Ukufaka Umphathi ku-HestiaCP: Ukusethwa Kokuphepha Okuzenzakalelayo + Ukuthuthukiswa Kokuphathwa Kwedathabheyisi

Umhlahlandlela wakamuva ophelele wokufaka i-Adminer ku-HestiaCP uhlanganisa ukufakwa ngokuchofoza okukodwa, ukuqinisa ukuphepha, kanye nezinyathelo zokucushwa okuzenzakalelayo. Ikufundisa isinyathelo ngesinyathelo ukuthi ungawasebenzisa kanjani amathuluzi okuphatha isizindalwazi futhi uvikele iseva yakho, okuvumela ngisho nabaqalayo ukuthi baqale ngokushesha futhi baxazulule izinkinga zokusebenza nokugcinwa kwe-HestiaCP + Administer.

Uma usasebenzisa amathuluzi okuphatha isizindalwazi ngaphandle kwesivikelo, unikeza okhiye kubaduni.

Kungani ukhethe i-Adminer esikhundleni se... phpMyAdmin?

I-Adminer inefayela elilodwa le-PHP elingaphansi kwe-1MB, okwenza ukufakwa kube lula kakhulu, kusheshe, futhi kusebenzise kahle izinsiza.

Uma kuqhathaniswa nesakhiwo esiyinkimbinkimbi se-phpMyAdmin, i-Adminer ifaneleka kakhulu kwi-VPS, amawebhusayithi amancane, kanye namaphrojekthi omuntu siqu.

Izinyathelo zokufaka i-Administrator ku-HestiaCP

1. Landa ifayela loMqondisi

Iya ku Iwebhusayithi Esemthethweni Yomphathi Landa inguqulo yakamuva adminer.php,

Layisha ifayela kufolda yewebhusayithi ye-HestiaCP, isibonelo:

/home/username/web/adminer.domain.com/public_html/adminer.php

2. Dala isizinda esincane bese unika amandla i-SSL.

Engeza isizinda esincane kuphaneli ye-HestiaCP adminer.domain.comNika amandla i-Let's Encrypt SSL ukuqinisekisa ukudluliswa okuphephile.

3. Lungiselela ukuvikelwa kwephasiwedi ye-Nginx

Engeza okulandelayo kufayela lokucushwa kwe-Nginx lesizinda esingaphansi:

location / {
    auth_basic "Restricted Area";
    auth_basic_user_file /etc/nginx/.htpasswd;

    root /home/username/web/adminer.domain.com/public_html;
    index index.php adminer.php;
}

Khiqiza ifayela lephasiwedi:

sudo apt-get install apache2-utils
sudo htpasswd -c /etc/nginx/.htpasswd adminuser

Uma ungena ku-Administrator, ibhokisi lengxoxo yephasiwedi lizovela, futhi ungangena ngemvume kuphela ngokufaka igama lomsebenzisi nephasiwedi efanele.

Buyekeza amafayela omlawuli ngokuzenzakalelayo

Ukuze kugwenywe izingozi zokuphepha ezihambisana nokusebenzisa izinguqulo ezindala, izibuyekezo ezizenzakalelayo zingatholakala kusetshenziswa izikripthi zegobolondo kanye nemisebenzi ehleliwe ye-Cron.

Buyekeza isibonelo sesikripthi

#!/bin/bash
URL="https://www.adminer.org/latest.php"
TARGET="/home/username/web/adminer.domain.com/public_html/adminer.php"

wget -q -O "$TARGET" "$URL"
chown username:username "$TARGET"
chmod 644 "$TARGET"

Igcine njenge /usr/local/bin/update-adminer.shFuthi engeza umsebenzi ohleliwe:

crontab -e
0 3 * * 1 /usr/local/bin/update-adminer.sh

Ngale ndlela, ifayela loMqondisi lizobuyekezwa ngokuzenzakalelayo njalo ngoMsombuluko ngo-3 ekuseni.

Fail2 Vimbela ukuhlasela okulwa nobudlova

I-Simple Basic Auth isengozini yokuhlaselwa ngamandla amakhulu, kuyilapho i-Fail2Ban ingavimba ngokuzenzakalelayo ama-IP anonya.

Ukucushwa kwesihlungi

idokhumenti:/etc/fail2ban/filter.d/nginx-adminer.conf

[Definition]
failregex = ^<HOST> - .* "GET /adminer.php HTTP/.*" 401
ignoreregex =

Ukucushwa kwejele (ubude bokuvinjelwa obungeziwe)

idokhumenti:/etc/fail2ban/jail.local

[nginx-adminer]
enabled  = true
filter   = nginx-adminer
port     = http,https
logpath  = /var/log/nginx/access.log
maxretry = 3
findtime = 600

bantime.increment = true
bantime.rndtime   = 60
bantime.factor    = 2
bantime           = 600

Umphumela: Ukuvinjelwa kokuqala kungokwemizuzu eyi-10, okwesibili kungokwemizuzu engama-20, okwesithathu kungokwemizuzu engama-40, njalo njalo. Abahlaseli abaqhubekayo bazovinjelwa isikhathi eside kakhulu.

Qedela iskripthi sokufaka ngokuchofoza okukodwa

Igcine njenge /usr/local/bin/setup-fail2ban-adminer.sh:

#!/bin/bash
FILTER_PATH="/etc/fail2ban/filter.d/nginx-adminer.conf"
JAIL_PATH="/etc/fail2ban/jail.local"

cat > $FILTER_PATH << 'EOF'
[Definition]
failregex = ^<HOST> - .* "GET /adminer.php HTTP/.*" 401
ignoreregex =
EOF

cat >> $JAIL_PATH << 'EOF'

[nginx-adminer]
enabled  = true
filter   = nginx-adminer
port     = http,https
logpath  = /var/log/nginx/access.log
maxretry = 3
findtime = 600

bantime.increment = true
bantime.rndtime   = 60
bantime.factor    = 2
bantime           = 600
EOF

systemctl restart fail2ban
fail2ban-client status nginx-adminer

执行:

sudo chmod +x /usr/local/bin/setup-fail2ban-adminer.sh
sudo /usr/local/bin/setup-fail2ban-adminer.sh

Isiphetho: Ukulinganisela Ukuphepha Nokusebenza Kahle

Ngikholelwa ngokuqinile ukuthi amathuluzi okuphatha isizindalwazi akuyona into ongayishiya nje ku-inthanethi yomphakathi bese uyisebenzisa ngokuthula kwengqondo. Idizayini elula ka-Adminer iyathandeka, kodwa izindlela zokuphepha kumele zihambisane nesivinini. Ukuvikelwa kwephasiwedi kuyindlela yokuqala yokuzivikela, izibuyekezo ezizenzakalelayo zinikeza ukuvikelwa okuqhubekayo, kanti i-Fail2Ban inikeza izindlela zokuzivikela ezihlakaniphile. Ngokuhlanganisa lezi zinto ezintathu kuphela lapho ungakha khona indawo yokuphathwa kwesizindalwazi esebenza kahle futhi ephephile.

Inkosi yangempela akuyona nje umuntu owazi ukwakha amathuluzi, kodwa umuntu owazi ukuwavikela.