Sunday, March 12, 2017

OpenVZ, Xen, and KVM – the differences, the advantages, a comparison

This editorial has been written by Anthony Smith from Inception Hosting. Thank you, Anthony, for your valued contribution to LowEndBox!
This overview is intended to be just that, this is just the first installment and is not intended as a fine detail technical paper simply a no nonsense overview to help in your decision making.
While this may be old news some some the subject comes up time and time again, what is the difference, which one is faster, which one should I use and so on so initially let’s start with a non exhaustive comparison table:

KVM

KVM is full hardware virtualisation, you can run almost any operating system as a guest BSD/Windows/Linux and with virtio driver you will get near native performance, some experiments have shown only 3% loss on native hardware under ideal circumstances.
It does support installation from ISO and also template based installation, it comes with good separation in terms of privacy, it can suffer I/O lag under heavy load which impacts the guest operating systems and the host operating system.
Each guest (VM) runs as a process on the host node while this is great for discovering which guest is causing issues when required it can also cause problems if the host is under heavy load all guests suffer.
You can over allocate Ram with little effort however in most cases unless the host is full SSD this is unlikely to happen due to the overhead it puts on the host node and subsequent and obvious performance issues.
Due to KVM being native in most modern kernels it does lend a performance advantage over others in some circumstances and is still fairly new and under very active development.
Most people select KVM for excellent performance and flexibility although perhaps not quite as stable as Xen due to maturity.

XEN

Xen comes in 2 flavors but can run simultaneously on the same physical host, Xen PV (paravirtualisation) and HVM (full hardware virtualisation)
Xen PV guests (in the hosting industry) tend to be template based for repid deployment and snappy performance, you can run your own kernel in Xen PV and this is pretty much default these days, you can only run Linux on Xen PV (BSD with additional configuration is possible but not common).
Xen HVM runs much like KVM it has better drivers for Linux based distributions as PV has been available by default since around 2006 in most kernels so you do not need to install virtio for a performance boost however NetBSD and windows perform poorly on Xen HVM compared to KVM, while you can over come this to some degree on Windows with Xen PV drivers for Windows it does not run as well as KVM out of the box so to speak.
Xen is quite old now and very mature, most people select Xen for good performance with exceptional stability.
Xen hosts will usually pre-allocate Ram and CPU cores to the xen hypervisor so it has its own dedicated resources that guests cannot impact on to achieve stability.

OpenVZ

OpenVZ is hugely popular in the hosting industry due to its rapid deployment and very high density, it achieves this as the host kernel is shared with the guests along with ram, cpu and disk, with fairly basic separation between guest and host the I/O bottleneck is almost none existent.
In terms of disk access speed and disk latency OpenVZ is a clear winner when compared to KVM and Xen however this comes at the cost of lack of separation in terms of privacy and also in terms of how much impact 1 guest OS can have on both the host node and other guests, all individual processes are visible to the host node and you cannot encrypt your data.
OpenVZ supports Linux only (unless using the commercial parallels which will support windows in a fashion)
OpenVZ can also be nested inside Xen or KVM to achieve even greater density, due to the volume of containers you can run on a single host node this keeps the price of OpenVZ much more competitive than KVM and Xen.

How to Setup a Shoutcast Radio VPS on Ubuntu

Have you ever wanted to use your VPS to host a Shoutcast Radio stream? In this article we will talk about how to install SHOUTcast Distributed Network Audio Server (DNAS 2.0) on your Ubuntu 16.04 VPS.
Once you have SHOUTcast installed, you will be able to use media players like Winamp or Mixxx to broadcast audio playlists onto the Internet.
Read more to learn how!
First, we will create local user in VPS to run DNAS server since it is not recommended to run DNAS server from a root account. Login to your VPS through SSH or Putty and create new user with your desired name using the following commands.
> su -

> adduser radio-user
The command will ask you for a password for the new user created. Choose one and type it in. You will need this password later so be sure to store it in a safe location.
We will now need to logout from the current root user and login with newly created user. Execute the following commands:
> exit

> su - radio-user

$ pwd
It’s now time to create two different directories. One will be used for downloading the software and the second will be use to install it. Type the following commands:
> mkdir ShoutCastDowload

