I have bought VPS private server on linux Ubuntu 20 and here I will log all issues.
VPS
SSH
1. To connect SSH without entering password everytime you need key authentification.
1.1. Generate SSH public keys on client linux machine. Use $ ssh-keygen -t rsa // two files will be created. Public key in .pub file
1.2. Set open key to server. # touch ~/.ssh/authorized_keys and put in content from .pub
1.3. Try to connect. Get Error. signing failed
1.3.1. Maybe I have to change username in pub file from linux user to server user root@<my ip> // No
1.3.2. On client use default files ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub // still error "agent refused operation"
1.3.3. Try $ ssh -i ~/.ssh/id_rsa user@<my ip> // No
1.3.4. $ ssh-add on client // helped
REMOTE DESKTOP
1. Connected succesfully with $ ssh root@my-ip-address
2. Now I have to install GUI.
2.1. # apt-get update
2.2. # apt-get install ubuntu-desktop
2.3. # startx // too early I have to install RDP server and after that startx
2.3.0. Too check if GUI is loaded by default $ sudo systemctl list-units --type target | egrep "eme|res|gra|mul" | head -1
2.3.0.1. If you don't see "graphical.target loaded active active Graphical Interface" then $ sudo systemd isolate graphical.target
2.3.1. Which RDP linux cliens exists? // TigerVNC, Remmina, AnyDesk, VNC Connect
2.3.2. remmina is already installed on server. To install it on client use snap-store.
2.3.3. I didn't setup something on client side. Try to connect // doesn't work
2.3.5. I'll try to use X11 forwarding with $ ssh -X it easiest way to remote desctop Linux-Linux
2.3.5.1. Om server check $ sudo nano /etc/ssh/sshd_config
X11Forwarding should be yes
// It works but very slow
2.3.5.2 X11UseLocalhost should be no then restart server $ sudo service ssh restart and for client side set
ForwardX11 yes
ForwardX11Trusted yes // Still slow. I need RDP
2.4. Try to install xRDP server $ apt install xrdp
2.4.1. Add user for xrdp # adduser xrdp ssl-cert and restart # systemctl restart xdrp
2.4.2. If you have firewall allow port 3389 # ufw allow 3389
2.4.3. working but slow
2.4.4. Try to decrease resolution on server. // There is no option I have to try by cli
2.4.5. Decrease resolution in Remmina settings to 640x480. // Better but still unable to watch video.
2.4.6. Decrease color depth in remmina // doesn't help
2.4.7. Network connection type set to model in remmini // doesn't help
2.4.8. On client increase priority of remmini client.
2.5. Try xcfe GUI.
2.5.1. Install XFCE $ sudo apt install xfce4 xfce4-goodies -y choose lightdm as a default manager
2.5.2. To use xfce with xRDP $ echo xfce4-session > ~/.xsession
2.5.3. $ sudo systemctl restart xrdp
XFCE4 works better but video still slow. I have to setup VPN or proxy. Idea to watch youtube throuth RDP has been crashed.
PROXY ON VPS
1. What proxies we have. SQUID, NGINX, HAProxy
Squid
HTTP
0. Prerequisites. I have Ubuntu 20 with Apache web server.
1. Install. # apt install squid
1.1. Check if it is working # systemctl status squid
1.2. Set to autoload $ systemctl enable squid
2. Configure server /etc/squid/squid.conf
2.0. http_port 3128 by default
2.1. http_access deny all substitute with http_access allow all
2.1. After string "# Example rule allowing access from your local network" add string
acl localnet src my_ip_address
2.2. # systemctl restart squid
3. Specify the network and access with password
3.1. $ sudo apt install apache2-utils
3.2. Create file for passwords $ touch /etc/squid/passwords
3.3. $ sudo htpasswd -c /etc/squid/passwords squid_user
3.4. Set squid.conf to use passwords file:
include /etc/squid/conf.d/*
auth_param basic program /usr/lib/squid3/basic_ncsa_auth /etc/squid/passwords
auth_param basic realm proxy
acl authenticated proxy_auth REQUIRED
# Example rule allowing access from your local networks.
acl localnet src your_ip_address
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
#http_access allow localnet
http_access allow localhost
http_access allow authenticated
# And finally deny all other access to this proxy
http_access deny all
3.4.1. To test $ curl -v -x http://squid_username:squid_password@your_server_ip:3128 http://www.google.com/ //Looks like it is connected
