Welcome Guest. Please Login or Register  


You are here: Index > Virtualizor - Virtual Server Control Panel > General Support > Topic : Secure Virtualizor host



Threaded Mode | Print  

 Secure Virtualizor host, What ports and how to force SSL (4 Replies, Read 18191 times)
gauthig
Group: Member
Post Group: Newbie
Posts: 12
Status:
1. Hi, I had a problem with install as it turned out that not only 4084-4085 was needed for the web server, but a bunch or ports for php-fpm was also needed (9178-9183). 
Can someone, preferably Virtualizor, provide all ports that must be opened for their product to run with either openvz, xen, KVM and list which ports are required for which type of VE.  This way we can lock it down. 
2. Also, I installed my registered certificate so HTTPS works great, what does virtualizor recommend to prevent their web server from serving the non-sll pages?
IP: --   

Secure Virtualizor host
siddhesh
Group: Member
Post Group: Newbie
Posts: 30
Status:
>>1. Hi, I had a problem with install as it turned out that not only 4084-4085 was needed for the web server, but a bunch or ports for php-fpm was also needed (9178-9183). 
Can someone, preferably Virtualizor, provide all ports that must be opened for their product to run with either openvz, xen, KVM and list which ports are required for which type of VE.  This way we can lock it down.
For virtualizor web panel access you will require port 4082-4085 .
To access vnc you will require port 5900-7000
Also php-fpm ports are only local accessible .
This ports wont have any effect on the server.
Are you using firewall on the server or external firewall.

>>2. Also, I installed my registered certificate so HTTPS works great, what does virtualizor recommend to prevent their web server from serving the non-sll pages?
We would recommend to use https .You can secure access to the server using firewall or any other security tools.
IP: --   

Secure Virtualizor host
uname-r
Group: Member
Post Group: Newbie
Posts: 38
Status:
Hi,

I would suggest you to use CSF firewall.  It's easy to install and to configure for Virtualizor.

Instructions on how to install are here : http://configserver.com/cp/csf.html

Once it's installed in /etc/csf/csf.conf , make sure you have this :

Code
# Allow incoming TCP ports

TCP_IN = "5900:7000 "

# Allow outgoing TCP ports
TCP_OUT = "25,80,443"


// if you have IPV6 :
Code

# Allow outgoing TCP ports
TCP6_IN = "5900:7000
"

# Allow outgoing TCP ports
TCP6_OUT = "25,80,443"


Now, in /etc/csf/csf.allow  just add your ip address you need to authorize.

then, to let virtualizor work with csf, just create this file :

/etc/csf/csfpost.sh

and add this line :

Code
/sbin/iptables -A FORWARD -m physdev --physdev-is-bridged -j ACCEPT


It will be much easier for you to manage your firewall this way, with CSF :)   You'll get much better rules.

If you enable the CSF UI, you'll also get a web interface to manage your firewall.  However, it's more secure if you only use the command line to configure it­.

p.s.: why should you be using something else than https for transactions on this server?    I recommend to close the port 4082, and never use it ;) 

hope that help :)






IP: --   

Secure Virtualizor host
uname-r
Group: Member
Post Group: Newbie
Posts: 38
Status:
Forgot to mention :

-> if you are using this config, then only 1 ip address (the one you added to /etc/csf/csf.allow) will be able to access virtualizor and manage your servers.

I would recommend using a VPN to make sure you will always keep the same ip address and you will be able to manage your server from everywhere.

if you cannot get a dedicated (fix) ip then add 4083 and 4085 under TCP_IN and TCP6_IN  in /etc/csf/csf.conf

Once your done with configuring your firewall files, just do this to stop and start the Firewall

csf -x

followed by :

csf -e


...it's also possible you miss some dependencies on Centos and Ubuntu to install CSF.

If you are using Centos :

yum install perl-libwww-perl

and under Ubuntu :

apt-get install libwww-perl

:D  
IP: --   

Secure Virtualizor host
quickbooks2018
Group: Member
Post Group: Working Newbie
Posts: 69
Status:
I installed csf running successfully, I allowed the port 4085.

but is not working,

when I stop the csf and lfd ALL IS WELL.

Regards
IP: --   

« Previous    Next »

Threaded Mode | Print  



Jump To :


Users viewing this topic
1 guests, 0 users.


All times are GMT. The time now is April 26, 2024, 4:45 pm.

  Powered By AEF 1.0.8 © 2007-2008 Electron Inc.Queries: 11  |  Page Created In:0.039