#ColdFusion with Node.js on the Same Server

[lucid-outsourcing-solutions]

Run ColdFusion with Node.js on the Same Server

[myresellerhome]

Best practices to strengthen Plesk server security

For any web hosting company or server administrator, server security is the most important aspect of server management. Every internet company needs to provide careful attention to protecting its servers. In this section, we will discuss the most crucial parts of hardening Plesk servers and monitoring them for security flaws.

What is Plesk? 

Plesk was initially introduced to the public in the year 2001 after being developed by Plesk, Inc., a Russian corporation. In 2003, Plesk was acquired by SWSoft, which then transformed itself into Parallels the following year. After Oakley Capital had purchased it in 2015, it was spun off into its own independent company. The commercial web hosting data centre automation software known as Plesk was designed specifically for Linux/Unix and Windows-based companies that provide commercial hosting services.

The user-friendliness of Plesk's menu makes it an excellent choice as a control panel solution for virtual private servers (VPS) and dedicated servers. To put it another way, a server that uses Plesk is so simple to operate that even someone with little to no prior server administration knowledge may begin managing their server right away. The administrator has the ability to establish client and site templates, which, in essence, is the process of allotting resources for domains and/or customers. In addition, Plesk was developed with the goal of making the normal management and administration of websites easier to perform. On a single server or across numerous servers, Plesk can automate a wide variety of operations and tasks. Plesk is a web hosting platform that comes with a control panel that gives the administrator the ability to set up websites, reseller accounts, e-mail accounts, DNS, and database accounts from a web browser.

Integration of support for content management systems (CMS) is included in Plesk; supported CMS include WordPress, Joomla, and Drupal, among others; this list is not exhaustive. Other technologies, such as Docker, multi-server management, and framework environments for Node.js, PHP, Python, Ruby on rails, and a great deal more, have also been added to it. In addition to Microsoft Windows, Plesk is compatible with a variety of Linux and Unix operating systems. In addition, the MySQL and PostgreSQL databases, the Microsoft SQL Server and Desktop Engine, the Apache Tomcat Java platform server, and the ColdFusion server are all supported by Plesk.

The term "extensions" refers to "add-ons," and those "add-ons" comprise software packs that are not included in the core codebase. These extensions interact and integrate completely with Plesk on every level. In addition, you do not have to pay for extensions that you do not require because Plesk's user interface was built to just add the features that you require.

Hardening the Security of Plesk Servers Using Generic Steps

Latest After installation, Plesk immediately provides a higher level of protection than before. Advisor, which integrates the best possible security practices and speed tune-up of the server and hosted domains, was recently released as part of the Plesk software suite. At the same time, it is a smart idea to make certain that the following normal actions are carried out:

Ensure regular Plesk updates 

Change the strength of your password to Strong.

Install Google Authenticator on your device and use two-step verification to access your account.

To protect the mail server, make use of SSL and TLS.

Set sFTP connection

Restrict the access that administrators have to the system

Limit remote access via XML API

Be sure to make regular use of the Web Application Firewall.

You should make regular use of the WP Toolkit Security Check.

Configure automatic updates for all instances of WordPress.

Ensure that out-of-date web applications are not being used and that those that are being used are regularly updated. Failure to comply with this guideline may result in unanticipated holes in security.

Checking existing websites with VirusTotal's Website Check is recommended.

The Firewall should be used to close any ports that are not currently being used.

Tips for Maintaining Server Safety with Plesk on Linux

Make use of the key file in order to enable SSH access.

When establishing SSH connections, use a port of your choice.

There is no root SSH authentication available.

If you do not use Perl or Python on your website, turn off those languages' support and do not use them yourself. Mod /mod python

Use the Opsani vulnerability scanner.

Configure Fail2Ban to thwart any efforts at hacking.

Stay away from PHP handlers that are served up as Apache modules because this is not a secure approach.

Ensure that the option to update system packages automatically is selected.

Server Security Tips for Plesk under Windows

Custom port usage for RDP connections is a must

Get rid of unused programming languages

Make sure you install the latest Windows updates

Restrict users from overriding handlers via the web. config files

Keep DDOS protection  enabled

Top Security Best Practices to Protect Your Plesk Server

 1. Always Use the Latest Version of Plesk

Before you do anything further, check to see if your Plesk configurations have been brought up to date. The updates to Plesk install any additional components that you might require in order to significantly improve the server's level of security. The most effective method for ensuring the safety of a Plesk server is to ensure that it is always kept up to date. You may determine whether or not you have an updated version by using the following methods:

In the options menu, select the option to "Automatically Install Plesk Updates."

