ZFS is in Proxmox GUI is meh. You can't add more content other than Disk Images and Containers? What about my ISO? This guide will show how to add all content via everyone's best friend, the Terminal.

Prerequisites

1. At least 2 or more disk
2. Wipe the disk (Either in fdisk or Proxmox)

Wiping the disk

via Proxmox GUI

Go to the Proxmox webpage and wipe the disk. The option is under your node -> Disks. I will be setting up Mirror raid level for "/dev/sdc" and "/dev/sdd".

via dd

If the command line is your way, you can run the command below. Make sure to replace the device id with yours.

# dd if=/dev/zero of=/dev/sdc bs=512 count=1

Create ZPOOL

"zpool create" command will create a new ZFS pool to create more ZFS dataset.

example: zpool create tank raidz sda sdb sdc sdd sde sdf

command i run:
# zpool create local-zfs mirror sdc sdd

Mountpoint

By default, after you create your zpool, it will be mounted in the "/" directory.

Mounting to Proxmox

Go to the Proxmox web UI and add a new Directory.

Now I test the new Directory by uploading a new ISO.

Checking ZFS Health Status

Proxmox UI will automatically detects the ZFS and insert it in the ZFS page.

Pimox is a port of Proxmox Virtual Environment, an open-source software server for virtualization management, to the Raspberry Pi allowing you to build a Proxmox cluster of Raspberry Pi's or even a hybrid cluster of Pis and x86/x86_64 hardware.

GitHub - pimox/pimox7: Proxmox V7 for Raspberry Pi

Proxmox V7 for Raspberry Pi. Contribute to pimox/pimox7 development by creating an account on GitHub.

GitHubpimox

In this guide:

1. Flashing Raspberry Pi OS 64bit
2. Configure Pi
3. Setting Up Pimox
4. Running a LXC/LXD Container from Pimox

What you need:

1. Raspberry Pi 4
2. Raspberry Pi OS 64bit
3. Ethernet (RJ45) Cable
4. Static IP for Raspberry Pi
5. Monitor and Keyboard (Initial Setup to enable SSH)

Flashing Raspberry Pi OS 64bit

You can download the image from the Raspberry Pi download page and flash it to your SD card. Alternatively, you can use the Raspberry Pi Imager and flash the 64-bit Lite version.

Configure Pi

For first run, you need to attach a physical monitor and keyboard to configure your Pi. To make your Raspberry Pi running headless, you need to enable SSH during set up.

The default login for pi is shown below:

username: pi
password: raspberry

After you login, type sudo raspi-config to start the configuration tool and change your Pi password. To enable SSH, go to 3 Interface Options and 2 SSH from the menu.

Setting Up Pimox

From this point, you can either run them physically or remotely via SSH. For my own convenient, I will be running over SSH.

Installing Pimox

You can use the command below to run the interactive installer for Pimox.

sudo su

apt update && apt upgrade -y

curl https://raw.githubusercontent.com/pimox/pimox7/master/RPiOS64-IA-Install.sh > RPiOS64-IA-Install.sh

chmod +x RPiOS64-IA-Install.sh

./RPiOS64-IA-Install.sh

Follow the prompt. Once the installation started, it will take around 10-20 mins. Time to grab a coffee!

Access Pimox Web Interface

The default URL is https://[pimox ip]:8006. Enter root as your username and the root password to login.

The web interface is similar to the Proxmox VE. You will need to upload your .iso to the storage to install your VM. As of 13 march 2022, only aarch64/arm64 is confirmed to be working for VM and LXC/LXD containers.

Running a Container from Pimox

For LXC/LXD  container, you need to upload your own container to the Pimox or use the "download from URL" feature in Pimox. Currently, the download template will download x86_64 containers and x86_64 will not work in Pimox.

Manually Upload a Container Image

You can access the list of LXD container images at https://us.lxd.images.canonical.com/images/or https://jenkins.linuxcontainers.org/view/Images/.

I will download Ubuntu 20.04 LTS arm64 lxd image from https://us.lxd.images.canonical.com/images/ubuntu/focal/arm64/cloud/. The image file to download is named root.tar.xz. Once you download to your PC, rename the file to a better name, such as ubuntu-20.04.tar.xz.

Once you rename the file, click the "Upload" button and select the file.

Alternatively, you can use the "download from URL" feature. However, you are unable to change the file name unless you go to the terminal and change the file as root in the /var/lib/vz/template/cache folder.

Setting up the container

Setup the container by clicking the "Create CT" blue button at the top right of the page. Run the Create Tool as you normally would in any Promox VE. It will take around 40sec to 2mins to create a container, after all, this is a Raspberry Pi.

Start the container

Start the container and go to the console tab.

For Virtual Machine, you need to upload the arm64 image ISO and create the VM.

In this post:

• Introduction
• Setting Up The Lab Network
• Creating a Domain Controller
• Configuring the DNS Server
• Configuring the DHCP Server

Introduction

I have installed a Windows Server 2019 in a VM in the previous post. Currently, the VM is the only machine that is alive in the new network. That's very lonely.

Create A Windows Server 2019 VM In Proxmox + New Virtual Network

This post will guide you on creating an isolated separate network in Proxmox and installing Windows Server 2019 VM attached to a new virtual network. Create a new networkCreate a new network in Proxmox by going to the Node -> Network -> Create Linux Bridge. I am still

fscene8aki

By the end of this post, the VM will become a Domain Controller for the lab network. It will also be running DNS and DHCP servers for the network. It will be accompanied by a virtual router and a Windows 10 VM to test to make sure the DC, DNS and DHCP are working.

In order to create a Domain in the lab network, at least one Domain Controller must exist. A Domain Controller requires at least one Active Directory Domain Service running in the network. And the Active Directory Domain Service requires DNS and DHCP Service in the network. They can be at the same server or separate servers.

I isolated the lab network from my home network to prevent countless headaches, frustration, and disruptions to my main home network. The lab network will use the DNS server and DHCP server in the Windows Server 2019.  

To connect between those two networks in life, a router is needed. That is because a router is used to bridge and connect two separate networks.

I used a Linux VM that is running pfSense, an open-source router solution. This allows me to connect to my lab network from the outside network, only if the pfSense router firewall rules allow it.

This allows the possibility to expose a service from my lab network to my home network or public with port forwarding at the pfSense router and configuring a reverse proxy at Ngnix Proxy Manager on my home network.

You can skip the next section if you do not need the lab network to communicate externally. Your lab network will only be the Domain Controller and the windows client. The next step is to make the lab network to be able to connect to the outside network with port forwarding and firewall rules if they are set.

I installed pfSense Community Edition as the router and set up 2 network interfaces in Proxmox, one for WAN and one for LAN. Both of them are configured to run a separate network. The .iso can be downloaded from here.

Finally, I turned off the DHCP at the pfSense to make way for the Windows Server DHCP.

For VMware ESXi or Workstation, you need to turn off DHCP at the Virtual Network Editor and pfSense router. For the pfSense hardware, you need to have both interfaces, Host-Only and Bridging or NAT, attached.

Firewall Rules for pfSense

I created a firewall rule to enable devices from the WAN network to access the router only. This enables me to access the router's web portal from my home network and any ports that the router port forwarded.

I checked from my home network to confirm that I am able to ping to the interface exposed to the WAN. But not the LAN. This is the correct setting.

In Proxmox, I have configured the Windows Server 2019 VM network interface to use the same network as the pfSense router. A fresh windows server installation comes with no settings or services configured by default.

The first thing to do after a fresh Windows Server 2019 installation is to set a static IP address and change the hostname. Once I have set them, I reboot the server.

