configuring a system for remote access

[Fayd]

I'm intending to set up a zoneminder system for my father for CCTV.

problem is, i'm leaving before I can complete configuration. Since it's linux, I'd like to set it up so I can just SSH into the system to complete the process and do maintenance/updates/fixing catastrophic errors. Can anyone point me in the right direction on what all I'll have to do to complete that?

Beyond knowing of the existence of SSH and using telnet briefly during a few CS classes a long time ago (i didn't major in CS, so those are the only few i took...) I have little knowledge of remote operation of computers. So a beginner's guide on what I have to configure now would be helpful.

I'm guessing i'll have to forward ports on the router, similar to what I did for other computers for bittorrent listening ports. Luckily this computer is set up to have a reserved IP address, so it won't change.

a lot of zoneminder configuration occurs through a browser. beyond using something like teamviewer on another computer in the house to access the zoneminder config, how would i set up a graphical connection so I could open a browser on the cctv server?

the distro I'm intending on using is the latest LTS ubuntu server (whatever it is)

Can anyone point me in the right direction?

Also:

this will be done for CCTV purposes. I haven't bought the harddrives yet. I'm intending on using raid drives, 2x2 tb in raid1 (mdadm). Should I be using a separate harddrive (or ssd) for the OS? or just push it all onto the same harddrives as the capturing will be written to? I've already gone through the installation of ubuntu server LTS to a raid array using a virtual machine, it wasn't that hard. just wondering if there will be any performance or stability problems by doing so?

 

[MrColin]

I have never messed with RAID so I cant comment on that.

If you just run "apt-get install openssh-server," you will have the default config that listens on port 22 and allows password based login.

If it is behind a NAT'd router you will need to forward the port. The listening port and almost everything else can be changed in the config file /etc/ssh/sshd_conf. You'll need to reload the service to reflect any changes made to the config.

 

[manly]

MrColin basically summarized sshd for you. I'd add to pick a very strong password, and with Debian/Ubuntu you can use the package fail2ban which will lock out brute force attackers.

As for software RAID, I like the redundancy so unless you need every ounce of I/O throughput, just put the OS on the same 2-drive array. If you stick with MBR, your partitioning scheme can be as simple as you want it, i.e.:

/dev/md0 - /
/dev/md1 - swap
/dev/md2 - /cctv

Otherwise, you'd have to buy 2 small SSDs for the OS alone and it doesn't sound like you need maximum performance for this project.

Make sure both HDDs are boot devices in the BIOS, and run grub-install /dev/sdb so that both drives are bootable in case of a failure and restart.

Finally, I would setup a Postfix null client (very easy) and configure mdadm.conf to email you if there's a failure within the array.

 

[Red Squirrel]

Make sure you also setup fail2ban. It will prevent brute force attacks on SSH. Also a good idea to put SSH on a non default port so your logs don't get flooded with bot login attempts. (most bots wont try all ports)

Definitely look into md raid as well. This explains it well and has lot of command examples to make it easier: http://www.iceteks.com/articles.php/linuxmdadmraid/

I found zoneminder really flaky when I tried it,I'm curious to see how it goes, maybe they improved it since.

 

[Scarpozzi]

Best practices is to use VPN and only allow SSH sessions from the local subnet. That will help reduce drivebys by forcing all traffic to be at the physical location or to go through another layer of security before they can even run IMAP to find your ssh port.

Also, look at your ssh configuration. As stated, you can change the port if vpn isn't an option. Look for PermitRootLogin and set that to no. Setup an obcure local username/password as complex as you can handle and then su or sudo to manage the server remotely.