Guides Archives - 益沃斯

How to enable Qemu Guest Agent for Virtual Machines

Evoxt — Sat, 10 Dec 2022 21:14:39 +0000

Linux Based OS

Install Qemu Guest Agent

CentOS

yum install -y qemu-guest-agent

Ubuntu

apt install -y qemu-guest-agent

Debian

apt install -y qemu-guest-agent

AlmaLinux 8

dnf install -y qemu-guest-agent

RockyLinux 8

dnf install -y qemu-guest-agent

Then, start and ensure the service is persistent

systemctl enable –now qemu-guest-agent

Windows OS

Download these 2 installers in your Windows VM, and install
https://spice-space.org/download/windows/spice-guest-tools/spice-guest-tools-latest.exe
https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-qemu-ga/qemu-ga-win-102.10.0-0.el8_5/qemu-ga-x86_64.msi

the program will start automatically after installation

The post How to enable Qemu Guest Agent for Virtual Machines appeared first on 益沃斯.

I bought a United States server, why did I get a server from xxx country?

Evoxt — Sat, 10 Dec 2022 18:49:03 +0000

Information regarding IP Geolocation

Websites track your location from your IP address, this is usually done using an IP geolocation database. This will be the same for websites such as eBay, Amazon, TikTok, etc…

A geolocation database usually works by tracking the Whois of the IP address block or waiting for ISPs to submit an IP address geolocation correction. Whois data can be obtained from RIRs. Because of such a tedious process, some geolocation databases can be out of date and not fetch the correct geolocation data. This is especially true when an ISP or a service provider just acquired an IP address and they have just updated the IP address block’s whois info.

An example of this is when a Malaysia server is deployed but when checked with an IP address geolocation website, it displays the IP address as a United Kingdom IP address from the United Kingdom region instead of a Malaysia IP address from Malaysia region. In cases like this, it is better to consult a different geolocation database as the current one you are using might be outdated. To know your IP address location, we strongly suggest you use ipinfo.io or maxmind.com as they are currently the biggest IP address geolocation databases and they always spent tremendous efforts just to make sure that their geolocation data is correct.

If the geolocation database is showing a correct IP location but on some specific websites this is showing incorrectly, this is due to some websites choosing to fetch geolocation data infrequently, which causes the website to show your location incorrectly. If this affected your usage, we suggest contacting the website in order to get this updated.

How about Traceroute?
Traceroute is a tool used to display the path of a packet as it travels through many different networks. It does not have any geolocation data included. If a traceroute tool is showing the location of the IP address, this is because the traceroute tool is fetching IP geolocation data from geolocation databases which are susceptible to outdated geolocation data. If a traceroute is showing an irregularity in the country, this is usually the sign of an outdated geolocation database used by the traceroute tool. If you are performing a traceroute from the United States to Malaysia, there is almost no way your packet will be routed to Singapore and then ends in the United Kingdom the next hop, this is a sign of outdated geolocation data.

Some misconceptions
We have also heard a lot of terms from our China-based customers regarding “原生 IP”, this is an invalid term used as there is literally no English translation for this, try translating the term to English and you will get “native IP”, try Googling native IP and there will be no information on this at all. There is no such thing as a website showing an incorrect location due to the IP address not being a “原生 IP”, most of the time, this is due to the geolocation database that the website is using is outdated or websites that refuse to update their geolocation data.

Some add-on points:
– Some customers pointed out that this is not right, you are supposed to get this info from the whois of the IP address block to determine if this is a “原生 IP”. This is incorrect, the whois info for a specific IP block that BGP.HE.NET displays will be the same as what providers set on RIR, this is how providers configure geolocation.

More add-on points:
– Some customers pointed out that the Abuse Contact plays a role in geolocation, which is incorrect. Abuse contact is what we use to receive abuse reports, such as phishing complaints, DDoS complaints, malware spreading complaints, copyright complaints / etc.

Email: Where we receive most of the abuse complaints
Address: Where we can receive mailed physical letters of abuse complaints
Phone: For emergency abuse complaints

The reason they exist is not for geolocation purposes, this can be edited just like whois contact, but we will leave it as it is because that is where we are open to receiving abuse complaints.

Google Geolocation
Google doesn't rely on any geolocation databases and they are geolocating depending on their users' activity which we believe is a brilliant solution but it is bad for us.

We are always actively submitting a geolocation request to Google, but because of how Google geolocate the IPs, the geolocation was corrected but changed back a few weeks later :/ To make things worst, Google does not accept any IPv6 correction requests.

