Setting up a Linux server for a settlement means installing from media you already hold, because there is no repository to download from, giving the machine a fixed address in the settlement’s plan, enabling only the services it needs, and keeping its configuration on paper and on a second machine. With no outside updates, security fixes will not arrive, so the defence is a small set of running services on a network outsiders cannot reach. Check the disk, mirror two disks and set the clock before anything else, because certificates and log files depend on correct time.
Part of Networking
Installing and preparing a Linux machine as a network server with no internet: what to hold in advance, the order of setup, and what to do about missing updates.
The Operating System Is Easy To Run And Hard To Replace
The carrier Internet Infrastructure chooses Linux because it runs on minimal hardware and contains all the network tools, with the server programs (BIND for names, Apache or nginx for the web, Postfix for mail) open source. All of that is true and none of it helps if the installation media and the packages are not already in the settlement. The honest limit of this article is that it can only tell you what to do with what you hold. Whoever can still copy a distribution’s installation media and its package archive should do so now, and anyone who finds such media in the ruins should treat it as the most valuable software in the settlement.
What You Need
- Installation media for a release that supports the hardware, with a second copy
- An offline package archive containing every server program in the plan and their dependencies; a package installer needs these files in a directory, not a connection
- Manual pages and the documentation of each server, stored on the machine and on paper
- A tested machine with a disk you trust (Network Hardware)
- The address plan (IP Addressing)
Method: Build The First Server
Step 1: Test the hardware before installing
Run a memory test, check the disk’s own health report with a tool such as smartctl (general knowledge, not from the other articles), and look at the power supply for swollen capacitors (Hub Construction describes the signs).
Step 2: Mirror two disks, and keep data apart from the system Mirroring two disks (RAID 1) protects against one disk failing, and is not a backup (Resource Sharing). Put the system and the data on separate partitions so the system can be reinstalled without touching the data.
Step 3: Install the smallest system that does the job Install only the server programs in the plan. Fewer running programs means fewer to watch.
Step 4: Give it a fixed address
With the commands in Network Interface: ip addr add 10.1.0.2/24 dev eth0 and ip route add default via 10.1.0.1. Make the setting survive a reboot in the system’s own network configuration, which differs between distributions.
Step 5: Set the clock The clock on a salvaged machine may have reverted to a default date because its battery is dead. Set the time by hand, then run a time service so one machine keeps the time for the rest (Resource Sharing explains why certificates and logs need it).
Step 6: Secure remote administration and close the rest Use SSH and never telnet (the carrier). Set the firewall to refuse everything incoming except what the machine serves (Firewalls).
Step 7: Install one service, test it from another machine, then the next Follow the order in Core Protocols.
Step 8: Copy the configuration to a second machine and onto paper A server whose settings exist only inside it cannot be rebuilt.
Worked Example: Address And Disk Choices
Address. The plan gives servers .2 to .10 in 10.1.0.0/24 and the router .1. Server 1 takes 10.1.0.2 with prefix /24, whose network is 10.1.0.0 and whose broadcast is 10.1.0.255 (Subnet Masks). The address is inside the block, the gateway 10.1.0.1 is on the same subnet, and the machine can reach everything on 10.1.0.1 to 10.1.0.254 directly.
Disk. Mirroring two disks gives the capacity of one, not two. With two 500 GB disks (invented sizes), usable space is 500 GB, and the second 500 GB is the copy. A loss of either disk loses no data; deleting a file deletes it from both.
Common Mistakes
- Planning to download what you need after the install — there is nowhere to download from
- Ignoring the clock — a machine with a wrong date breaks certificates and confuses logs
- Installing everything the installer offers — the carrier calls running unneeded services a vulnerability and a burden
- Giving the only copy of the configuration to the machine it configures
Safety
Mains and stored charge inside salvaged machines
Do not open a power supply, and unplug the machine before changing a component. See Server Deployment and Electrical Safety.
What’s Next
- Learn next: Web Server — the first service to install
- Combine with: Access Control — who may log in to the machine you just built