> mkdir myShoutCastServer
Now let’s enter into the download directory:
> cd ShoutCastDowload
We will now need to download and extract the latest version of SHOUTcast server archive from the website. In order to select that we will have use our browser and connect to the following webaddress:
http://download.nullsoft.com/shoutcast/tools/
Use one of the following commands depending on which architecture your VPS has:
— For 32-bit OS —
> wget http://download.nullsoft.com/shoutcast/tools/sc_serv2_linux-latest.tar.gz

> tar xfz sc_serv2_linux-latest.tar.gz
— For 64-bit OS —
> wget http://download.nullsoft.com/shoutcast/tools/sc_serv2_linux_x64-latest.tar.gz

> tar xfz sc_serv2_linux_x64-latest.tar.gz
Once the download of SHOUTcast server archive completes, we will need to locate sc_serv executable binary file and copy it to the installation directory and finally switch to the that directory. Use the following commands to do that:
> ls

> cp  sc_serv  ../myShoutCastServer/

> cd  ../myShoutCastServer/

> ls
We will now need to create two directories named control and logs.
> mkdir control

> mkdir logs

> ls
In the next step we will create a configuration file for the SHOUTcast server. We will need to create a new file named “sc_serv.conf” and edit it with a text editor of your choice. Before adding the following statements to this file, you will need to change all the password with some you choose. Make sure to use different password for the lines “adminpassword” and “password” or the server will not start.
— This is sample configuration file —
adminpassword=YYYYYY

password=XXXXXX

requirestreamconfigs=1

streamadminpassword_1=XXXXXX

streamid_1=1

streampassword_1=XXXXXX

streampath_1=http://radio-server.lan:8000

logfile=logs/sc_serv.log

w3clog=logs/sc_w3c.log

banfile=control/sc_serv.ban

ripfile=control/sc_serv.rip
As an alternative, you can also configure the server through web interface by creating a configuration file. Just go to your ShoutCastDowload directory and run the following command:
> ./setup.sh
Then you will have to type the following link into your web browser and follow the instructions:
http://your-IP-address:8000
Once you are done with the guided installation you will need to copy the configuration file to your home directory using the following command:
> cp sc_serv.conf ../myShoutCastServer

> cd ../myShoutCastServer

> ls
In order to start the server execute SHOUTcast server as a daemon use the following command:
> ./sc_serv daemon
Once SHOUTcast server is started, you can access its web interface in browser. Type your server IP Address on port 8000 and SHOUTcast server web interface should appear with no live streams available.
In order to make it easier to start and stop our new server, we need to create an executable script using the root user in /usr/local/bin/ as shown below and make it executable. Use the following commands to do that:
> su -

> vim /usr/local/bin/scradio
— Add following code and save it —
#!/bin/bash

case $1 in

start)

cd /home/radio-user/myShoutCastServer/

./sc_serv deamon

;;

stop)

killall sc_serv

;;

*)

echo "Usage radio start|stop"

;;

esac

 

> chmod +x /usr/local/bin/scradio

> exit
Now, you can use following commands to manage your SHOUTcast server.
> scradio start

> scradio stop
Congratulations! Our SHOUTcast server is now ready to receive playlists through remote media players and broadcast the audio content over the Internet.

Using Nagios to Monitor your Virtual Private Servers

Monitoring the uptime of your virtual private servers is an essential part of guaranteeing maximum uptime for your web facing assets. As a result, many VPS enthusiasts have exclusively chosen Nagios as their uptime monitoring suite.
Nagios is an open source uptime monitoring app that is used extensively by server administrators all around the world. If a problem is detected on one of your virtual private servers, Nagios can be configured to immediately alert an administrator of the issue.
When it comes to free open-source uptime monitoring software, Nagios is considered the gold standard.  Nagios gives administrators expert insight into services such as:
  • CPU Usage
  • Memory Consumption
  • Disk Performance
  • Log Files
  • HTTP Logs
  • SMTP Monitoring
  • DNS Uptime
Nagios can also be modified using plugins to get the exact uptime metrics of specific services used by your VPS.  In this article, we will setup Nagios on a low end box and use this VPS to remotely monitor other virtual private servers in your fleet.
How to Setup Your First Instance of Nagios
First, let’s setup Nagios on low end VPS and configure it to monitor itself. After this is setup, we can deploy Nagios to other servers that we may want to monitor remotely. Please note that the instructions in this article pertain to the Ubuntu 16.04 operating system.
Here are a few prerequisites for getting started with Nagios:
  • Root access
  • Apache
  • PHP
We will assume that you are logged in the VPS with your root account. If you aren’t, you will need to use all the commands below by prepending ‘sudo’.  Let’s start running the following commands to make sure our system is up to date and that we have all the required modules:
> apt-get update
> apt-get install openssl perl make php5-gd libgd2-xpm-dev libapache2-mod-php5 libperl-dev libssl-dev daemon wget apache2-utils unzip
Next, let’s create a user for Nagios with the following commands:
> useradd nagios

