Fail2ban is a free and open-source intrusion prevention software framework written in Python. It is used to prevent your server from brute-force attacks by continuously monitoring various service logs for unauthorized access. Fail2ban automatically blocks the client’s IP address after too many failed login attempts and other malicious activities attempting to gain access to your server. Using Fail2ban, you can secure various services such as SSH, vsftpd, nginx, Apache, etc.

However, for various reasons, you may need to allow certain IP addresses access to your server, even if they have been banned by Fail2ban. This tutorial will teach you how to whitelist IP addresses in Fail2ban.

Identify the Fail2ban configuration file jail:

Usually, the Fail2ban configuration file is located in the /etc/fail2ban/ directory with the name jail.conf. For best practices, it is recommended that instead of modifying jail.conf, you create a new file called jail.local. Any settings you provide in this file will override the configuration settings in the jail.conf file.

After copying the configuration file as jail.local, you need to modify this file. Open jail.local in any text editor to make modifications.

Here, look for the [DEFAULT] section, and search for the following line:

You need to uncomment or add this line and include the IP addresses that you want to whitelist.

ignoreip = 127.0.0.1/8 ::1 your_ip_address

Here, 'your_ip_address' represents the single or multiple IP addresses that you want to whitelist. You can add multiple IP addresses using spaces or use CIDR notation for a range of addresses.

In our case, we want to whitelist single IP address 206.189.186.84 and subnet range 192.168.1.0/24, So the line should be like as shown below:

ignoreip = 127.0.0.1/8 206.189.186.84 192.168.1.0/24

After modifying the configuration file, you need to restart the Fail2ban service to apply the changes, To do so, execute the command below in the terminal:

You can verify your whitelisted IP addresses by running the below command:

You can also check the Fail2ban log or try accessing the server using that IP address to confirm whether the IP address has been whitelisted or not.

Example:

Let’s manually ban an IP address 192.168.1.51, using the command below:

To verify the same, execute the following command:

Here, you can see the 192.168.1.51 IP address is in the banned IP list.

Let’s whitelist 192.168.1.51 by modifying the jail.local file.

ignoreip = 127.0.0.1/8 206.189.186.84 192.168.1.0/24 192.168.1.51

Now, restart the fail2ban service to apply the changes we just made.

Next, run the below command to verify whether the IP address is whitelisted or not.

Here, You can see 192.168.1.51 got removed from the Banned IP list.

Whitelisting an address is very handy when your IP address gets blocked due to multiple login attempts or accidental. Using these features, you can allow users and services to access your server. For services like vsftpd, you can unblock users by whitelisting their IP addresses if they are banned by Fail2ban. Remember to only whitelist trusted IP addresses for your server's security.

Currently, there is an issue with installing Fail2ban on the newer Ubuntu 24.04. We have tested this on Ubuntu 22.04.

Join our discord channel and discuss fai2ban  or get direct  help from the tech expert by clicking the button below 

Get help

Fail2ban is a free and open-source intrusion prevention software framework written in Python. It is used to prevent your server from brute-force attacks by continuously monitoring various service logs for unauthorized access. Fail2ban automatically blocks the client’s IP address after too many failed login attempts and other malicious activities attempting to gain access to your server. Using Fail2ban, you can secure various services such as SSH, vsftpd, nginx, Apache, etc.
However, for various reasons, you may need to allow certain IP addresses access to your server, even if they have been banned by Fail2ban. This tutorial will teach you how to whitelist IP addresses in Fail2ban.

Prerequisites
A pre-configured system with Fail2ban.
A user with sudo or root privileges.

Identify the Fail2ban configuration file jail:

Usually, the Fail2ban configuration file is located in the /etc/fail2ban/ directory with the name jail.conf. For best practices, it is recommended that instead of modifying jail.conf, you create a new file called jail.local. Any settings you provide in this file will override the configuration settings in the jail.conf file.

 

Modify the configuration file

After copying the configuration file as jail.local, you need to modify this file. Open jail.local in any text editor to make modifications.

 

Here, look for the [DEFAULT] section, and search for the following line:

#ignoreip = 127.0.0.1/8 ::1

You need to uncomment or add this line and include the IP addresses that you want to whitelist.

ignoreip = 127.0.0.1/8 ::1 your_ip_address

Here, 'your_ip_address' represents the single or multiple IP addresses that you want to whitelist. You can add multiple IP addresses using spaces or use CIDR notation for a range of addresses.
In our case, we want to whitelist single IP address 206.189.186.84 and subnet range 192.168.1.0/24, So the line should be like as shown below:

ignoreip = 127.0.0.1/8 206.189.186.84 192.168.1.0/24

Save and exit the editor.

Restart the Fail2ban service

After modifying the configuration file, you need to restart the Fail2ban service to apply the changes, To do so, execute the command below in the terminal:

 

Verify the Whitelisted IPs

To check the jail list:

 

You can verify your whitelisted IP addresses by running the below command:

 

You can also check the Fail2ban log or try accessing the server using that IP address to confirm whether the IP address has been whitelisted or not.

Example:

Let’s manually ban an IP address 192.168.1.51, using the command below:

 

To verify the same, execute the following command:

 

Output:
Status for the jail: sshd
|- Filter
|  |- Currently failed: 1
|  |- Total failed: 1
|  `- File list: /var/log/auth.log
`- Actions
   |- Currently banned: 1
   |- Total banned: 1
   `- Banned IP list: 192.168.1.51

Here, you can see the 192.168.1.51 IP address is in the banned IP list.

Let’s whitelist 192.168.1.51 by modifying the jail.local file.