There is not much we can do in cases like this as this is completely out of our control. To resolve this, if you are on IPv6 the geolocation is probably incorrect, try disabling IPv6 and connecting to Google using IPv4. Otherwise, the easiest way will be just to sign in to your Google account, Google will then geolocate depending on your account region. If Google services are not required, nothing will be affected, and all other websites should show the correct geolocation.

VPN Providers
In some cases of VPN providers, some VPN providers are even using IP geolocation to create a “Virtual Location” for their customers. For example, when VPN providers require a Cayman Island location and they don’t have any, they can geolocate some of their US server’s IP address to Cayman Island for their customers. This practice is fairly common, their customers will not realize much difference besides the unusual latency compared to a server that is actually located on Cayman Island.

I hope this read clears up your doubt about IP address geolocation, do not hesitate to contact us if you require any further clarification on this.

The post I bought a United States server, why did I get a server from xxx country? appeared first on 益沃斯.

Evoxt IP Management Tool Guide

Evoxt — Fri, 12 Aug 2022 22:49:24 +0000

Evoxt's IP Management tool provides you with more control of your servers and easier management of your servers. With the ability to reassign IP, remove IP, add extra floating IP and swap IPv4 addresses between servers. With these IP management tools, you can easily switch between development and live servers, minimize downtime with Evoxt's Floating IP address, and more!

Evoxt's IP Management tools mainly focus on IPv4 at this moment. This will be Assign IPv4 Tools and Swap IPv4 Tools

Accessing Assign IP tool

To access the Assign IP tool, go to the VM control panel.

Then click on the IP Management on the top bar, as shown in the image below.

You are now at the Assign IP tool.

Assign IPv4 Guide

Here is a screenshot that helps you with understanding the Assign IPv4 tool. Each option and thing to note in the screenshot is labeled with numbers.
Please note that you can only assign IP from the same region, if you wish to move server to another region, please open a support ticket.

1, 2 & 3 – These are the currently assigned and active IP addresses in the server.
4s – Set as Primary button. Use this button to set the specific IP address as the primary IP address
5 – "Primary" indicates that this IP address is the primary IP address. All servers must have a primary IP address.
6 – "Main Server IP (Sticky)" indicates that this IP address is the IP address that comes with this server. Sticky IP cannot be removed. Please use the Swap IP feature if you need to move this to another server.
7s – Remove button. Use this button to remove the specific IP address from the server.
8 – This dropdown box list all the extra IP address that can be assigned to this server. Use this dropdown box to select an IP address and the assign button below to assign the IP address selected.
9 – Assign button. Use this button to assign the selected IP address on the dropdown box as one of the IP addresses.
10 – Assign as Primary IP button. Use this button to assign the selected IP on the dropdown box as the primary IP address of this server.

After performing any action, our system will perform a reboot on the server. Please make sure all temporary files that need to be kept are saved before performing any IP assignment action

Accessing Swap IP tool

To access the Assign IP tools, go to the VM control panel.

Then click on the IP Management on the top bar, as shown in the image below.

You are now on the Assign IP tool.

Then from the sidebar, click on Swap IPv4 to access the Swap IP tool.

Swap IP Guide and More information

Swap IP tool will swap all the public IPv4 from one server to another server.

To use this tool, select a server on the second dropdown box to swap with and click on the swap IP address to perform the swap.

Please note that you can only swap IP between servers from the same region. If you wish to move a server to another region, please open a support ticket.

After performing IP swapping, our system will perform a reboot on the server. Please make sure all temporary files that need to be kept are saved before performing any IP swap

The post Evoxt IP Management Tool Guide appeared first on 益沃斯.

Evoxt Layer 3 Firewall Guide

Evoxt — Sun, 31 Jul 2022 19:59:40 +0000

Layer 3 firewall is included with all servers offered by Evoxt. This will act as a defense line before inbound traffic reaches your servers. Layer 3 firewall performs slightly differently than a host-based firewall (the firewall in your server). Please spend some time understanding them.

Enabling the Firewall

Go to your VM control panel to manage the layer 3 firewall.

Then click on the Firewall on the top bar, as shown in the image below.

Introduction to the Firewall

Evoxt's Layer 3 Firewall is separated into 2 groups, IPv4 firewall, and IPv6 Firewall.
IPv4 Firewall manages all IPv4 inbound traffic, while the IPv6 firewall manages all IPv6 inbound traffic. Evoxt's Layer 3 Firewall defaults to blocking all protocol and ports when enabled. All rules added are to allow the ports or protocol through the firewall.

To get started with managing the firewall and firewall rules, click on Enable Firewall on the Firewall tab.