Once the server rebooted, I check that the server is able to ping to the pfSense router and nothing from the WAN network. Connecting to my home devices (WAN Network) is not allowed because of the pfSense router port forwarding and firewall rules.

Configuring Windows Server 2019

The lab network is now ready. Let's continue with the domain controller setup. Open up the Server Manager to continue setting up the Windows Server 2019.

Installation Type

Server Selection

Make sure the server name and IP address are correct.

Adding the Server Roles

On the Server Roles page, select the roles, add any prerequisite features and included management tools that come with it.

Roles to be checked:

• Active Directory Domain Services
• DHCP Server
• DNS Server

Once all 3 selected, click the Next button.

Features

The features were added automatically based on the roles selected on the previous page. Skip this page and click the Next button.

AD DS, DHCP Server and DNS Server

The next 3 pages are to educate us on those services. Skip those pages by clicking the Next button.

Confirmation

At the confirmation page, check the "Restart the destination server automatically if required" selection and click the "Install" button.

Result

Once it is successfully installed, click on the "Promote this server to a domain controller".

Promoting server to a domain controller

After selecting the "Promote this server to a domain controller", select the "Add a new forest" and enter the Root domain name. For my lab, I type in lab.local.

As this is the only active directory server in the lab network, leave these setting values as default.

The domain name lab.local will only exist internally in the lab network. There is no need to enable DNS delegation.

Additional Options and Paths

Accept the default values and click the "Next" button.

Prerequisites Check

The first warning is telling us that the Server will not be able to communicate with Windows NT 4.0. And the second warning tells us that it can not find the parent zone for lab.local.

These warnings are totally ok to ignore because this server going to be the only domain controller and the lab.local will only exist internally in the lab network.

The server will restart automatically after the "Install" button is clicked.

Once the server reboots, notice the LAB domain at the front of the username. Log in to the account. This means that we are logging in with a domain user account.

Double-check and confirm the domain by running the set command in the CMD.

Setting up Reverse Lookup Zone

The first thing I like to do is to insert a new reverse lookup entry for the server at the DNS. As of now, only the forward lookup is being entered by default.

Forward Lookup Zone will resolve domain name (serverdc1.lab.local to IP address 10.18.157.5), while Reverse Lookup Zone is the other way around.

Checking the Forward Lookup Zone

Search DNS Manager from the Start Menu and open it. Check the lab.local zone inside the Forward Lookup Zone. I confirmed the record by running nslookup domainname in the CMD.

Adding a new Reverse Lookup Entry

A new zone has to be created first to create a new entry. Add a new zone by selecting Action -> New Zone.

Zone Type

Select Primary Zone and check the "Store the zone in Active Directory". Click "Next".

Active Directory Zone Replication Scope

For the replication scope, select the second option "To all DNS servers running on domain controllers in this domain: lab.local".

If I were to set up a second DC for the lab.local domain, the DNS record will be replicated at the second DC but not to the subdomains. Click "Next".

Reverse Lookup Zone Name

Select "IPv4 Reverse Lookup Zone" and click "Next".

Enter the IP Network Address that you are using and click "Next".

Dynamic Update

Select the first option. Click "Next" and "Finish".

Create a new PTR record for Reverse Lookup DNS

The reason I like to have both forward and reverse lookup zone for the DC server is that some applications or services, that I going to install later on, might need these records.

Right-click the new zone and select "New Pointer (PTR)".

Insert the Host IP address and the Host name and click "Ok". Do a nslookup 10.18.157.5 in a CMD. This will resolves the same as nslookup serverdc1.lab.local.

DNS Forwarders

Right now, the DNS is unable to resolve any records that are not in the DNS Forwarded Lookup Zone. If you don't want the devices to resolves any external records, you can skip this step and proceed to configure the DHCP server.

By having a DNS Forwarder, it will forward any request that it is unable to resolve to the pfSense router. The pfSense router will then forward it to the pi.hole DNS server at WAN network.

To set DNS forwarders, right-click the SERVERDC1 and click on Properties.

Go to the 2nd tab labelled Forwarders. Click on the "Edit" button and enter the IP Address of the forwarder. You can do a simple DNS test at the "Monitoring" tab.

I will add the DHCP scope first before enabling the DHCP on the server.

Adding a New Scope

Search for DHCP in the Start Menu and open it. Right-clock the IPv4 and select New Scope.

Scope Name

Insert the scope name and description to identify the DHCP scope.

IP Address Range

Insert the start IP address, end IP address and the subnet mask values.

Add Exclusion and Delay

I want to reserve the first 10 IP addresses for my upcoming servers and services. This is where you should set yours too.

Lease Duration

The lease duration is the amount of time before they check with the DHCP server if they can continue using the same IP address. If the clients did not made any request when the lease expires, the DHCP server will release that IP to other clients.

Configure DHCP Options

DHCP options are settings that the DHCP server gives out to the client devices. Click "Next" to configure the DHCP default gateway and DNS IP address.

Router (Default Gateway)

I set my pfSense IP address as the default gateway IP address.

Domain Name and DNS Server

For this page, it will auto set for me. Unless you want to use another DNS server or set up a subdomain of an active directory of an FQDN, you should not change any values here

WINS Server

WINS is not being used that much these days. WINS is the predecessor to DNS and this is for legacy support. It was used to resolve NetBIOS computer names to IP addresses. Leave this blank.

Activate Scope

Activate the scope now.

Enable the DHCP Server

Go to Server Manager and click on the notification flag to open the notification. Click on the "Complete DHCP configuration" to enable the DHCP server.

Click "Next" and click "Commit" on this screen.

Activate DHCP relay on pfSense Router

You may skip this step if you do not wish to enable the DHCP relay at your router.

I will enable the DHCP Relay for my LAN interface at the router. The DHCP relay will send the DHCP packets from the lab network to my DHCP server.

Check if the DHCP is working

I have a VM running Windows 10 on the lab network. By running ipconfig /all on that machine, I can confirm my DHCP server is running.

From the server, we can check the connected client by going into the DHCP Manager.

Success! I have created an isolated Virtual Network, with pfSense router, Windows Server 2019. The Windows Server is now a Domain Controller with DNS and DHCP server up and running.

This guide can also work with VMware Workstation or other virtualization software. You will only need to prepare and configure the virtual network first, depending on your design.

For my next post, I might be creating a new user account, computer account and organization unit. Who knows....

This post will guide you on creating an isolated separate network in Proxmox and installing Windows Server 2019 VM attached to a new virtual network.

Create a new network

Create a new network in Proxmox by going to the Node -> Network -> Create Linux Bridge.

For VMware ESXi or Workstation, the settings should be "Host-Only". However, this post is about Proxmox.

I am still learning on VLAN with virtualization but I can't seem to make it work yet. All I know is that I need a virtual Layer 3 switch but I'm not a networking guy and this article is kinda hard to understand.

However, a Linux bridge is a layer 2 virtual device that on its own cannot receive or transmit anything unless I bind one or more real devices to it. So I treat it as a virtual L2 switch with an RJ45 cable and everything became easy to understand.

Installing Windows Server 2019 VM

VM Settings

These are the setting I used for the Windows Server 2019 VM.

You will need to provide the drivers during installation. Go to the VirtIO Github page to download the iso driver for windows and attach another CD-Drive with the iso.

Boot up the VM. Select option 2 "Custom: Install Windows Only (advanced)" on this screen.

Missing storage drivers

Windows will not be able to detect your Virtual Disk. Select the "Load driver" option to install the driver.

