Configuring your self-hosted server

This article assumes a debian-based linux distro on your server.

Great, you’ve installed a Linux distro to run on your self-hosted server. Now what? Here are three quality of life changes I would recommend setting up to make make accessing your server a little easier and safer.

  1. Set static IP address for your server – this ensures that the server can always be reached with the same IP address.
  2. Configuring a DNS server – allows you to give your server a domain name on your network.
  3. Generate SSH Key’s – makes login in to SSH quicker and more secure.

Making your server reachable on the local network #

When hosting a server, you’ve most likely set it up as a headless system. In order to access a system remotely you’ll want to know it’s IP address and it’s highly likely you’re connecting to it using SSH. When connecting you typed something along the lines of ssh <user>@<ip-address>. Where your IP address may looks like 192.168.0.x this is your local IP which was assigned by your router when you connected.

Most routers and devices use a protocol called DHCP to automatically assign IP addresses to all devices on the network. It can be thought of as a handshake between your device and the router. The protocol manages the leases for all IP addresses on the network preventing two devices to have the same IP address.

Depending on your routers IP lease time, DHCP may assign your server a different IP address after it tries to re-connecting past the lease expiration time. This may not be too much of a problem for a server that will always be online, however if the router allows you to reserve an IP address, doing so can ensure the server is reachable after a prolonged power outage.

Setting a static IP address #

Setting a static IP address is essentially telling the server that it will only use the IP address you gave it, however this does not prevent to server from using the IP address if the server has been offline for longer than the lease period.

If you’re unable to reserve a DHCP on your router, another way you can prevent IP conflict is to select a static IP address outside the DHCP assignment pool. This is a range of IP addresses the DHCP may use to hand out to new devices. If the server is outside that range, the router shouldn’t be able to automatically hand it off.

DNSmasq #

DNS stands for Domain Name System, which can be thought of as an address book that links a name with an address. Specifically, a human legible name, such as debian.org with the IP address 151.101.130.132 (try pinging it yourself).

DNSmasq is lightweight DNS service that allows you to add names to the address book and pair it with IP addresses. In our case, we would want to add the domain name for our server and the local IP address, allowing us to connect to our server using something like ssh myserver.

Install the program with

sudo apt install dnsmasq

Next you’d want to configure your IP addresses.

sudo nano /etc/dnsmasq.d/localhosts.conf

Then add the IP addresses to the config file.

address=/<server-domain>/<local-ip-address>

where <server-domain> is going to be what you name your server and if you’ve purchased a domain name this should be your domain. <local-ip-address> is the static IP address you assigned your server in the previous section.

Reload and start the systemd daemon.

sudo systemctl daemon-reload
sudo systemctl start dnsmasq.service

Next you want to set up the DNS server address on your router. On your router’s admin page, navigate to the DNS page, then change the primary DNS to your servers local IP address in numeric form (e.g. 192.168.0.x).

SSH keys #

When using SSH to connect to your server, it default to using the user name and password when connecting. This means that anyone on your network with the username and password can access your server. This may be a security vulnerability on the server. A better way to secure access to your server and making it easier for you to access the server would be to create a key pair between your ssh agent and your server. The way this works is you need to generate a public and private key on both your computer and the server, then share the public keys with one another. This ensure that the two device can identify each other with unique identifiers.

To create a key we must create a key pair, one private and one public. As the names suggest, your private key is only for you to see, whilst your public key is what you can share to others.

To generate your keys use:

ssh-keygen

Then follow the instructions when prompted.

Next you want to copy your public key you just created over to the remote server.

ssh-copy-id -i $HOME/.ssh/id_rsa.pub <user>@<your-remote-host>

Under the hood this copies over you public key ~/.ssh/id_rsa.pub to the servers ~/.ssh/authorized_keys file.

You should now be able to login to your server without needing to enter a passphrase.

Lastly, to improve security we can disable authentication with password in the sshd_config.

sudo nano /etc/ssh/sshd_config

Then change the following line

PasswordAuthentication no

Uncomment it if needed by deleting the # on the start of the line.

That’s it! You should now be able to connect to your server easily and safely without password and using a domain you’ve selected.

If you’re not sure what to do next here are some ideas you can do that are quite lightweight:

For more ideas and services to use, see Luke Smith’s Landchad website. It is your server after all, you can make it server you however you want.