As part of the security updates, you need to make sure that the Plesk Firewalls, Fail2Ban, and ModSecurity packages have been properly installed.

2. The Safeguarding Process

It's possible that the security settings in Plesk will let you make secure FTP connections to the server. You have the ability to change the password settings by using a robust password.

To make changes to the minimum password requirement:

Under "Settings," click "Security." Once there, locate the "Password Strength" button within that section, and choose the level of security that best suits your needs. Now, select the OK button.

If FTP is configured to only allow authorized connections to the server, it can prevent attacks from occurring. The use of a strong password to protect the server from intrusions at the principal login location is one way to increase the level of security provided by Plesk. By employing this strategy, we are able to protect the server from being attacked with brute force.

3. Attack Utilizing Both Fail2Ban and Force

With the assistance of the Fail2Ban, the log files on the Plesk server are monitored and secured against attacks using brute force. It treats as suspect any attempt to log in that is not authorized. In the event that any of these failed login attempts are performed, the Fail2Ban will either send a notification to the user or temporarily prevent the user's IP address from gaining access to the server.

How to Configuration instructions for Fail2Ban

Make a filter that looks for odd activity in log files by utilizing one or more regular expressions. This filter may be used to search for it.

The sentence you receive in jail depends on the specific circumstances of your case. In the event of an attack, this might make it possible to carry out vital measures by utilizing the information that has been provided.

Please provide a listing of the IP address that was provided. You can protect your server from being attacked by limiting access to only the IP addresses that have been allowed.

In addition to this, you might also try either activating or deactivating a jail that you have set up. On the other hand, if you think it's necessary, you might make an effort to unblock the IP address that was previously banned. In general, Plesk comes equipped with a large number of predefined prison configurations and filters.

4. The configuration of the Web Application Firewall under ModSecurity

ModSecurity is a tool that assists in the detection and prevention of attacks on your web applications. The web application firewall has a rule set that decides how to respond to incoming requests and how they should be treated. In other words, the Firewall is activated whenever a user makes a request, and the HTTP request will only acquire material from the website if the check is successful.

Using Plesk, you are now able to activate ModSecurity and add your own personalized configurations to the parameters for the ruleset.

In order to install the ModSecurity component, you should follow these steps:

You will need to navigate to the "Updates and Upgrades" settings in order to get rid of or add any component. Find the Web Hosting Groups by going to the submenu that says "Add/Remove Components" under that.

You now have the option of using predefined ModSecurity rules or creating your own from scratch.

5. Changing the settings on the Firewall

The network connections that are trying to establish a connection to your server are monitored and kept safe by the Plesk Firewall. The following is a list of the steps to configure:

The first thing you need to do is go to "Tools and Settings" and then pick "Firewall Management." Pick "Firewall Rules Management" from the menu, and then activate it.

At this point, a preview of the status box that authorizes the Firewall module will be displayed. You just need to turn it on.

You have successfully arrived at your destination when a green box indicating success displays and the firewall rules management is operational.

To modify the settings of the Firewall,

Using the Plesk Tools and Settings interface, you are able to modify the Plesk Firewall rules.

At this point, pick the SSH server.

Select the option for the property that will permit you to allow traffic from some sources while preventing it from entering from others.

Include the IP address to which you would like access to be granted.

Select the OK button.

What to do in the event that the server's security is breached

Moving everything over to the new server is what we recommend in this situation. If the attack is successful, the invaders will have their privileges raised to the root level, which means they will have complete control over the server. Even if you uncover malware or rootkits during the investigation and remove them, this does not guarantee that there will be no more instances of either on your system. Malware can be loaded straight into RAM if the user so chooses. It is possible for already infected servers to have backdoors enabled or even common cronjobs set up for use in order to download rootkits.

Even if you successfully restore the server to a previous snapshot, there may still be issues with the server. Because, in many instances, it is unclear exactly when the server was hacked and when rootkits were uploaded to the server.

The question now is how to locate the origin of the issue.

When utilizing security solutions that are specifically designed to scan for rootkits and malware, it is important to keep the following in mind: these solutions rely solely on previously identified patterns in order to determine the presence of malware, and they may be completely ineffective in detecting brand new forms of malicious software. Please call a security audit company that specializes in such circumstances if you want to be absolutely certain about how the server was compromised. Please refrain from changing anything before the investigation has been completed in order to prevent the loss of traces.