Choose the correct version. Look at the path directory with 2k19.

Once the driver finishes installing, it will bring you back to the drive selection page. Select Drive 0 and click Next.

The Windows Setup will continue installing the Windows Server 2019.

CTRL + ALT + DELETE

To send Ctrl + Alt + Delete, you need to use the noVNC side panel at the left.

Installing VirtIO network, serial and ballooning drivers

Navigate to the Device Manager and install the missing drivers.

For the 3 missing drivers, browse D:\ and windows will install those drivers.

The VM will restart itself once you finish installing all 3 drivers. You may now remove the 2 ISO from the CD drives.

Now you can start tinkering with the VM. Do your backup/restore point so you won't have to go through the installation again.

You can check out my next post on promoting this server to a domain controller.

Create A Domain Controller with Windows Server 2019 VM In A Homelab VLAN

In this post: IntroductionSetting Up The Lab NetworkCreating a Domain ControllerConfiguring the DNS ServerConfiguring the DHCP ServerIntroductionI have installed a Windows Server 2019 in a VM in the previous post. Currently, the VM is the only machine that is alive in the new VLAN. That’s very lonel…

fscene8aki

Have fun!

The Nginx Proxy Manager generate logs of every connection made. With this data, GregYankovoy created a docker image that provides a real-time data dashboard. It can be run easily alongside the Nginx Proxy Manager.

GitHub - GregYankovoy/docker-goaccess: goaccess reverse proxied through nginx for ease of use

goaccess reverse proxied through nginx for ease of use - GitHub - GregYankovoy/docker-goaccess: goaccess reverse proxied through nginx for ease of use

GitHubGregYankovoy

If you have not set up Nginx Proxy Manager, check out my guide at the link below.

Nginx Proxy Manager, A Reverse Proxy Management System

Guide on setting up Nginx Proxy Manager

fscene8aki

How to install GoAccess?

Run the command below at your Nginx Proxy Manager server terminal.

docker run --name goaccess -p 7889:7889 -v ~/nginx-proxy-manager/data/logs:/opt/log -v ~/goaccess:/config -d gregyankovoy/goaccess

What does each of these means?

• docker run --name goaccess to run a docker container and set the name as goaccess
• -p 7889:7889 is to host the docker image at the 7889 port
• -v ~/nginx-proxy-manager/data/logs:/opt/log, to bind the Nginx logs to the docker container log at /opt/log
• -v ~/goaccess:/config, to bind the image config directory to the goaccess directory at your home directory
• -d gregyankovoy/goaccess, to run the container in the background and print container ID

You can check if the docker container is running by running docker ps command.

Add the log file to GoAccess

Now, the config file will be created at ~/goaccess/config/. Let's configure the config file.

mv goaccess.conf goaccess.conf.backup

nano goaccess.conf

For Nginx Proxy Manager, add the following lines to the goaccess.conf file.

time-format %H:%M:%S
date-format %d/%b/%Y
log_format [%d:%t %^] - %s %^ - %m %^ %v "%U" [Client %h] [Length %b] [Gzip %^] [Sent-to %^] "%u" "%R"
real-time-html true
log-file /opt/log/proxy-host-1_access.log
log-file /opt/log/proxy-host-2_access.log
log-file /opt/log/proxy-host-3_access.log

Save the file and restart your goaccess docker image.

docker restart goaccess

Navigate to your GoAccess page. Replace 127.0.0.1 with your IP address.

http://127.0.0.1:7889

In this post,

• What is a reverse proxy and why use it?
• What is Nginx Proxy Manager?
• Installing the Nginx Proxy Manager
• How to set up a reverse proxy?

What is a reverse proxy and why use it?

The purpose of a Reverse Proxy Server is to redirect web traffic to the requested server hosting behind it. This allows multiple web applications to be hosted and exposed to the public by using just one public IP address and one port, mainly 443.

However, this can only be done with a Domain Name. It must be configured in the Nginx Virtual Host configuration file with the server IP address and port. The client will never know the real IP address and port number of the server.

Lastly, the SSL/TLS certificate can be easily managed and renewed at a reverse proxy for all the hosted domain names. The SSL can be configured to be terminated at the reverse proxy and forward the unencrypted data to the server. This allows better performance for the backend servers where decryption is not needed on their end.

For local web applications that require a port number to access the web portal, Nginx Proxy Manager also allows you to connect to the local web application without the port number.

This can be done by setting a local DNS entry myapp.home at the DNS server to point to the reverse proxy IP address. The reverse proxy server will forward that traffic to the myApp server at 192.168.1.100:8006.

server {        
    listen 80;
    server_name myapp.home;
    ...
    ...
    location / {            
        proxy_pass http://192.168.1.100:8006;
    }
}

What is Nginx Proxy Manager?

It is a web-based GUI tool that is based on Nginx, a web server, to host the Web UI and perform as a reverse proxy server. It comes with a clean and nice UI that is easy to navigate around.

It comes as a pre-built docker image that enables you to easily forward to your websites running at home or otherwise, including SSL management, without having to know too much about Nginx or Letsencrypt.

This helps you to spend lesser time configuring the reverse proxy configuration file and shift your focus more on the web application that you want to deploy.

Installing the Nginx Proxy Manager

Install Docker

The quickest way to install is to use a docker image. Install docker and docker-compose first.

apt install docker docker-compose

Install Nginx Proxy Manager

Make a new directory for the docker container at your home directory and enter the directory.

mkdir ~/nginx-proxy-manager

cd ~/nginx-proxy-manager

Create a new docker-compose.yml file.

nano docker-compose.yml

Add the following lines into the docker-compose.yml file.

version: '3'
services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

Run the docker image.

docker-compose up -d

Once the download is completed and the image is running, log in to the webpage at http://127.0.0.1:81. If you are logging in for another computer, replace 127.0.0.1 with the IP address of the Nginx Proxy Manager server.

Emailadd: admin@example.com
Password: changeme

Change your account details once you successfully log in. Make sure to change your password to a secure password.

How to set up a reverse proxy?

In the example below, I have set up a webserver on 192.168.1.192 at port 80 and called it myapp.

Navigate to the proxy host page, add a new proxy host with the server IP and port number of that web application.

I will set a domain myapp.home, with the IP address and the port number of the myapp is hosted. For the Access List, the client IP must belong to Home Network to gain access to it.

Setting up local DNS A name record for myapp.home

My local Pi.Hole DNS server will be pointing myapp.home to this Nginx Proxy Manager IP address. In addition, I also have a Plex Media Server, that is pointing to the same Proxy IP, where the client will never know what is the real IP address of both places.

Hosting web application to the public

You need a domain name for this.

For this example, I will be using demo.fscene8.xyz. At my DNS provider, I have set the DNS record to point to my Nginx Proxy Manager Public IP address. I will also grab an SSL cert and change from plain HTTP to HTTPS.

Let's Encrypt

Change to the SSL tab, select Request a new SSL certificate and turn on Force SSL. Enter your email address and agree to the Terms of Service. Click Save.

I have just created an SSL cert for demo.fscene8.xyz and encrypts the traffics between the client and the proxy server. The SSL termination will be done at my proxy server and forwards the unencrypted traffic back to 192.168.1.192:80.

Let's check out the new site

Navigate to the site and check the cert.

This post will guide you on how to install Nextcloud with Collabora and the High-Performance backend for pushing Nextcloud notifications on Debian 11 server natively. No Docker, AppImages or Snap!

