Best Practices for Security on Your New Ubuntu Server: Users, Console and Firewall

Reading Time: 4 minutes

Thank you for taking the time to review this important information. You will find this guide broken down into six major sections that coincide with Ubuntu’s security policy guide. The major topics we talk on throughout these articles are as follows:

Continue reading “Best Practices for Security on Your New Ubuntu Server: Users, Console and Firewall”

Troubleshooting: Locked Out of RDP

Reading Time: 3 minutes

How Do I Get Back Into RDP?

You may be working from a local machine that has an IP that is not scoped on that RDP port, making it impossible for you to gain remote access to add the IP address to the RDP rule’s scope. Do not fret; there is a simple and quick way to add your IP to the RDP scoping (or any others entities such as MySQL or MSSQL) right through your Plesk interface in your local browser. You can watch this video, or scroll down for step-by-step directions.

For security purposes, it is always recommended that you scope off your Remote Desktop Protocol (RDP) connection on your server. Putting a scope on the RDP rule in the Windows Firewall will allow only the indicated  IP addresses to gain access to the server through Remote Desktop Protocol. The issue is that many of us do not have static IP addresses, but rather Dynamic IP addresses. This means that while at one time our IP address may be 120.32.111.01, it may change to something like 95.42.121.01 later. So if you were to add 120.32.111.01 to the RDP firewall for a customer or a system administrator, then you may need to add another rule for a different IP address.

 

Adding Your IP in Plesk

Step 1: Log in to Plesk

First, we need to make sure we know how to get to that Plesk login page. By default, the Plesk login page is https://<YourServerIP>:8443. For example https://124.0.0.1:8443

We should arrive on a page with this in the center. Go ahead and type in Admin for the username and your password for Plesk. Usually, that password is set up by our team and is the default Server Administrator Password. Sometimes the username is Administrator, depending on a few variables. But one of the two user names should be fine.

Plesk login

Step 2: Tools & Settings

The first thing we need to do after we log into Plesk through the previous page is to navigate to the Firewall Rules. Go ahead and click on Tools & Settings. It will be located in the right sidebar near the bottom as shown below.

plesk tools and settings

Step 3: Firewall

Once we pull up Tools & Settings go ahead and click on our destination, Firewall. You will find that option under the Security section. It will be the second option, just under Security Policy.

firewall tools and settings

Step 4: Firewall Rules

After we are in the Firewall management, go ahead and click on Firewall Rules. This is where we will add the rule to allow a certain IP address to gain RDP access.

firewall management

Step 5: Add a Firewall Rule

Under Tools, after going into the Firewall Rules, we will see the option labeled Add Firewall Rule. Go ahead and click on that, bringing us to our next step.

firewall add rule

Step 6: Add Detail the the New Rule

This is the page that we see after clicking on Add Firewall Rule. It can seem to be complicated and intimidating for some beginner level System Administrators, but it is quite simple.

add a new firewall rule

firewall profiles

If you or your client are not sure what that IP address that needs RDP access is, Liquid Web has a great site to visit that will only display your IP address here.

Note:

Here is an example of what you will find at https://ip.liquidweb.com.

While this particular example IP will not be the one that the customer or the System Administrator will see, (when visited on the local machine) the page will display the IP address that needs to be added to the rule for this RDP session to connect. That will be the only information that will be displayed on this page. Simply copy that IP address and use it in the instructions below.
ip address

remote ip address

Once you enter the IP address into the text box under Remote addresses, you do need to click the ADD button before clicking on OK.

remote ip address example

As mentioned above, after clicking the ADD button while the IP address is entered into the Add an IP address or a network text box, it will be placed into the left text box. After that step, you will then be able to click OK to apply this rule to the firewall for the server.

Step 7: Connect to RDP

The individual at that IP address can now access the server via RDP. If you would like more information on how to use Remote Desktop Connection, you can find a help article explaining exactly how to do that here.

rdp connection login screen

Congratulations! You now know how to add an IP address to an RDP rule that will allow a user to connect if the RDP is scoped off to the public. This can be done many times. Although Plesk does not allow you to edit the rule, you will have to create a new one each time. But this shouldn’t cause any issues. Also, keep in mind that this method can be used for any port, including MySQL and MSSQL.

If you ever have any trouble with your Liquid Web server, feel free to contact us through our chats system, by submitting a ticket, or by calling 800-580-4985. We’d love to help!

How To Set Up FTP for Windows

Reading Time: 5 minutes

What is FTP?

