Skip to main content

Posts

How to Configure 4096 bits Let's Encrypt SSL for VestaCP Control (Admin) Panel?

VestaCP uses self-sign certificates for VestaCP control panel for login url and you will get warning from your browser. We will generate 4096 bits Let's Encrypt SSL VestaCP Control Panel. It's very easy process to generate the SSL certificate for VestaCP Control Panel. We will link the SSL certificate for Server FQDN that will use for login to VestaCP Control Panel. # mv /usr/local/vesta/ssl/certificate.crt /usr/local/vesta/ssl/certificate.crt.old # mv /usr/local/vesta/ssl/certificate.key /usr/local/vesta/ssl/certificate.key.old # ln -s /home/admin/conf/web/ssl.mail.datahead.biz.pem /usr/local/vesta/ssl/certificate.crt # ln -s /home/admin/conf/web/ssl.mail.datahead.biz.key /usr/local/vesta/ssl/certificate.key # reboot

Part 1: VestaCP Basic Configuration after Fresh Installation

We need to change some basic configuration after VestaCP successfully installation. There are four default Packages in vestacp as follow :  default, gainsboro, palegreen, slategrey . 1. Change the Name Servers on each packages as per your needs where my name server are  ns1.datahead.biz &  ns2.datahead.biz 2. Create a package as per your needs 3. Change admin password and set SSH Access to nologin 4. Delete alias for Server FQDN 5. Configure DNS for Server FQDN 6. Delete Default database and user from PhpMyAdmin 7. Configure Authoritative DNS from your domain panel

How to Update & Upgrade APT on Ubuntu 16.04 LTS?

You should first run update , then upgrade . Neither of them automatically runs the other. apt update updates the list of available packages and their versions, but it does not install or upgrade any packages. apt upgrade actually installs newer versions of the packages you have. After updating the lists, the package manager knows about available updates for the software you have installed. This is why you first want to update. Additionally, you can use apt update && apt upgrade to do both steps after each other. # apt update && apt upgrade

CWP : How to Enable PORTFLOOD Protection using CSF firewall?

There is no practical way to actually prevent Dos / DDoS attacks, because your server is connected to the internet. When you are connected to the internet, even with a simple local PC computer you are exposed to remote attacks. The only thing you can do is to mittigate its effects. When you are under ddos and trying to mitigate the attack, the server will not respond normally, it will get slower than usual, it can often appear down temporary while the attack is decreasing. On large-volume attacks your provider can even null-route the server IP address to avoid from overload their entire network. Can CSF firewall help me to stop only small / medium attacks? Why not large attacks? Beacuse of the way DDOS works. For very large and distributed attacks, you must use a dedicated firewall, or an specialized antiddos shield that works on network level inside the datacenter where you are hosted, or you can use 3rd party anti-ddos services like Cloudflare, Incapsula or Level3 AntiDDOS servi

CWP : How Configure DDOS Prevention Settings in CSF firewall ?

Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks are common threats that every publicly accessible web server faces. The purpose of such attacks, in simplest terms, is to flood a server with connections, overloading it and preventing from accepting legitimate traffic. Step #1: SYNflood Protection A SYNflood attack is a DoS attack exploiting the TCP (Transmission Control Protocol) connection process itself. In basic terms, a TCP connection is established using a three-way handshake: The client (incoming connection) sends a synchronization packet (SYN) to the server. The server responds with a synchronization acknowledgement (SYN/ACK) to the client. The client then responds with an acknowledgement (ACK) back to the server. A SYNflood attack manipulates that three-way handshake by initiating multiple synchronization requests and then refusing to respond with any final acknowledgements. On a Linux server, you can quickly check for SYN packets by running thi

CWP : How to Blocking Access to Specific Ports for Specific Countries ?

Restricting access by port to IP addresses originating in a specific country or countries can be an effective way to help minimize the negative performance impact that country-level blocking can bring. In this example , we’re blocking access to the FTP Ports (20,21) & SMTP Ports(25,110,143,465,587,993,995)   to IP addresses originating in Belgium & Bulgaria. Step #1: Specify the Country or Countries to be Denied Scroll down to the Country Code Lists and Settings section and add the country code to CC_DENY_PORTS . Multiple countries can be comma separated with no spaces in between, and you can find a list of ISO 3166-1 alpha-2 codes at https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2. List the port that will be blocked in the specified country in the CC_DENY_PORTS_TCP and CC_DENY_PORTS_UDP fields. Step #2: Save Your Changes and Restart the Firewall Scroll to the bottom of the Firewall Configuration page and click on the Change button. On the next screen, click the R

CWP : How to Allowing Access to Specific Ports for Specific Countries ?

I have some listed ports for my services management and I want that listed ports only accessible from my country. Yes, you can choose to allowing incoming traffic by port to only a specific country or countries. Generally, this should be a better option than attempting to deny port access to a long list of countries because the firewall be working with a smaller CIDR range against which each incoming request must be checked. My Listed Ports: 22,2030,2031,2086,2087,5550,55004,1025 To limit the ability to connect on a specific port or ports to visitors with IP addresses originating in a specific country or countries, you must: close the ports in the firewall define the country code allowed to connect on those blocked ports specify the blocked ports to be opened for the specified country In this example, we’re allowing access to above  My Listed Ports , to IP addresses based in My Country ( Germany). Step #1: Close the Ports in the Firewall On the Firewall Configuration page,