Conclusion

There are a few recommended procedures that should be carried out in order to improve the security of a Plesk server. Among these is the utilization of a firewall, the updating of software, and the monitoring of logs. In the event that you come under assault, having a backup and security strategy that is kept up to date is of the utmost importance.

Myresellerhome.com

We offer experienced web hosting services that are customized to your specific requirements.

[mylighthost]

Web Server Definition - How does it work?

A web server is a computer connected to a network and has special software installed. The software shows the files (such as HTML, CSS, PHP, js, jar, etc) of the main computer as a website to other computers on the same network. The main function of a web server or internet server is to respond to HTTP requests to deliver website content and services over the internet. It consists of a physical server, operating system (OS) and software used to simplify HTTP communication. 

In this case, you may have a question that a computer connected with a network shows a website. So, if the main device remains off, then how can others use or find it? Obviously, you are unable to access if this really happens. Web hosting companies perform all the activities to mitigates this downtime issue. They maintain the web servers located on different data centers that can make the availability of the website for 24/7. The system may need to be restarted once a year or a month. 

Generally, the web hosting companies and professional web app developers use the webserver software. Besides, people who own a website and want to use server-side technologies, such as, PHP or ColdFusion, can also use the webserver. 

Here I will show how the web servers work.

Obtaining the IP Address

Generally, a website is assigned an IP address when it is first created on a web server. The browser first obtains the IP address from the domain name either by searching in its cache or requesting one or more DNS (Domain Name System) Servers.

Requesting the Full URL

After knowing the IP address the website is located at, the browser requests a full URL from the webserver.

Responding to the Request

Now the browser receives a response from the web server accessing the desired pages. If in any case, the pages do not exist or the browser experiences some errors, the web server will send the appropriate error message.

Now the browser receives a response from the webserver accessing the desired pages. You may see error 404 while accessing a page. It means the page does not exist, an error message sent by the webserver. Another is error 401 which means that your access is denied to us due to providing incorrect credentials such as username, password, etc.

Displaying the Web Page

Finally, the browser displays the web page or error message sending by the web server. 

Popular Web Servers:

Different types of web servers are available in the market. Apache HTTP Server, Microsoft IIS, Nginx Web Server, Apache Tomcat, and LightSpeed Web Server are the popular ones. 

Let us know about some of the popular web servers.

Apache HTTP Server

Apache is a widely used and most popular web server that has been maintained and developed since 1995 through the Apache Software Foundation. It is distributed under an open-source license and available for various operating systems like Windows, Mac OS X, Unix, Linux, Solaris, Novell Netware, and FreeBSD.

Nginx Web Server

Nginx - pronounced as “Engine-Ex, is an open-source HTTP web server that has emerged as the second most popular Web server behind the Apache and Microsoft’s IIS. It currently powers popular websites like Pinterest, WordPress.com, Netflix, Hulu, CloudFlare, Zappos and Zynga, and is now also used as a reverse proxy, HTTP cache, and load balancer.

Nginx can run on Linux, Mac OS X, Solaris, AIX, HP-UX and BSD variants.

Microsoft IIS

Another popular web server is Microsoft IIS (Internet Information Service) that runs on Windows systems to serve requested HTML pages or files. It accepts requests from remote client computers and returns the appropriate response. IIS server is not open source though it has all the features of the Apache server. 

It is developed and maintained by Microsoft, thus it works with all the Windows operating system platforms and will likely be unstable on Linux and Macs.

Apache Tomcat

Apache Tomcat is an open-source server software developed by the Apache Foundation (ASF). It’s written in Java and widely used by web developers when working on web application development. Apache Tomcat provides an environment in which one could run their java code. 

It can be configured using an SSL certificate to secure sensitive data by providing a secure connection and used on Windows, Mac OS, Linux operating systems.

Summarizing all, web servers can be used by an individual or a web hosting company. The main job of a web server is to respond to the browser request to display the website content. As mentioned above that a web server must be set on data centers to be always online for the visitors. To mitigate the downtime issue, companies put their servers on different data centers around the world. 

MyLightHost - web hosting service provider uses the popular web server software like Apache, Nginx, node.js, Tomcat and provides highly protected shared, VPS & managed dedicated server solutions from different data centers with 24/7 support and top-notch uptime.