 

And add 192.168.1.51 IP address to it.

ignoreip = 127.0.0.1/8 206.189.186.84 192.168.1.0/24 192.168.1.51

Now, restart the fail2ban service to apply the changes we just made.

 

Next, run the below command to verify whether the IP address is whitelisted or not.

 

Output:
Status for the jail: sshd
|- Filter
|  |- Currently failed: 2
|  |- Total failed: 3
|  `- File list: /var/log/auth.log
`- Actions
   |- Currently banned: 0
   |- Total banned: 1
   `- Banned IP list:

Here, You can see 192.168.1.51 got removed from the Banned IP list.

Conclusion
Whitelisting an address is very handy when your IP address gets blocked due to multiple login attempts or accidental. Using these features, you can allow users and services to access your server. For services like vsftpd, you can unblock users by whitelisting their IP addresses if they are banned by Fail2ban. Remember to only whitelist trusted IP addresses for your server's security.

Important note: 
Currently, there is an issue with installing Fail2ban on the newer Ubuntu 24.04. We have tested this on Ubuntu 22.04.

Join our discord channel and discuss fai2ban  or get direct  help from the tech expert by clicking the button below 

 
 

Discover the essential steps to whitelist an IP address in Fail2ban. Safeguard your systems effectively, manage access control and enhance security

How to whitelist an IP address in Fail2ban

Looking for an easy tool to automate your Docker setup? 

Check out STACK BUILDER (Web application stack builder)

Let’s see how it works with a simple example!

Case 1: Setting up a basic nginx web server on Digital Ocean cloud.

Just log in to your account, click on STACK BUILDER, and then hit "Build your stack".

Since we don’t have any project, we need to create a new one. Simply click on the "Create new project" button, and you'll see the screen as shown in the screenshot below. From there, you can fill in the details according to your needs.

Here, enter the project name and other necessary details based on your needs. In this example, we'll set up a web server using Nginx. Go to the "Services" option and click on "Add from template"

Here, you'll find various ready-to-use Docker service templates. In our case, select Nginx, as shown below:

Next, you can adjust different settings like App name, Domain, Ports, Environment, Volumes, Networking, Docker Restart Policy, and more. In our case, we'll configure it without a domain name and using default predefined settings.

Once you've set up all the parameters, click on the "Continue" button. Then, choose your preferred cloud provider. In our example, we've selected DigitalOcean.

After selecting Digital Ocean, you'll see a screen like the one below, where you'll need to provide your Personal Access Token.

To get your Personal Access Token, follow the steps outlined in this link: https://try.direct/clouds/deploy-to-digital-ocean

Once you've generated your Personal Access Token on Digital Ocean, paste it in the designated field, as shown in the screenshot below:

Here, you can choose the Datacenter, Hardware configuration, and Base image by simply clicking on them. You can also select the number of Instances you need.

Next, click on continue button, and you will see your Docker-compose file in the next screen:

Review the docker-compose content, then click on the "Deploy" button to start your deployment automatically. It will take approximately 15 minutes. You can also check the runtime logs.

Once, the process is completed, you will see the screenshot similar to the below:

You'll notice the droplet has been automatically created in your DigitalOcean account. To access the Nginx webpage, simply enter your domain name or server IP address.

We have successfully set up Nginx web-server on Docker using Stack Builder.


Looking for an easy tool to automate your Docker setup? 
Check out STACK BUILDER (Web application stack builder)

Let’s see how it works with a simple example!

Case 1: Setting up a basic nginx web server on Digital Ocean cloud.
Just log in to your account, click on STACK BUILDER, and then hit "Build your stack".


 


You will see the screen as shown below:


 


Since we don’t have any project, we need to create a new one. Simply click on the "Create new project" button, and you'll see the screen as shown in the screenshot below. From there, you can fill in the details according to your needs.



 


Here, enter the project name and other necessary details based on your needs. In this example, we'll set up a web server using Nginx. Go to the "Services" option and click on "Add from template"


 


Here, you'll find various ready-to-use Docker service templates. In our case, select Nginx, as shown below:



 


Next, you can adjust different settings like App name, Domain, Ports, Environment, Volumes, Networking, Docker Restart Policy, and more. In our case, we'll configure it without a domain name and using default predefined settings.
Once you've set up all the parameters, click on the "Continue" button. Then, choose your preferred cloud provider. In our example, we've selected DigitalOcean.


 


After selecting Digital Ocean, you'll see a screen like the one below, where you'll need to provide your Personal Access Token.
To get your Personal Access Token, follow the steps outlined in this link: https://try.direct/clouds/deploy-to-digital-ocean
Once you've generated your Personal Access Token on Digital Ocean, paste it in the designated field, as shown in the screenshot below:


 


Here, you can choose the Datacenter, Hardware configuration, and Base image by simply clicking on them. You can also select the number of Instances you need.


 


Next, click on continue button, and you will see your Docker-compose file in the next screen:


 


Review the docker-compose content, then click on the "Deploy" button to start your deployment automatically. It will take approximately 15 minutes. You can also check the runtime logs.


 


Once, the process is completed, you will see the screenshot similar to the below:


 


You'll notice the droplet has been automatically created in your DigitalOcean account. To access the Nginx webpage, simply enter your domain name or server IP address.


 


We have successfully set up Nginx web-server on Docker using Stack Builder.

Install Nginx on DigitalOcean using the ultimate simplifier for docker-compose builds and seamless deployment to the cloud | TryDirect

Install NGINX with application Stack Builder

Adding a public key to your server is an important step for enhancing security and enabling secure, password-free logins using SSH (Secure Shell).

