update server tuto for ssh
This commit is contained in:
hugogogo
+6
-215
@@ -1,222 +1,13 @@
|
||||
ssh huho@62.210.206.99
|
||||
|
||||
---
|
||||
|
||||
install new os steps :
|
||||
|
||||
- exemple os : proxmox
|
||||
- connect to ecowan
|
||||
- activate IPMI (Intelligent Platform Management Interface) :
|
||||
- fill ip address (ip of internet connexion)
|
||||
- ecowan generates :
|
||||
- the session ip : 51.159.47.149
|
||||
- the username : sd-51086
|
||||
- the password is shown on ecowan panel
|
||||
- you can use it to connect to the IDRAC6 panel with different methods :
|
||||
1. either go to the url `https://51.159.47.149`
|
||||
2. or with this script (which download the java packages and create the console for you) :
|
||||
- the script can be found here : **https://gist.github.com/TheJJ/2394cd76d3e2c34d02e3da1bd3e489b2?ref=blockdev.io**
|
||||
- I added it to this config folder
|
||||
- i also added it to the PATH **~/.local/bin/idracclient.py** so you can call it from anywhere like that : **idracclient.py <ip> -u <username>**
|
||||
3. or use a java console, manually (you need to download all the java packages),
|
||||
- folder architecture :
|
||||
```
|
||||
idrac-folder/
|
||||
├── jre/ ← contains bin/java
|
||||
├── jnlp/ ← optional: keep the original .jnlp here for backup
|
||||
├── avctKVM.jar
|
||||
├── lib/
|
||||
│ ├── libavctKVMIO.so
|
||||
│ └── libavmLinux.so
|
||||
└── start-virtual-console.sh
|
||||
```
|
||||
- jre/ :
|
||||
- download from oracle : https://www.oracle.com/java/technologies/javase/javase7-archive-downloads.html
|
||||
- download `1.7.0_80 or 1.7.0_79` : `jre-7u80-macosx-x64.tar.gz` or `jre-7u79-macosx-x64.tar.gz` (need to create an account)
|
||||
- jnlp/ :
|
||||
- connect to idrac online from ecowan session
|
||||
- download jnlp by clicking `launch virtual console`
|
||||
- avctKVM.jar :
|
||||
- find the file avctKVM to download in the jnlp file by looking for line : `<jar href="https://<idrac-ip>:443/software/avctKVM.jar" />`
|
||||
- download with this curl command to avoid problems with dh : `curl -k --ciphers 'DEFAULT:!DH' "https://51.159.47.149:443/software/avctKVM.jar" -o avctKVM.jar`
|
||||
- lib/ :
|
||||
- find the lines in jnlp file to download :
|
||||
`<nativelib href="https://51.159.47.149:443/software/avctKVMIOLinux64.jar" download="eager"/>`
|
||||
`<nativelib href="https://51.159.47.149:443/software/avctVMLinux64.jar" download="eager"/>`
|
||||
- download them :
|
||||
`curl -k --ciphers 'DEFAULT:!DH' "https://51.159.47.149:443/software/avctKVMIOLinux64.jar" -o avctKVMIOLinux64.jar`
|
||||
`curl -k --ciphers 'DEFAULT:!DH' "https://51.159.47.149:443/software/avctVMLinux64.jar" -o avctVMLinux64.jar`
|
||||
- `mkdir -p lib`
|
||||
- extract from the native library jars
|
||||
`unzip -j avctKVMIOLinux64.jar "*.so" -d lib/`
|
||||
`unzip -j avctVMLinux64.jar "*.so" -d lib/`
|
||||
- start-virtual-console.sh :
|
||||
```
|
||||
#!/bin/bash
|
||||
echo -n 'jre folder: '
|
||||
read dracjrefolder
|
||||
echo -n 'host ip: '
|
||||
read drachost
|
||||
echo -n 'username: '
|
||||
read dracuser
|
||||
echo -n 'password: '
|
||||
read -s dracpwd
|
