Kapsule Cloud Firewall me te Whakapanatanga Āhuatanga Kalitatanga

Ko ia KapsuleHost Server ka tae mai me te ārai haumanu i whakahaere a ia e whakatakoto kore tūtaki pūmano i te tīmata, me te whakamarumaru i te aukati kaha, he ārai mahi tukutuku, me te whakapatunga haumanutanga ā-ōtōmāti, katoa e whakahaere ana mai i tētahi whārangi i roto i te KPanel.

Ko ngā tīmata he whiriwhiri kia te taumata i te kāinga tūroa e tonutanga haumanutanga mā muri i tō wawe i ā koe. Ko āna kupu e tāpiri ana i runga ake he nuinga kē tō tā ā-tūmahi tono e hiahia ana. Ka haere tēnei aratohu puta noa i te rārangi Server management katoa, nā te mea ko te ārai he wāhi tētahi o ngā wāhi, a ko ērā atu ko aua āhuatanga e pēhia nei koe kia kore ai e hiahia ki te ārai i te tuatahi.

Te Whakatūtuki i te Whārangi Whakahaere

1. Tomokohia KPanel.
2. Pāwhiri Cloud Servers ki te taha maui, katahi ka pāwhiri i tō tūmako.
3. Pāwhiri Management ki ngā pūtona mahi ki te runga o te whārangi.

Ko te ā-inihi tika ko /cloud-servers/<server-id>/management. E whakaahuatanga ana te whārangi i a ia ake mō "Firewall, OS patches, fail2ban, and ModSecurity. Changes apply over SSH within seconds."

Te Kaupapa Ārai Taunoa

Ko te Firewall (UFW) wāhi e tautengia ana te kaupapa i tētahi rarangi: "Default-deny inbound. SSH (22) is always open. App-stack ports open automatically. Add custom rules below."

I te mahi pūtea ko te tikanga:

• Kaore he mea e taea te eke ki tō tūmako mai i te Ao Hōkiokio engari mehemea e waatea ana te tūtaki.
• Ko te pūtake 22 he āhuatanga kē, nō reira kaore e kore ā tētahi huringa ārai ki te tohu koe i waho i te miihini.
• Ko ngā pūtake e hiahia ana ā tō tae rauemi mō te mahi, pērā i te 80 me te 443 mō tētahi tono tukutuku, e whakatūwhakatūkia ana mā a koe.
• Ko te tūtaki tuarongo i te tūmako kaore i te ārai.

Kāore he tūtaki arotake, ko te wāhi e whakaatu ana "No custom rules. Defaults: SSH + app-stack ports." He āhuatanga ngaio tenei, ehara i te whiriwhiri ngaro.

Te Tāpiri i tētahi Tūtaki Arotake

Tāpirihia tētahi tūtaki i a koe ka whakahaere tāu i tētahi mea ki te pūtake kaore e kōrerotia e te kaupapa taunoa: tētahi tono Node ki te 3000, tētahi pūtaiao e hiahia koe ki te eke tika ki te 5432, tētahi kēmu rānei kaiwhakaata i te pūtake UDP.

1. Whakatūtukihia te Firewall (UFW) wāhi.
2. Whakauru i te Port nama ki te āhuatanga tuatahi. Ko ngā uara ē ā 1 ki te 65535.
3. Whiriwhirihia TCP rānei UDP.
4. Whiriwhirihia Allow rānei Deny.
5. Pāwhiria Add.

Ko te tūtaki e puta ana i te rārangi me tētahi ALLOW rānei DENY tohu me te pūtake me te whakatupuranga, tae atu ki 3000/tcp. E tukitukihia ana ki te tūmako i runga i te hononga whakahaere i roto i ētahi hēkona.

Kia tango tūtaki, pāwhiri te X ki te mutunga o tōna rarangi. Ko te tango i tētahi Allow tūtaki e tutuki ano i tērā pūtake.

Ngā Tae Tūmahi

Ko te App stack wāhi e whakatau ana ki te paparitanga he aha te momo tūmahi e kawe nei tēnei tūmako, kia tūnoa ai te tūtaki tohu ki a reira. Ko te whakauru i tētahi tūmahi i roto i te paenui e whakatakotohia ana ēnei mā a koe.

Ko ngā tae e mōhiotia ana ko WordPress, WooCommerce, Ghost, Nextcloud, GitLab, Mattermost, Generic web, me No app stack. Ko te wāhi e whakaahuatanga ana mō ia anō: "The hardening preset is tuned to your app. Installing an app from the marketplace auto-sets this."

Ko te tae e āwhina ana ki tēhea ngā pūtake e whakatūwhakatūkia ana i a ia anō me te āhuatanga e tūnoa ana ērā atu whakamarumaru, i roto i a fail2ban.

fail2ban

Ko fail2ban e titi ana ki te whakaputa whakamatau me te aukati i ngā wānoatanga e āhuatanga kē ai. He mea noa i te tīmata a he paenui e whakaahuatanga ana "Bans IPs that brute-force SSH. For WordPress sites, adds wp-login.php protection too."