Generate a Key Pair: Use ssh-keygen to create a new SSH key pair if you don't already have one. This includes both a public and a private key.

Locate the Public Key: Use cat ~/.ssh/id_rsa.pub to display your public key. This key needs to be copied to your server.

Copy the Public Key to Your Server: Use the ssh-copy-id command or manually append the public key to the ~/.ssh/authorized_keys file on your server.

Test Your Connection: Attempt to SSH into your server using ssh your_username@your_server_ip to confirm that you can log in without a password prompt, verifying that the setup was successful.

Here’s a step by step guide on how to do it, explained in simple terms:

If you do not already have an SSH key pair (which consists of a public and a private key), you will need to create one. On your local computer, open a terminal or command prompt and run the following command:

-t rsa specifies the type of key to create, in this case RSA.

-b 2048 specifies the key length, with 2048 bits being a good balance of security and performance.

Follow the prompts to specify where to save the key (by default, this is in the .ssh directory under your user directory) and whether to secure the key with a passphrase.

Once the key pair is generated, you need to find your public key. It’s usually named id_rsa.pub or similar, located in the .ssh directory. You can display the key with the command:

This command prints the contents of your public key file. It will look something like this:

Step 3: Copy the Public Key to Your Server

To enable authentication with your public key, you need to add it to a special file in the user account you are using on the server. This file is located at ~/.ssh/authorized_keys.

You can copy the public key to your server by using the ssh-copy-id command. Replace your_username@your_server_ip with your actual username and server IP address:

If ssh-copy-id is not available, you can manually add the key by appending it to the authorized_keys file. You can do this by running: 

This command connects to your server, creates the .ssh directory if it doesn’t exist, and appends the public key to the authorized_keys file.

Finally, test your SSH connection to ensure that the key has been added successfully and you can log in without a password (unless you set a passphrase, which you will need to enter):

If everything is set up correctly, you should be logged into your server without needing to enter your user password.

Permissions: Make sure that the .ssh directory and the authorized_keys file on the server have strict permissions set. This can be done using:

Security: Always keep your private key secure and never share it. Use a strong passphrase for an extra layer of security.

Security Enhancement: Adding your public key to the server's authorized_keys enables secure, password-less authentication, which is more secure against brute-force attacks than password-based login methods.

Permissions: Ensure that the .ssh directory and the authorized_keys file on the server have proper permissions set to prevent unauthorized access. This means setting the directory to 700 and the file to 600.

Private Key Safety: The private key should remain confidential and never be shared. Securing it with a passphrase provides an additional layer of security.

Convenience and Efficiency: Using SSH keys speeds up the login process and can facilitate automated processes by allowing scripts and programs to securely access the server without manual password entry.

Still have difficulties ?  Join our community discord channel, get help and free consultation! 

Need a quick help from the Linux expert ? 

Get help from tech expert

Adding a public key to your server is an important step for enhancing security and enabling secure, password-free logins using SSH (Secure Shell).

Major Steps:
Generate a Key Pair: Use ssh-keygen to create a new SSH key pair if you don't already have one. This includes both a public and a private key.
Locate the Public Key: Use cat ~/.ssh/id_rsa.pub to display your public key. This key needs to be copied to your server.
Copy the Public Key to Your Server: Use the ssh-copy-id command or manually append the public key to the ~/.ssh/authorized_keys file on your server.
Test Your Connection: Attempt to SSH into your server using ssh your_username@your_server_ip to confirm that you can log in without a password prompt, verifying that the setup was successful.
Here’s a step by step guide on how to do it, explained in simple terms:

Step 1: Generate a Key Pair
If you do not already have an SSH key pair (which consists of a public and a private key), you will need to create one. On your local computer, open a terminal or command prompt and run the following command:

 

-t rsa specifies the type of key to create, in this case RSA.
-b 2048 specifies the key length, with 2048 bits being a good balance of security and performance.
Follow the prompts to specify where to save the key (by default, this is in the .ssh directory under your user directory) and whether to secure the key with a passphrase.

Step 2: Locate the Public Key
Once the key pair is generated, you need to find your public key. It’s usually named id_rsa.pub or similar, located in the .ssh directory. You can display the key with the command:

 

This command prints the contents of your public key file. It will look something like this:

 


Step 3: Copy the Public Key to Your Server

To enable authentication with your public key, you need to add it to a special file in the user account you are using on the server. This file is located at ~/.ssh/authorized_keys.
You can copy the public key to your server by using the ssh-copy-id command. Replace your_username@your_server_ip with your actual username and server IP address:

 

If ssh-copy-id is not available, you can manually add the key by appending it to the authorized_keys file. You can do this by running: 
This command connects to your server, creates the .ssh directory if it doesn’t exist, and appends the public key to the authorized_keys file.

Step 4: Test Your Connection
Finally, test your SSH connection to ensure that the key has been added successfully and you can log in without a password (unless you set a passphrase, which you will need to enter):

ssh your_username@yourserver_ip 

If everything is set up correctly, you should be logged into your server without needing to enter your user password.

Additional Tips
Permissions: Make sure that the .ssh directory and the authorized_keys file on the server have strict permissions set. This can be done using:

 

 

Security: Always keep your private key secure and never share it. Use a strong passphrase for an extra layer of security.