||||
echo
|
||||
./$dracjrefolder/bin/java -cp avctKVM.jar -Djava.library.path=./lib com.avocent.idrac.kvm.Main ip=$drachost kmport=5900 vport=5900 user=$dracuser passwd=$dracpwd apcp=1 version=2 vmprivilege=true "helpurl=https://$drachost:443/help/contents.html"
|
||||
```
|
||||
- make it executable : `chmod +x start-virtual-console.sh`
|
||||
- then on the console, you don't need to login, just click on attaching a media, map your iso file, and then click on warn reboot, and when prompter press f11 to enter boot menu and choose the virtual cd with the iso file
|
||||
|
||||
---
|
||||
|
||||
proxmox network configuration :
|
||||
|
||||
- hostname (FQDN - Fully Qualified Domain Name) : proxmox.hugulumu.fr
|
||||
- ip address (CIDR) : 62.210.206.99/24
|
||||
- gateway : 62.210.206.1
|
||||
- DNS server : 1.1.1.1 (cloudflare)
|
||||
- url : https://62.210.206.99:8006
|
||||
|
||||
still need to do :
|
||||
|
||||
- Create the A record (e.g. proxmox.hugulumu.fr) :
|
||||
You can point your domain whenever you want — the hostname is just internal until then.
|
||||
- Configure HTTPS (Let’s Encrypt or proxy) :
|
||||
By default, Proxmox uses a self-signed cert. You’ll get browser warnings, but it still works securely.
|
||||
- Set up a firewall or 2FA :
|
||||
Strongly recommended later, especially since it’s a public server — but not required to get started.
|
||||
-> Enable 2FA, Or even set up a reverse proxy with HTTPS (Let’s Encrypt) and restrict access with a VPN or fail2ban
|
||||
|
||||
todo list :
|
||||
|
||||
✅ 1. DNS Configuration
|
||||
|
||||
- [ ] Create an A record:
|
||||
- proxmox.hugulumu.fr → your server’s public IP.
|
||||
- Do it from your domain registrar (where you manage hugulumu.fr).
|
||||
- [ ] Wait for DNS propagation (can take a few minutes to hours).
|
||||
|
||||
🔐 2. HTTPS Access
|
||||
|
||||
- [ ] Set up a valid SSL certificate for your Proxmox web UI:
|
||||
- Option 1: Use Let’s Encrypt via acme.sh or Proxmox built-in ACME support.
|
||||
- Option 2: Use a reverse proxy like Nginx or Caddy (if you plan to expose more services later).
|
||||
|
||||
🛡️ 3. Firewall Setup
|
||||
|
||||
- [ ] Enable firewall on Proxmox (Datacenter → Firewall → Enable).
|
||||
- [ ] Create basic rules:
|
||||
- Allow Web UI (port 8006)
|
||||
- Allow SSH (port 22)
|
||||
- Block everything else by default
|
||||
- [ ] If your hoster (like Online.net / Scaleway / Hetzner?) has a cloud firewall, configure it too.
|
||||
|
||||
🔐 4. Secure Access
|
||||
|
||||
- [ ] Create a new user for yourself, disable root login (or set 2FA for root)
|
||||
- [ ] Enable 2FA (TOTP) for web UI
|
||||
- [ ] Set up SSH key authentication and disable password SSH login (optional but good)
|
||||
|
||||
🧰 5. System Updates
|
||||
|
||||
- [ ] apt update && apt full-upgrade
|
||||
- [ ] Enable automatic security updates:
|
||||
```
|
||||
apt install unattended-upgrades
|
||||
dpkg-reconfigure --priority=low unattended-upgrades
|
||||
```
|
||||
|
||||
🧠 6. Backups and Templates
|
||||
|
||||
- [ ] Set up a storage volume (local or NFS/SSH backup target)
|
||||
- [ ] Download some VM templates (Debian, Ubuntu, etc.)