You or your developer may want to have access via FTP (File Transfer Protocol) to the folders for the project or domain that is being worked on. FTP is a quick and easy way for someone to connect to their project, without having to have full access to RDP into the server. An FTP user will only have access to the folders that are designated to them, limiting them in their own environment so as not to accidentally change other user’s files and file structure on their project/domain. In this tutorial, we will cover how to utilize FTP on a Core/Self-Managed Dedicated or VPS Server, as well as a Plesk Server.  Let’s jump right in!

 

Enabling FTP Services

The first thing that you need to check before creating an FTP user is to enable FTP on your server. To do that on a Core/Self-Managed server, we need to RDP to the server and open Server Manager.

rdp connection info

Once the server manager is open, in the top right corner, there are a few options: Manage, Tools, View, and Help. We want to click on Manage, which will show a drop-down menu. At the top of the menu, click on the option Add Roles and Features.

IIS server manager dashboard

Once you have the Add Roles and Features Wizard up, click Next until you are at the Server Selection.

add role feature wizard

Make sure your server is highlighted, by default, it should be. If so, you can click Next which brings you to Server Roles.

select destination server

Server Roles are where you will find the features your server can have enabled separately, depending on your needs. We aren’t looking for anything but FTP at this time, so we won’t cover all of the features and services we find here. FTP services are going to be found under the role Web Server. Click on the carrot next to Web Server. There are 3 different options with checkboxes; Web Server, FTP Server, and Management Tools. Dropping down the FTP Feature will show the available FTP features.

If all of these are already checked, you can skip ahead to the Adding and Assigning FTP Users section of this help article. However, if these are not checked, go ahead and check FTP Server and FTP Service. If your users plan on using ASP.NET services or IIS Manager, you will want to make sure you check FTP Extensibility.

Once you have the FTP features selected, click on Next a couple of times until you get to the Confirmation page. At the top, you will see an option to “restart the destination server automatically if needed. For installing FTP Services, a restart is not needed. We can leave this box unchecked and click on Install. This install process shouldn’t take too long.

Adding and Assigning FTP Users section

Adding an FTP User Account

Before we add an FTP site, we need to set up a user with some credentials. We do this by accessing Computer Management.

set up a user credentials

On Windows 2012 and up, we can do this by right-clicking the Start Menu button, and selecting Computer Management. Here, under System Tools, if we click the drop down carrot, we will see the Local Users and Groups section. Double-click on Users and a list of all the Local Users will formulate. On the far right of the Computer Management, once we have navigated to Users, we see a More Actions and will need to click on that to add a New User.

add a New User

Clicking on New User will pop up a simple interface that asks for the user name, the user’s full name, a description for that user that serves as a description for you, the administrator, to recognize the purpose of this user. Fill out this information accordingly and type in a password for this user. Under Confirm Password, we see that by default “User must change password at next logon” is selected. Because this is strictly for FTP, we will uncheck that and check “User cannot change password” and “Password never expires”. Considering the FTP user will only have access to the destination you allow, it is not necessary to change the password.

description for FTP user

 

Adding an FTP Site

Now that FTP Services are installed and a user is created, we need to head on over to the IIS Manager. This can be found in the Start Menu, or by clicking on Tools in Server Manager as we did before, but clicking on Internet Information Services (IIS) Manager.

Adding an FTP Site

Here is the IIS Manager, we need to create the FTP site that you will want this specific user to have access to. We do this by clicking on the drop-down carrot next to the server name, and then right-clicking on the folder that says “Sites“.

create FTP site access for user

A menu will pop up, with the option to Add FTP Site. Enter the name you wish to give this FTP site. Select a Physical path, where you want the user for this FTP site to have access. Do this by either typing in the direct path, or selecting the 3 dots next to the entry bar and physically selecting the folder you wish to assign this FTP site.

Select a Physical path to ftp site

Clicking next will bring you to Bindings and SSL settings. If you have any specific IP address that is assigned to a domain that is being used for this FTP Service, you need to make sure that the IP address is selected by dropping down the bar.

Bindings and SSL settings

If all sites are taking advantage of Windows SNI (Server Name Identification) than you can leave this set to All Unassigned, if you wish to use a different port than the default FTP port, go ahead and type that in under Port. But if this is just a basic FTP instance for everyday purposes, go ahead and leave that port at the default 21. Next, you want to make sure that “Start FTP Site automatically” is selected. Unless of course, you want to manually allow the user to connect to their FTP site only when you designate by starting the page in IIS. Select No SSL and click Next for this FTP Site. In this tutorial, we will not be covering setting up an SSL for this specific FTP Site. If you do already have an SSL that you have added to the server for this purpose, you need to make sure that Allow or Require under SSL is checked, and select your SSL on the drop down bar labeled SSL Certificate.

authentication authorization info

Now we have been brought to the Authentication and Authorization section. Here at the top are two options for Authentication. Make sure that both boxes are checked. Finally, we have the Authorization section where we would select the groups or users we want to allow to be able to log into this FTP Site.