By default, there will be 5 firewall rules automatically added. This will be:

TCP 32768 – 65535 (This rule handles the connection with private port, is a temporary communication hub used for Internet Protocol (IP) communications)
UDP 32768 – 65535 (This rule handles the connection with private port, is a temporary communication hub used for Internet Protocol (IP) communications)
TCP 0 – 65535 with the IP range 10.0.0.0/8 (This rule allow all inbound TCP traffic from servers that are located in the private network, all server that exists in the same region hosted at Evoxt)
UDP 0 – 65535 with the IP range 10.0.0.0/8 (This rule allow all inbound UDP traffic from servers that are located in the private network, all server that exists in the same region hosted at Evoxt)
ICMP with the IP range 10.0.0.0/8 (This rule allow all inbound ICMP protocol or ping from servers that are located in the private network, all server that exists in the same region hosted at Evoxt)

We strongly recommend deleting the list's 2nd, 3rd, and 4th rules if private networking is unnecessary. This ensures that the server is unreachable through Evoxt's private network to protect your server from any potential malicious server in the same network.

Suppose private networking is needed and the exact set of IP addresses that the server is communicating with is known. In that case, we recommend deleting the default rules and re-adding a more specific rule.

For example, two servers are under the same region in the same network. Their IP addresses are 10.0.1.1 and 10.0.1.2, server 1 and server 2 respectively.

On server 1, only allow the second server with the IP address 10.0.1.2/32 through the firewall.
On server 2, only allow the first server with the IP address 10.0.1.1/32 through the firewall.
With this configured, only these 2 servers can communicate, blocking any potential malicious connection attempts from servers in the same network.

Note: Do not forget about the IP address mask. In this case, this will be /32 for a single IP address.

Understanding the options

After enabling the layer 3 firewall, you will be greeted with this easy-to-use firewall panel.

Below states the meaning for each of the fields and buttons:

Protocol
Protocol to allow through the firewall. Most of the protocols that will be used are TCP and UDP.
Ports
Ports to allow through the firewall. If only need to allow a single port is required, leave the second box empty. If this is a range, key in the starting port range in the first box and the ending port range in the second box.
Source
The IP address that sends information to the server or the inbound IP address. Evoxt's Layer 3 Firewall only handles inbound traffic; the source will be the incoming IP address.
Notes
Notes or Label for rules. Only alphabets, numbers, and spaces are allowed in this field.
Add
Click on this button to add a firewall rule.
Disable Firewall
Clear all firewall rules and disable the firewall.
Delete
Delete the specific firewall rule.

Common Firewall Rules Settings

Here are some screenshots of the most common firewall rules,

Allow RDP through the firewall. If your server runs on Windows, you will likely need to add this rule to remote control your server. Follow this screenshot to enable RDP through layer 3 firewall.

Allow SSH through the firewall. If your server is running on Linux based OS, you most likely will need to add this rule to remote control your server.

Allow HTTP port through the firewall. If you are running a web server or hosting a website, this is the default non-SSL port. You will most likely need this to set up a web server or website along with an HTTPS port rule.

Allow HTTPS port through the firewall. This is the default SSL port for running an HTTPS web server. You will likely need this to set up an HTTPS web server or website.

Allow connections to the database. This is the database default connection port.

Allow incoming ping requests to your server. Enable this if you want your ping request to reach your server. This is very useful for doing uptime monitoring.

However, this can potentially be dangerous. Hackers can use this protocol to check if your server is online by pinging your server's IP address and attempting to gain unauthorized access to your server. Besides that, by enabling ICMP protocol, your server will also be susceptible to some types of DDoS attacks.

Hence, if you want your server to be pingable, we strongly suggest setting a stricter IP source rule to protect your server.

IPv6 Layer 3 Firewall

IPv6's layer 3 firewall acts the same as IPv4, but it regulates inbound connection for IPv6 protocol. The control for the IPv6 firewall is the same as the IPv4 firewall, but the initial rules that will be added when the firewall is first enabled will be slightly different.

When IPv6 Firewall is enabled, 3 firewall rules are automatically added. This will be:

TCP 32768 – 65535 (Which handles the connection with private port, is a temporary communication hub used for Internet Protocol (IP) communications)
UDP 32768 – 65535 (Which handles the connection with private port, is a temporary communication hub used for Internet Protocol (IP) communications)
ICMPv6 on the IPv6 block of the server's IPv6 address is in. This is needed to ensure IPv6 is functioning properly. IPv6 requires ICMP to function properly. Hence this specific rule is added. We strongly recommend not disabling this rule.

