gilangvperdana

How to secure a Proxmox exposed host

When you look for tutorials on how to install Proxmox, it always stops after the initial installation - which is quite dangerous, since it leaves a Proxmox host being exposed to the internet while listening to Ports 22 and 8006.

Heck, there is not even any SSH-hardening covered - your SSH is typically set to default values, which means: Password-authentication with the root account is perfectly possible. While you can mitigate some of these things by harding SSH or by installing fail2ban (which we will do anyhow), the host still exposes ports 22 and 8006.

For a secure system, these ports (and actually, apart from one single port ANY ports) have to be disabled. The only acceptable management access to the system should either happen via a Jumpserver or - if not available - via a direct VPN-connection.

In this gist, you find all the required steps to secure your Proxmox exposed host. This gist should work for any Proxmox host with - say - Hetzner, OVH or other vendor

gilangvperdana

System Updates

http://bookofzeus.com/harden-ubuntu/initial-setup/system-updates/

Keeping the system updated is vital before starting anything on your system. This will prevent people to use known vulnerabilities to enter in your system.

sudo apt-get update
sudo apt-get upgrade
sudo apt-get autoremove
sudo apt-get autoclean

gilangvperdana

# Install tmux 2.8 on Centos

# install deps
yum install gcc kernel-devel make ncurses-devel

# cd src
cd /usr/local/src

# DOWNLOAD SOURCES FOR LIBEVENT AND MAKE AND INSTALL
curl -LO https://github.com/libevent/libevent/releases/download/release-2.1.8-stable/libevent-2.1.8-stable.tar.gz

gilangvperdana

How to configure static website using Nginx with MinIO ?

1. Install nginx

2. Install minio

3. Install mc client

• Add Minio

mc config host add <ALIAS> <YOUR-S3-ENDPOINT> <YOUR-ACCESS-KEY> <YOUR-SECRET-KEY>
mc config host list

gilangvperdana

## Find Available Target Editions
DISM.exe /Online /Get-TargetEditions

## Convert Server Standard 2019 Evaluation to Server Standard 2019
DISM /online /Set-Edition:ServerStandard /ProductKey:N69G4-B89J2-4G8F4-WWYCC-J464C /AcceptEula

## How To Activate 
slmgr /ipk XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
slmgr /skms [server]:[port]
slmgr /ato

gilangvperdana

How to automatically start ssh server on boot on Windows Subsystem for Linux

Microsoft partnered with Canonical to create Bash on Ubuntu on Windows, running through a technology called the Windows Subsystem for Linux. Below are instructions on how to set up the ssh server to run automatically at boot.

1. Edit the /etc/ssh/sshd_config file by running the command sudo vi /etc/ssh/sshd_config and do the following
   1. Change Port to 2222 (or any other port above 1000)
   2. Change PasswordAuthentication to yes. This can be changed back to no if ssh keys are setup.
2. Restart the ssh server:
   • sudo service ssh --full-restart
3. With this setup, the ssh server must be turned on every time you run Bash on Ubuntu on Windows, as by default it is off. Use this command to turn it on:

gilangvperdana

How to host a telegram bot on Ubuntu (18.04/20.04)

Introduction

This short guide will walk you through hosting your very own telegram bot on Ubuntu (tested on Ubuntu 18.04 and 20.04)!

Prerequisites

This guide assumes knowledge of the following:

1) Provisioning a VPS
2) Familiarity with SSH
3) Familiarity with linux command line

gilangvperdana

apiVersion: v1
kind: Namespace
metadata:
  name: istio-test
  labels:
    istio-injection: enabled
---
apiVersion: v1
kind: Service
metadata:

gilangvperdana

apiVersion: v1
kind: ConfigMap
metadata:
  name: imagecleanupconfig
  namespace: default
  labels:
    component: imagecleanup
data:
  # removes all images unused by a running container
  cronjobs: 0 0 * * * crictl rmi --prune 2>&1

gilangvperdana

How to add an image to a gist

1. Create a gist if you haven't already.
2. Clone your gist:

   # make sure to replace `<hash>` with your gist's hash
   git clone https://gist.github.com/<hash>.git # with https
   git clone git@gist.github.com:<hash>.git     # or with ssh