 

Setting Up the Windows Firewall

Now that we have the FTP site all set up and ready to go, we do need to set up the firewall rules. Open up your firewall by clicking on Start, scrolling to Windows Administrative Tools, and clicking on Windows Firewall with Advanced Security.

Windows Firewall with Advanced Security link

firewall.advanced.security

We need to set some rules on the Inbound Rules section, so click on that first. It’s in the top right corner. After clicking on Inbound Rules in the top right corner under Actions, you will see a section called Inbound Rules. Under that category should be New Rule.

set Inbound Firewall Rules

You may have to click on the arrow next to Inbound Rules to see this. Click on the New Rule

setup new firewall rule

And you will be selecting the Rule Type. For FTP we will be using Port, so click on that and Next. Now you will see Protocol and Ports. For Protocol, use the setting TCP. For Specific local ports type 21, 5001-5051 and click on Next.selecting Firewall Rule Type

Now we have the Action section. By default, “Allow the connection” is selected. Keep this the way it is and press Next. Now you will be prompted for when this rule will apply.

Firewall Allow the connection

We want it always to apply so keep each network connection type box checked. There are three: Domain, Private, and Public. Click Next, and you will be naming the firewall rule. We suggest just naming it FTP Connection or something of the sort.

naming the firewall rule

You should be all set. Go ahead and log into another computer, use your favorite FTP client (such as Filezilla), enter the IP address as a host, and your newly created username and password, port number, and click connect. You are now connected FTP to your designated pathway on your server.

 

FTP on a Plesk Server

This process is a lot faster and much simpler. Here are a couple links in regards to setting it up on a Plesk Windows Server.

https://help.liquidweb.com/s/article/Creating-FTP-Users

https://help.liquidweb.com/s/article/Uploading-Files-Using-FTP-in-Plesk

You did it! You have successfully set up an FTP site so that you or the developers can now edit, copy, and remove files from their designated folders smoothly.

Windows Firewall Basics

Reading Time: 6 minutes

A firewall is a program installed on your computer or a piece of hardware that uses a rule set to block or allow access to a computer, server or network. It separates your internal network from the external network (the Internet).

Firewalls can permit traffic to be routed through a specific port to a program or destination while blocking other malicious traffic. A firewall can be a hardware, software, or a blending of both.

Continue reading “Windows Firewall Basics”

Plesk to Plesk Migration

Reading Time: 9 minutes

Migrating from one Plesk installation to another is easy with the Plesk Migrator Tool! The Plesk team has done a great job creating an easy to use interface for migrating entire installations of Plesk to a new server.

If you need to move files, users, subscriptions, FTP accounts, mail and DNS servers setup through Plesk, this guide will help you successfully navigate the process and come out victorious!

We will be splitting this tutorial into three sections:

Continue reading “Plesk to Plesk Migration”

Install vsftpd on Ubuntu 16.04

Reading Time: 3 minutes

Installing vsftpd allows you to upload files to a server, the concept is comparable to that of Google Drive.  When you invite specified users to your Google Drive they can create, delete, upload and download files all behind a secure login. Vsftpd is excellent for company’s looking for an alternative to Google Drive or for anyone who wants to create a robust server. This “Very Secure File Transfer Protocol Daemon” is favored for its security and speed and we’ll be showing you how to install vsftpd on an Ubuntu 16.04 LTS server.

 

Continue reading “Install vsftpd on Ubuntu 16.04”

Malicious Activity Detector (MAD) for Windows

Reading Time: 3 minutesOne of the simplest goals of server security is keeping administrator credentials private. There is no better way to achieve this than through strict firewall rules that only allows specific IPs to authenticate. However, there are some situations where it is necessary to open a login prompt to the broader Internet. In this case, the only thing barring anonymous internet users from unauthorized access is your password. The stronger your password, the better off you are, but even the most cryptic passwords can be guessed given enough tries.

Malicious Activity Detector (MAD) helps protect you in these instances. It functions by monitoring login attempts to several services, and if it detects malicious activity, it applies a temporary block on that IP. If more attempts come in, the block continues to last longer. This method is exceptionally effective in preventing a successful brute-force attack while limiting the number of system resources expended.

 

Installation of MAD

Depending on the configuration and age of your server, you may already have it installed. Check the installation status by looking for an item in your Start Menu shown below.

Installing Liquid Web's Malicious Activity Detector for Windows tightens security for you server.