Unlike the IPv4 firewall, there is no private IPv6 network with Evoxt, so no Private network rules are required.

Difference between Evoxt's Layer 3 Firewall and Host-based Firewall (Windows/ Linux Firewall)

On a host-based firewall, firewall software or similar programs might need to be installed on the server for the firewall to function. In contrast, Evoxt's Layer 3 Firewall does not require any software installed.
Evoxt's Layer 3 Firewall operates on the network layer, which means malicious traffic can be blocked before it reaches the server. In contrast, a host-based firewall will start processing the packet when the packet reaches the server, leading to potential security flaws. Besides that, because a layer 3 firewall does not exist in the system, a lot of traffic and processing power can be saved during a DDoS attack when the malicious packets are dropped before reaching the server.
Layer 3 firewall will provide a stronger defense than a host-based firewall because this operates on the network layer, separated from the server, which is not susceptible to tampering or backdoors.
Evoxt's Layer 3 Firewall is easy to understand and set up. In Linux operating system, setting up a firewall usually requires some comfort in CLI skills, while Evoxt's Layer 3 Firewall only takes a few clicks to get a firewall set up.
Layer 3 firewall is not "intelligent" compared to a host-based firewall because a layer 3 firewall operates on the network layer and will not understand information on the application layer. This means that firewall blocking, such as based on the application type or only allowing established connections, cannot be set. With layer 3 Firewall, a rule can only be set by using a protocol, port, or IP address only.

As you can see, there are upsides and downsides with both firewalls. To fully protect your server, we strongly recommend setting up both firewalls for maximum protection.

Common DDoS attacks that can be mitigated with Evoxt's Layer 3 Firewall

UDP Flood – Only allow the UDP ports in use through the Firewall. If access is not public, consider allowing only a specific IP address through the UDP port that is in use.
ICMP (Ping) Flood – Block ICMP Protocol to block all ping requests. This can be done by enabling the firewall, which defaults to blocking all protocol and ports.
Ping of Death – Block ICMP Protocol to block all ping requests. This can be done by enabling the firewall, which defaults to blocking all protocol and ports.

The post Evoxt Layer 3 Firewall Guide appeared first on 益沃斯.

Prioritize IPv4 over IPv6 on a Windows server

Evoxt — Sat, 30 Jul 2022 19:40:14 +0000

With the new Evoxt implementation, where all new VM deployments will be assigned an IPv6 address, we have received reports from customers due to websites and servers not supporting IPv6 and causing problems.

All Windows servers will prefer IPv6 over IPv4 if IPv6 is enabled. Disabling IPv6, which is the new internet protocol, will cause your server to be not future-proof. So this guide will help you configure your Windows server network connection to prefer IPv4 over IPv6.

Change IPv4 priority on Microsoft's Network Shell

To do that, you will need to do so from CMD

1) Head to CMD, Windows Search > CMD. Alternatively, you can access it through WIN + R, then type in cmd.exe and press ok.

2) On CMD, copy these lines and paste them into CMD. This will move the priority of the IPv4 mapped address to the top, making Windows use IPv4 as the default internet protocol. ::ffff:0:0/96 is an IPv4 mapped address range, equivalent to IPv4. Created to aid in IPv4 to IPv6 transition.

netsh interface ipv6 set prefixpolicy ::ffff:0:0/96 50 4
netsh interface ipv6 set prefixpolicy ::1/128 40 0
netsh interface ipv6 set prefixpolicy ::/0 30 1
netsh interface ipv6 set prefixpolicy 2002::/16 20 2
netsh interface ipv6 set prefixpolicy 2001::/32 5 5
netsh interface ipv6 set prefixpolicy fc00::/7 3 13
netsh interface ipv6 set prefixpolicy fec0::/10 1 11
netsh interface ipv6 set prefixpolicy 3ffe::/16 1 12
netsh interface ipv6 set prefixpolicy ::/96 1 3

Now try to ping google again. Ping should default to IPv4.

Bonus:
To change IPv6 back to the default internet protocol used, use the command below and do a restart.

netsh interface ipv6 reset

Change IPv4 preference through Registry

1) Head to Registry, Windows Search > Regedit. Alternatively, you can access it through WIN + R, then type in regedit.exe and press ok.

2) Go to HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > Tcpip6 > Parameters (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\)

3) On the folder, right-click and create a Dword (32-bit).

4) Then, rename the entry to DisabledComponents

5) Right-click on the entry and click on modify

6) Enter 0x20 in the value data field as shown in the screenshots below, then click Ok

7) Once this is done, do a server restart.

Now try to ping google again. Ping should default to IPv4.

