Ia ia te whanaungatanga o ia ārai ahi e whakahaere ana i KapsuleHost Server, he ārai ahi e whakakāhore ana i te trafika whakaetanga ki muri, me te tiaki whakahihi-kaha, he ārai ahi taupānga tīmatanga, me te patakitaki āhuatanga aunoa, ka whakahaerea katoa mai i tētahi whārangi i KPanel.
Kua tohua ngā tūwhakatūnga kia haumaru ai te tūmau hou i mua koe e whakatū ai. Ko āna mea e tāpiri ai e koe he nui rawa ko ngā tomokanga e hiahia ana tō tono. Ka haereere te aratohu nei i roto i te whārangi katoa o te Whakahaere Tūmau, arā he wāhī tahi te ārai ahi, ā ko ētahi atu wāhī ka whakatupuranga e kore e hiahia koe i te ārai ahi.
Te Whakatūtuki i te Whārangi Whakahaere
- Whakatūtakina ki KPanel.
- Pīkia Ngā Tūmau Kapua i te pae taha maui, katahi pīkia tō tūmau.
- Pīkia Management i ngā pūtton mahi i te timatanga o te whārangi.
Ko te wāhi tika ko /cloud-servers/<server-id>/management. Ko te whārangi i whāki ai te īa mō ia: "Firewall, OS patches, fail2ban, and ModSecurity. Changes apply over SSH within seconds."
Mēnā he pīrangi e pānui ana "Live apply unavailable. Changes will save to the next provisioning run but won't take effect immediately", kāore te paripanui e taea te whakawhiti ki te tūmau i tēnei wā. Kua tiakina tō ake tūturiuri, heoi anō kāore ā kua tino whakamahi. Tirohia kua rima te tūmau ā, kua eke.
Te Kaupapa Ārai Ahi Taunoa
Ko te wāhanga Ārai ahi (UFW) e rīanga ana i te kaupapa i tētahi rarangi: "Default-deny inbound. SSH (22) is always open. App-stack ports open automatically. Add custom rules below."
I te āhuatanga:
- Kaore i te taea te whakawhiti ki tō tūmau i te ipurangi mena he ture e whakaa ai.
- Ko te tomokanga 22 kei te tuwhera tonu, no reira kaore e taea e te panui ārai ahi koe ki te pīwaru i a koe ake.
- Ko ngā tomokanga e hiahia ana tō taupānga, pērā ki te 80 me te 443 mō tētahi taupānga tīmatanga, kua tuwhera.
- Kaore te trafika whakatūtuki mai te tūmau e aukati.
Ki te kaore he ture mua, ko te wāhanga ka tīwhiri "No custom rules. Defaults: SSH + app-stack ports." He āhuatanga hauora tēnei, kaore he whakatūturiuri tāpiri.
Te Tāpiri i tētahi Ture Mua
Tāpiria tētahi ture ki te rere koe i tētahi mea i runga i tētahi tomokanga kaore te kaupapa taunoa e āta: tētahi tono Node i 3000, tētahi pūtaiao e tika koe ki te whakawhiti tika ki 5432, tētahi keemu rānei tūmau he tohu i tētahi tomokanga UDP.
- Whakatūtakina te wāhanga Ārai ahi (UFW).
- Tuhia te nama Tomokanga ki te mara tuatahi. Ko ngā uara e tika ana ko te 1 ki te 65535.
- Tohua TCP rānei UDP.
- Tohua Allow rānei Deny.
- Pīkia Add.
Ka puta te ture i te rārangi me tētahi paepae ALLOW rānei DENY, me te tomokanga me te kaupapa, hei tauira 3000/tcp. Ka pana ki te tūmau i runga i te hononga whakahaere i roto i ngā hēkona.
Ki te tango i tētahi ture, pīkia te X i te mutunga o tōna rarangi. Ko te tango i tētahi ture Allow ka tutuki taua tomokanga anō.
