- Introduction
- Setup_Server
- Node-red
- Hosting_to_the_world
- Security
- Extras * automatic_increasing_ban_times
This Guide is for setting up a secure Dedicated Server.
Running node-red
This guide assumes you have a running server with Ubuntu 20.04 and that you have access to terminal on the server. You can host this yourself however this guide does not address port forwarding from routers or DMZ settings and or ipv6 settings.
You need a Domain Name and the ability to point it to your IP address. Let’s Encrypt doesn’t issue certificates for bare IP addresses, only domain names. You’ll need to register a domain name in order to get a Let’s Encrypt certificate.
What your server needs: a visable IP address to the internet to include if you wish a ipv6 address.
I used a VPS (Virtual Private Server) provider. For less than $10 a month, I have a server, and I have complete root access to and can spin up Ubuntu on. I used https://servercheap.net/pricing.php I was not paid or compensated to link them. Its just what I use.
I suggest you purchase a server close to your geographical location.
If all you are going to use this server for is node-red you will only need 1gb of ram and 1 cpu however I recommend 2gb of ram and 2 cpu's
MORE! ram and cpu if you plan on running Huge flows with multiple/constantly running injections
This Guide is not for individuals who fear the CLI (command line interface). If you have issues your going to need to read and search. You can always open an issue here https://github.com/meeki007/node-red-server-howto-guide/issues and if i have time I can try to help.
Bring up a terminal on the server
You should never log into your server as root. example ssh root@youripaddress
If you have not or no privileged user account exists lets create one.
If you have a privileged user account you can skip this step
In terminal:
$ adduser YourChosenNameHere
Give your new user account sudo rights by appending (-a) the sudo group (-G) to the user’s group membership:
In terminal:
$ usermod -a -G sudo YourChosenNameHere
Exit root account and login with the new privileged user account you have created
Update the local repositories and upgrade the operating system and installed applications by applying the latest patches.
Keep settings or files during the upgrade if asked. Follow the suggestions presented in terminal
In terminal:
$ sudo apt update && sudo apt upgrade -y
If you have a firewall setup you can skip this step.
Install a firewall, enable it, and configure it only to allow network traffic that you designate
In terminal:
$ sudo apt install ufw
UFW (universal firewall) denies all incoming connections and allows all outgoing connections
Enable access to SSH, HTTP, and HTTPS
In terminal:
$ sudo ufw allow ssh
$ sudo ufw allow http
$ sudo ufw allow https
Now lets start UFW
In terminal:
$ sudo ufw enable
You can see what services are allowed and denied with:
In terminal:
$ sudo ufw status
If you ever want to disable UFW, you can do so by typing:
In terminal:
$ sudo ufw disable
Fail2ban is an application that examines server logs looking for repeated or automated attacks. If any are found, it will alter the firewall to block the attacker’s IP address either permanently or for a specified amount of time.
In terminal:
$ sudo apt install fail2ban -y
Copy the included configuration file
In terminal:
$ sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
And restart Fail2ban
In terminal:
$ sudo service fail2ban restart
Install follows the guide @ https://nodered.org/docs/getting-started/raspberrypi
Using the install script method works for Ubuntu
Install possible dependency build-essential first
In terminal:
$ sudo apt install build-essential git
Install nod-red and its dependencies
In terminal:
$ bash <(curl -sL https://raw.githubusercontent.com/node-red/linux-installers/master/deb/update-nodejs-and-nodered)
We want node-red to run automatically every time the server restarts
In terminal:
$ sudo systemctl enable nodered.service
We need to setup our DNS for our domain. Install Nginx to reverse proxy so users don't have to enter a port to get to the server. Install Lets encrypt certbot to issue ssl certificates and automate the process so you never have to manually renew ssl certificates; also so users can access the site using https for security and so browsers will not complain and block access. Configure fail2ban so random people on the internet can't mess with your server.
Nginx is a web server which can also be used as a reverse proxy.
By default, Nginx is configured to start automatically when the server boots/reboots
In terminal:
$ sudo apt install nginx
Check to see if Nginx is running
In terminal:
$ systemctl status nginx
Check to see if Nginx is hosting properly.
In a web browser type your servers ip address with no port. IE http://server_ip
You should see a welcome to nginx page
You need to tie your server ipv4 and if you have one ipv6 addresses to you DNS records.
I like to use subdomains for my reverse proxy needs in Nginx.
Log into your domain name hosting provider of choice and add some records.
DNS advice is outside the scope of this tutorial. You will need to learn and or ask your provider for help if you do not understand the steps below.
Create an A record for your ipv4 server address.
Create an AAAA record for your ipv6 server address.