Bonus:
To change IPv6 back to the default internet protocol used, delete the entry (DisabledComponents) and do a server restart.

Source: https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-ipv6-in-windows

If these are too complicated, you can also choose to just disable IPv6 networking entirely. However, this will disable the dual stack status and cause your server to be not future-proof. Take a look at this guide here

The post Prioritize IPv4 over IPv6 on a Windows server appeared first on 益沃斯.

How to use Evoxt's VNC

Evoxt — Sat, 30 Jul 2022 10:43:22 +0000

VNC is a remote control program that helps users to control another device over a network. One upside of VNC is that it works across multiple operating systems.

With Evoxt's VNC, the VNC server is located on the host node. This means that it can connect to a VM even when the VM's network connectivity is down or when the VM is stuck in a boot loop or grub, users can still connect through VNC to be able to perform troubleshooting. Also, with Evoxt's VNC, if your client device does not have a proprietary remote desktop protocol such as RDP/SSH client installed, you can still perform a quick remote control through VNC.

If your VM is facing the issues below, with Evoxt's VNC, this usually can be fixed:

The network adapter is disabled accidentally.
VM is stuck in a boot loop or Grub
The primary IP address is accidentally changed with a proxy or a VPN
Enabled firewall but forgot to add in RDP/SSH's firewall rule

Accessing Evoxt's VNC

To access Evoxt's VNC,

Login to your Evoxt account.

On your account's dashboard, click on the VM that you want to remote control.

On the VM control panel page, click on VNC

On the VNC page, click Connect VNC.

You have now established a VNC connection to your server.

Login to a Windows Server

To login to your Windows server, click on the left tab and click on the expand button to input Control + Alt + Del to the login screen.

Click on Show Extra Keys

Then click on Send Ctrl-Alt-Del

On the login screen, type in your password, and you will be logged in.

Login to a Linux based Server

Upon successful connection, your will be prompted to key in your username and password. Once these are keyed in, you will be logged in.

Note: Using a VNC will be slower than the proprietary remote desktop protocol such as RDP/SSH because it requires connecting to another node and then to your VM, and it is not as optimized. If not needed, it is better to connect directly through RDP or SSH to get the best remote control experience.

The post How to use Evoxt's VNC appeared first on 益沃斯.

Windows Server showing incorrect disk size after configuring partition

Evoxt — Fri, 29 Jul 2022 22:49:05 +0000

Windows File system size is not showing correctly after configuring the Windows partition.

Prerequisites

You will need CMD for this entire fix. Get yourself comfortable with using the command line.

To get started,

1) Head to CMD, Windows Search > CMD. Alternatively, you can access it through WIN + R then type in cmd.exe and press ok.

CHKDSK command to repair drive

1) On CMD, type in chkdsk /F and press enter

2) Key in Y and enter if you are prompted with a message requiring a drive repair or system reboot.

If this method does not fix your issue, try the next method.

DiskPart

1) Type in diskpart in cmd to go into diskpart

diskpart

2) Use the command below list volume to list all available volume

list volume

3) Select the volume that the partition size is displaying incorrectly, use command select and in this case Volume 0, so the command, in this case, will be select Volume 0

select

4) Extend filesystem, use the command extend filesystem

extend filesystem

Your file explorer's size should show correctly now.

If you are worried and not comfortable with command lines, please file a ticket and our support team will be happy to help you with this. Please do not forget to include your server's IP and password in the ticket for faster ticket processing. Deploy a Cloud Virtual Machine with Evoxt now !
Deploy

The post Windows Server showing incorrect disk size after configuring partition appeared first on 益沃斯.

Disable IPv6 on Windows Server

Evoxt — Mon, 18 Jul 2022 22:25:38 +0000

With the new Evoxt implementation, where all new VM deployments will be assigned an IPv6 address, we have received reports from customers due to websites and servers not supporting IPv6 and causing problems. Here is how to Disable IPv6 on a Windows Server

If you are facing issues with IPv6 enabled and want to disable IPv6 on your Windows Servers, this is how to do it.

To check if you have an IPv6 address set up, head to the command prompt and type ipconfig to check all the assigned IP addresses.
As you can see on the screenshot, IPv6 is indeed assigned, and we want to remove that.

Step 1:
Head to Control Panel by searching Control Panel on the search bar. Alternatively, this can be done by going to run ( WIN + R ), type control.exe and press enter.

Step 2:
Head to the Network and Sharing center to make network changes

Step 3:
We needed to disable IPv6 networking on the main interface. To do that, go to change adapter settings on Network and Sharing Center

Step 4:
Right-click on the adapter, and click on Properties to make changes to the network interface

Step 5:
Untick Internet Protocol Version 6 (TCP/IPv6) to disable IPv6 Networking and click Ok to save the configuration.

