🏗 Post OS install immediate hardening

Run this procedure immediately after server rebuild.

🔐 Post-install hardening & Ansible prep

Once the OS is installed and the server is reachable, perform these steps to prepare for Ansible to do the rest.

ssh -F /dev/null -i ~/.ssh/id_cherry -l ubuntu <servername>.attestant.io

Or/Else login with temporary user password in your email 📩 or as shown in portal
```
ssh -F /dev/null ubuntu@<servername>.attestant.io
```
Or/Else login with root password in your email 📩 or as shown in portal
```
ssh -F /dev/null root@<servername>.attestant.io
```

Add your current dev or prod public key to the server as per environment:

Run as root:

PUBKEY='YOUR_STD_PUBLIC_KEY_HERE'

rm -rf /root/.ssh
install -d -m 0700 /root/.ssh
echo $PUBKEY > /root/.ssh/authorized_keys
chmod 0600 /root/.ssh/authorized_keys
echo -e "Port 789\nPermitRootLogin Yes" >> /etc/ssh/sshd_config
systemctl daemon-reload && systemctl restart ssh ssh.socket

```bash
 ssh <servername>.attestant.io
```

Update the OS: Servers are usually built with vendor supplied old ISO's. We need to update the OS to latest.

Run following and reboot:

# 1. Update system packages
export DEBIAN_FRONTEND=noninteractive
apt update
apt -y install nvme-cli mdadm parted
apt -y upgrade
apt -y autoremove
reboot

DNS & Hostname

Create DNS record (Route 53 example)

Record type: A (or AAAA)
Name: shortname (eg. eth-val-p01-01)
Value: server public IP

TTL: 300.

Verify with:

dig +short eth-val-p01-01.attestant.io 8.8.8.8
dig +short eth-val-p01-01.attestant.io 1.1.1.1

ping -c4 eth-val-p01-01.attestant.io

Note - It may take a while to propagate the new dns entry to entire world 🌐

Set hostname on the server(Optional) :

hostnamectl set-hostname eth-val-p01-01

Configure reverse DNS (PTR) in supplier portal once forward name is resolvable.

Verify the DNS host name and its reverse DNS(PTR) are resolving correctly before next steps.

Post Invoice / Billing

If an invoice arrives, forward it to Xero and tag it to the appropriate project/cost centre.

Swap file (preferred over swap partition)

Recommendations:

Use a swap file sized to the system's needs. Common starting point: 50% of RAM, check other similar server.

Example:

fallocate -l 64G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
cp -p /etc/fstab /etc/fstab.$(date +%d_%b_%y_%H%M).preswap.bak
echo '/swapfile none swap sw,nofail 0 0' >> /etc/fstab

Verify:

  swapon --show
  free -h

RAID (for multi-disk servers)

Inspect devices

nvme list
lsblk -o NAME,SIZE,MODEL
cat /proc/mdstat

Apply this when machine has multiple NVMe. For example RAID10 for 4x7TB nvme disks:

NAME        MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
nvme2n1     259:4    0     7T  0 disk
nvme3n1     259:3    0     7T  0 disk
nvme4n1     259:1    0     7T  0 disk
nvme5n1     259:0    0     7T  0 disk

Optional - wipe old data(⚠️ CAUTION - following commands are destructive and not recoverable):

Wipe the RAID metadata and any filesystem signatures from the partitions(adjust device names)

mdadm --zero-superblock /dev/nvme[2345]n1p1
wipefs -a /dev/nvme[2345]n1p1
wipefs -a /dev/nvme[2345]n1

Partition disks (example using parted)

Adjust device names

⚠️ following commands are destructive and not recoverable. Confirm device names twice.

 for dev in nvme2n1 nvme3n1 nvme4n1 nvme5n1; do
  parted --script /dev/$dev mklabel gpt mkpart primary 2048s 100% set 1 raid on
 done

Create RAID10

Example (4 data disks; adapt --raid-devices and device list):

mdadm --create --verbose /dev/md127 \
--level=10 \
--raid-devices=4 \
--metadata=1.2 \
--chunk=512 \
--bitmap=internal \
/dev/nvme2n1p1 /dev/nvme3n1p1 /dev/nvme4n1p1 /dev/nvme5n1p1

Verify
```
watch -n5 cat /proc/mdstat
```

Persist mdadm config and initramfs.

Run

mv /etc/mdadm/mdadm.conf /etc/mdadm/mdadm.conf.o

mdadm --detail --scan > /etc/mdadm/mdadm.conf

update-initramfs -u -k all

LVM & Filesystems (optional)

Use LVM for flexible volume sizing on top of RAID devices.

Create LVM stack

pvcreate --dataalignment 512k /dev/md127
vgcreate vg_data /dev/md127
lvcreate --name lv_home --size 1T vg_data

Keep ~10–20% free for snapshots.

Create filesystems

mkfs.ext4 -m 1 -O metadata_csum,64bit,^has_journal -i 65536 -E stride=128,stripe-width=256 /dev/vg_data/lv_home

Mount using UUIDs in `/etc/fstab`

blkid /dev/vg_data/lv_home
cp -p /etc/fstab /etc/fstab.o
# add lines : UUID=<uuid> /home ext4 noatime 0 0
mkdir -p /home
mount -a

Create filesystem directly on the RAID volume:

mkfs.ext4 -m 1 -O metadata_csum,64bit,^has_journal -i 65536 -E stride=128,stripe-width=256 /dev/md127

Verification & Monitoring

Confirm RAID state: cat /proc/mdstat and mdadm --detail /dev/md0.
Confirm LVM: vgs, lvs.
Confirm mounts and free space: df -h.

Bitwise Onchain Dev & Ops