Important Conclusions:
Security Enhancement: Adding your public key to the server's authorized_keys enables secure, password-less authentication, which is more secure against brute-force attacks than password-based login methods.
Permissions: Ensure that the .ssh directory and the authorized_keys file on the server have proper permissions set to prevent unauthorized access. This means setting the directory to 700 and the file to 600.
Private Key Safety: The private key should remain confidential and never be shared. Securing it with a passphrase provides an additional layer of security.
Convenience and Efficiency: Using SSH keys speeds up the login process and can facilitate automated processes by allowing scripts and programs to securely access the server without manual password entry.

Still have difficulties ?  Join our community discord channel, get help and free consultation! 
Need a quick help from the Linux expert ? 
 
 


Learn how to securely add a public key to your server. Enhance your server's security and simplify authentication processes effortlessly

How to add public key to your server

We are happy to introduce Stack Builder (beta) – a tool to Seamless Cloud Deployments! 🌐✨

Stack Builder was developed in response to multiple customer requests, and our aim was to keep it as simple as possible. While it is currently in beta, you can still enjoy its features.

Cloud Freedom: Explore the clouds like never before! Whether it's Digital Ocean, Hetzner Cloud, Linode, or beyond – Stack Builder empowers you to experiment and find the perfect cloud match for your projects.

DevOps Simplicity: DevOps can be as easy as 1-2-3! With our user-friendly interface and step-by-step guides, even beginners can become cloud maestros in no time.

Time Savings for Developers: The tool is perfect for developers who want to showcase their applications in the cloud, especially when considering the time spent.

combine various solutions available as Docker images, including those from Docker Hub. 

integrate your own application or set of applications into a solution  that results in a single Docker Compose file. 

This comes with the  ability to select the cloud and instantly deploy the solution, complete  with automatic infrastructure setup, VPS server, networks, firewalls.

"Great tool if you understand the concept of docker compose" 

"I was drowning in cloud complexity until I found TryDirect. Now, deploying applications feels like a walk in the cloud!"

"I was using OroCommerce on Google Cloud but then I wanted to try some other clouds, TryDirect helped me to setup oro on Hetzner Cloud and did that easy"    

We are happy to introduce Stack Builder (beta) – a tool to Seamless Cloud Deployments! 🌐✨

Stack Builder was developed in response to multiple customer requests, and our aim was to keep it as simple as possible. While it is currently in beta, you can still enjoy its features.

🌟 Why Stack Builder:

Cloud Freedom: Explore the clouds like never before! Whether it's Digital Ocean, Hetzner Cloud, Linode, or beyond – Stack Builder empowers you to experiment and find the perfect cloud match for your projects.
DevOps Simplicity: DevOps can be as easy as 1-2-3! With our user-friendly interface and step-by-step guides, even beginners can become cloud maestros in no time.
Time Savings for Developers: The tool is perfect for developers who want to showcase their applications in the cloud, especially when considering the time spent.

✨ What you can do with Stack Builder:

With Stack Builder, you can: 
combine various solutions available as Docker images, including those from Docker Hub. 
integrate your own application or set of applications into a solution  that results in a single Docker Compose file. 
This comes with the  ability to select the cloud and instantly deploy the solution, complete  with automatic infrastructure setup, VPS server, networks, firewalls.

🌟 What DevOps Heroes Say:

"Great tool if you understand the concept of docker compose" 
"I was drowning in cloud complexity until I found TryDirect. Now, deploying applications feels like a walk in the cloud!"
"I was using OroCommerce on Google Cloud but then I wanted to try some other clouds, TryDirect helped me to setup oro on Hetzner Cloud and did that easy"    


👉 Try it today, its FREE !


Cloudily Yours, TryDirect Team

Stack Builder (beta) – a tool to Seamless Cloud Deployments! Compose your solution from docker images including your personal apps. 



🚀 Introducing Stack Builder (beta)

🚀 Introducing Bastillion to Our Platform!

Are you in search of a solution to simplify secure remote access to your servers and network devices while ensuring top-notch security practices and compliance? Look no further than Bastillion, the open-source, web-based SSH console, and file transfer tool.

Whether you are an IT administrator, a managed service provider, or a cloud service provider, Bastillion has got you covered. It is designed to streamline remote access management, enhance security through role-based access control, and meet compliance requirements.

Getting started with Bastillion is a breeze! Our deployment process sets up Bastillion as a Docker container, complete with all the necessary configuration files, including docker-compose.yml. This empowers you to independently manage your server and carry out your development tasks without the need for additional assistance—simply follow the provided steps.

For more details, visit https://try.direct/applications/bastillion

🚀 Introducing Bastillion to Our Platform!

🔒 What is Bastillion 
Are you in search of a solution to simplify secure remote access to your servers and network devices while ensuring top-notch security practices and compliance? Look no further than Bastillion, the open-source, web-based SSH console, and file transfer tool.

🌐 Who Can Benefit? 
Whether you are an IT administrator, a managed service provider, or a cloud service provider, Bastillion has got you covered. It is designed to streamline remote access management, enhance security through role-based access control, and meet compliance requirements.

📚 How to Begin? 
Getting started with Bastillion is a breeze! Our deployment process sets up Bastillion as a Docker container, complete with all the necessary configuration files, including docker-compose.yml. This empowers you to independently manage your server and carry out your development tasks without the need for additional assistance—simply follow the provided steps.
For more details, visit https://try.direct/applications/bastillion

Simplify Bastillion deployment on your own cloud-based VPS effortlessly | TryDirect

Meet Bastillion at TryDirect 

Introducing HashiCorp Vault to our platform!

Whether you're a software developer or a system administrator, the HashiCorp Vault stack has got your interests covered. Tailor-made for contemporary DevOps and cloud-native configurations, it streamlines secrets administration and ensures top-tier security measures.

