KernelCare

KernelCare – the great option for hosting provaiders and businesses. KernelCare runs on Ubuntu, CentOS, Debian, and other popular flavors of Linux. It checks for updates every 4 hours and installs them automatically. Patches can be rolled back. KernelCare is free for nonprofits. To install KernelCare, run the installation script:

wget -qq -O - https://kernelcare.com/installer | bash

If you are using an IP based license, nothing else is required. Otherwise, if you are using a key based license, run the following command to register the service:

/usr/bin/kcarectl --register <your-key>

Where is the registration code string <your-key>provided when signing up for a trial or purchasing a product. You can get it on this page. Below are some useful KernelCare commands. To check if a running KernelCare kernel is supported:

curl -s -L https://kernelcare.com/checker | python

To unregister a server:

sudo kcarectl --unregister

To check the status of the service:

sudo kcarectl --info

The software will automatically check for new patches every 4 hours. To update manually, run:

/usr/bin/kcarectl --update

Canonical Livepatch

Canonical Livepatch is a service that fixes a running kernel without rebooting your Ubuntu system. Livepatch is free to use on three Ubuntu systems. To use this service on more than three computers, you need to subscribe to the Ubuntu Advantage program. Before installing the service, you need to get a livepatch token from the Livepatch service website. After installing the token and enabling the service by running the following two commands:

sudo snap install canonical-livepatch
sudo canonical-livepatch enable <your-key>

To check the status of the service, run:

sudo canonical-livepatch status --verbose

Later, if you want to unregister the machine, use this command:

sudo canonical-livepatch disable <your-key>

The same instructions apply for Ubuntu 20.04 and Ubuntu 18.04.

In the Debian distribution, the root user can only connect using the keys and cannot connect using the password. The configuration file itself may contain settings that may be useful to you depending on the situation. Keys DennyUsers and AllowUsers – Allows you to restrict users and IP from which they can connect. For example, these lines:

DennyUsers login
AllowUsers "root@15.45.78.5,johnn,anny@78.65.55.0/24"

Only root, johnn, anny users can connect. In addition, the root user can only connect with IP 15.45.78.5 and anyy from the 78.65.55.0/24 subnet.

Key Match – Let’s redefine some settings and global restrictions for connections that fall under the filter.

For example:

PasswordAuthentication no
PermitRootLogin no
Match Address 1.2.3.4,9.8.7.6 Host vps12.hostry.com
PasswordAuthentication Yes
PermitRootLogin yes

For connections from addresses 1.2.3.4,9.8.7.6 and from the node vps12.hostry.com will allow you to use a password

X11Forwarding no
Match User John Address 172.16.1.*
X11Forwarding yes

Installation

To install vsftpd, you must enter the following command:

apt-get install vsftpd

Configuration

First you need to open the configuration file using your text editor. This example uses vim

vim /etc/vsftpd.conf

vsftpd allows anonymous users to access the server by default. This feature is considered a serious security vulnerability. To disable, you must enter an anonymous login by changing the following line:

anonymous_enable=NO

To enable local login, uncomment the following:

local_enable=YES

The following command enables the download:

write_enable=YES

Next, you need to save the file and close the text editor. Then run vsftpd as a daemon:

service vsftpd start

This step is final in order to enter the FTP server from your local computer.

So, after the snapshot recovery period has passed on the new VPS, problems may arise caused by changing the MAC address of the network adapter. Typically, when you change a network adapter, the operating system creates a new network adapter for it. Typically you will see the network adapter on “eth1” (or eth2 if you have a private network enabled).

CentOS

This operating system describes the following steps to correct network configuration after snapshot recovery:

1. First you need to log into your server, this can be done as a consequence of this;
2. Delete the contents of /etc/udev/rules.d/70-persistent-net.rules
3. Open /etc/sysconfig/network-scripts/ifcfg-eth0 and change the content to the following:

DEVICE=eth0
TYPE=Ethernet
ONBOOT=yes
NM_CONTROLLED=yes
BOOTPROTO=dhcp
DNS1=8.8.8.8
NAME="System eth0"

After this three steps, you need to restart VPS

Debian & Ubuntu

This operating system describes the following steps to correct network configuration after snapshot recovery:

1. First you need to log into your server, this can be done as a consequence of this;
2. Delete the contents of /etc/udev/rules.d/70-persistent-net.rules
3. Review the contents of /etc/network/interfaces and update all IP addresses to match the current server.