A Free Alternative to Cloud Storage Solution, Nextcloud

Cloud storage is becoming increasingly popular. They offer an easy way to share documents and photos with other people, which is very similar to services like Dropbox, or OneDrive. Let’s take a more detailed look at the free software. What is Nextcloud?It is open-source cloud storage. It allows

fscene8aki

In this post:

• Prerequisites
• Part 1: Installing Nextcloud 23
• Part 2: Installing Collabora Online Office Suite
• Part 3: Installing High-Performance Backend

Prerequisites

You will need a running Debian 11 installed. You may install it locally or get one from any hosting providers, such as DigitalOcean and Linode.

You will also need a domain name for your Nextcloud server. It can be the current domain name you own now as we will be using subdomains in this guide.

Please set two new A record DNS for Nextcloud and Collabora each now. We will let the DNS update while we set up our server.

I will be using fscene8.xyz as my domain name and DigitalOcean as my hosting provider.

• Nextcloud server -> nextcloud.fscene8.xyz
• Collabora server -> collabora-office.fscene8.xyz

All the commands are being executed as the root account. Log in as root either from the start or su. You can also type sudo at the start of each command as a normal user.

Part 1: Installing Nextcloud 23

Part 1.1: Set a hostname

Please set a hostname for your Debian server, if necessary.

hostnamectl set-hostname nextcloud

Make sure to add a new entry in your /etc/hosts.

127.0.0.1	nextcloud

To see the changes take effect, relog to your server.

Part 1.2: Update your system

Make sure that your server is up-to-date.

apt update && apt upgrade -y

Part 1.3: Installing prerequisite packages for Nextcloud

The prerequisite packages for Nexcloud basic installation are:

• Apache Web Server
• PHP
• MariaDB Database
• Redis Caching Memory Server
• SSL certbot

Install all of them.

apt install apache2 mariadb-server php-common libapache2-mod-php php-gd php-mysql php-curl php-mbstring php-intl php-gmp php-bcmath imagemagick php-imagick ffmpeg php-xml php-zip php-bz2 php-redis redis-server python3-certbot-apache

Part 1.3: Configure the Redis memory caching server:

Configure the Redis Memory caching server.

nano /etc/redis/redis.conf

For nano, use ctrl + w to search for text.

By default, Redis uses the networking port. Since we are only dealing with localhost and not going out, we going to use unixsocket for Redis. This is a more secure way for this guide setup. Once configured, any program can go through Redis without going thru the networking at all.

• Uncomment the line unixsocket /var/run/redis/redis-server.sock.
  This file will be used for its socket.
• Uncomment the line below unixsocketperm 700.
• Change the line from unixsocketperm 700 to unixsocketperm 770.
  Only the Redis Group Users can access the file.
• Search for port 6379.
• Change the line from port 6379 to port 0.
  The line is located at the bottom of the file.
  This will disable the TCP port since we are using unixsocket.
• Save the file with ctrl+x and then press y.

Part 1.4: Add Apache user to Redis group

usermod -aG redis www-data

Part 1.5: Setup Apache virtual host file

Create a new Apache virtual host configuration file nextcloud.conf with nano.

nano /etc/apache2/sites-available/nextcloud.conf

Add the following line below and set theServerName to your domain name. Make sure  DocumentRoot is pointing to /var/www/nextcloud.

<VirtualHost *:80>
        ServerName nextcloud.fscene8.xyz        
        DocumentRoot /var/www/nextcloud

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Save the config file and enable the nextcloud virtual site.

a2ensite nextcloud

Before reloading the Apache, enable the rewrite and headers apache modules. The rewrite is needed for the URL scheme for Nextcloud and headers is needed for the HTTPS and SSL. We will configure both of them later.

a2enmod rewrite headers

Restart both Redis and Apache.

systemctl restart redis apache2

Part 1.6: Setting up Nextcloud directory

Go to the Nextcloud download page and click on the "Details and download option". Right-click and copy the link for the .tar.bz2 file.
Paste the link after the wgetcommand.

wget https://download.nextcloud.com/server/releases/nextcloud-23.0.0.tar.bz2

Extracts the file into the /var/www/ directory.

tar -xvf ./nextcloud-23.0.0.tar.bz2 -C /var/www/

Change the ownership of extracted folder directory to Apache.

chown -R www-data: /var/www/nextcloud

Create a new directory for your Nextcloud user data. This is where the files for the cloud will be stored. It can be your external or network-attached storage device.

mkdir /nextcloud-data

Change the owner of the /nextcloud-data.

chown www-data: /nextcloud-data

You can remove now the downloaded .tar.bz2. (Optional)

rm nextcloud-23.0.0.tar.bz2

Part 1.6a: For external or network-attached storage devices

Mount your storage with permission 0770 for the file and directory.

//ipaddress/share /nextcloud-data cifs gid=33,uid=33,credentials=/root/.nextcloudshare,iocharset=utf8,comment=systemd.automount,file_mode=0770,dir_mode=0770      0       1

For LXC unprivileged containers, you need to mount from the Proxmox web UI. The LXC needs to be a privileged container to mount devices directly. If you are still unable to mount your NAS, discard LXC and install a VM.

Now, you can visit your cloud domain and the Nextcloud page will be loaded if the DNS is updated. We have not yet configured SSL/TLS and MariaDB. This page will not work till the remaining two are installed.

Part 1.7: Enable HTTPS for Nextcloud

We going to use certbot to help us get your SSL/TLS cert. Enter the details required by the certbot. Choose the redirect option.

certbot --apache

Choose the 2: Redirect on this screen.

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2

Visit your Nextcloud webpage and it will redirect you to the HTTPS version. You can check the cert and its expiry date.

Part 1.8: Installing the database

We will need to create a new database and user for Nextcloud. If you have not run mysql_secure_installation before, you need to set up a password for the MariaDB root user. Please read carefully at each prompt.

mysql_secure_installation

In order to log into MariaDB to secure it, we'll need the current
password for the root user.  If you've just installed MariaDB, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.

Enter current password for root (enter for none):

Setting the root password ensures that nobody can log into the MariaDB
root user without the proper authorisation.

Set root password? [Y/n] Y

For the rest of the installation, accept the default answer provided.

Part 1.9: Creating a database and user for Nextcloud

Enter the database.

mariadb

Create a new database.

CREATE DATABASE nextcloud;

Create a new user for Nextcloud. Replace the P@ssw0rd with a super-secure password.

CREATE USER 'nextcloud'@'localhost' IDENTIFIED BY 'P@ssw0rd';

Grant the user all privileges for the Nextcloud database.

GRANT ALL PRIVILEGES ON nextcloud . * TO 'nextcloud'@'localhost';

Exit the MariaDB console.

quit

Part 1.10: Nextcloud GUI Wizard

Visit your webpage and fill in the details. Make sure to uncheck the "Install recommended apps" checkbox. This will interfere with the installation of Collabora.

You will be logged in to the Nextcloud dashboard.

Part 1.11: Set recommended PHP and Apache settings for Nextcloud

Since you installed Nextcloud manually, it is currently using the default PHP option.

When you visit the Settings -> Overview page, you will be greeted with multiple warnings. We are going to fix this now.

Open the PHP configuration file.

nano /etc/php/7.4/apache2/php.ini

• Search for memory_limit = 128M and change the value from 128M to 512M.
• Search for output_buffering = 4096 and change the value from 4096 to Off. 'Off' with the capital letter 'O'.
• Save the file.

Open the Nextcloud Apache configuration file.

nano /etc/apache2/sites-enabled/nextcloud-le-ssl.conf

Add the following line below inside the <VirtualHost *:443> tag. As long it is inside the tag, it is fine.