|
||||
- [ ] Create a snapshot or scheduled backup job
|
||||
|
||||
🚨 Optional (But Nice):
|
||||
|
||||
- [ ] Set up fail2ban or similar tool
|
||||
- [ ] Monitor with cockpit or netdata
|
||||
- [ ] Set up email notifications for Proxmox alerts
|
||||
|
||||
---
|
||||
|
||||
install pbs on a vm on proxmox (Proxmox Backup Server) -> to have incremental backups
|
||||
|
||||
---
|
||||
when i connect to proxmox i get this message : You do not have a valid subscription for this server. Please visit www.proxmox.com to get a list of available options.
|
||||
ChatGPT said:
|
||||
|
||||
Yep, that message is normal if you're using the free version of Proxmox without a paid subscription.
|
||||
💡 What it means
|
||||
|
||||
Proxmox VE (Virtual Environment) is open source and free to use.
|
||||
|
||||
But they offer enterprise support via paid subscriptions.
|
||||
|
||||
That message is just a reminder—it doesn’t block any functionality (except access to the enterprise repo).
|
||||
|
||||
✅ Your Options
|
||||
1. Ignore It
|
||||
|
||||
Totally safe to ignore.
|
||||
|
||||
It just appears after login on the web UI.
|
||||
|
||||
2. Disable the Message (UI Only)
|
||||
|
||||
You can remove the popup by editing a file on your Proxmox host:
|
||||
|
||||
nano /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js
|
||||
|
||||
Search for:
|
||||
|
||||
if (data.status !== 'Active') {
|
||||
|
||||
And change it to:
|
||||
|
||||
if (false) {
|
||||
|
||||
Then save (Ctrl+O, Enter, Ctrl+X) and clear your browser cache or reboot the UI:
|
||||
|
||||
systemctl restart pveproxy
|
||||
|
||||
⚠️ Note: This gets overwritten when you update Proxmox, so it’s a temporary cosmetic fix.
|
||||
3. Switch to the Free Repo
|
||||
|
||||
Make sure you're using the no-subscription repository for updates:
|
||||
|
||||
Edit this file:
|
||||
|
||||
nano /etc/apt/sources.list.d/pve-enterprise.list
|
||||
|
||||
Comment out the enterprise repo:
|
||||
|
||||
# deb https://enterprise.proxmox.com/debian/pve bookworm pve-enterprise
|
||||
|
||||
Then add the no-subscription repo:
|
||||
|
||||
echo "deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription" > /etc/apt/sources.list.d/pve-no-subscription.list
|
||||
|
||||
And update:
|
||||
|
||||
apt update && apt full-upgrade
|
||||
|
||||
Let me know if you want help setting that up or if you're considering a subscription.
|
||||
|
||||
-------------------------------------------------------------------------------------
|
||||
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
||||
END PROXMOX
|
||||
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
||||
-------------------------------------------------------------------------------------
|
||||
|
||||
ipv6 : fe80::d6ae:52ff:fec9:29d6
|
||||
netmask : 64
|
||||
gateway : fe80::226:bff:feef:59ff
|
||||
|
||||
# server :
|
||||
------------------------------------------------------------------------------------
|
||||
|
||||
## connect with ssh :
|
||||
- create ssh key
|
||||
- `ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_<name_of_file> -C <name_in_pub_key>`
|
||||
- ex: `ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_contabo_yunohost_huho -C 42_contabo_yunohost_huho`
|
||||
- then i know :
|
||||
- that this key is for yunohost server at contabo, for user huho
|
||||
- and when i look at the public key on server, i see it's used from 42
|
||||
- **ssh <username>@<server_ip>**
|
||||
- if first time after reinstalling on same ip, you need to remove local old keys :
|
||||
- **ssh-keygen -f "/path/to/.ssh/known_hosts" -R <ip>**
|
||||
|
||||
Reference in New Issue
Block a user