Category Archives: Howto

Letsencrypt and Certbot

Posted on by
Reply

Certbot User Guide
https://eff-certbot.readthedocs.io/en/latest/using.html

Instructions to install Certbot and a DNS plugin:
https://certbot.eff.org/instructions?ws=nginx&os=snap&tab=wildcard

Request a certificate via Cloudflare plugin:

Remove Snap Certbot (if exists)

sudo snap remove certbot

Install Certbot via APT (Debian/Ubuntu package):

sudo apt update
sudo apt install certbot python3-certbot-dns-cloudflare

Request a certificate:

# certbot-dns-cloudflare plugin
# https://certbot-dns-cloudflare.readthedocs.io/en/stable/

sudo certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /root/.secrets/certbot/cloudflare.ini \
  --dns-cloudflare-propagation-seconds 60 \
  -d mycompliancetracker.com \
  -d *.mycompliancetracker.com \
  -d myctracker.com \
  -d *.myctracker.com \
  -d myctrackerpro.com \
  -d *.myctrackerpro.com

cloudflare.ini content

# cloudflare.ini
# Cloudflare API token used by Certbot
# Get if from https://dash.cloudflare.com/profile/api-tokens
# You have to create a new one - you cannot see the value of an existing one.
# The token needs Zone:DNS:Edit permission
dns_cloudflare_api_token = 0123456789abcdef0123456789abcdef01234567

Change the permissions of the file:

chmod 600 cloudflare.ini

Test automatic renewal

sudo certbot renew --dry-run

Delete a certificate

certbot delete --cert-name mycompliancetracker.com

# or to choose from a list:
certbot delete

Sync the certificates

 ssh-keygen -t rsa -b 4096 -C "Let's Encrypt sync key" -f ~/.ssh/letsencrypt_sync_key
 
 ssh-copy-id ubuntu@dev-server.mycompliancetracker.com
 
 ssh-copy-id -f -i ~/.ssh/letsencrypt_sync_key.pub -o IdentityFile=~/.ssh/dev-server.mycompliancetracker.com ubuntu@dev-server.mycompliancetracker.com
 
 ssh-copy-id -f -i ~/.ssh/letsencrypt_sync_key.pub angel@ionos-ubuntu-01.anichin.com
 
 -- Test to log in with the new key - Works
 ssh -o 'IdentityFile=/root/.ssh/letsencrypt_sync_key' 'ubuntu@dev-server.mycompliancetracker.com'
 
 ssh -o 'IdentityFile=/root/.ssh/letsencrypt_sync_key' 'angel@ionos-ubuntu-01.anichin.com'
 
 ssh -o 'IdentityFile=/root/.ssh/letsencrypt_sync_key' 'root@ionos-ubuntu-01.anichin.com'

Transfer Certificates to Target Server

 rsync -avz -e "ssh -i /root/.ssh/letsencrypt_sync_key" --rsync-path="mkdir -p /home/angel/letsencrypt/live/anichin.com && rsync" /etc/letsencrypt/live/anichin.com/ angel@ionos-ubuntu-01.anichin.com:/home/angel/letsencrypt/live/anichin.com/

 rsync -avz -e "ssh -i /root/.ssh/letsencrypt_sync_key" --rsync-path="mkdir -p /home/angel/letsencrypt/archive/anichin.com && rsync" /etc/letsencrypt/archive/anichin.com/ angel@ionos-ubuntu-01.anichin.com:/home/angel/letsencrypt/archive/anichin.com/

 rsync -avz -e "ssh -i /root/.ssh/letsencrypt_sync_key" --rsync-path="mkdir -p /home/angel/letsencrypt/renewal && rsync" /etc/letsencrypt/renewal/anichin.com.conf angel@ionos-ubuntu-01.anichin.com:/home/angel/letsencrypt/renewal/


 rsync -avz -e "ssh -i /root/.ssh/letsencrypt_sync_key" --rsync-path="mkdir -p /home/angel/letsencrypt/live/pautalia.ca && rsync" /etc/letsencrypt/live/pautalia.ca/ angel@ionos-ubuntu-01.anichin.com:/home/angel/letsencrypt/live/pautalia.ca/

