Cloudron Forum

@nebulon

I am not of any help regarding the constraints, I'd go headlong towar parsing /etc/ssh/sshd_config ... grep Listen

But as you said, drawbacks exist.
netstat might not be present on the system and so on

I'm just raising an idea, I'm far from having all the constraints in mind

Thank you, this is really nice to be part of it, Cloudron is just a dream come true, wish I had heard about it years ago

Edit:
Hello everyone,

While creating an application token for OVH API use, there are security options an user might and should leverage.

One of the options is the rights that can be configured.

I would advise for documenting the following rights as being the minimal scope needed by cloudron to perform its dutties:

GET /domain/zone/{zone Name}/record
POST /domain/zone/{zone Name}/record
PUT /domain/zone/{zone Name}/record/*
DELETE /domain/zone/{zone Name}/record/*
GET /domain/zone/{zone Name}/record/*
POST /domain/zone/{zone Name}/refresh

Rights, above, are extracted from the OVH API client of cloudron (as is on master branch at time I wrote this post) and translated to the expected format in the OVH createToken page.

Edit:
Hello everyone,

The security page of Cloudron doc, in "Securing SSH Access", advises to relocate SSH Server to a different port (security through obscurity), to prevent bruteforce attacks. The only advised (and available port) is 202, which means the expected effect is now void, because the whole community is forced to behave the same way.

On the other end, the networking documentation page indicates how to open port on a cloudron install the clean way.

Those two pages should be linked (security => network) and the 202 restriction should be un-mentionned.

Hello to everyone (feels like I forgot being polite in my other two posts),

I recently installed cauldron on a VPS after having secured said VPS.
Including in securing it was the following :

• moving SSH to port 39552 (or something alike)
• installing fail2ban
• whitelisting port 39552

After Cloudron installation, sshd was still listenning on the custom port while cloudron-firewall was blocking it.
It was then impossible to use SSH to adress the issu and the remote KVM of my provider made it hard for me to resolv it the right way.

My suggestion is to add the following steps in the setup :

• Check the current listening port of sshd
• Whitelist this port

Regards,
sholan

My message was lacking context :

1. increase validity to unlimited or 30 days (but unlimited is better in this case)
2. hit the + sign and create rights
3. add the Cloudron public IPs here one per input field, hit plus to add

A complete example :

Feels nice, thank you guys !

@girish
You are welcome, nice job

I will consider joining the gitlab in the future... I was lazy today