The line below will set all headers that are being sent out with HTTPS, including the outgoing HTTP. For the next 180 days, the client web browser will not make any attempt to make an unencrypted connection to your server.

<IfModule mod_headers.c>
	Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"
</IfModule>
<Directory /var/www/nextcloud/>
	AllowOverride All
</Directory>

Restarts the Apache webserver.

systemctl restart apache2

Reload your Nextcloud settings page. We should have fixed a number of issues.

Part 1.12: Set recommended Nextcloud settings

Now, we are left with a warning from our Nextcloud configuration. There are only two configurations missing, memory cache and phone region.

Open up the Nextcloud configuration file.

nano /var/www/nextcloud/config/config.php

Add these lines after 'installed' => true, and before the closing bracket );.

  'htaccess.RewriteBase' => '/',
  'default_phone_region' => 'SG',
  'memcache.local' => '\OC\Memcache\Redis',
  'memcache.distributed' => '\OC\Memcache\Redis',
  'redis' => [
  'host' => '/var/run/redis/redis-server.sock',
  'port' => 0,
],

Save the config file and run the Nextcloud occ command, shown below, as the webserver for these changes to take effect. You will get a reply, .htaccess has been updated.

sudo -u www-data php /var/www/nextcloud/occ maintenance:update:htaccess

Reload your Nextcloud settings page and you will see a green tick.

Now, your basic Nextcloud is up and running.

Part 2: Installing Collabora Online Office Suite

The Collabora Online Office Suite requires another domain name. You can use the subdomain for this. I will be using collabora-office.fscene8.xyz as my domain.

Part 2.1: Installing Collabora Server

We will install the prerequisite packages for Collabora and then, import the Collabora package signing keys.

apt install gnupg 
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 0C54D189F4BA284D
echo 'deb https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-debian11 ./' >> /etc/apt/sources.list 
apt update 
apt install coolwsd code-brand hunspell

Create a new Apache configuration file for Collabora. Open the collabora.conf. This will be an empty file.

nano /etc/apache2/sites-available/collabora.conf

Create a virtual host with the ServerName set to the Collabora domain name. This will be set as a reverse proxy soon. For now, we need to have a virtual site to be up to get the SSL cert.

<VirtualHost *:80>
        ServerName collabora-office.fscene8.xyz

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Enable the site and reload Apache.

a2ensite collabora
systemctl reload apache2

Next, we are going to set up SSL for the Collabora virtual host. Accept the default answers provided. But choose the option to expand the certification.

certbot --apache

Enable the modules needed for reverse proxy.

a2enmod proxy proxy_wstunnel proxy_http

Before reloading the Apache service, we are going to set the configuration for the reverse proxy in the Collabora 443 Apache configuration file.

nano /etc/apache2/sites-enabled/collabora-le-ssl.conf

Add these settings inside the virtual host 443 tag.

        # Collabora config:
        Options -Indexes

        # Encoded slashes need to be allowed
        AllowEncodedSlashes NoDecode

        # Container uses a unique non-signed certificate
        SSLProxyEngine On
        SSLProxyVerify None
        SSLProxyCheckPeerCN Off
        SSLProxyCheckPeerName Off

        # keep the host
        ProxyPreserveHost On

        # static html, js, images, etc. served from coolwsd
        # (broswer is the client part of Collabora Online)
        ProxyPass /browser http://127.0.0.1:9980/browser retry=0
        ProxyPassReverse /browser http://127.0.0.1:9980/browser

        # WOPI discovery URL
        ProxyPass /hosting/discovery http://127.0.0.1:9980/hosting/discovery retry=0
        ProxyPassReverse /hosting/discovery http://127.0.0.1:9980/hosting/discovery

        # Capabilities
        ProxyPass /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities retry=0
        ProxyPassReverse /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities

        # Main websocket
        ProxyPassMatch "/cool/(.*)/ws$" ws://127.0.0.1:9980/cool/$1/ws nocanon

        # Admin Console websocket
        ProxyPass /cool/adminws ws://127.0.0.1:9980/cool/adminws

        # Download as, Fullscreen presentation and Image upload operations
        ProxyPass /cool http://127.0.0.1:9980/cool
        ProxyPassReverse /cool http://127.0.0.1:9980/cool

Save the file and restart the Apache.

systemctl restart apache2

Part 2.2: Changing the Collabora Office configuration

Open the configuration file.

nano /etc/coolwsd/coolwsd.xml

• Search for allowed_languages and set the tag value to en_GB for English, as Singapore uses British English. You might need to scroll all the way to your right to find the value at that line.
• Search for the SSL Settings. There will be multiple results. You will need to look for the SSL setings with 2 comments inside it.
  For the inner tag that contains <enable type="bool" and set the value to false.
  for the inner tag that contains <termination desc and set the value to true

    <ssl desc="SSL settings">
        <!-- switches from https:// + wss:// to http:// + ws:// -->
        <enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable>        
        <!-- SSL off-load can be done in a proxy, if so disable SSL, and enable termination below in production -->
        <termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination>

This will disable the SSL between the Collabora to the Apache webserver. This is safe as the data is contained in the localhost. However, any outgoing traffic will be terminated with SSL.

Save the file and restart Collabora.

systemctl restart coolwsd

Insert the Nextcloud domain name in /etc/hosts file. This is required for Collabora to resolve.

nano /etc/hosts

127.0.0.1 nextcloud.fscene8.xyz

Part 2.3: Install Collabora Online Nextcloud App

Install Collabora Online App from the Nextcloud App page.

Go to your Nextcloud Settings webpage and go to the Office section. Select the radio button "Use your own server". Set the URL of your Collabora server.

Now, let's open a document file from Nextcloud. It will open with Collabora Online.

Part 3: Installing High-Performance Backend

What is HPB?

High-Performance Backend is a notification tool to make your server run efficiently.

Without it, the client will use any open PHP page to retrieve notifications every 30 seconds. This is a pull process.

If the client opens 10 tabs, that is 10 times 30 seconds of retrieval. If there are 100 users open 1 tab, your server will be serving these requests regardless of whether there's any new notification for them. This really adds ups the resource usage.

With HPB, this process becomes a push process. The client will wait and the server will push notifications to them when they are ready. This process uses lesser resources.

Part 3.1: Install the Client Push App from the Nextcloud App Page

Part 3.2: Setup Push Notification in Nextcloud Server

Run the notify_push:setup as webserver

sudo -u www-data php /var/www/nextcloud/occ notify_push:setup

Open up another terminal or SSH session. The setup script will instruct us on how to set up the service.

Create a new file, /etc/systemd/system/notify_push.service and insert the following line. Make sure that the URL is your Nextcloud URL.

nano /etc/systemd/system/notify_push.service

[Unit]
Description = Push daemon for Nextcloud clients

[Service]
Environment=PORT=7867
Environment=NEXTCLOUD_URL=https://nextcloud.fscene8.xyz
ExecStart=/var/www/nextcloud/apps/notify_push/bin/x86_64/notify_push /var/www/nextcloud/config/config.php
User=www-data

[Install]
WantedBy = multi-user.target

Enable the service.

systemctl enable --now notify_push

Change back to the previous terminal and press ENTER for the next instruction.
We need to add the proxies settings to our Nextcloud Apache configuration file. Change to the other terminal to set up the proxy.

nano /etc/apache2/sites-available/nextcloud-le-ssl.conf 

ProxyPass /push/ws ws://127.0.0.1:7867/ws
ProxyPass /push/ http://127.0.0.1:7867/
ProxyPassReverse /push/ http://127.0.0.1:7867/

Restart the Apache webserver.

sudo systemctl restart apache2

Change back to the previous terminal and press ENTER. It will check and see if the configuration is set up correctly.