After successfully deploying HashiCorp Vault, an email notification will gracefully walk you through accessing both the server and the Vault Web UI. Just follow the provided steps to wrap up the setup hassle-free.

Introducing HashiCorp Vault to our platform!

🌐 Who's in for Gains? 
Whether you're a software developer or a system administrator, the HashiCorp Vault stack has got your interests covered. Tailor-made for contemporary DevOps and cloud-native configurations, it streamlines secrets administration and ensures top-tier security measures.

📚 How to Start? 
After successfully deploying HashiCorp Vault, an email notification will gracefully walk you through accessing both the server and the Vault Web UI. Just follow the provided steps to wrap up the setup hassle-free.


TRY NOW !

HashiCorp Vault painless deployment to your cloud account

HashiCorp Vault has arrived!

We are happy to announce that Nginx Proxy Manager,  is now available as a companion app to almost any stack on our platform!

Nginx Proxy Manager – your ultimate solution, ready for installation from our platform!

🔐 Why Opt for Nginx Proxy Manager: Bid farewell to the intricacies of traffic routing. 

Nginx Proxy Manager effortlessly directs traffic to your websites, whether they're hosted at home or elsewhere. What's more, it comes with complimentary SSL capabilities, eliminating the necessity for Nginx or Letsencrypt expertise. Simplify SSL generation and seamlessly proxy your Docker containers with unparalleled ease.

👨‍💻 Navigating Nginx Proxy Manager: Nginx Proxy Manager stands out as a highly recommended companion app for efficient web app management. Designed to handle numerous web applications at the backend, it's your secret recipe for streamlined operations. For added convenience, we also recommend integrating Portainer CE.

Don't forget, configuring the proxy host in Nginx Proxy Manager post-deployment is your gateway to seamless web traffic management.

Elevate your web traffic strategy with Nginx Proxy Manager – now at your fingertips!

We are happy to announce that Nginx Proxy Manager,  is now available as a companion app to almost any stack on our platform!
Nginx Proxy Manager – your ultimate solution, ready for installation from our platform!

🔐 Why Opt for Nginx Proxy Manager: Bid farewell to the intricacies of traffic routing. 
Nginx Proxy Manager effortlessly directs traffic to your websites, whether they're hosted at home or elsewhere. What's more, it comes with complimentary SSL capabilities, eliminating the necessity for Nginx or Letsencrypt expertise. Simplify SSL generation and seamlessly proxy your Docker containers with unparalleled ease.

👨‍💻 Navigating Nginx Proxy Manager: Nginx Proxy Manager stands out as a highly recommended companion app for efficient web app management. Designed to handle numerous web applications at the backend, it's your secret recipe for streamlined operations. For added convenience, we also recommend integrating Portainer CE.

Don't forget, configuring the proxy host in Nginx Proxy Manager post-deployment is your gateway to seamless web traffic management.
Elevate your web traffic strategy with Nginx Proxy Manager – now at your fingertips!

Optimize web traffic management with Nginx Proxy Manager! Simplify traffic routing, secure websites with free SSL, and streamline Docker container proxying.

Nginx Proxy Manager is now available for install

🚀 Exciting News Update from TryDirect!


We're excited to share the news that FastAPI is now accessible for deployment on the TryDirect platform.

Simplifying the journey, TryDirect orchestrates a comprehensive VPS server setup, complete with all essential software. 

This empowers developers to seamlessly initiate their FastAPI projects in their favored cloud environment.

FastAPI, a globally acclaimed Python web framework, has ushered in a transformative paradigm shift for Python software development. Its exceptional speed and user-friendly design have revolutionized the process of API creation. Witness the remarkable transformation first-hand today! 🌐

Additionally, we recommend incorporating Portainer CE and Nginx Proxy Manager into your FastAPI deployment strategy. This integration empowers developers to proficiently manage Docker containers while effortlessly configuring domain and SSL settings. By embracing these tools, you'll optimize your management workflow and elevate your deployment experience. 🛠️🌐🔒

🚀 Exciting News Update from TryDirect!

We're excited to share the news that FastAPI is now accessible for deployment on the TryDirect platform.
Simplifying the journey, TryDirect orchestrates a comprehensive VPS server setup, complete with all essential software. 
This empowers developers to seamlessly initiate their FastAPI projects in their favored cloud environment.

FastAPI, a globally acclaimed Python web framework, has ushered in a transformative paradigm shift for Python software development. Its exceptional speed and user-friendly design have revolutionized the process of API creation. Witness the remarkable transformation first-hand today! 🌐

Additionally, we recommend incorporating Portainer CE and Nginx Proxy Manager into your FastAPI deployment strategy. This integration empowers developers to proficiently manage Docker containers while effortlessly configuring domain and SSL settings. By embracing these tools, you'll optimize your management workflow and elevate your deployment experience. 🛠️🌐🔒

Deploy FastAPI on your own VPS in few clicks, test, play

FastAPI has arrived!

Exciting tidings await as we unveil remarkable news! We're thrilled to announce the availability of OpenResty, the dynamic web platform integrating Nginx and LuaJIT, for seamless deployment on your preferred cloud infrastructure, courtesy of TryDirect.

Are you a developer or a pioneering startup in pursuit of a rapid, adaptable, and user-friendly platform that simplifies the creation of web applications and services? Look no further, for OpenResty is your unparalleled answer.

This is your golden opportunity to propel your projects to new heights. Venture to our website to discover the wealth of captivating details on harnessing the enchantment of OpenResty. Let's embark on a shared journey of crafting web development into a truly delightful and seamless experience! 🌐🌟

🚀 Greetings, our vibrant community!