 rsync -avz -e "ssh -i /root/.ssh/letsencrypt_sync_key" --rsync-path="mkdir -p /home/angel/letsencrypt/archive/pautalia.ca && rsync" /etc/letsencrypt/archive/pautalia.ca/ angel@ionos-ubuntu-01.anichin.com:/home/angel/letsencrypt/archive/pautalia.ca/

 rsync -avz -e "ssh -i /root/.ssh/letsencrypt_sync_key" --rsync-path="mkdir -p /home/angel/letsencrypt/renewal && rsync" /etc/letsencrypt/renewal/pautalia.ca.conf angel@ionos-ubuntu-01.anichin.com:/home/angel/letsencrypt/renewal/
 
 rsync -avz -e "ssh -i /root/.ssh/letsencrypt_sync_key" --rsync-path="mkdir -p /home/angel/letsencrypt/live/vickisplace.org && rsync" /etc/letsencrypt/live/vickisplace.org/ angel@ionos-ubuntu-01.anichin.com:/home/angel/letsencrypt/live/vickisplace.org/

 rsync -avz -e "ssh -i /root/.ssh/letsencrypt_sync_key" --rsync-path="mkdir -p /home/angel/letsencrypt/archive/vickisplace.org && rsync" /etc/letsencrypt/archive/vickisplace.org/ angel@ionos-ubuntu-01.anichin.com:/home/angel/letsencrypt/archive/vickisplace.org/

 rsync -avz -e "ssh -i /root/.ssh/letsencrypt_sync_key" --rsync-path="mkdir -p /home/angel/letsencrypt/renewal && rsync" /etc/letsencrypt/renewal/vickisplace.org.conf angel@ionos-ubuntu-01.anichin.com:/home/angel/letsencrypt/renewal/

Option 1: Use sudo Without Password Prompt

sudo visudo
angel ALL=(ALL) NOPASSWD: /bin/systemctl reload nginx

Opening up port 80 and 443 for Oracle Cloud servers

Posted on by
Reply

Original: https://dev.to/armiedema/opening-up-port-80-and-443-for-oracle-cloud-servers-j35

Are you working on setting up your Oracle Cloud server and are facing issues with sites rendering as expected? Such as, getting time out issues when navigating to the site’s url?

Before we get into the steps of making port 80 and 443 work properly on an Oracle server, you may be wondering why Cleavr only integrates with some of the free server options and does not provide paid tier options. In short, we wanted to provide users with a free server option and Oracle in one of the few providers that offers a decent free server option. However, the experience to connect with Oracle accounts is very rough around the edges plus these oddities around port connections have led us to delay integrating with Oracle further until their experiences improve.

But, let’s get back to the main issue. When you provision a server via Oracle’s cloud interface, ports 80 and 443 won’t be fully opened until you make the following updates.

Step 1: Add ingress rules

For this first step, you’ll need to access your Oracle Cloud account.

Port 80 and 443 will be closed by default. Assuming you plan to add websites to the server, open port 80 and 443 by clicking on Virtual Cloud Network from the server instance details screen.

setting up ports

Click Security List on the left menu.

![setting up ports]((https://dev-to-uploads.s3.amazonaws.com/uploads/articles/43y5fy5paah81vle9bh8.png)

Click on the security list

setting up ports

Click Add Ingress Rules

setting up ports

Add the following source and port –

setting up ports

Add the ingress rule for port 80. Do the same process for port 443.

At this juncture, you may be led to believe that ports 80 and 443 are opened. Afterall, you just set the ingress rule that opens up the ports.

Not so fast!

It’d be best and most expediant to scan the server ports to make sure that these ports are actually opened to the outside world.

We’ll use Doneo.io’s server port scanning tool to scan the server after making the above updates.

doneo port scan shows 443 is still closed

In the above, we can see that we still have some work to do to open up port 443.

Step 2: Modify iptables

For this step, we’ll need to SSH into the server so we can run some terminal commands.

Run the following commands:



iptables -I INPUT 6 -m state --state NEW -p tcp --dport 443 -j ACCEPT
netfilter-persistent save

This will update the iptables to allow port 443. If port 80 was blocked after performing a port scan, then also run the above but swap out 443 with 80.

Now, run another server port scan to see if 443 is open.

doneo port scan shows 443 is open

We can see from the screenshot above from the Doneo.io port scan that 443 is now open.

Your http and https sites should now be accessible to the public.

Hopefully, this article saves you some time and stress as this can be a frustrating issue to resolve.