> groupadd nagcmd

> usermod -a -G nagcmd nagios

> usermod -a -G nagcmd www-data
We are now ready to install Nagios.  Let’s download the app and install it using the following commands:
> wget  https://assets.nagios.com/downloads/nagioscore/releases/nagios-4.1.1.tar.gz
> tar -zxvf /tmp/nagios-4.1.1.tar.gz

> cd nagios-4.1.1/

> ./configure --with-nagios-group=nagios --with-command-group=nagcmd --with-httpd_conf=/etc/apache2/sites-enabled/

> make all

> make install

> make install-init

> make install-config

> make install-commandmode

> sudo /usr/bin/install -c -m 644 sample-config/httpd.conf /etc/apache2/sites-enabled/nagios.conf
If you haven’t encountered any errors, the Nagios Core should be completely installed. We need to execute a few more commands before Nagios is fully functional.
Type the following into an SSH window:
> wget http://www.nagios-plugins.org/download/nagios-plugins-2.1.1.tar.gz

> tar xzf nagios-plugins-2.1.1.tar.gz

> cd nagios-plugins-2.1.1

> ./configure --with-nagios-user=nagios --with-nagios-group=nagios

> make

> make install
The next step is to edit the Nagios configuration file. This is the part where you’ll input your email address so that you can get the alerts generated from the servers.  Use the following command to open the config file.
> vim /usr/local/nagios/etc/objects/contacts.cfg
And change the following line:
> email admin@idroot.net ;
To the address that should receive the alerts.
> email youremail@domain.com;
Now that this is complete, we will need to open this file with your favorite editor:
/etc/apache2/sites-enabled/nagios.conf
and comment each occurrence the following lines:
AuthName "Nagios Access"

AuthType Basic

AuthUserFile /usr/local/nagios/etc/htpasswd.users

Require valid-user
Don’t forget to enable Apache’s rewrite and CGI modules:
> sudo a2enmod rewrite

> sudo a2enmod cgi
Before restarting the webserver, open the following configuration file:
/usr/local/nagios/etc/cgi.cfg
And change the following line from:
use_authentication=1
to
use_authentication=0
Now it’s time to restart the webserver. This will load the new configuration file. You can restart Apache using the following command:
> systemctl restart apache2
Now that our environment is ready, let’s create a configuration file that helps us monitor services. Use the following command to add the new file to the Nagios configuration:
> echo "cfg_file=/usr/local/nagios/etc/objects/newhost.cfg " >> /usr/local/nagios/etc/nagios.cfg
Create and open the new file with your favorite editor and add the following content changing the X.X.X.X with the IP address of the server you want to monitor:
define host{

use                     linux-server

host_name               newhost

alias                   newhost

address                 X.X.X.X

}

 

define service{

use                             local-service

host_name                       newhost

service_description             PING

check_command                   check_ping!100.0,20%!500.0,60%

}
In this test, we are only performing a basic ping to monitor the server’s response. Be sure to check out Nagio’s configuration file webpage for tips on how to further customize your uptime monitoring services.
We’ll want Nagios load when the system is booted up, therefore we must verify that the configuration file has no errors. Use the following command:
> /usr/local/nagios/bin/nagios -v /usr/local/nagios/etc/nagios.cfg
And you should get the following 2 lines at the end of the output:
Total Warnings: 0
Total Errors:   0
We are now ready to start Nagios service:
> systemctl start nagios
Nagios will be available on HTTP port 80 by default. Open your favorite browser and navigate to
http://YOURIP/nagios/
Click on the “Services” link located on the left side of the webpage in order to access the list of monitored services. You should be able to monitor the availability of both the local and remote server that we have configured in the steps above.
If they do not appear to be green, give it some time. The service will run regular tests in order to check the availability of the services. Since we just started Nagios for the first time, it will require a bit of time to complete the first check.
Important: Make sure that the remote server has no firewall on the ICMP protocol. Otherwise, the test will fail and you will receive an alert from Nagios that the server is unreachable.
Congratulations! You have installed and configured Nagios on your virtual private server.