Exciting tidings await as we unveil remarkable news! We're thrilled to announce the availability of OpenResty, the dynamic web platform integrating Nginx and LuaJIT, for seamless deployment on your preferred cloud infrastructure, courtesy of TryDirect.

Are you a developer or a pioneering startup in pursuit of a rapid, adaptable, and user-friendly platform that simplifies the creation of web applications and services? Look no further, for OpenResty is your unparalleled answer.

This is your golden opportunity to propel your projects to new heights. Venture to our website to discover the wealth of captivating details on harnessing the enchantment of OpenResty. Let's embark on a shared journey of crafting web development into a truly delightful and seamless experience! 🌐🌟


Deploy OpenResty to your own VPS in one click, play, test and learn it.

OpenResty is ready for deployment

Enhancing Website Security and Performance

In today's digital landscape, website security, and performance are of utmost importance. That's where Cloudflare comes in. Cloudflare is a leading web infrastructure company that offers a comprehensive suite of services designed to protect and optimize websites. By leveraging Cloudflare, businesses can benefit from enhanced website security, protection against DDoS attacks, increased stability for high-traffic websites, and streamlined SSL certificate generation.

The Ease of Generating SSL Certificates with Cloudflare

SSL certificate generation is a crucial aspect of securing websites. Cloudflare simplifies this process by offering a user-friendly solution. By generating SSL certificates on Cloudflare, users can enjoy a hassle-free experience. This approach eliminates the need for manual configuration on the user's side, such as with WordPress. Cloudflare takes care of the certificate generation, making it easier for users to manage their SSL certificates effectively. Additionally, by generating certificates on Cloudflare, users can reduce dependencies and rely on a centralized platform for all their security needs.

Website Security and Stability with Cloudflare

When it comes to website security, Cloudflare is a powerful ally. Cloudflare's robust security features provide a layer of protection against various threats, including DDoS attacks and other malicious activities. With Cloudflare, businesses can ensure the stability of their websites, mitigate security risks, and maintain a seamless user experience. Real-world examples and case studies demonstrate how Cloudflare has successfully safeguarded websites, protecting them from potential vulnerabilities.

Unleashing Flexibility with User-Generated SSL Certificates

While Cloudflare offers a convenient solution for SSL certificate generation, there are instances where user-generated certificates may be preferred. By generating SSL certificates on the user's side, users gain more control and flexibility over their certificate management. This flexibility allows businesses to adapt their security measures to specific requirements and preferences. Depending on the scenario, user-generated SSL certificates can provide a tailored solution that aligns precisely with their needs.

How to Generate an SSL Certificate Using Cloudflare

Step-by-Step Guide: Generating an SSL Certificate on Cloudflare

Generating an SSL certificate using Cloudflare is a straightforward process. Here is a step-by-step guide to help you through the certificate generation process:

Access your Cloudflare account and navigate to the SSL/TLS settings.

Choose the desired SSL certificate option that aligns with your website's needs.

Follow the prompts and provide the necessary information for the certificate generation.

Verify the successful generation of your SSL certificate.

Validating a Let's Encrypt Certificate on a Site Already Active on Cloudflare

Validating a Let's Encrypt certificate on a site that is already active on Cloudflare is an important step in ensuring secure connections. Here's the process to validate your Let's Encrypt certificate:

Enable the Let's Encrypt certificate option in your Cloudflare SSL/TLS settings.

Follow the validation process outlined by Let's Encrypt to authenticate your domain ownership.

Once validated, Cloudflare will automatically manage and renew the Let's Encrypt certificate for your site.

Using Let's Encrypt certificates in conjunction with Cloudflare offers numerous benefits, including enhanced security and encryption for your website. By combining the power of Let's Encrypt and Cloudflare, you can ensure the highest level of security and trustworthiness for your online presence.

At TryDirect, we provide you with the flexibility to choose between Cloudflare certificates and the pre-installed Certbot when deploying your application. However, it is important to note that using both options simultaneously may result in connection issues. Therefore, it is essential to select one approach based on your specific needs.

If you decide not to use Cloudflare SSL, you demonstrate courage and choose the harder path. However, this decision grants you greater control over your website's security, as you are not reliant on Cloudflare for SSL management. By opting for this route, you can implement security measures tailored to your unique requirements and maintain full ownership of your SSL certificates.

Our team is here to support you in making the best choice for your website's security. Whether you choose Cloudflare certificates or prefer to handle SSL management independently, we will provide the necessary guidance and expertise to ensure a secure and reliable environment for your online presence.

Feel free to reach out to us if you have any questions or require further assistance in determining the best SSL approach for your website.

All that you need is just connect your instance via SSH and install certbot using following command

For any help regarding your website  performance and security enhancement contact us at or explore our services

Enhancing Website Security and Performance
In today's digital landscape, website security, and performance are of utmost importance. That's where Cloudflare comes in. Cloudflare is a leading web infrastructure company that offers a comprehensive suite of services designed to protect and optimize websites. By leveraging Cloudflare, businesses can benefit from enhanced website security, protection against DDoS attacks, increased stability for high-traffic websites, and streamlined SSL certificate generation.

The Ease of Generating SSL Certificates with Cloudflare
SSL certificate generation is a crucial aspect of securing websites. Cloudflare simplifies this process by offering a user-friendly solution. By generating SSL certificates on Cloudflare, users can enjoy a hassle-free experience. This approach eliminates the need for manual configuration on the user's side, such as with WordPress. Cloudflare takes care of the certificate generation, making it easier for users to manage their SSL certificates effectively. Additionally, by generating certificates on Cloudflare, users can reduce dependencies and rely on a centralized platform for all their security needs.