We have reached the end of the guide. I hope I am able to help you with your Nextcloud setup.

Why not use Docker for this?

The native Linux packages use less space and resources on your server. It supports lower processing power and at the same time, supports more users.

Docker will use more resources as it has to run in a container environment. I faced a few Docker commands that are so hard to work with.

In my opinion, most Linux native packages are easier to be configured as I can refer to their documentation and everything is exactly where it is. For Docker packages, their configuration is confusing and harder. Files are not present at the location you expect. Sure, find / -iname "*texttosearch*" does help but why live the hard way.

In the end, I scarp Docker and went natively. I am not a fan of Docker.

Cloud storage is becoming increasingly popular. They offer an easy way to share documents and photos with other people, which is very similar to services like Dropbox, or OneDrive. Let’s take a more detailed look at the free software.

What is Nextcloud?

It is open-source cloud storage. It allows you to sync your files, calendars and contacts between multiple devices and share your files with the public.

It also provides you with organizing and collaboration tools. The instant messaging app allows for groups and supports video calls.

What's more, you have complete control over your data and the add-ons tools you need through the App page. You can enable the social app and have a social feed like FaceBook.

What is Collabora?

It is a LibreOffice-based online office suite with collaborative editing, which supports all major document, spreadsheet and presentation file formats and works in all modern browsers. If you pair it with Nextcloud, you can have an online office suite right in your browser, just like Google Docs.

How to get it?

You can get yourself a Nextcloud server for free at home or from one of the hosting providers such as DigitalOcean and Linode.

There are multiple ways of installing Nextcloud. You can try getting one and run it from a Linux VM.

Installing Nextcloud 23 with Collabora and HPB on Debian 11 natively

This post will guide you on how to install Nextcloud with Collabora and the High-Performance backend for pushing Nextcloud notifications on Debian 11 server natively. No Docker, AppImages or Snap! Dashboard, Cloud Storage, Photos/Videos, Calendar, Instant Messaging, DeckPrerequisitesYou will need a…

fscene8aki

Have you ever worked at a company where they have a lockdown policy, where you can't install software to automate things for you? And you have to do the same things over and over again manually?

Imagine this.

• Your company client sends you an email with excel and other garbage attachments.
• You need to download only the excel file and rename them based on the format specified by your company
• Upload it to the company SharePoint
• Your job, do this minimum of 1000 emails attachment daily

The company decided to hire you for this because of the company's policy of not allowing 3rd party software installation.

The HTA

I will be using HTA/VBScript to automate this task. I have yet come across a single company that deny/block this yet. mshta.exe is still being used by other applications too.

The HTA will download all the email attachments from a folder, along with the subfolders.

You can download the HTA from the repo page at my GitHub profile. However, this tool will download everything that has attachments.

To configure the file type and file name, you need to edit HTA file at line 165.

GitHub - fscene8/HTA-Extract_Outlook_Email_Attachments: Extract Outlook Email Attachment

Extract Outlook Email Attachment. Contribute to fscene8/HTA-Extract_Outlook_Email_Attachments development by creating an account on GitHub.

GitHubfscene8

In the previous semester, I was preparing for my semester exam for one of my Python programming modules, ICT162 Object-Oriented Programming. The duration of the exam was 3 hours.

However, it is an open book exam and I have to write Python codes and finish on time. In an open book exam, we are allowed to refer to our seminar notes and Python codes. Our screen will be monitored and recorded throughout the exam. In my understanding, as long it is not a socialising application, such as Telegram or Discord, we are fine.

Revision

I attempted the past year paper and solving those questions will take time. It took me 4-5 hours to complete a paper. As with any programming, if you rush it, you will encounter bugs and logical errors. Furthermore, the class diagram, functional and non-functional requirements were not explained clearly. My English stopped at N'level.

The more I practised on the past year paper, I begin to see a pattern where I wasted my time a lot. It was the writing of classes. The writing of def declaration. One class can have a few methods to declare, and there were more than 10 classes to create during the exam.

The writing of classes is the most time-consuming part of the exam. There's no time to correct them if something goes wrong.

As it was an open book exam, I figured out ways to make myself code faster. Any tools to complete it. The restriction for the exam is that the code must not include libraries except the ones mentioned by the question. Usually, those are built-in libraries such as, math and datetime.

So guess, there's no importing of dataclasses. It will result in zero marks. Every get/set method is being written manually. Time-consuming!

Writing the auto-class template generator

After careful consideration, I decided to automate the creation of the class template. This application will generate an empty class template based on the class diagram it reads.

The features are:

1. Generate a class template.
2. Identify @abstractmethod, @classmethod and @property decorators.
3. Identify the instance variable and methods.
4. Identify the class variable and methods.
5. Identify the return value and type of each method.
6. Generates set and get methods based on the class diagram.
7. Include Python typehints.
8. Respects the PEP 8 style.

Phew! That's kinda a lot to do for 3 hours exam, excluding programming the actual logic. I manage to get the tool running. I did not have the time to finish writing the tool with validation prompts.

Did my DIY tool make a difference?

Of course, it did. It took me 5 secs to copy and paste the generated output. It is faster compared to writing the wrong class template for 5 to 20 minutes while looking for errors.

I can focus more on writing the logic than making the class template. For example, the class diagram requires us to write the two classes and logic. The tool will generate the template based on the diagram.

Where's the code?

I have uploaded the code to my Github Gist page. I uploaded two, one without typehints and one with.

ICT162 Class Generator. To save time during the TOA exam.

ICT162 Class Generator. To save time during the TOA exam. - ict162_toa_class_generator.py

Gist262588213843476

ICT162 Class Generator with typehints. To save time during the TOA exam.

ICT162 Class Generator with typehints. To save time during the TOA exam. - ict162_toa_class_generator_PEP8typehints.py

Gist262588213843476

Result

I am able to answer all the questions and I got A+, 5.0 GPA for the paper.

• Always prepare and study for your exam
• Practice past year paper and see which part you are wasting your time.
• Improvise it.
• Create notes or tools to assist with your weakness

Study smart!

OpenVPN allows you to connect to your home network remotely.

In this guide:

• Setting up VM
• Installing OpenVPN
• Adding and revoking clients
• Troubleshoot

Setting up VM

In this guide, I will be using a Virtual Machine with Debian Linux minimal installation. To install the minimal installation, download the ISO image from the official Debian website.

Here is my Virtual Machine specification. You can either go for a higher or lower specification.

1. CPU - 1 core
2. RAM - 512 MB
3. Storage - 2 GB
4. Network Interface -> Set to bridging and set the IP address to static.
   You will need to port forward the UDP VPN port at your home router.
5. USB - 2.0 Compatibility
6. Sound card - Removed
7. Printer - Removed
8. Display - Basic, no 3D acceleration

If you prefer to install the GUI, please select your preferred desktop environment on this screen shown below. I strongly discourage installing it as you can free up more resources in your hypervisor and allocate them to other services.

Continue installing the VM before proceeding to the next step.

Installing OpenVPN

We will be using the installation script by a Github user, angristan.

GitHub - angristan/openvpn-install: Set up your own OpenVPN server on Debian, Ubuntu, Fedora, CentOS or Arch Linux.

Set up your own OpenVPN server on Debian, Ubuntu, Fedora, CentOS or Arch Linux. - GitHub - angristan/openvpn-install: Set up your own OpenVPN server on Debian, Ubuntu, Fedora, CentOS or Arch Linux.