How to Install LimeSurvey On Your VPS

LimeSurvey provides you with instant feedback from your users. When compared to services that sell survey services, hosting your own VPS to conduct online surveys could potentially save you some money. LimeSurvey is the leading free online survey app. In this article we will learn how to install LimeSurvey on an Ubuntu 16.04 VPS.

Before starting the installation of LimeSurvey, we must ensure that our VPS meets some basic requirements. Most of these requirements will also be checked during the installation; Just for reference, here is a full list:

– Minimum 180MB disk space

– MySQL 5.5.3

– A web server (Apache or nginx)

– Minimum PHP 5.3.3 or later, however “PHP 5.5.x” is recommend

– The following PHP modules/libraries enabled: mbstring, PDO for MySQL (pdo_mysql or pdo_mysqli), PHP curl

– The following PHP Extensions are optional: PHP GD-Library, PHP IMAP, PHP LDAP, PHP Zlib

From an end user standpoint, LimeSurvey supports popular modern web browsers. In addition, LimeSurvey can automatically render on mobile devices. This is espicially helpful if you create mobile apps and you wish to use your VPS to host surveys that are available for end users through app itself.


Installing LimeSurvey on your VPS

Now that we have cleared all the requirements of LimeSurvey, it is time to start with the installation. First we will need to connect to our VPS via SSH. Once we are logged in, we will need to gain root access using the following command:

> sudo -i
You will be asked for the password. Type it in and you will be ready to start!

The next step is to download the latest stable LimeSurvey zip package (from this page) and save it to the  local disk of the VPS. Before we do this, let’s first enter the default web folder:

> cd /var/www/html
Now use the following command to begin the download.

> wget https://www.limesurvey.org/stable-release?download=1898:limesurvey255%20161021targz
If this link doesn’t work, simply go to the latest stable release page at LimeSurvey and right click on the “Download” button for the tar.gz file. You’ll select Copy Link Address and use this URL in your wget command.

Uncompress the file into a dedicated directory using the following command:

> tar xzf filename.tar.gz
You’ll want to pay attention to the file name at the end of the URL; you’ll need to explicitly call this filename when you go to uncompress the LimeSurvey tar.gz file.

For the script to work properly, we need to change some permissions around on the server.

The "/limesurvey/tmp" directory and all its subdirectories are used for imports & uploads. This location will require Read/Write permissions to be configured on your webserver.
The "/limesurvey/upload/" directory and all its subdirectories must also have Read/Write for your webserver in order to enable picture and media files upload.
The "/limesurvey/application/config/" directory also needs Read/Write permissions for your webserver. The other directories can be set to Read Only.
You may wish to set the permissions on each file within the /limesurvey/admin directory to Read Only. In order to do this execute the following commands:

> chmod –R 755 limesurvey/

> chmod –R 555 limesurvey/admin

> chown -R www-data:www-data limesurvey
Create a MySQL Database for LimeSurvey

Now we will need to create a database and a database user. LimeSurvey will create the tables inside it. Let’s begin configuring the username and password of the database user.

In general it is recommend to create a database user with the following permissions: SELECT, CREATE, INSERT, UPDATE, DELETE, ALTER, DROP, INDEX. In order to do so, execute the following command:

> mysql –u root -p

> CREATE DATABASE limesurvey;

> GRANT ALL PRIVILEGES ON limesurvey.* To 'limesurvey'@'localhost' IDENTIFIED BY 'l1m3surv3y';

> FLUSH PRIVILEGES;
We are now ready to run the installation process. Go to “http://your-IP/limesurvey/admin” and press the “Start Installation” button.