Ko te whakawhāiti i tētahi tomokanga pūtaiao ki te katoa o te ipurangi tētahi o ngā huarahi nui ka whakaahuatia ai tētahi tūmau. I mua i koe e whakaa ai i te 3306, 5432, 6379 rānei 27017, pātai: he kaha rānei te mea e whakawhiti ana kia whakawhiti ai i te pūtaiao i runga i te loopback o te tūmau anō, rānei i tētahi whatunga e whānui ānoa? Mehemea me whakawhiti tika i waho, me whakatunui koia kua whakatū te mahi ki te kaha whakaae me te ārai.
Tāpiria te ture i mua, katahi tīmata te mahi. Ko te mahi e whakatū ana i muri i tētahi tomokanga kua tutuki e ōrite tonu me te mahi i rahua te timatanga, ā, e taea e koe te whakahāngai i a koe ki te āhuatanga he nui nei.
Ngā Pūranga Taupānga
Ko te wāhanga Pūranga taupānga e kī ana ki te papatuanui he aha te momo tono e rere ana i tēnei tūmau, kia rite te hunga tiaki ki a ia. Ko te whakakitanga i tētahi tono i roto i te paripanui ka whakarite i tēnei mō koe.
Ko ngā pūranga e mohiotia ana ko WordPress, WooCommerce, Ghost, Nextcloud, GitLab, Mattermost, Generic web, me No app stack. Ko te whārangi e whakaaturia ana: "The hardening preset is tuned to your app. Installing an app from the marketplace auto-sets this."
Ko te pūranga e tohu ana ko ēhea ngā tomokanga ka tuwhera aunoa me pēhea te hunga tiaki kē e rite, he nui rawa ki te āhuatanga o fail2ban.
fail2ban
Ko fail2ban e titiro ana i ngā ngā whakatūtakinga me te whakataringa i ngā wāhi e rahua nuitia. Kei runga a i te taunoa ā, ko te whārangi i rīangahia ai: "Bans IPs that brute-force SSH. For WordPress sites, adds wp-login.php protection too."
Waiho kei runga. Ko te tiaki tē iti nei i te whārangi, kaore e utu ki te mahi, ā, ka huri i te ng motu o te whakatupuranga tonutanga ki te kore. I runga i tētahi pūranga WordPress, WooCommerce rānei e whakatupurangia ai te puka whakatūtakinga, arā kei te nuinga o te whakawhiwhiwhia o WordPress.
ModSecurity, te Ārai Ahi Taupānga Tīmatanga
Ko ModSecurity e tirotiro ana i ngā tono HTTP e whakatika ana i te OWASP Core Rule Set ā, ka tūwhera ki aua mea e ahua ai he whakawhiwhiwhia. I runga i te tūmau KapsuleHost e tīmata ana i te ahumahi mate-tika: "OWASP Core Rule Set in DetectionOnly mode by default. Logs suspicious traffic without blocking; flip to active mode in your server once tuned."
Ko te mate-tika te huarahi tika ki te tīmatanga. He whakapā nui te Core Rule Set, ā, i runga i tētahi tono tino tika tētahi tono pūtea ka whakatika ki tētahi ture. Waiho i a ia ki te mate-tika mō tētahi wā, pānuihia ngā whakatai, mōhio te whārangi o ō tono e whakatika, ā, anake ka whakapihia te ārai ahi ki te tūmau.
Ko te whakawhiwhiwhia i te ārai ahi me te whakawhiwhiwhia ki te tiaki i te nuinga e karo i tō tūmau. Ko te tuku harikoa, te tuku kōnae, me ngā kiwa API me te tohu tino iti roa ko te nuinga e mate ai. Pānuihia ngā whakatai i mua i te whakapihia.
Papaki Aunoa o te OS
Ko te whakahāmatatanga āhuatanga e tāpirihia ana. Ko te whārangi e whakaaturia ana te kupu tiaki: "Security updates applied automatically. Snapshot-protected: a server snapshot is taken before each run, with automatic rollback if the server becomes unreachable after reboot."
E rua ngā tūturiuri kei raro i te whakapihinga:
- Allow automatic reboot when a kernel update needs it (only during quiet hours below). Ko ngā whakapihinga o te kernel anake te whakamahi i muri i te whakapihinga hou. Mēnā ka waiho koe kāore, ka whakapihia ngā patching o te kernel heoi anō kāore a kua tino mahi i a koe e whakapihinga.