GitHubangristan

Step 1: Login into the VM

By default, the Debian minimal installation does not allow ssh as root. You may skip this step if you want to continue logged in as root.

From your hypervisor UI, you have to console into the Debian VM and log in as root.

Check that the command sudo is installed by executing the command sudo. Install sudo if command not found.

sudo: command not found

apt install sudo

If no normal user account was created during the installation, please refer to this guide below on how to create a user account with sudo access.

Create a Sudo User in Ubuntu/Debian

What Is sudo?sudo is a command enables the user to run commands with the security privileges of another user, by default the root user. When you create a new Linux instance from a hosting provider, most of the time, they will create only one account which is the root

fscene8aki

For more info about the risk of using a root account, you can read more using the link below.

Why You Should Not Log In As Root In Linux?

What Is A Root Account? From a Windows user perspective, it is the same as the Administrator account. Microsoft tried to improve its security by introducing UAC, even if you are logged in as an Administrator. Windows 11 UAC DialogIn Linux, there is no UAC inbuilt. Hence, you should never

fscene8aki

Step 2: Installing OpenVPN Server

Once you successfully login as a normal user with sudo access, update the VM.

sudo apt update && sudo apt upgrade -y

Install Curl.

sudo apt install curl

Download the script and make it executable.

curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
chmod +x openvpn-install.sh

Then run it with sudo.

sudo ./openvpn-install.sh

The script will prompt you for the setting required. If you are unsure, you can use the default value it provides and press ENTER.

If you are hosting a local DNS server such as pi.hole, select option 13 and provide the IP address of the DNS server on this screen.

What DNS resolvers do you want to use with the VPN?
   1) Current system resolvers (from /etc/resolv.conf)
   2) Self-hosted DNS Resolver (Unbound)
   3) Cloudflare (Anycast: worldwide)
   4) Quad9 (Anycast: worldwide)
   5) Quad9 uncensored (Anycast: worldwide)
   6) FDN (France)
   7) DNS.WATCH (Germany)
   8) OpenDNS (Anycast: worldwide)
   9) Google (Anycast: worldwide)
   10) Yandex Basic (Russia)
   11) AdGuard DNS (Anycast: worldwide)
   12) NextDNS (Anycast: worldwide)
   13) Custom
DNS [1-12]: 13
Primary DNS: [DNS IP Address]

Step 3: Setting up your first client

Please choose a meaningful client name to identify the device. Each configuration file can only be used for one device.

Tell me a name for the client.
The name must consist of alphanumeric character. It may also include an underscore or a dash.
Client name: [client-name]

Step 4: Retrieving the .ovpn file from the server

The default output directory of the .ovpn file is at the user home directory, ~/ or /home/<user>/.

You can retrieve the file by using scp command from your windows machine. Open up a terminal at Windows. Replace the username with your username, ipaddress with your OpenVPN server IP and client-name with your client name.

# Change the directory for the file to get downloaded
# The command below will set your Download folder as the directory
cd ~/Download

# Download the .ovpn file
# Format: scp [source] [dest]
scp username@ipaddress:~/client-name.ovpn ./

Step 5: Port forwarding OpenVPN at your router

For this step, I am unable to show you how it is done all router models as there are different kinds of routers. However, the steps are the same. You have to find the location of the port forward setting in your router. You can find more information by visiting your router manufacturer website and downloading the user manual.

What is required?

• Select the OpenVPN external port [default = 1194]
• Select the OpenVPN correct protocol [default = UDP]
• Select the OpenVPN internal IP address [OpenVPN server local IP address]

Step 6: Setting up the OpenVPN client

Install the OpenVPN client on the client device. You need to import the .ovpn configuration file into the OpenVPN client.

Once imported, you can test it by connecting to a public Wi-Fi or a mobile hotspot. Then, connect to your VPN server.

Adding and revoking clients

To add and revoke clients, re-run the script again.

sudo ./openvpn-install.sh

Troubleshoot

If you are unable to get your OpenVPN working, please try the following:

• Check the VM interface. This guide is created with bridging network settings.
  For NAT, there will be another configuration to be done.
  However, this not recommended due to double NAT, one from your router and one from your virtualization software.
• If you are not using SSH, check if the VM is pingable?
• Check your Port Forward setting. Visit your router manufacturer website and read the user manual of your router model.
• Is your home using a dynamic IP address? Once your public IP address has changed, you will need to reconfigure the .ovpn file again.
• Is your client connected to the internet?

I hope this guide helps you with your OpenVPN setup.

This guide will show you how to log in to your Linux servers without typing your password from your Windows OS.

What is Passwordless SSH Authentication?

Passwordless SSH Authentication is a more secure alternative than typing in your account password. It uses public-key cryptography for authenticating the hosts and users. This serves as proof(s) of identity required in lieu of passwords.

However, a more secure alternative does not mean unhackable. The public key is another type of credential, just like passwords. They should be removed from your server when they are no longer needed or compromised.

How does Passwordless SSH Authentication work?

Remember in the Movies, when the lovers separated, they broke a necklace or medallion in half? Only when they got back together, could they put it as one, and true love win the day? Same thing here.

The client (your computer) generates the SSH key pair, which is a public key and a private key. You only need to do this once.

The client's public key is something that the computer always hand out to anyone, even the bad guys. The client's private key is the only key that will pair with its own public key. This is the proof of identity that the public key belongs to the client.

To make it simpler, the public key is the padlock and the private key is the key to that padlock.

The process:

1. The client tries to connect to the server by SHH using its Public key.
2. The server verifies the client Public key if it matches with any of its Public keys in the authorized_keys file.
3. Once the server matches the client's Public key with the authorized_keys file, the server challenges the client with an encrypted message. If the client can figure it out, they can connect.
4. The client decrypts the encrypted message with the private key.
5. The client hash out a few parameters and they both get the party started.

As the commands and responses are encrypted, any Man-In-The-Middle attack will not have the ability to read their traffic, providing better security than Password-based logins. The attacker will need to have both keys.

To set up passwordless SSH within your environment, it requires you to complete three main steps:

1. Generating client's SSH key pair.
2. Check if .ssh folder exists in the home directory of the remote account.
3. Upload the public key to the server.

Generating client SSH key pair

In Windows OS, open PowerShell and execute the line below:

ssh-keygen.exe -b 4096

It will prompt you for the file in which to save the key. Let's use the default option, leave blank and ENTER to continue.

Enter file in which to save the key (C:\Users\user/.ssh/id_rsa):

You can enter a passphrase to have more security. However, each time you connect, you have to key in your passphrase, making it no longer a Passwordless login.

Leave blank and press ENTER for an empty passphrase for both prompts.

Created directory 'C:\Users\user/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:

Take note of the location of both your private and public keys.

• Public key -> id_rsa.pub
• Private key -> id_ras

Your identification has been saved in C:\Users\user/.ssh/id_rsa.
Your public key has been saved in C:\Users\user/.ssh/id_rsa.pub.

Check if .ssh folder is missing in ~/

The server needs to know who you are. This will be done by uploading the public key that you just generated. But before that, you need to make sure the destination folder (~/.ssh) exist.