Website Security and Stability with Cloudflare
When it comes to website security, Cloudflare is a powerful ally. Cloudflare's robust security features provide a layer of protection against various threats, including DDoS attacks and other malicious activities. With Cloudflare, businesses can ensure the stability of their websites, mitigate security risks, and maintain a seamless user experience. Real-world examples and case studies demonstrate how Cloudflare has successfully safeguarded websites, protecting them from potential vulnerabilities.

Unleashing Flexibility with User-Generated SSL Certificates
While Cloudflare offers a convenient solution for SSL certificate generation, there are instances where user-generated certificates may be preferred. By generating SSL certificates on the user's side, users gain more control and flexibility over their certificate management. This flexibility allows businesses to adapt their security measures to specific requirements and preferences. Depending on the scenario, user-generated SSL certificates can provide a tailored solution that aligns precisely with their needs.

How to Generate an SSL Certificate Using Cloudflare
Step-by-Step Guide: Generating an SSL Certificate on Cloudflare
Generating an SSL certificate using Cloudflare is a straightforward process. Here is a step-by-step guide to help you through the certificate generation process:
Access your Cloudflare account and navigate to the SSL/TLS settings.
Choose the desired SSL certificate option that aligns with your website's needs.
Follow the prompts and provide the necessary information for the certificate generation.
Verify the successful generation of your SSL certificate.

Validating a Let's Encrypt Certificate on a Site Already Active on Cloudflare
Validating a Let's Encrypt certificate on a site that is already active on Cloudflare is an important step in ensuring secure connections. Here's the process to validate your Let's Encrypt certificate:
Enable the Let's Encrypt certificate option in your Cloudflare SSL/TLS settings.
Follow the validation process outlined by Let's Encrypt to authenticate your domain ownership.
Once validated, Cloudflare will automatically manage and renew the Let's Encrypt certificate for your site.
Using Let's Encrypt certificates in conjunction with Cloudflare offers numerous benefits, including enhanced security and encryption for your website. By combining the power of Let's Encrypt and Cloudflare, you can ensure the highest level of security and trustworthiness for your online presence.

Letsencrypt Certbot 
At TryDirect, we provide you with the flexibility to choose between Cloudflare certificates and the pre-installed Certbot when deploying your application. However, it is important to note that using both options simultaneously may result in connection issues. Therefore, it is essential to select one approach based on your specific needs.
If you decide not to use Cloudflare SSL, you demonstrate courage and choose the harder path. However, this decision grants you greater control over your website's security, as you are not reliant on Cloudflare for SSL management. By opting for this route, you can implement security measures tailored to your unique requirements and maintain full ownership of your SSL certificates.

Our team is here to support you in making the best choice for your website's security. Whether you choose Cloudflare certificates or prefer to handle SSL management independently, we will provide the necessary guidance and expertise to ensure a secure and reliable environment for your online presence.
Feel free to reach out to us if you have any questions or require further assistance in determining the best SSL approach for your website.

All that you need is just connect your instance via SSH and install certbot using following command

Ubuntu Linux command line:

 

Execute to generate certificates:

 

Follow instructions provided by certbot
For any help regarding your website  performance and security enhancement contact us at or explore our services

Which approach is better to setup SSL on your website for better security, Cloudflare or self-deployed Certbot?

CloudFlare or self-deployed Certbot for your web-site SSL?

SSL certificates have become a modern necessity. Organizations operating online need to add them to their websites for secure transactions and user information protection. They are also effective at mitigating cyberattacks.

However, not many people are familiar with the ways to obtain an SSL certificate. Those who are aware often do not know how to check their SSL certificate’s validity. These small problems can lead to major inconveniences.

This article aims to explain Let’s Encrypt and Certbot, as well as the most efficient methods for checking SSL certificate installation and validity.

Let’s Encrypt is a free and automated certificate authority that provides TLS/SSL certificates to compatible clients. You can use them to encrypt data and communications for your website users.

Let’s Encrypt is developed by the Internet Security Research Group (ISRG). The main purpose of these digital certificates is to enable HTTPS for websites at no cost. The paid certificates market is quite vast, but Let’s Encrypt offers a free alternative.

Let’s Encrypt offers two types of certificates:

Both types of certificates are issued for 90 days and are automatically renewed after installation.

These certificates are domain-validated and do not require a dedicated IP address.

Let’s Encrypt provides a straightforward way to obtain certificates. The process is free, does not require email verification, and is fully automated.

Certbot is a command-line client application that fetches certificates from Let’s Encrypt, an open certificate authority. It deploys the certificates to a web server after obtaining them. It is an easy-to-use client that works in five simple steps:

Install Certbot, which is available in most Linux distro repositories or as a snap package.

Post-configure your web server if needed.

These SSL/TLS certificates are deployed to your web server automatically. You can also use certbot-auto to always fetch the latest version.

Another related term is the Webroot plugin for Certbot. It works by placing a file in a web-accessible directory and using the HTTP-01 challenge to prove domain ownership. You must specify the web server's root directory during the process.

All issued certificates can be found in: /etc/letsencrypt/live/$domain

It provides a command-line interface, compatible with HTTP websites with port 80 open.

You can choose from various server types, including virtual private servers, dedicated servers, and cloud-hosted servers, accessible via SSH.

All Certbot certificates are auto-renewable every 90 days, with renewal recommended every 60 days for continuous coverage.