To check if IPv6 is disabled, head to the command prompt and type in ipconfig again. All IPv6 addresses should be now gone.
If IPv6 address is still showing, do a restart.

Ping ipv6.google.com to check your server's IPv6 connection. If you have this disabled, the ping will not be successful.

C:\Users\Administrator>ping ipv6.google.com -6
Ping request could not find host ipv6.google.com. Please check the name and try again.

Source: https://docs.microsoft.com/en-US/troubleshoot/windows-server/networking/configure-ipv6-in-windows

Alternatively, you can set your Windows server to prefer IPv4 networking by default. With this you do not need to disable IPv6, maintaining a dual-stack protocol. This is the preferred method.

Please take a look at this guide here

The post Disable IPv6 on Windows Server appeared first on 益沃斯.

Enable automatic updates in Linux

Evoxt — Wed, 05 Jan 2022 10:34:25 +0000

It is almost impossible to log in to your server to check and update it every day. However, failing to keep servers up to date can be a potential threat.

There is a better solution to this, automatic updates. Here is how to enable automatic updates in Linux:

Ubuntu/ Debian based servers

Install unattended-upgrades

apt install unattended-upgrades

Edit the unattended upgrade configuration

vi /etc/apt/apt.conf.d/50unattended-upgrades

// Automatically upgrade packages from these (origin:archive) pairs
//
// Note that in Ubuntu security updates may pull in new dependencies
// from non-security sources (e.g. chromium). By allowing the release
// pocket these get automatically pulled in.
Unattended-Upgrade::Allowed-Origins {
"${distro_id}:${distro_codename}";
//"${distro_id}:${distro_codename}-security";
// Extended Security Maintenance; doesn't necessarily exist for
// every release and this system may not have it installed, but if
// available, the policy for updates is such that unattended-upgrades
// should also install from here by default.
"${distro_id}ESMApps:${distro_codename}-apps-security";
"${distro_id}ESM:${distro_codename}-infra-security";
// "${distro_id}:${distro_codename}-updates";
// "${distro_id}:${distro_codename}-proposed";
// "${distro_id}:${distro_codename}-backports";
};

In this case we will enable the security updates only to avoid potentially messing up the running programs.
To enable security updates, remove the comment on this line "${distro_id}:${distro_codename}-security";

//"${distro_id}:${distro_codename}";

"${distro_id}:${distro_codename}-security";

// Extended Security Maintenance; doesn't necessarily exist for
// every release and this system may not have it installed, but if
// available, the policy for updates is such that unattended-upgrades
// should also install from here by default.
"${distro_id}ESMApps:${distro_codename}-apps-security";
"${distro_id}ESM:${distro_codename}-infra-security";
// "${distro_id}:${distro_codename}-updates";
// "${distro_id}:${distro_codename}-proposed";
// "${distro_id}:${distro_codename}-backports";
};

After this, we will have to enable automatic upgrade. Use this command to enable automatic upgrade.

echo 'APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "3";
APT::Periodic::Unattended-Upgrade "1";' > /etc/apt/apt.conf.d/20auto-upgrades

CentOS/ Fedora based servers

Install dnf-automatic

dnf install dnf-automatic

We will have to make changes to the configuration files before enabling automatic update. Go to the configuration file by using this command

vi /etc/dnf/automatic.conf

[commands]
# What kind of upgrade to perform:
# default = all available upgrades
# security = only the security upgrades
upgrade_type = default
random_sleep = 0

# Maximum time in seconds to wait until the system is on-line and able to
# connect to remote repositories.
network_online_timeout = 60

# To just receive updates use dnf-automatic-notifyonly.timer

# Whether updates should be downloaded when they are available, by
# dnf-automatic.timer. notifyonly.timer, download.timer and
# install.timer override this setting.
download_updates = yes

# Whether updates should be applied when they are available, by
# dnf-automatic.timer. notifyonly.timer, download.timer and
# install.timer override this setting.
apply_updates = no

In this case we will enable the security updates only to avoid potentially messing up the running programs.

