원격 개발 서버 설정 방법

In order to follow along, you need access to a remote server or have a VM installed your machine. The commands shown here are based on RHEL CentOS 8.

As good measure, create a user and add it to the wheel group. Use this user instead of root. The user can run commands that require root privileges with sudo.

SSH as root into the server and create the user. At this occasion upgrade the kernel, before exiting.

ssh root@remote_host
adduser username && passwd username
usermod -aG wheel username
dnf distro-sync -y
dnf upgrade -y
exit

Add a public ssh key to users authorized keys file. The easiest way to achieve to is to copy the public key from the local machine via ssh onto the remote host.
Make sure you are connecting with the created user and not with root.

cat ~/.ssh/id_rsa.pub | ssh username@remote_host "mkdir -p ~/.ssh && \
     touch ~/.ssh/authorized_keys && \
     chmod -R go= ~/.ssh && \
     cat >> ~/.ssh/authorized_keys"

Connect back to remote and edit the config file.

ssh username@remote_host
sudo vim /etc/ssh/sshd_config

Add the following lines to the config file.

LoginGraceTime 1m
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
PermitEmptyPasswords no
IgnoreRhosts yes
Protocol 2
AllowUsers username

Before disabling password authentication, test the public key authentication by restarting sshd , exiting the session and reconnecting.
If it is not asking for your password anymore but logs you in, the key is working.

Restart the service.

sudo systemctl restart sshd

Next, disable IPV6 all together as it's not needed and reduces the attack surface.

sudo vim /etc/sysctl.d/disableipv6.conf

Place the following entry to disable IPv6 for all adapter

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
# A particular network card instead of default can be accessed
# for example for the imaginary card enp0s3
# net.ipv6.conf.enp0s3.disable_ipv6 = 1

Restart the Service

sudo systemctl restart systemd-sysctl

If the below command does not return anything, ipv6, is disabled.

ip a | grep inet6

Now the development environment is secure. All connections to the outside world and are cut off and only the ssh connection to the local machine is open. How does the actually workflow look like now? There are essentially two major ways, old and new school.

Ok, you can write some code now, that's great but how can an application actually be viewed? The answer is simple, run the app on the remote server on some port. Then forward whatever is sent on this port to the local machine.

Let's say you just started a React dev server on the remote host. The React app is being served at localhost:8080 . You can now connect with a new shell but this time, only to forward the ports.

ssh -L -O localhost:6000:localhost:8080 username@remote_host

Navigate to localhost:6000 in the browser of your local machine and see the application.

We have learned how to secure a remote development server, taking care of various configurations such the firewall and ssh. We have also looked at possible workflows for our environment and at SSH Tunneling.

It was an exiting trip, I hope you enjoyed it as much as I did.

Thank you.