Now Create a CNAME record pointing a subdomain to your domain name. IE your_domain_name.com
It should look somting like this:
| Hostname | Type | Address / Value |
|---|---|---|
| A | server_ipv4_address | |
| AAAA | server_ipv6_address | |
| www | CNAME | your_domain_name.com |
| node-red | CNAME | your_domain_name.com |
The goal of all this is to create the address node-red.your_domain_name.com for users to access
You can pick a subdomain name of your choice.
Testing that your domain works with Nginx. Enter your domain name. http://your_domain_name.com
You should see a welcome to nginx page
If not DO NOT PASS GO. Fix your domain issues.
This is used so when users goto node-red.your_domain_name.com they are directed to the node-red server running on port :1880
First create a server block file for the url , making sure to change:
server_name node-red.your_domain_name.com;
To the subdomain.domain.com that you own
In terminal:
$ sudo nano /etc/nginx/sites-available/node-red.your_domain_name.com
This will open a text editor
Paste the following into the editor, making sure to change one line:
server_name node-red.your_domain_name.com;
To the subdomain.domain.com that you own
#proxy for node-red @ port :1880
server {
listen 80;
listen [::]:80;
server_name node-red.your_domain_name.com;
location = /robots.txt {
add_header Content-Type text/plain;
return 200 "User-agent: *\nDisallow: /\n";
}
location / {
proxy_pass http://127.0.0.1:1880;
#Defines the HTTP protocol version for proxying
#by default it it set to 1.0.
#For Websockets and keepalive connections you need to use the version 1.1
proxy_http_version 1.1;
#Sets conditions under which the response will not be taken from a cache.
proxy_cache_bypass $http_upgrade;
#These header fields are required if your application is using Websockets
proxy_set_header Upgrade $http_upgrade;
#These header fields are required if your application is using Websockets
proxy_set_header Connection "upgrade";
#The $host variable in the following order of precedence contains:
#hostname from the request line, or hostname from the Host request header field
#or the server name matching a request.
proxy_set_header Host $host;
#Forwards the real visitor remote IP address to the proxied server
proxy_set_header X-Real-IP $remote_addr;
#A list containing the IP addresses of every server the client has been proxied through
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#When used inside an HTTPS server block, each HTTP response from the proxied server is rewritten to HTTPS.
proxy_set_header X-Forwarded-Proto $scheme;
#Defines the original host requested by the client.
proxy_set_header X-Forwarded-Host $host;
#Defines the original port requested by the client.
proxy_set_header X-Forwarded-Port $server_port;
}
}
Now enable the file by creating a link from it to the sites-enabled directory, which Nginx reads from during startup:
making sure to change:
server_name node-red.your_domain_name.com;
To the subdomain.domain.com that you own
In terminal:
$ sudo ln -s /etc/nginx/sites-available/node-red.your_domain_name.com /etc/nginx/sites-enabled/
To avoid a possible hash bucket memory problem that can arise from adding additional server names, it is necessary to adjust a single value in the /etc/nginx/nginx.conf file. Open the file:
In terminal:
$ sudo nano /etc/nginx/nginx.conf
Now uncomment (remove the # symbol) from the http section line server_names_hash_bucket_size 64; so it looks like this:
http {
...ignore stuff here...
server_names_hash_bucket_size 64;
...ignore stuff here...
}
Next, test to make sure that there are no syntax errors in any of your Nginx files:
In terminal:
$ sudo nginx -t
Restart Nginx to enable your changes:
In terminal:
$ sudo systemctl restart nginx
Later if we ever need to disable a server block file simply remove the symbolic link.
In terminal:
$ sudo rm /etc/nginx/sites-enabled/node-red.your_domain_name.com
And don't forget to restart to effect changes
In terminal:
$ sudo systemctl restart nginx
Test if the reverse proxy is working
Goto your website, non https, and make sure it works
http://node-red.your_domain_name.com
The node-red page should load. I know its tempting but do not configure it now. exit the page / close the browser.
Install certbot to get ssl certificates for domain
at this time cerbot not relesed for ppa package use snap
In terminal:
$ sudo snap install --beta certbot --classic
Generate the certificate for domain
making sure to change:
server_name node-red.your_domain_name.com;
To the subdomain.domain.com that you own
In terminal:
$ sudo certbot --nginx -d node-red.your_domain_name.com
If asked to redirect HTTP traffic to HTTPS, removing HTTP access:
Select 2: Redirect - Make all requests redirect to secure HTTPS access.
Test if https is working
Goto your website, https, and make sure it works
https://node-red.your_domain_name.com
The node-red page should load. I know its tempting but do not configure it now. exit the page / close the browser.
Test that lets encrypt cerbot is working and will automatically update certificates before they expire
In terminal:
$ sudo certbot renew --dry-run
Setup node-reds built in login a password for the admin area, also create a fail2ban filter for 4xx failed requests.