After this three steps, you need to restart VPS

A graphical interface is a kind of unique opportunity for simple work and management of all files and multimedia. It is very convenient to use it, because it can be used by people with any skills: both with beginners and technically advanced.

This interface allows the user to interact with electronic devices using graphic icons.

Using the GUI, you have access to a unique and very understandable way to navigate and interact with the computer. Also, the graphical interface allows you to simplify the creation of websites without skills in the field of HTML, CSS, JavaScript

Installing GUI on Linux

To install the graphical user interface on the Linux operating system, you need the following actions:

Go to the list of your services: https://hostry.com/orders/  and select the desired virtual server where you want to install the GUI. If you do not have a server, you can order it right now by clicking on the link: https://hostry.com/products/vps/

You need connect to your VPS – by following this links below:

It is necessary to log in and register the following commands:

UBUNTU

apt update
apt install xfce4
start

DEBIAN

apt-get update
apt-get install xfce4 -y
apt-get install xfce4-goodies -y

CENTOS

yum update 
yum -y group install "CNOME Desktop" "Graphical Administration Tools" 
ln -sf /lib/systemd/system/runlevel5.target /etc/systemd/system/default.target 

After successful installation, you will have a GUI panel, where you can quickly and easily manage your data from a computer!

For ubuntu and debian

For centos

After successfully installing the ssl certificate Let’s Encrypt, you need to download the files located in the “ZIP” folder. This folder must be unpacked. You can order the New SSL Certificate Let’s Encrypt by chicking in the link:  https://hostry.com/solutions/ssl-for-free/

You need to open the folder with the files needed to install the certificate. They need to copy them in a text editor.

Then, issuing the certificate you will need to configure Apache. To configure Apache2, you must save the primary, intermediate certificate and private key to a folder on the server.

After, you need to open the Apache configuration file in a text editor. Apache configuration files are usually stored in /etc/httpd/ or /etc/apache2/. The main configuration file is usually called httpd.conf or apache2.conf

If You need the site to be accessible via a secure connection (HTTPS) and also through an unsecured connection (HTTP) You will need to create a virtual host for each type of connection. Copy the existing virtual host for the http connection and change the port from 80 to 443.

Then in this case You need to add the following:

<VirtualHost 192.168.0.1:443>
     DocumentRoot /var/www/website
     ServerName www.domain.com
     SSLEngine on
     SSLCertificateFile /etc/ssl/crt/certificate.crt
     SSLCertificateKeyFile /etc/ssl/crt/private.key
     SSLCertificateChainFile /etc/ssl/crt/ca_bundle.crt
     </VirtualHost> 

1. SSLCertificateFile should be your primary certificate file for your domain name.
2. SSLCertificateKeyFile should be the key file generated when you created the CSR.
3. SSLCertificateChainFile should be the intermediate certificate file (if any) that was supplied by your certificate authority

After a successful configuration, you must save the changes (Ctrl+S).
It is best to test the configuration in advance for various syntax errors, otherwise Apache simply will not start.

In Finish, restart Apache, using the command:

systemctl restart apache2

After successfully installing the ssl certificate Let’s Encrypt, you need to download the files located in the “ZIP” folder. This folder must be unpacked. You can order the New SSL Certificate Let’s Encrypt by chicking in the link:  https://hostry.com/solutions/ssl-for-free/

You need to open the folder with the files needed to install the certificate. They need to copy them in a text editor

Then you need to go to the Cpanel Account and enter the “SECURITY” section. In this section you need to find SSL/TLS

Go to this “Install and Manage SSL for Your site (HTTPS)” panel and click on “Manage SSL Sites

Copy each file from your text editor and paste it into the appropriate fields as follows

Next, click on “Install Certificate” after which information will appear in your cPanel that“SSL Host Successfully Installed”

Then, issuing the certificate you will need to configure Nginx . You must save the primary, intermediate certificates and private key to a folder on the server

After that, you need to open the nginx configuration file. Usually, it is located in the following way: /etc/nginx/sites-available. As a rule, the file should be called default.

