SELinux,Fail2ban,Security Configurations - Revision history

Admin: /* SELF-SIGNED SSL */

2024-01-29T21:46:20Z

SELF-SIGNED SSL

2024-01-29T21:44:29Z

SELF-SIGNED SSL

2023-09-03T21:29:33Z

Install Letsencrypt

2022-02-10T21:01:45Z

Install Letsencrypt

2021-02-06T23:02:32Z

Install Letsencrypt

2021-02-06T21:49:01Z

FAIL2BAN

2021-01-31T17:44:10Z

2021-01-31T17:43:27Z

Install Letsencrypt

2021-01-31T08:09:26Z

Install firewalld

2021-01-30T14:17:14Z

FAIL2BAN

@@ Line 90: / Line 90: @@
 </syntaxhighlight>
 <syntaxhighlight lang="shell">
-openssl req -newkey rsa:4096 -nodes -keyout /etc/ssl/certs/nginx-selfsigned.key -x509 -days 365 -out /etc/ssl/certs/nginx-selfsigned.crt -subj "/C=GH/ST=Greater Accra/L=Accra/O=Rhomicom Demo/OU=IT/CN=*.rhomicom.com/emailAddress=admin@rhomicom.com"
+openssl req -newkey rsa:4096 -nodes -keyout /etc/ssl/private/nginx-selfsigned.key -x509 -days 365 -out /etc/ssl/certs/nginx-selfsigned.crt -subj "/C=GH/ST=Greater Accra/L=Accra/O=Rhomicom Demo/OU=IT/CN=*.rhomicom.com/emailAddress=admin@rhomicom.com"
 </syntaxhighlight>

@@ Line 88: / Line 88: @@
 openssl req -newkey rsa:4096 -nodes -keyout /etc/pki/nginx/private/server.key -x509 -days 365 -out /etc/pki/nginx/server.crt -subj "/C=GH/ST=Greater Accra/L=Accra/O=Rhomicom Demo/OU=IT/CN=*.rhomicom.com/emailAddress=admin@rhomicom.com"
-</syntaxhighlight><span> </span>
+</syntaxhighlight>
    openssl dhparam -out /etc/pki/nginx/dhparam.pem 4096
    nano /etc/nginx/nginx.conf #(# Add DH parameters

@@ Line 67: / Line 67: @@
    OR certbot --apache
    certbot --apache -d wiki.rhomicom.com
-   certbot --nginx-d wiki.rhomicom.com
+   certbot --nginx -d wiki.rhomicom.com
    certbot renew

@@ Line 73: / Line 73: @@
    certbot certonly --apache
    certbot certonly --nginx
    echo "0 0,12 * * * root python3 -c 'import random; import time; time.sleep(random.random() * 3600)' && certbot renew -q" | sudo tee -a /etc/crontab > /dev/null
 ==SELF-SIGNED SSL==

@@ Line 67: / Line 67: @@
    OR certbot --apache
    certbot --apache -d wiki.rhomicom.com
    certbot renew

@@ Line 30: / Line 30: @@
    sudo yum -y install epel-release
    sudo yum -y install fail2ban
-   sudo systemctl enable fail2ban
+   sudo systemctl enable fail2ban && sudo systemctl start fail2ban
    [DEFAULT]
    # Ban hosts for one hour:
@@ Line 40: / Line 41: @@
    # Override /etc/fail2ban/jail.d/00-firewalld.conf:
    banaction = iptables-multiport
-   ignoreip = 127.0.0.1/8 154.160.2.127/8
+   ignoreip = 127.0.0.1/8 154.160.2.127/16
    [sshd]
@@ Line 55: / Line 56: @@
    sudo fail2ban-client status wordpress3
    sudo fail2ban-client status http-get-post-dos
 == Install Letsencrypt ==
    dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm

@@ Line 15: / Line 15: @@
    Follow this link for [[Additional Firewall-Cmd Commands]]
 == SELinux Permissions ==
    setsebool -P httpd_can_network_connect 1
@@ Line 56: / Line 55: @@
    sudo fail2ban-client status wordpress3
    sudo fail2ban-client status http-get-post-dos
 == Install Letsencrypt ==
    dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
@@ Line 74: / Line 72: @@
    echo "0 0,12 * * * root python3 -c 'import random; import time; time.sleep(random.random() * 3600)' && certbot renew -q" | sudo tee -a /etc/crontab > /dev/null

@@ Line 13: / Line 13: @@
    nano /etc/firewalld/firewalld.conf
    <nowiki>#</nowiki> AllowZoneDrifting=no
 == SELinux Permissions ==
    setsebool -P httpd_can_network_connect 1