The Best Ways to Check if an SSL Certificate is Installed and Valid

1. Open a terminal and use the following command to check the SSL certificate installation and validity:

2. This command will display details about the SSL certificate. Look for the verification status code. A status code of "0" indicates successful verification. If the status is "20," the certificate is not configured correctly, and you will see an error: "unable to get local issuer certificate."

4. Verify the hostname. A status code of "0" means the verification was successful. If there's an error, you will see a return code "62" and the error "Hostname Mismatch."

5. To verify a certificate issued to an IP address instead of a hostname, use the -verify_ip switch:

In the Certificates - Local Computer console, navigate through the certificates to see which ones are installed.

Download Sigcheck from the official Microsoft website.

After downloading, extract and install the application.

Open a command prompt and enter the following command:

4. This command downloads the trusted Microsoft root certificate list and displays the valid certificates.

These methods are widely trusted. However, the most preferred way is to use the Linux command line for quick and accurate results.

Did not find the solution? Join our discord channel and consult with our developers
Still don't know how to check? Get system administration help from our partners

https://www.sslshopper.com/ssl-checker.html

https://serverfault.com/questions/589590/understanding-the-output-of-openssl-s-client

https://stackoverflow.com/questions/24992976/openssl-telling-certificate-has-expired-when-it-has-not

https://community.letsencrypt.org/t/problem-with-certificate-has-expired/161013/2

SSL certificates have become a modern necessity. Organizations operating online need to add them to their websites for secure transactions and user information protection. They are also effective at mitigating cyberattacks.
However, not many people are familiar with the ways to obtain an SSL certificate. Those who are aware often do not know how to check their SSL certificate’s validity. These small problems can lead to major inconveniences.
This article aims to explain Let’s Encrypt and Certbot, as well as the most efficient methods for checking SSL certificate installation and validity.

Let’s Encrypt
Let’s Encrypt is a free and automated certificate authority that provides TLS/SSL certificates to compatible clients. You can use them to encrypt data and communications for your website users.
Let’s Encrypt is developed by the Internet Security Research Group (ISRG). The main purpose of these digital certificates is to enable HTTPS for websites at no cost. The paid certificates market is quite vast, but Let’s Encrypt offers a free alternative.

Let’s Encrypt offers two types of certificates:
Standard Single Domain SSL
Wildcard SSL
Both types of certificates are issued for 90 days and are automatically renewed after installation.

Benefits of Let’s Encrypt Certificates
These certificates are domain-validated and do not require a dedicated IP address.
Let’s Encrypt provides a straightforward way to obtain certificates. The process is free, does not require email verification, and is fully automated.
Enrollment is easy to start and manage.

Certbot
Certbot is a command-line client application that fetches certificates from Let’s Encrypt, an open certificate authority. It deploys the certificates to a web server after obtaining them. It is an easy-to-use client that works in five simple steps:
Install Certbot, which is available in most Linux distro repositories or as a snap package.
Run Certbot.
Post-configure your web server if needed.
Enable automatic certificate renewal.
Restart the web server after renewal.
These SSL/TLS certificates are deployed to your web server automatically. You can also use certbot-auto to always fetch the latest version.
Another related term is the Webroot plugin for Certbot. It works by placing a file in a web-accessible directory and using the HTTP-01 challenge to prove domain ownership. You must specify the web server's root directory during the process.
All issued certificates can be found in: /etc/letsencrypt/live/$domain

Benefits of Certbot
It is free.
It provides a command-line interface, compatible with HTTP websites with port 80 open.
You can choose from various server types, including virtual private servers, dedicated servers, and cloud-hosted servers, accessible via SSH.
All Certbot certificates are auto-renewable every 90 days, with renewal recommended every 60 days for continuous coverage.

The Best Ways to Check if an SSL Certificate is Installed and Valid

Unix/Linux Users

Method 1:

1. Open a terminal and use the following command to check the SSL certificate installation and validity:

 

2. This command will display details about the SSL certificate. Look for the verification status code. A status code of "0" indicates successful verification. If the status is "20," the certificate is not configured correctly, and you will see an error: "unable to get local issuer certificate."

3. Check your certificate’s path:

 


If you have a single file, use:

 

4. Verify the hostname. A status code of "0" means the verification was successful. If there's an error, you will see a return code "62" and the error "Hostname Mismatch."

5. To verify a certificate issued to an IP address instead of a hostname, use the -verify_ip switch:

 

Windows Users

Method 2: Using Certificates MMC Snap-in
Press Win + R to open the Run dialog.
Type certlm.msc and press Enter.
In the Certificates - Local Computer console, navigate through the certificates to see which ones are installed.

Method 3: Using Sigcheck
Download Sigcheck from the official Microsoft website.
After downloading, extract and install the application.
Open a command prompt and enter the following command:

 

4. This command downloads the trusted Microsoft root certificate list and displays the valid certificates.
These methods are widely trusted. However, the most preferred way is to use the Linux command line for quick and accurate results.

Did not find the solution? Join our discord channel and consult with our developers
Still don't know how to check? Get system administration help from our partners


Check SSL certificates online

https://www.sslshopper.com/ssl-checker.html
https://www.digicert.com/help/

More info

https://serverfault.com/questions/589590/understanding-the-output-of-openssl-s-client
https://stackoverflow.com/questions/24992976/openssl-telling-certificate-has-expired-when-it-has-not
https://community.letsencrypt.org/t/problem-with-certificate-has-expired/161013/2

How to manage letsencrypt and certbot on your own server. Basic steps to install free SSL on your server.

Dashboard

TryDirect blog