IMPORTANT!

You need to create two independent configurations for the HTTP and HTTPS protocols. A domain must address both protocols. If you do not register the connection via HTTPS, then your site will not be protected, and if it will not be registered through HTTP, the site will not open.

In the default configuration file you need to make changes. In order for your HTTPS to be present in the configuration file, you need to specify the following:

server {
 listen              443 ssl;
 server_name         www.example.com;
 ssl_certificate     etc/ssl/ctr/ca_bundle
 ssl_certificate_key etc/ssl/crt/private.key

 ...

*In this case, server_name is your existing domain (site), where both port 80 and port 443 will be referred to.

• Ca_bundle – Public server certificate. It is sent to each client connecting to the server
• Private.key – The private key should be stored in a file with limited access (permissions should allow the main nginx process to read this file).

After configuration, you must restart nginx:

systemctl restart nginx

On a Linux system, IP addresses are automatically assigned by DHCP servers. They are dynamic, and often changing, every time you reboot your system. If the system is a dedicated or virtual server administering remotely, for example, for this it is necessary to have (as a recommendation) a static IP address.

To configure an IP address on a Red Hat system, enter the command nmcli
which will list the network connections and devices in the system

$ nmcli dev status
DEVICE      TYPE      STATE        CONNECTION
wlo1        wifi      connected    Comtrend7FB9
virbr0      bridge    connected    virbr0
enp3s0      ethernet  unavailable  --
lo          loopback  unmanaged    --
virbr0-nic  tun       unmanaged    --

Next, you need to change the network interface. To do this, edit the file in the directory /etc/sysconfig/network-scripts
which is an open interface. In a line called“BOOTPROTO=dhcp» needs changes to BOOTPROTO = static».
Also, the IP address itself must be added to this file. For example, this interface will be called IPCONT211

After making changes, run the program systemctl restart NetworkManager to save the changed settings.

Preliminary Actions

First you need to update your server. To do this, enter a simple command:

apt update && upgrade

It is worth noting that the installation is not difficult, since Fail2Ban is already included in the repositories of your Debian 11. Installation is easy, just enter the command:

apt install fail2ban

After you set it up, please check. The verification step is extremely important for making future adjustments:

systemctl status fail2ban

If Fail2ban is not running on your instance, you need to run it. This can be done with the following command:

systemctl start fail2ban

Next, move on to configuring Fail2ban. This is necessary for proper launch. Enter the following command:

systemctl enable fail2ban

Configuring Fail2Ban

If the first installation step was successfully completed and verified, then you can proceed to the Fail2ban configuration. Fail2ban is installed bundled with a default configuration file. This file contains configurable settings in Fail2ban. The file location is as follows:

/etc/fail2ban/jail.conf

The file contains settings known as filters for configuring Fail2ban. This tool also has many options in its configuration file. These options can be useful for specific scripts and services that work with each other on your Linux machine.

• The bantime value is the exact time during which the malicious IP is blocked
• The maxretry value – The number of times the user will try to login. If the limit is exceeded, the IP address is blocked.
• The ignoreip value is the networks you trust. All networks you enter here will bypass Fai2Ban filtering.
• The enable value allows Fail2ban to confirm whether you want this jail to be enabled or disabled.

Next is to talk about jails. It has an individual customization option. Jails can increase the security of your Linux computer in many ways. You can add different filters to your server services. The first step is to create the jail.local configuration file. You can do it like this:

touch /etc/fail2ban/jail.local

Open jail.local in a text editor of your choice.

nano /etc/fail2ban/jail.local.

After the clarifications above have been provided regarding hail conf. you will be able to apply this directly to the configuration.

enabled = true
port = ssh
bantime = 10h
maxretry = 12
ignoreip = Any_IP

[apache-badbots]
enabled = true
port = http,https, smtp...
bantime = 72h
maxretry = 3

[squid]
enabled = false
port = 80,443,25, 1234...