Accept the Terms and Conditions of the license. The next page checks that you are meeting all the requirements to run LimeSurvey on your VPS. If you are missing any of the modules, you can easily install them using the following commands:

> apt-get install php5-imap php5-gd php5-ldap php5-curl pdo-mysql
> /etc/ini.d/apache2 restart
You will be asked for the user and password for the database you just created. LimeSurvey then creates the needed tables in the database.

Get Logged Into the LimeSurvey App

On the last page, you will be asked for your Administrator login information. You can leave the default and change everything later, but it is recommend that you change the password to something secure.

After the installer has finished, LimeSurvey will up and running. Open your browser and enter the following URL:

http://your-IP/limesurvey/admin
You’ll be greeted by the LimeSurvey Admin login screen. The default login credentials (if not changed during in the installation) are

User: admin

Password: password

Enjoy creating surveys for your end users that will help you gain valuable feedback on your products and services.

Tuesday, December 27, 2016

How to install vDDoS Protection - Reverse Proxy Layer 7 Firewall Filter Mitigate DOS, DDOS, SYN Floods, or HTTP Floods attack

What is vDDoS Protection?

vDDoS Protection is free software to provide a Reverse Proxy Server HTTP(S) protocols. It act as a Layer 7 Firewall Filter & Mitigate DOS, DDOS, SYN Floods, or HTTP Floods attack to protect your website.

Features:
-Reverse Proxy
-DDoS Protection
-Robot Mitigator
-HTTP challenge/response
-reCaptcha Robot challenge
-HTTP Denial of Service tools
-Cookie challenge/response
-Block/Allow Country Code You Want (Status 403)
-Limit the request connection coming from a single IP address (Status 503)
-CDN Support (CloudFlare, Incapsula...)
-Whitelist for Botsearch (SEO Support, Allow Botsearch: Google, Alexa, Bing, Yahoo, Yandex, Facebook...)

How it work?

vDDoS Protection is Nginx bundled with module HTTP/2; GeoIP; Limit Req, Testcookie; reCaptcha processor... Working like CloudFlare, but vDDoS is software help you build your own System Firewall.

If your site does not use protection service: (accept all queries)

vDDoS-HTTP-S-DDoS-Protection-Reverse-Pro


If your site uses protection service: (challenge all queries)
-Human queries:

vDDoS-HTTP-S-DDoS-Protection-Reverse-Pro

vDDoS-HTTP-S-DDoS-Protection-Reverse-Pro


-Bad Bots queries:
vDDoS-HTTP-S-DDoS-Protection-Reverse-Pro

vDDoS-HTTP-S-DDoS-Protection-Reverse-Pro



How to install vDDoS?
-vDDoS Protection only support CentOS Server 5/6/7 x86_64 (http://centos.org) & CloudLinux Server 5/6/7 x86_64 (http://cloudlinux.com)

-Please go to Homepage and download vDDoS Protection version working on your system (https://github.com/duy13/vDDoS-Protection)

-vDDoS Protection should be installed before installing other things (cPanel, VestaCP, LAMP, LEMP...)

yum -y install epel-release 
yum -y install curl wget gc gcc gcc-c++ pcre-devel zlib-devel make wget openssl-devel libxml2-devel libxslt-devel gd-devel perl-ExtUtils-Embed GeoIP-devel gperftools gperftools-devel libatomic_ops-devel perl-ExtUtils-Embed gcc automake autoconf apr-util-devel gc gcc gcc-c++ pcre-devel zlib-devel make wget openssl-devel libxml2-devel libxslt-devel gd-devel perl-ExtUtils-Embed GeoIP-devel gperftools gperftools-devel libatomic_ops-devel perl-ExtUtils-Embed 

Example: my system is CentOS 7 x86_64 install vDDoS 1.10.1 Version (only need wget a file vddos-1.10.1-centos7):

curl -L https://github.com/duy13/vDDoS-Protection/raw/master/vddos-1.10.1-centos7 -o /usr/bin/vddos
chmod 700 /usr/bin/vddos
/usr/bin/vddos help

/usr/bin/vddos setup
(This installation takes about 15 minutes or more)

vDDoS Command Line?
   Welcome to vDDoS, a HTTP(S) DDoS Protection Reverse Proxy. Thank you for using!

