SSH is arguably the most basic service on a linux based server. It’s secure as well, when using SSH keys (and with root login and passwords disabled) but it’s still a big target for the “bad guys” (mostly automated bots). You can run SSH on a non-standard port (not port 22), but that is just security through obscurity, which really isn’t good practice.
Well, then along came Zero Trust. Cloudflare perhaps didn’t invent this, but they are the biggest proponent of it. What is it? In my own words, it’s VPN less authentication for web and anything else you can access via the internet. Now we can authenticate down to the user, not just the entire network (like a VPN). How does it work? You authenticate to the Zero Trust Service via a webpage and once that is done, any applications that you have been given access to are automatically authenticated or protected behind the Zero Trust Provider, in this case Cloudflare Can you do the same for SSH? YES SECURELY and IN THE BROWSER. It’s not new, it’s free (for up to 50 applications) and it’s easy to setup. See the original blog post here.
Add an application, making sure you follow these specific steps At this point you can actually login to SSH in the browser, but you will need to authenticate yourself
Configure a short lived certificate to allow automatic login to SSH in the browser A word of warning, the SSO identity you use to authenticate with Cloudflare access will be the username passed to your server, read this section to understand this
The possibilities are endless once you get your head around this. You could protect a WordPress admin login page (though automatic login to WordPress is not something I’ve explored yet). Grant secure access to a server running in another location, and as discussed here, actually login to SSH in the browser.
With this done (Zero Trust SSH) you can go ahead and close port 22 of your server. How much safer do you feel?
Managed hosting is a common marketing term many web hosts are now using. It means different things to different people, but let’s explain what it means to you as our customer.
People. The person who you interact with will personally have the access and authority to resolve or action your request. None of our support is outsourced.
Product. We’re not just providing you a hosting service, we are providing you a fully managed product. You tell us what you need, we make it happen. For example you may ask: “Please duplicate this existing website of mine to a new location” or “I need a new WordPress site setup on this domain”. We do the rest. We don’t just give you what you asked for, we go further and setup our tools to give you what you need (as well as what you asked for) not only caring for your current needs, but also anticipating what you will need in the future.
Systems. We have systems in place to proactively monitor, audit and resolve any security and website issues. This is in your best interests as it means less problems (or none at all) with your websites. We know of any issues and resolve them before you even notice.
Speed. We want you to have the fastest loading website you can. We work with you to optimise and setup our custom caching and speed solutions. Some of these may include CDN, NGINX, FastCGI, Redis Database query caching.
Security. The internet is a dangerous place, so we have setups that automatically block bad traffic and malicious login attempts and well known hacks. We monitor live certain key files on your website to ensure that none of them have been modified without your knowledge. We update your website and any plugins (WordPress/Joomla) for you. This isn’t a paid add-on, we offer it free for all customers.
Backups. You’ve heard of them, have you had to use them? Was it easy? We provide free off server backups to you, so you have access to them at the same time we do. We provide you a tool in your website that allows you to restore from these backups at any time.
DNS and Domains. We provide a fully managed DNS service to you. You don’t have to understand DNS to work with us, we will look after it all for you. SPF, DKIM, DDNSEC, CNAME, AAAA, SSL etc, we know all this so you don’t have to.
Flexibility. There is no one size fits all solution, so we will tailor the hosting solution to meet you and your customers needs. As your site grows, we grow with you.
Some of you may have noticed that our website URL has changed from xyzulu.hosting to xyzuluhosting.com
For some time we have been watching the price of our domain name xyzulu.hosting climb well past $500 AUD per year, and we just can’t justify spending that much on a domain name when a .com costs just $23 per year. So, we’ve moved over to xyzuluhosting.com as of today. We will be redirecting traffic and emails sent directly to our support email address for at least 12 months more. In any case, if you notice the change, you can be assured nothing else is changing with our services.