Kukhazikitsa Admin mu HestiaCP: Kukhazikitsa Chitetezo Chokha + Kukonza Kasamalidwe ka Database

Buku laposachedwa lathunthu lothandizira kukhazikitsa Administer pa HestiaCP likuphatikizapo kuyikapo kamodzi kokha, kulimbitsa chitetezo, ndi njira zosinthira zokha. Limakuphunzitsani pang'onopang'ono momwe mungagwiritsire ntchito zida zoyendetsera database ndikuteteza seva yanu, zomwe zimathandiza ngakhale oyamba kumene kuyamba mwachangu ndikuthetsa mavuto omwe amabwera chifukwa cha ntchito ndi kukonza kwa HestiaCP + Administer.

Ngati mukugwiritsabe ntchito zida zoyendetsera database popanda chitetezo chilichonse, mukupereka makiyi kwa akuba.

Chifukwa chiyani mungasankhe Adminer m'malo mwa... phpMyAdmin?

Adminer imakhala ndi fayilo imodzi ya PHP yosakwana 1MB, zomwe zimapangitsa kuti kuyika mafayilo kukhala kosavuta, mwachangu, komanso kogwira ntchito bwino.

Poyerekeza ndi kapangidwe kovuta ka phpMyAdmin, Admininer ndi yoyenera kwambiri pa VPS, mawebusayiti ang'onoang'ono, ndi mapulojekiti aumwini.

Njira zokhazikitsira Woyang'anira mu HestiaCP

1. Tsitsani fayilo ya Woyang'anira

Pitani ku Webusaiti Yovomerezeka ya Adminer Tsitsani mtundu waposachedwa adminer.php.

Kwezani fayiloyo ku chikwatu cha tsamba la HestiaCP, mwachitsanzo:

/home/username/web/adminer.domain.com/public_html/adminer.php

2. Pangani subdomain ndikuyatsa SSL.

Onjezani subdomain mu gulu la HestiaCP adminer.domain.comYambitsani Let's Encrypt SSL kuti muwonetsetse kuti kutumiza kwa data kuli kotetezeka.

3. Konzani chitetezo cha mawu achinsinsi a Nginx

Onjezani zotsatirazi ku fayilo yosinthira ya Nginx ya subdomain:

location / {
    auth_basic "Restricted Area";
    auth_basic_user_file /etc/nginx/.htpasswd;

    root /home/username/web/adminer.domain.com/public_html;
    index index.php adminer.php;
}

Pangani fayilo yachinsinsi:

sudo apt-get install apache2-utils
sudo htpasswd -c /etc/nginx/.htpasswd adminuser

Mukalowa mu Administrator, bokosi la mawu achinsinsi lidzawonekera, ndipo mutha kulowa pokhapokha mutalemba dzina lolowera ndi mawu achinsinsi oyenera.

Sinthani mafayilo a Administrator okha

Pofuna kupewa zoopsa zokhudzana ndi chitetezo zomwe zingachitike pogwiritsa ntchito mitundu yakale, zosintha zokha zitha kuchitika pogwiritsa ntchito ma shell script ndi ntchito zokonzedwa za Cron.

Sinthani chitsanzo cha script

#!/bin/bash
URL="https://www.adminer.org/latest.php"
TARGET="/home/username/web/adminer.domain.com/public_html/adminer.php"

wget -q -O "$TARGET" "$URL"
chown username:username "$TARGET"
chmod 644 "$TARGET"

Sungani monga /usr/local/bin/update-adminer.shNdipo onjezerani ntchito yomwe mwakonza:

crontab -e
0 3 * * 1 /usr/local/bin/update-adminer.sh

Mwanjira imeneyi, fayilo ya Administrator idzasinthidwa yokha Lolemba lililonse nthawi ya 3 koloko m'mawa.

Fail2Letsani kuukira kotsutsana ndi mphamvu

Simple Basic Auth ili pachiwopsezo cha ziwopsezo za brute-force, pomwe Fail2Ban imatha kuletsa ma IP oyipa okha.

Kasinthidwe ka fyuluta

文件:/etc/fail2ban/filter.d/nginx-adminer.conf

[Definition]
failregex = ^<HOST> - .* "GET /adminer.php HTTP/.*" 401
ignoreregex =

Kapangidwe ka ndende (nthawi yowonjezera yoletsa)

文件:/etc/fail2ban/jail.local

[nginx-adminer]
enabled  = true
filter   = nginx-adminer
port     = http,https
logpath  = /var/log/nginx/access.log
maxretry = 3
findtime = 600

bantime.increment = true
bantime.rndtime   = 60
bantime.factor    = 2
bantime           = 600

Zotsatira zake: Kuletsa koyamba ndi kwa mphindi 10, kwachiwiri ndi kwa mphindi 20, kwachitatu ndi kwa mphindi 40, ndi zina zotero. Otsutsa mosalekeza adzaletsedwa kwa nthawi yayitali.

Malizitsani kulemba script yotumizira kamodzi kokha

Sungani monga /usr/local/bin/setup-fail2ban-adminer.sh:

#!/bin/bash
FILTER_PATH="/etc/fail2ban/filter.d/nginx-adminer.conf"
JAIL_PATH="/etc/fail2ban/jail.local"

cat > $FILTER_PATH << 'EOF'
[Definition]
failregex = ^<HOST> - .* "GET /adminer.php HTTP/.*" 401
ignoreregex =
EOF

cat >> $JAIL_PATH << 'EOF'

[nginx-adminer]
enabled  = true
filter   = nginx-adminer
port     = http,https
logpath  = /var/log/nginx/access.log
maxretry = 3
findtime = 600

bantime.increment = true
bantime.rndtime   = 60
bantime.factor    = 2
bantime           = 600
EOF

systemctl restart fail2ban
fail2ban-client status nginx-adminer

zidachitidwa:

sudo chmod +x /usr/local/bin/setup-fail2ban-adminer.sh
sudo /usr/local/bin/setup-fail2ban-adminer.sh

Kutsiliza: Kulinganiza Chitetezo ndi Kuchita Bwino

Ndikukhulupirira kuti zida zoyendetsera database si chinthu chomwe mungangochisiya pa intaneti ya anthu onse ndikugwiritsa ntchito mwamtendere. Kapangidwe ka Adminer kopepuka ndi kokongola, koma njira zotetezera ziyenera kuyenderana ndi izi. Chitetezo cha mawu achinsinsi ndiye mzere woyamba wa chitetezo, zosintha zokha zimapereka chitetezo chosalekeza, ndipo Fail2Ban imapereka njira zanzeru zotsutsana. Pokhapokha mutaphatikiza zinthu zitatuzi ndi pomwe mungapange malo oyendetsera database omwe ndi othandiza komanso otetezeka.

Mbuye weniweni si munthu amene amadziwa kupanga zida zokha, koma munthu amene amadziwa kuziteteza.