Enabled security updates

Set apply updates to yes to automatic applying the update once downloaded

[commands]
# What kind of upgrade to perform:
# default = all available upgrades

security = only the security upgrades

upgrade_type = default
random_sleep = 0

# Maximum time in seconds to wait until the system is on-line and able to
# connect to remote repositories.
network_online_timeout = 60

# To just receive updates use dnf-automatic-notifyonly.timer

# Whether updates should be downloaded when they are available, by
# dnf-automatic.timer. notifyonly.timer, download.timer and
# install.timer override this setting.
download_updates = yes

# Whether updates should be applied when they are available, by
# dnf-automatic.timer. notifyonly.timer, download.timer and
# install.timer override this setting.

apply_updates = yes

Once this is done, start dnf-automatic.timer service

systemctl start dnf-automatic.timer

Enable dnf-automatic.timer service to automatic start on reboot

systemctl enable dnf-automatic.timer

[root@evoxt ~]# systemctl enable dnf-automatic.timer
Created symlink /etc/systemd/system/timers.target.wants/dnf-automatic.timer → /usr/lib/systemd/system/dnf-automatic.timer.
[root@evoxt ~]#

By following this guide, automatic security update is now enabled on your Linux system.

Your server will now automatically install the latest security updates, protecting your server.

Deploy a server with Evoxt now!
Deploy

The post Enable automatic updates in Linux appeared first on 益沃斯.

Securing a Linux server

Evoxt — Mon, 03 Jan 2022 13:48:36 +0000

Is your Linux server safe from hackers? Can they get hacked? Freak out about getting your server compromised and getting your data leaked? Take a look at some of the tips you can take to secure and protect your Linux server.

1. SSH security

SSH is like a path to connect you to your Linux server. Of course, you will have to secure the passage. Hackers can access your server the same way you access your server.

SSH Port

Everyone knows that SSH uses the default port 22 to connect to your server. To avoid letting people know that your SSH is open to connection, change the port so hackers that scan port 22 will not know that your server's SSH is active. The best practice is to change your SSH ports to a different port between 10000 and 32767.

To change your SSH ports, edit SSH config

vi /etc/ssh/sshd_config

Find this line

#Port 22

change port value

Port

Don't forget to restart your ssh server to apply the settings.

systemctl restart sshd

2. SSH Keys

Password can easily get bruteforced, trying keying in your Password in https://www.security.org/how-secure-is-my-password/ and find out how long does it take for a hacker to crack your password. Scary isn't it?

Now, how about cracking a 4096 bits SSH key? Good luck with that, Mr. Hackers.

To set up an SSH key, use the code to generate a rsa 4096 bit key pair

ssh-keygen -t rsa -b 4096

On Windows machine (cmd), this will be

C:\Users\evoxt>ssh-keygen -t rsa -b 4096 Generating public/private rsa key pair.
Enter file in which to save the key (C:\Users\evoxt/.ssh/id_rsa):
Created directory 'C:\Users\evoxt/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in C:\Users\evoxt/.ssh/id_rsa.
Your public key has been saved in C:\Users\evoxt/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:RSM1LY13KzUzgSziCz1gLKfTSLs3YtgKBtHdQGdX2SQ evoxt@DESKTOP-DU15VE5
The key's randomart image is:
+—[RSA 4096]—-+
| . oo+o ooEO…. |
|. . +o*..o=+B * |
| . . O + ..+ o = |
|. = o +. . . |
|. o o .So . |
|… = o . |
|.. o o . |
| . |
| |
+—-[SHA256]—–+
C:\Users\evoxt>

Then, you will have to manually copy the ssh public key to your server ( ~/.ssh/authorized_keys )

The formatting will be

ssh-rsa

Example:

[root@evoxt .ssh]# cat authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDPsDZ5LPRriU4wDjZVzSVdqVzWNlaon2WdOm9v1AsAp+9R0u+dyy0YiXcxhF9rjK4bnLc840pw2AiCiQIEwfXS03jVA3b1q1yqCqyiO3WVf+SGuL9m+GXq9hNsRCHznGhhsoi9VbbED5ECMFYoU6SeVucXntEtfR32C8Hnb1eBCICU5GXrZpIqEgqZrnDEVKzMUS/T4HjGGnT4puQDEg++e33HE3z0vr7PXbDW2RR1kIsRdNS0/BfdlPCXf1lA8aAkKWq49rGO5T5PT4+bCDh7aVCS5ouTfL0qJNpyijBudRvHy4DUuzdqNJLEcR4DYZRSXEQsYc+oK+5mjvcGFNQXbx8bQNYyGtERBfAVuWSTsk8oVwRwbo9YIzkMYKyf1GwJvoggKHCsx+s0gHcAo0LSU7BFXVJMS5NY6Zvw6Cv+z/UUokVkTZ/CkTiTJHhVJjzLkeqmFPWbxEWSWED5RUuCnWTmHcV6Fkc3sbUAwp+qRdQgVcGPYigpa8/dsyLWFTbdK1fe5UUeY5C3UbBqr6bItn42tJCNPcu6YpxtfdxDtq/IDWGRsZltM15FEFCrvBGX8JD1z1H3S+j3GjFJtA1iW1cODOV5l+s0sUS64OnY+o0hpsqs2Mie4Xy/zzKg5C071wHIORML1tZq40ZETmwCUXlwmv4shay5cJJm/Ss3qQ==
[root@evoxt ~]#

