotehost:[location] .

[bash]scp -r [email protected]:/some/remote/directory .[/bash]

If you don’t have automated keys setup you will be asked for the password for that user.

An example for copying a MySQL database. Including the : without a location puts the file in the home folder.

[bash]mysqldump database_name -uroot > database_dump.sql
scp database_dump.sql [email protected]:[/bash]

Then ssh into the remote server and open the mysql prompt
[bash]mysql -uroot -p
mysql> create database database_name;
mysql> exit[/bash]

Then run the mysqldump file

[bash]mysql database_name -uuser -p < database_dump.sql[/bash]

Remember to create the database user on the new machine (this has to match what is in the wp-config.php file).