SSH to the server with your login password.

ssh myusername@192.168.1.223

Do a ls -al command to check if the .ssh folder is in your home directory.

myusername@ubuntu-demo:~$ ls -al
total 28
drwxr-x--- 3 myusername myusername 4096 Jan 21 07:23 .
drwxr-xr-x 3 root       root       4096 Jan 21 06:48 ..
-rw------- 1 myusername myusername   88 Jan 21 08:36 .bash_history
-rw-r--r-- 1 myusername myusername  220 Jan 21 06:48 .bash_logout
-rw-r--r-- 1 myusername myusername 3771 Jan 21 06:48 .bashrc
drwx------ 2 myusername myusername 4096 Jan 21 07:22 .cache
-rw-r--r-- 1 myusername myusername  807 Jan 21 06:48 .profile

If it is not there, run the command below to create and give read permission to everyone who needs it.

mkdir ~/.ssh && chmod 700 ~/.ssh

Log out from the SSH.

Upload the Public Key to the server

This is the final step. But, how do we upload to the server? By using the scp command.

scp $env:USERPROFILE/.ssh/id_rsa.pub myusername@192.168.1.223:~/.ssh/authorized_keys

Test your Passwordless SSH login

Time to ensure that the key is actually working as intended. To test the key, log in to the server again as you would normally. No password is needed.

ssh myusername@192.168.1.223

If the login still asks for your password, try changing the permissions to the authorized_keys file to 600 and retry.

chmod 600 ~/.ssh/authorized_keys

Pros and Cons of using Passwordless SSH

There are always pros and cons when it comes to security. If you want to start using it, please understand the potential risk before they appear.

Pros:

• Makes authentication exprience pleasent
• Better security against brute force attacks
• Connects more quickly than typing in your password
• Allows automation scripts and background file transfer securely

Cons:

• Public keys will pile up if you don't do any key management at the server
• Man-In-The-Attacks is still a risk if both your public and private keys are stolen or compromised (which is why key management is important)

Conclusions

Vulnerabilities are everywhere, and no security is perfect. If these risks are addressed with caution and best practices are followed, you should be fine.

sudo is a command enables the user to run commands with the security privileges of another user, by default the root user.

When you create a new Linux instance from a hosting provider, most of the time, they will create only one account which is the root user account. The best practice is to create a sudo user account first.

This guide will show you how to create a new user with sudo access to the system.

Login As root Your Linux System

If you create a Linux instance from a hosting provider, 0pen up your SSH client and log in as root. Replace the IP address with your IP address.

ssh root@192.168.1.100

Create A New User

Create a new user account with the command adduser. Replace myusername with the user name that you want to create.

adduser myusername

Enter a new password for this user. Make sure the password is a strong secure password.

Adding user `myusername' ...
Adding new group `myusername' (1000) ...
Adding new user `myusername' (1000) with group `myusername' ...
Creating home directory `/home/myusername' ...
Copying files from `/etc/skel' ...
New password:
Retype new password:
passwd: password updated successfully

After the password setup, you will be prompt to enter the particular details of the new user. You can leave all the information blank and just press ENTER to accept the empty details.

Changing the user information for myusername
Enter the new value, or press ENTER for the default
        Full Name []:
        Room Number []:
        Work Phone []:
        Home Phone []:
        Other []:
Is the information correct? [Y/n]

Giving The User sudo Access

Only the members of the group sudo are allowed to use the sudo command. To add the user to the sudo group, use the usermod command. Replace myusername with the username you just created.

usermod -aG sudo myusername

Testing the sudo Access

Logout of the root user and login to your Linux system with the newly created user.

# logout
Connection to 192.168.1.100 closed.

Now, ssh with the new user.

ssh myusername@192.168.1.100

Do a simple check with the whoami command. This command will execute as root.

sudo whoami

The output:

root

Changing User Password

To change the current logged in user password, use the command passwd.

passwd

To change another user account password, you need to use sudo at the front and include the user name after the command. Replace username with the account user name.

sudo passwd username

Delete User Account

To delete a user account, use the command userdel. Replace  username with the account name you want to delete.

userdel username

Conclusion

You have learned how to create a new user with sudo access, change a user account password and delete a user account.

Now, you can start using the new user account with sudo access. Stay tune for the upcoming post on how you can securely lockdown your Linux system.

From a Windows user perspective, it is the same as the Administrator account. Microsoft tried to improve its security by introducing UAC, even if you are logged in as an Administrator.

In Linux, there is no UAC inbuilt. Hence, you should never log in as a root user. Even if you know what you are doing, you cannot be too sure that the application you are executing is safe.

Introducing sudo

The equivalent to Windows UAC for Linux is sudo. It stands for "superuser do". It will execute commands with the security privileges of another user.

sudo apt update && sudo apt upgrade -y

How Does This Minimise Damage?

Any command or application running on a normal user account will not be able to modify system files without gaining root permissions. They can only write to your /home/<user>/ folder. This will also prevent the user from accidentally modifying a system folder too.

For example, John received a script that does the following:

• Archives the current working directory
• Uploads the archive to a remote site
• Deletes the archive

John glanced through the description, and he did not have the time to inspect the code for malicious intent. But, don't worry, I did that too, once.

He ran the code at the / root directory, but he was logged in as a root account. The script was executed, and he went to make a coffee. When he came back, all the files in the root directory were gone.

The Linux is running from the RAM at this point. He thought he was saved with the backup the script made and uploaded, but it failed to connect to the remote drive. Oh no, now he's gone.

That will not occur if he ran the script as a normal user. Linux guides are full of instructions, and copy-pasting them blindly without reading them will cause more harm to your system.

When Should I Use sudo?

You should only use sudo when running a command that modifies the system file. Most daily Linux applications do not need sudo permission. Most applications will refuse to run as sudo. This practice provides another layer of security if the application opens a malicious file; it cannot modify the system file.

Even if you know what you are doing, it is still unsafe to run as a root account. You will be bypassing much of the security design that makes Linux secure.

root == administrator without UAC

With great power comes great responsibility.

Some days, we just want to stream our gameplay on YouTube or Twitch. At the same time, you don't want your viewers to listen to your conversation. The solution is simple and that is to use a virtual audio device.

I will walk through how to get it set up and how easy it is to enable and disable it. This works with any other chat applications other than discord. Even your music too!

The illustration below shows how the sound will get separated and arrives at the stream and you.

Download Voicemeeter

Voicemeeter is a virtual playback and recording device. Go to their website and download the EXE file.

Reboot your PC once the installation is completed. This is required for Windows to enable the drivers needed.

Finding out your physical device

Take note of your real physical default playback device. A playback device is a device that you plug in your speaker/earpiece, to listen to the computer output audio.

You can run the command in the run dialog (Win+R) to bring up the sound properties.

control.exe /name Microsoft.Sound

In my setup, it's Speakers (Realtek High Definition Audio). This is the device that I plug in my speaker/headphone to.

Setting up Voicemeeter - Output Device

In the Voicemeeter program, set your output device for it as shown in the picture below. This will set the Voicemeeter to output all the inputted audio to your real physical device.

Set your A1 to your REAL Physical Output device, which is MME: Speakers (Realtek High Definition Audio) for me. In my experience, choose MME as WDM will cause issues when multiple applications are outputting audio.

Setting up Voicemeeter - Input Device

Set your Voicemeeter Input playback device as your default device for playback. Any opened application will now use this device to output its audio by default.

Configuring Discord

In the Discord settings, set your output device to your real physical playback device. For my setup, it is Speakers (Realtek High Definition Audio).

Setting up the streaming audio

The may differ from your streaming software. It should be the same for most software. You need to find the audio setting and change it to Voicemeeter Input.

Lastly, don't forget to mute your microphone. Else, your viewers will be listening to you talking to yourself.

There are more things that Voicemeeter are able to do. It can change the tone and pitch of any audio input, software or microphone. I won't be covering cause that will take another post to explain Voicemeeter's capabilities.