- Quiet window (UTC), tētahi wā timatanga me tētahi wā mutunga. Ko te whakapihinga anake kei roto i a ia. Whakaritea ki ngā wā e haumaru ai mō tō āwī, ā, me maumau te mara i te UTC, kaore i tō wā ake.
Waiho autoa-patching kei runga. Ko te nuinga whakatupuranga o te tūmau kua tae atu ki te pūtake he rauparuparunaga i te whakahāmatatanga o te wiki okoa. Ko te snapshot i mua i te patching me te whakapihinga aunoa he ute e tiki nei te whakahihi ki te whakawhiwhiwhia, ka tino whakatupuranga tēnā.
Hītoria Patching me te Whakahaere Patching Nāianei
Ko te wāhanga Hītoria Patching e rārangi ana i ia whakahaere me te āhuatanga o RUNNING, SUCCESS, ROLLED_BACK, FAILED rānei SKIPPED, te nama o ngā pūranga i whakahōia, mēnā kua whakapihinga te tūmau, me te wā i tīmataia ai.
Ki te patching aunoa kaore i te whanga ki te āteatenga, pīkia Whakahaere patching nāianei. Ko te whakaae e pānui ana: "A snapshot is created first. The server stays online except for a brief reboot if a kernel update needs it."
Ko tētahi ingoa ROLLED_BACK e te tohu nei kua mahi pai te kupu tiaki: kāore te tūmau i te whakahoki pakari i muri i te whakapihinga hou, no reira ka whakahuihuia te snapshot i mua i te patching. Tirohia Cloud Server Snapshots mō pēhea aua snapshots e mahi ai.
Te Wāiti E Hirahira Ana
Mō te nuinga o ngā tūmau, ko tēnei te whārangi āhuatanga haumaru:
| Te Tūturiuri | I Whakatūtakina |
|---|---|
| Ārai ahi | Kei runga, ngā ture taunoa, me anake ngā tomokanga e hiahia ana tō tono |
| fail2ban | Kei runga |
| ModSecurity | Kei runga, mate-tika i a koe kua pānuihia ngā whakatai |
| Papaki aunoa o te OS | Kei runga, kua whakaa ngā whakapihinga i tētahi wā haumaru |
| Whakatūtakinga SSH | Ngā kī, kaore i ngā kupu whakatūtakinga |
Ko te rarangi whakamutunga kaore i tēnei whārangi heoi anō e tino nui ake i te tokoiti. Tirohia Connecting to Your Cloud Server With SSH.
Te Whakatika Raru
"Could not load management config." Kāore te paripanui i taea te pānui i ngā tūturiuri mō tēnei tūmau. Tukitukia hou, ā, tirohia kua oha te tūmau me te whakarite.
"Port must be 1-65535." Ko te mara tomokanga e whakatangi ana i tētahi tau noa i taua whānuitanga. Ko ngā whānuitanga me ngā ingoa mahi kaore i te whakatangi i konei.
Ko taku ture i tiakina heoi anō kaore he mea i huri. Rapu i te pīrangi "Live apply unavailable". Mēnā ka puta, ka tiakina te panui heoi anō kaore a kua pania ki te tūmau.
Ka whakawhiti mai i tētahi whatunga heoi anō kaore i tētahi atu. He nuinga tēnei ko tō ake ārai ahi whakatūtuki, kaore ko te tūmau. Whāia mai i tētahi hononga kē i mua i te panui i ngā ture i konei.
Ko tētahi whakahaere patching e whakaaturia ana ko FAILED. Pānuihia te karanga hē i te rarangi. Ko te pūtake nui rawa ko te kōnae kua oti. Horoia tētahi wāhi ā, pīkia Whakahaere patching nāianei.
Ko ngā tono e tika ana i tīmata ana te whakapokapoka. Mēnā kua whakapihinga koe i ModSecurity ki te ahumahi ārai ahi, whakahoki ki te mate-tika, pānui ngā whakatai, me te tohu i te ture i mua i te ngana anō.
Mēnā he ture ārai ahi e whakawhiti kaore, rānei kua whakataringa koe i tētahi mahi kua whakaa, tukitukia support@kapsulehost.com me te ingoa tūmau, te tomokanga, me te āhuatanga e whakawhitihia ai koe.