Transcription
Hello everyone and welcome back to the Web Nestify channel. In today's video, we will follow up on our last week video, the SSH guide. So in this video particularly, we will continue our excloud uh series. So in this part two, we will secure the SSH on XCloud uh servers. And this is really necessary because by default, yes, it is secure as it can be but we still can take it further and follow zero trust principles.
So what will we basically do? We will completely uh disable the port 22 for SSH uh connections while keeping the excloud management agents communicating. So that means the SSH will be whitelisted to the excloud management IP addresses and then we will connect from our local taillet which is uh modern and it follows zero trust principles in 2026. So this video will be relatively shorter and easy to follow. So, uh, stick around and, uh, let me know if you have any issues, questions, leave the comments down below or even you can hit me up on, uh, Excloud community on Facebook and where I can answer some of your questions. So, stick around and yeah, by the end of this video, your XCloud server will be even more secure.
All right. So again uh I am in my virtual machine and I try to uh take this as from not very technical person like day-to-day business owner uh where they usually create servers via API or uh other things. So what we will do at the beginning is to add our user to the server where we can login. So, first what we need to do is uh open any server that you would like to have it. But I recommend you do it you do this uh guide or setup on every single server that you have because there's no reason why you shouldn't, you know. So that's why and I think when we go to the uh management pseudo users uh here we will need to add our uh pseudo user and let me click add a pseudo user and basically what uh uh s p s p s p s p s p s p s p s p s p s pseudo means is you will add administrator administrative account for this server so we will name it uh like SSH it doesn't matter uh pseudo password uh try to generate for example from your bit warden generate a passphrase should be good that and for the SSH key you need if you don't have your SSH key I recommend you watch the SSH guide the last week video but for now click the add SSH key we will do SSH guide doesn't matter what name it is go to your uh vault or your password manager of your choice. Go to SSH, open it and copy the public key. Put that SSH key there. And then what we can do is why my mouse is not working. Uh we can click save and pseudo user has been queued. It will be added shortly. That's completely fine.
Now what we need to do is basically we need to uh log to our server. So let me open a terminal. Let me clear this. And it's going to be SSH SSH at that one. Are you sure you want to continue? Of course you do. And now the bit warden is asking that you want to authorize this SSH request for this user and you want to authorize and this is already step one of proper security in 2026 for basic things. So uh now you can see we are logged at SSH and we can do who am I and we on SSH and now we need to elevate ourselves to the sudo. So we do sudo y and now you need to enter your password. So let me go to the bit warden. We go to generation history and I think is this one. Let me copy that. Nope, it's not that. So, it will be probably this one then.
Okay. So, once you uh logged in as uh root or elevated yourself as root, what we now uh going to check is the firewall rules on the server. So, we can do UF status numbered. And as you can see, the XCloud comes with the default firewall which allows uh HTTP3 443 UDP, HTTPS and also uh HTTP on port 80. But uh yeah and then it also automatically whitelist all the excloud server IP management uh servers which are used to communicate between xcloud your dashboard and your servers but one thing that uh yeah that's that's fine. So we can verify that we have those rules that's completely perfect.
Now let's go back to the uh excloud dashboard. And let's go to the security and the firewall management. And as you can see, basically you have the firewall management for the UFW right here in your dashboard. So you don't need to basically do the command line interface. So for example, let me test that. Let's do uh rule test port anything and let's do TCP traffic allow add rule and we should soon also see this port when we do u status numbered and as you can see we have this port here. So basically the xcloud user interface is uh UI for the UFW. So we can now easily remove this firewall rule because we don't need it. Okay, the firewall rules is deleted. And basically what are we going to do today? We're going to completely remove this any to22. And for that if you follow my uh part one of SSH uh you need to get your tailscale free account and then you need to onboard your device. So what we need to do first is go to access control. If you did not start your tel scale first, all the zero trust principles are in access control list and this is really necessary to get it right because with ACL's you control who can get where and this is important.
So first let me create the tax and we will create for example tag for our workstation machine and tag owner usually is your account. You can save the tag and then we will create tag for the excloud SSH and tag owner again it will be your account. Click save. So t workstation machine is this virtual machine or any any computer you are currently logged in like Windows, Linux, Mac OS it doesn't matter and then we have the tag excloud SSH which will add to all xcloud uh servers then you go to general access rules and we will add our rule. So for the source where you want to connect from you can use all users in devices but we are following zero trust. So it will be only tag uh workstation machine and destination to connect to will be xcloud SSH and ports and protocols we don't want all ports and protocols we will do just TCP 22 and that's it and there will be excloud SSH and this is our access control access grant perfect so now when we go to machine. This is our Mac OS workstation where I'm recording. So, I go to edit settings, edit ACL text, and I will add workstation machine. I will remove this old one. Click save. And now we will onboard our excloud server to the tanglet. So, you click add a device Linux server and you can specify the tag. So you do excloud SSH and generate install script and you copy the script in your clipboard. Go to your terminal still as a root and you paste this and it will automatically install the latest tcale agent and it will add our machine to local taillet. So we can SSH via private uh taillet. Perfect. So let's do system control status tail scal everything is correct. Let me clear this. Let me go back to the devices. And as you can see we have our xcloud tutorial machine connected. Great.
So now on you can completely delete this rule because we will SSH via local subnet. So delete this rule. Of course it will ask you that for this you know uh for this it will ask you to add your current IP address to white list. So for example if uh tail scale is down or something happened which is not very likely but in that case always add your current IP to the white list and you understand your risk etc etc. So you want to delete this rule anyway. And this is really good job from the excloud to notifying user what needs to be done. Amazing. So our IP should be invited and we got no port 22 wide open. Same what we can do when you go to your uh server provider firewall you can also disable port 22 globally on the the virtualization layer. Perfect.
So now we should go back to terminal and let me exit that. Actually let's verify if the firewall rule are there. So, UV status numbered and we have no port 22 open anymore, which is what we wanted. So, I do exit and yeah, now all the magic happens. Basically, you can just SSH using the name. So let's do like SSH excloud tutorial. Let's actually user SSH and user is SSH. Want to accept unlock your uh bitward authorize the connection. And there you are. As you can see uh where are we? As you can see the last login was from the public IP address. But when we exit that and SSH again now you see last login is from your local private subnet and this is something that change things a lot of things now you don't need to worry that for SSH vulnerabilities outdated packages some remote code execution on open SSH servers which can happen and now your SSH is completely secure and whitelisted and you are connecting from your local local taillet.
If that's that's basically it for this video is very easy and uh seriously I highly recommend to follow the if you don't have any SSH keys or you don't know how to create a sec SSH then you need to follow the SSH guide from the last week video and you will set up your SSH key in password managers. you will get to know better the tail scale and other options that you have because tail scale is not the only one. There are a couple of them and then you will be up to the speed with this part two of XCloud SSH. And I hope you start to think more like zero trust in mind. Never trust, always verify. And this is really important for your day-to-day operations, your day-to-day life. And this is necessary to keep your to keep your digital business uh secure and sound all the time. So yeah, that's it.
All right, everybody. So uh there you have it. In this video, we secured our excloud uh server with the zero trust principles and modern tools. And uh in the next video part three uh we will we will start exploring how we can even further secure our docker server and docker applications on the xcloud because yes there are some standard things that everyone is doing but I think we can do better right so that's why we will uh secer the docker demon and we will check some applications So stay tuned for the part three and I hope you like this video and if you have any questions feel free to ask me on the ExCloud community forum or Facebook or leave the comments down below. All right, so that's it uh for this video and I see you guys in the next one.