First lets hash a password so we can add it to the settings.js file.
My method of choice for this is to use bcryptjs
Add to your node-red manage pallet node-red-contrib-bcrypt
Now import this flow into node-red
[{"id":"6fb8f86c.3dd218","type":"comment","z":"93ccda7b.0f6118","name":"create a key for a password","info":"","x":220,"y":120,"wires":[]},{"id":"2c990cc6.7e76e4","type":"bcrypt","z":"93ccda7b.0f6118","name":"","action":"encrypt","field":"payload","hash":"payload","rounds":"10","x":570,"y":160,"wires":[["480852c7.37515c"]]},{"id":"e203ec3d.eb8938","type":"inject","z":"93ccda7b.0f6118","name":"","topic":"","payload":"","payloadType":"date","repeat":"","crontab":"","once":false,"onceDelay":0.1,"x":190,"y":160,"wires":[["15919cce.3e10a3"]]},{"id":"15919cce.3e10a3","type":"change","z":"93ccda7b.0f6118","name":"Enter Password Here","rules":[{"t":"set","p":"payload","pt":"msg","to":"MyPassword","tot":"str"}],"action":"","property":"","from":"","to":"","reg":false,"x":380,"y":160,"wires":[["2c990cc6.7e76e4"]]},{"id":"480852c7.37515c","type":"debug","z":"93ccda7b.0f6118","name":"","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"false","x":730,"y":160,"wires":[]}]
Replace MyPassword with your password!!!
Trigger the flow and check the msg.payload
copy the payload as it is your password hash you will need next
We need to setup a user name and password by editing node-red's settings.js file.
Edit the settings.js file in our current privileged_user_account /home/YourChosenNameHere/.node-red/settings.js
We can use $HOME variable to accomplish this
In terminal:
$ nano $HOME/.node-red/settings.js
This will open a text editor
Edit the adminAuth section removing forward slashes // so it looks like this:
adminAuth: {
type: "credentials",
users: [
{
username: "admin",
password: "$2a$08$zZWtXTja0fB1pzD4sHCMyOCMYz2Z6dNbM6tl8sJogENOMcxWV9DN.",
permissions: "*"
}
]
}
Replace $2a$08$zZWtXTja0fB1pzD4sHCMyOCMYz2Z6dNbM6tl8sJogENOMcxWV9DN. within QUOTES with your password hash you created.
More information on this can be found at: https://nodered.org/docs/user-guide/runtime/securing-node-red
Every time a user....hacker...etc tries to login to node-red with a bad user name or password it sends a 403 Forbidden error
This response code indicates that the server understood the request but refuses to authorize it
What we would like todo is ban users who have multiple failed attempts to login
That way we can keep the bad people from password spamming the server trying to gain access.
Lets block 404, 444, 403, 400 responses from the server. Feel free to read up on these codes but the gist of it is we will be blocking people trying to gain access to areas they should not be trying to get into.
Create a new fail2ban filter for 404, 444, 403, 400 responses from the server.
In terminal:
sudo nano /etc/fail2ban/filter.d/nginx-4xx.conf
This will open a text editor
Add the following to the file:
[Definition]
failregex = ^<HOST>.*"(GET|POST).*" (404|444|403|400) .*$
ignoreregex =
Now, edit your /etc/fail2ban/jail.conf, to use the new filter we created and ban after 10 failed attempts.
In terminal:
$ sudo nano /etc/fail2ban/jail.conf
This will open a text editor
Add the following to the bottom of the file:
[nginx-4xx]
enabled = true
port = http,https
logpath = %(nginx_access_log)s
maxretry = 10
Restart fail2ban
In terminal:
$ sudo service fail2ban restart
Check that the new rule is working
In terminal:
sudo fail2ban-client status nginx-4xx
Now the user will be banned for the amount of time you have set in fail2ban after 10 failed attempts
you can check this is working with the logs.
In terminal:
$ sudo cat /var/log/fail2ban.log | grep Ban
and to check in on what the nginx log is producing
In terminal:
$ sudo cat /var/log/nginx/access.log
Many malicious actors will just take note of the fixed ban time and just keep at it every 10min. Instead of increasing the fixed time we want to increase the time for specific bad actors and not every one.
In terminal:
$ sudo nano /etc/fail2ban/jail.conf
This will open a text editor
search for and remove the # sign in front of the following lines so they look like this:
bantime.increment = true
bantime.factor = 1
bantime.formula = ban.Time * (1<<(ban.Count if ban.Count<20 else 20)) * banFact>
Restart fail2ban
In terminal:
$ sudo service fail2ban restart
END OF TUTORIAL