On a Linux machine, this will be

[root@evoxt ~]# ssh-keygen -t rsa -b 4096
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:eIS1I1I0YXgvjR9igqAipDp0j3D+CYpyqjuJQ02ugZ8 root@evoxt
The key's randomart image is:
+—[RSA 4096]—-+
| o*.. |
|.. .o.+ . |
|+. …o++ |
|=o.+..=++. |
|* O oo.+S. |
|+o * . .. |
|+++.o . |
|BoE o |
|** |
+—-[SHA256]—–+
[root@evoxt ~]#

Then, you can use ssh-copy-id command to install the ssh public key.

ssh-copy-id user@your_server_ip

[root@evoxt ~]# ssh-copy-id root@xx.xx.xx.xx
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host 'xx.xx.xx.xx (xx.xx.xx.xx)' can't be established.
ECDSA key fingerprint is SHA256:umf+E/a0OQe8eRmPdYyCM5kE+ZG/FCC2MEEn2G81dGA.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed — if you are prompted now it is to install the new keys
root@xx.xx.xx.xx's password:

Number of key(s) added: 1

Now try logging into the machine, with "ssh 'root@xx.xx.xx.xx'"
and check to make sure that only the key(s) you wanted were added.

[root@evoxt ~]#

SSH from Specific IP

To allow specific IP to access your server through SSH, configure the firewall only to allow a single IP address to go through the firewall to your SSH port.

Make sure you have a static IP before doing this. Else you can get locked out of your server.

Disable Password Authentication

Once SSH key authentication has been set up, disable password authentication.

sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/g' /etc/ssh/sshd_config

Then restart SSH service

systemctl restart sshd

3. Automatic updates

Zero-day exploits are attacks that you can't react to. The best thing next is to protect yourself from N-day attacks once the zero-day exploit has been discovered. To protect yourself from N-day attacks, enable automatic updates. Keep in mind that automatic updates can potentially mess things up. To reduce the chances, enable automatic security only.

To enable automatic security updates, use this guide.

4. Default password

Change your server's default password. Most default passwords are stored in databases and your email inbox. Change them!

To change your server's password,

passwd

[root@TEST ~]# passwd root
Changing password for user root.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.
[root@TEST ~]#

5. Private Networks and VPNs

Set up a server and connect to your servers through a private network. Private network uses private IP to communicate with each other isolating your servers from the public without any exposure to the public.

To set up a private network or a VPN. Take a look at Pritunl. They offer many advanced features such as organization management to separate between Private networks, and it also comes with GUI to easily configure the server.

6. Firewall

Set up a firewall to block unnecessary open ports.

Most Linux distributions includes Iptables by default.

To control your Iptables:

CentOS/ Fedora uses FirewallD

Ubuntu/ Debian uses UFW.

To take a look for running programs that are currently using specific ports, use netstat

netstat -tulpn

Also, block ICMP Ping if not required.

With ICMP blocked, hackers have a harder time knowing your server is currently up and running.

7. Users

Root access is scary! With root access, the hacker can do almost anything to your servers.

Because root access is so powerful, hackers tend to try to crack and brute force root accounts. Hackers will usually stay away from other user accounts if you disable root user access due to the lack of permissions.

The most common practice is to block root access through SSH.

To disable root access through SSH

vi /etc/ssh/sshd_config

Change PermitRootLogin from yes to no and remove the # comment if there is any

#PermitRootLogin yes

PermitRootLogin no

Or use this simple command to disable root login.

sed -i 's/#PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config

Don't forget to restart your ssh service to apply the settings.

systemctl restart sshd

Note: Please make sure you have other users account created with sufficient permission to avoid getting locked out of your server.

8. Backup

This is not quite related to server security. However, I believe this is super important to be included.

It is crucial to have a server backup just in case something goes wrong.

When a server is hacked, backup files will be your savior.

Store your backup offsite, so the hacker cannot modify or alter your backup files.

Luckily for you, all servers under Evoxt will be backup weekly on an offsite server. If you are not using Evoxt yet, consider upgrading!

The post Securing a Linux server appeared first on 益沃斯.