Waiho tonu. Ko ia te ārai pai rawa ake i runga i tēnei whārangi, kaore he utu i te mahi, me te huri i ngā nui ngaru o te āta whakamatau tīkumā ki te kore. I runga i tētahi WordPress rānei WooCommerce tae rauemi e whakamarumaru ana i te puka tomokohia, ko te wāhi kei reira te nuinga o ngā whakatupu i a WordPress e haere.

ModSecurity, te Ārai Mahi Tukutuku

Ko ModSecurity e tirotiro ana i ngā tono HTTP i a OWASP Core Rule Set me te whakahau i ērā e ahuatanga ana mō ngā whakatupu. I runga i tētahi tūmako KapsuleHost e timatanga ana i te momo tēteketeke: "OWASP Core Rule Set in DetectionOnly mode by default. Logs suspicious traffic without blocking; flip to active mode in your server once tuned."

Ko te tēteketeke-anake ko te timatanga tika. Ko te Core Rule Set he whānui, a i runga i tētahi tūmahi tūturu ko ētahi tono tika e tutuki ana ki tētahi ture. Whakatakotohia ki te tēteketeke-anake mō tētahi wā, pānuihia ngā tuhinga, whakaritea ko ēhea ngā ture e pā ana ki tō tūtaki ake, a me tāu ka huri ki te ārai.

OS Whakapatunga Ā-ōtōmāti

Ko ngā whakapatunga haumanutanga e tukitukihia ana mā a koe. Ko te wāhi e whakaahuatanga ana i te ārai haumanu: "Security updates applied automatically. Snapshot-protected: a server snapshot is taken before each run, with automatic rollback if the server becomes unreachable after reboot."

E rua ngā tautuhinga e noho ana i raro i te whakawhiti:

• Allow automatic reboot when a kernel update needs it (only during quiet hours below). Ko ngā whakakitea maamaa e mahi anake ka taka mai i muri i te whakahohou. Mēnā e waiho ana koe i te kore, ko ngā whakakitea maamaa e whakauru ana engari kaore i te mahi kia koe e whakahohou anō.
• Quiet window (UTC), he timatanga me te whakamutunga haora. Ko ngā whakahohou e tupu ana i roto i a reira anake. Whakatakotohia ki ngā haora pokepokeā kei a koe hoki, me te mahara ko te āhuatanga i roto i te UTC, ehara i tō wā ā-rohe.

Te Hitori Patunga me te Patua Inaianei

Ko te Patch history wāhi e rarangi ana ia reka me tētahi tohu o RUNNING, SUCCESS, ROLLED_BACK, FAILED rānei SKIPPED, te nama paketike i te whakahou, mēnā i whakahohou te tūmako, me te wā i timatanga.

Kia patua katoatia i ahuatanga hoki kia tatari, pāwhiri Run patch now. Ko te whakatauhitanga e pānui ana: "A snapshot is created first. The server stays online except for a brief reboot if a kernel update needs it."

Ko tētahi ROLLED_BACK tūranga he tikanga kua mahi te ārai haumanu: kaore i taea e te tūmako te eke i muri i te whakahohou, nō reira ko te snapshot i mua i te patunga i whakahokia. Tirohia Cloud Server Snapshots mō te āhuatanga o ēnei snapshot.

Tētahi Raupapa Whakaaro Pai

Mō te nuinga o ngā tūmako, ko ēnei te whiriwhiri haumanutanga katoa:

Ko te rarangi waenganui kaore i runga i tēnei whārangi engari he mea nui ake i te toenga katoa. Tirohia Connecting to Your Cloud Server With SSH.

Te Whakaoti Raru

"Could not load management config." Kaore i taea e te paenui te pānui i ngā tautuhinga mō tēnei tūmako. Utaina anō, me te titiro kia tūturu te tūmako me te whakarite.

"Port must be 1-65535." Ko te āhuatanga pūtake he tau katoa i tērā rārangi. Kaore e āwe ana ngā rārangi me ngā ingoa ratonga i konei.

Kua tiakina taku tūtaki engari kaore ē hurihuri. Rapu i te "Live apply unavailable" tohu. Mēnā e whakaatu ana, ko te huringa e tiakina ana engari kaore i te tukituki ki te tūmako.

E taea e au te eke ki taku ratonga i tētahi whatunga engari kaore i tētahi atu. Ko te nuinga o te wā ko tō ārai pūmano ake, kaore te ārai o te tūmako. Me te whakamatau mai i tētahi hononga rerekē i mua i te huringa tūtaki i konei.

He tūranga patunga e whakaatu ana FAILED. Pānuihia te karere hē i te rarangi. Ko te diski kua kinakina tonu te take noa ake. Whakamarua tētahi ā-ōtōmāti me te pāwhiri Run patch now.

Ko te tūtaki tika kua ahuatanga tutuki. Mēnā kua huri koe ModSecurity ki te ārai mahi, waiho ki te tēteketeke-anake, pānuihia ngā tuhinga, me te tēnei ture i mua i te whakatry hou.

Mēnā e āhe ana tēhea tūtaki ārai e whakamahi, rānei kua tutuki koe i waho i tētahi ratonga i waatea, īmēra support@kapsulehost.com me te ingoa tūmako, te pūtake, me te mea e tīkumā ana koe ki te eke.