                Command Line Usage:
        vddos setup             :installing vDDoS service for the first time into /vddos
        vddos start             :start vDDoS service
        vddos stop              :stop vDDoS service
        vddos restart           :restart vDDoS service
        vddos autostart         :auto-start vDDoS services on boot
        vddos attack            :create a DDoS attacks to HTTP target (in 30 min)
        vddos stopattack        :stop "vddos attack" command
        vddos help              :display this help

                                        Please sure download vDDoS source from: vddos.voduy.com

How to use vDDoS protect your website?
Please edit your website.conf file in /vddos/conf.d
Example Edit my website.conf:

# nano /vddos/conf.d/website.conf

# Website       Listen               Backend                  Cache Security SSL-Prikey   SSL-CRTkey
default         http://0.0.0.0:80    http://127.0.0.1:8080    no    200      no           no
your-domain.com http://0.0.0.0:80    http://127.0.0.1:8080    no    200      no           no
default         https://0.0.0.0:443  https://127.0.0.1:8443   no    307      /vddos/ssl/your-domain.com.pri /vddos/ssl/your-domain.com.crt
your-domain.com https://0.0.0.0:443  https://127.0.0.1:8443   no    307      /vddos/ssl/your-domain.com.pri /vddos/ssl/your-domain.com.crt
your-domain.com https://0.0.0.0:4343 https://103.28.249.200:443 yes click    /vddos/ssl/your-domain.com.pri /vddos/ssl/your-domain.com.crt

"your-domain.com" is my site on my Apache backend http://127.0.0.1:8080 want to be Protection by vDDoS
"default" is option for All remaining sites
/vddos/ssl/your-domain.com.pri is SSL Private key my website
/vddos/ssl/your-domain.com.crt is SSL Public key my website
Cache:
variable: no, yes (Sets proxy cache website on vDDoS)
Security:
variable: no, 307, 200, click, 5s, high, captcha (Sets a valid for Security Level Protection)
Note Security Level: no < 307 < 200 < click < 5s < high < captcha
Restart vDDoS after saving:
vddos restart

Set Real IP traffic from Proxy or CDN:
Please edit file cdn-ip.conf
# nano /vddos/conf.d/cdn-ip.conf

# Cloudflare
set_real_ip_from 103.21.244.0/22;
...
Deny Country or IP:
Please edit file blacklist-countrycode.conf
# nano /vddos/conf.d/blacklist-countrycode.conf

geoip_country /usr/share/GeoIP/GeoIP.dat;
map $geoip_country_code $allowed_country {
    default yes;
    US yes;
    CN no;
    
}
deny 1.1.1.1;
Allow your IP Address do not need protection & challenge:
Please edit file whitelist-botsearch.conf
# nano /vddos/conf.d/whitelist-botsearch.conf

#Alexa Bot IP Addresses
204.236.235.245; 75.101.186.145;
...
Use Mode reCaptcha:
Please edit file recaptcha-secretkey.conf & recaptcha-sitekey.conf
# nano /vddos/conf.d/recaptcha-sitekey.conf
# Website        reCaptcha-sitekey (View KEY in https://www.google.com/recaptcha/admin#list)
your-domain.com        6Lcr6QkUAAAAAxxxxxxxxxxxxxxxxxxxxxxxxxxx
your-domain.org        6Lcr6FFFAAAAAxxxxxxxxxxxxxxxxxxxxxxxxxxx
...
# nano /vddos/conf.d/recaptcha-secretkey.conf
DEBUG=False
RE_SECRETS = { 'your-domain.com': '6Lcr6QkUAAAAxxxxxxxxxxxxxxxxxxxxxxxxxxx',
               'your-domain.org': '6LcKngoUAAAAxxxxxxxxxxxxxxxxxxxxxxxxxxx' }

(Go to https://www.google.com/recaptcha/admin#list and get your key for vDDoS)


Recommend?


-Recommend You use vDDoS with CloudFlare Free/Pro (hide your website real IP Address)
(CloudFlare is Mitigate Firewall Layer 3-4)
(vDDoS Protection is Mitigate Firewall Layer 7)
-Download vDDoS Protection packages from vDDoS HomePages
-Use this soft only for testing or demo attack!