The program path is C:\Program Files (x86)\Liquid Web\MAD\MADGUI.exe

You may also check if “MAD.exe” is running from your Task Manager. If you don’t see it there, please Contact Support so that we may get it up and running for you. Once running,  we can move on to the configuration.

 

Note:
MAD will be installed on all Windows servers by default in the future.

 

Configuring MAD

MAD’s default settings offer protection for the most vulnerable services, and extra configuration is not required. That said, you may find yourself wanting to change its behavior, and we’re happy to give you the tools you need.

Let’s start with the most common change you may want to make: whitelisting and blacklisting. Opening the MAD Configure utility will get you on the right page. From here, you only need to choose the radio button for the list you want to modify, enter the IP, and click the button. You can remove entries in either list by right-clicking. This page also allows you to start or restart the service, but you shouldn’t need to use those functions.

The List tab easily let's you add in blacklisted or whitelisted IPs.

The next page is where most options are located. All of the service scanners list three choices for each: Enabled/Disabled, BlockThreshold, and Retention.

Our Malicious Activity Detector allows you to adjust settings for maximum security.

Enabled/Disabled -You may want to disable scanners for services that you do not have installed, but it is generally recommended to leave all options enabled due to minimal performance cost.

BlockThreshold – This setting controls how many ‘strikes’ it takes to be blocked. These are set fairly high by default to avoid affecting legitimate users, but you may want to lower the threshold to increase MAD’s sensitivity.

Retention -This refers to the size of the window that MAD looks at to determine if a user has met the BlockThreshold in seconds. By default, this is set to 300 (five minutes).

Example:
Set your BlockThreshold to 10 and your Retention to 300. If 9 failed attempts occurred at 12:00 and a failed attempt occurs before 12:05 it will be blocked. By 12:06 you will be in a new period and will be able to attempt 9 more times before being blocked.

PermaBlock – Sometimes robots can’t take the hint after being temporarily blocked several times in a row. The PermaBlock list remedies this situation. By default the retention period is 2 hours, this scanner checks for IPs that have been temp blocked five times (or your custom BlockThreshold). If it gets a hit, it does as the name implies and adds it to your blacklist, where it is managed much like manual entries.

AuditPolicy – This setting determines if MAD is allowed to edit your login event auditing policy. Disabling AuditPolicy is not recommended and may prevent MAD from working as intended.

TempBlockTimeout -When a block is triggered on one of the scanners the offending IP address will be blocked for this amount of time. Measured in seconds with a default setting of 900 (15 minutes).

 

Reviewing MAD Logs

MAD creates logs of all of the actions that it takes. It is good practice to review them regularly to see what has been going on. For example, if a certain service seems to be getting attacked more often than others you may want to consider hardening your firewall rules or MAD’s configuration itself.

Our Malicious Activity Detector keeps logs of anyone attempting to connect to your Windows server.

MAD also creates events in Windows Event Viewer under the ‘Applications and Services Logs’ folder. These events are most helpful for long-term investigation, as the folder will hold historical data for quite some time.

MAD also creates Events for long-term investigation, as the folder will hold historical data.

MAD for Windows is an excellent tool in your security arsenal, but a proactive plan is always better than a reactive one. We recommend utilizing Windows Firewall to ensure that only things that must be publicly accessible are. For further reading on security visit some of our other articles:

Security for Remote Desktop
Best Practices for Your Firewall

Install TeamViewer on Ubuntu 16.04 LTS

Reading Time: 4 minutesVNC (Virtual Network Computing) is a method for sharing a remote desktop environment. Allowing you to remote control another computer or server over the Internet or local network as if you were sitting in front of it. Keyboard and mouse strokes from your computer are relayed to the remote computer/server. There are many different kinds of VNC softwares available today. Several are cross-platform and add additional features, such as chat or file transfers. VNC is often used for remote technical support and remotely accessing files.

What is TeamViewer?

Continue reading “Install TeamViewer on Ubuntu 16.04 LTS”

Improving Security for your Remote Desktop Connection

Reading Time: 4 minutesRemote Desktop Protocol (RDP) is the easiest and most common method for managing a Windows server. Included in all versions of Windows server and has a built-in client on all Windows desktops. There are also free applications available for Macintosh and Linux based desktops. Unfortunately, because it is so widely used, RDP is also the target of a large number of brute force attacks on the server. Malicious users will use compromised computers to attempt to connect to your server using RDP. Even if the attack is unsuccessful in guessing your administrator password, just the flood of attempted connections can cause instability and other performance issues on your server. Fortunately, there are some approaches you can use to minimize your exposure to these types of attacks. Continue reading “Improving Security for your Remote Desktop Connection”