3.4.2. But http proxy doesn't works from Ubuntu settings.
3.4.2.1 Try to delete ignored hosts ::1 // Works from Firefox
4. Test proxy server and configure client to use IP server and port
4.1. HTTP proxy doesn't work. // Set proxy not systewide but for specific browser
4.1. I use http://checkip.amazonaws.com
5. Set second port 8080
5.1. Just add to squid.conf another http_port 8080 // 8080 doesn't work but other numbers are working, looks like 8080 is busy.
HTTPS
1. Activate SSL Bumping.
1.1. In /etc/squid/squid.conf
http_port 3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_cert/myCA.pem
ssl_bump peek all
ssl_bump bump all
2. Generate SSL Certificate
2.1. $ mkdir /etc/squid/ssl_cert then $ cd /etc/squid/ssl_cert
2.2. $ openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout myCA.pem -out myCA.pem
2.3. restart squid
2.4. Doesn't work "job for squid failed". Maybe SQUID should be compiled with flag ./configure --enable-ssl, --enable-ssl-crtd --with-openssl
./configure \
--enable-ssl \
--with-openssl \
--enable-ssl-crtd
2.4. Use # squid -v to check configuration. I obviously don't have --with-openssl but I don't want to recompile.
2.4.1. Try recepie 2
Generate key
# openssl genrsa -out /etc/squid/ssl_cert/squid.key
# openssl req -new -key /etc/squid/ssl_cert/squid.key -out /etc/squid/ssl_cert/squid.csr
Self sign certificate
# openssl x509 -req -days 3650 -in /etc/squid/ssl_cert/squid.csr -signkey /etc/squid/ssl_cert/squid.key -out /etc/squid/ssl_cert/squid.pem
Generate cert for browser
# sudo openssl x509 -in /etc/squid/ssl_cert/squid.pem -outform DER -out squid.der
Give permission for squid user
# chown -R :squid /etc/squid/ssl_cert
2.4.2. In /etc/squid/squid.conf try instead https_port
https_port 3130 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_cert/squid.pem key=/etc/squid/ssl_cert/squid.key
Switch off cert
sslproxy_cert_error allow all
sslproxy_flags DONT_VERIFY_PEER
Set secure connection
ssl_bump server-first all
TCP tunnel
ssl_bump none all
Something else
sslcrtd_program /usr/lib64/squid/security_file_certgen -s /var/lib/ssl_db -M 4MB
2.4.3 While you compile squid special flags shouls be set ./configure --enable-ssl, --enable-ssl-crtd --with-openssl
VPN
1. What VPN protocols we have? OpenVPN (3 free connection), IPSec, Wireguard, Outline
2. What secure protocols we have? SSLv3/TLSv1.2, L2TP, PPTP, SSTP, IKEv2
OUTLINE
1. Outline is inconspicuous.
2. github.com/Jigsaw-Code
3. To install it I need NPM, NodeJS, Goland. I don't want to install all of this without Doker.
HOSTINGS WITH CRYPTO PAYMENT
1. Hostings accept bitcoin
hostvds.com // suspicious
cryptohost.org // People think it is manually maintained by one guy
bitcoin-vps.com // Updated list of VPS
btc-vps.com
liteserver.nl
ishosting.com
iphoster.net
alexhost.com
1984.hosting
njal.la
flokinet.is
orangewebsite.com
buyvm.net
nicevps.net
privex.io
kyun.host // Agregator
kycnot.me // Agregator
melbicom.net
2. If hosting accept monero it probably doesn't have kyc.