gilangvperdana

How to secure a Proxmox exposed host

When you look for tutorials on how to install Proxmox, it always stops after the initial installation - which is quite dangerous, since it leaves a Proxmox host being exposed to the internet while listening to Ports 22 and 8006.

Heck, there is not even any SSH-hardening covered - your SSH is typically set to default values, which means: Password-authentication with the root account is perfectly possible. While you can mitigate some of these things by harding SSH or by installing fail2ban (which we will do anyhow), the host still exposes ports 22 and 8006.

For a secure system, these ports (and actually, apart from one single port ANY ports) have to be disabled. The only acceptable management access to the system should either happen via a Jumpserver or - if not available - via a direct VPN-connection.

In this gist, you find all the required steps to secure your Proxmox exposed host. This gist should work for any Proxmox host with - say - Hetzner, OVH or other vendor

gilangvperdana

# Install tmux 2.8 on Centos

# install deps
yum install gcc kernel-devel make ncurses-devel

# cd src
cd /usr/local/src

# DOWNLOAD SOURCES FOR LIBEVENT AND MAKE AND INSTALL
curl -LO https://github.com/libevent/libevent/releases/download/release-2.1.8-stable/libevent-2.1.8-stable.tar.gz

gilangvperdana

## Find Available Target Editions
DISM.exe /Online /Get-TargetEditions

## Convert Server Standard 2019 Evaluation to Server Standard 2019
DISM /online /Set-Edition:ServerStandard /ProductKey:N69G4-B89J2-4G8F4-WWYCC-J464C /AcceptEula

## How To Activate 
slmgr /ipk XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
slmgr /skms [server]:[port]
slmgr /ato

gilangvperdana

How to automatically start ssh server on boot on Windows Subsystem for Linux

Microsoft partnered with Canonical to create Bash on Ubuntu on Windows, running through a technology called the Windows Subsystem for Linux. Below are instructions on how to set up the ssh server to run automatically at boot.

1. Edit the /etc/ssh/sshd_config file by running the command sudo vi /etc/ssh/sshd_config and do the following
   1. Change Port to 2222 (or any other port above 1000)
   2. Change PasswordAuthentication to yes. This can be changed back to no if ssh keys are setup.
2. Restart the ssh server:
   • sudo service ssh --full-restart
3. With this setup, the ssh server must be turned on every time you run Bash on Ubuntu on Windows, as by default it is off. Use this command to turn it on:

gilangvperdana

How to host a telegram bot on Ubuntu (18.04/20.04)

Introduction

This short guide will walk you through hosting your very own telegram bot on Ubuntu (tested on Ubuntu 18.04 and 20.04)!

Prerequisites

This guide assumes knowledge of the following:

1) Provisioning a VPS
2) Familiarity with SSH
3) Familiarity with linux command line

gilangvperdana

apiVersion: v1
kind: Namespace
metadata:
  name: istio-test
  labels:
    istio-injection: enabled
---
apiVersion: v1
kind: Service
metadata:

gilangvperdana

apiVersion: v1
kind: ConfigMap
metadata:
  name: imagecleanupconfig
  namespace: default
  labels:
    component: imagecleanup
data:
  # removes all images unused by a running container
  cronjobs: 0 0 * * * crictl rmi --prune 2>&1

gilangvperdana

How to add an image to a gist

1. Create a gist if you haven't already.
2. Clone your gist:

   # make sure to replace `<hash>` with your gist's hash
   git clone https://gist.github.com/<hash>.git # with https
   git clone git@gist.github.com:<hash>.git     # or with ssh

gilangvperdana

#!/bin/bash

#Harbor on Ubuntu 18.04

#Prompt for the user to ask if the install should use the IP Address or Fully Qualified Domain Name of the Harbor Server
PS3='Would you like to install Harbor based on IP or FQDN? '
select option in IP FQDN
do
    case $option in
        IP)

gilangvperdana

Running a docker registry with Minio S3 backend

Run minio in a container

docker run -d -p 9000:9000 --name minio minio/minio server /export

Use docker logs to retrieve access key and secret key from minio container

docker logs minio

Create config.yml for Docker Registry

This file will have to be mounted to /etc/docker/registry/config.yml