Linux User, Permission ও SSH Security

👤 User Management

whoami; id; who; last
sudo adduser deploy
sudo usermod -aG sudo deploy
sudo usermod -aG www-data deploy
groups deploy
su - deploy
sudo userdel -r olduser

🔐 sudo

sudo command
sudo -i               # root shell
sudo -u alice cmd
sudo !!

# /etc/sudoers via visudo
deploy ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx

🔑 Permission (rwx)

r=4 w=2 x=1
chmod 755 script.sh    # rwxr-xr-x
chmod 644 file.txt     # rw-r--r--
chmod 600 .env         # rw------- secret
chmod 700 .ssh/
chmod 400 key.pem      # private key

chown www-data:www-data file
chown -R www-data:www-data /var/www

# Recursive smart
find /var/www -type f -exec chmod 644 {} \;
find /var/www -type d -exec chmod 755 {} \;

🔑 SSH Key Setup

# Local generate
ssh-keygen -t ed25519 -C "you@email.com"

# Copy to server
ssh-copy-id deploy@server-ip

# Manual
cat ~/.ssh/id_ed25519.pub | ssh deploy@ip \
  "mkdir -p ~/.ssh && chmod 700 ~/.ssh && \
   cat >> ~/.ssh/authorized_keys && \
   chmod 600 ~/.ssh/authorized_keys"

🚀 SSH Config

# ~/.ssh/config
Host prod
    HostName 1.2.3.4
    User deploy
    Port 2222
    IdentityFile ~/.ssh/prod_key

# Now: ssh prod

🛡️ Day 1 Hardening

# 1. Update
sudo apt update && sudo apt upgrade -y

# 2. /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Port 2222
AllowUsers deploy

sudo systemctl restart sshd

# 3. Firewall
sudo ufw allow 2222,80,443/tcp
sudo ufw enable

# 4. Fail2ban
sudo apt install fail2ban
sudo systemctl enable --now fail2ban

# 5. Auto security update
sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades

🎓 মূল কথা ⭐

Root login disable, key-only auth, custom port, UFW, Fail2ban — Day 1 mandatory। Password auth = hack invitation।