Controle de acesso SSH com hosts.deny e hosts.allow

 

Faça login na sua máquina Linux e abra uma janela de terminal. Primeiro, vamos negar todo o acesso ao daemon SSH. Abra o arquivo hosts.deny com o comando 

sudo nano /etc/hosts.deny

No final desse arquivo, adicione:

sshd: ALL

Salve e feche o arquivo.

Em seguida, abra o arquivo hosts.allow com o comando

sudo nano /etc/hosts.allow

 Digamos que você queira permitir acesso SSH apenas para duas máquinas em sua rede, nos endereços IP 192.168.1.62 e 192.168.1.152. Para isso, adicione a linha:

sshd: 192.168.1.62, 192.168.1.152

Salve e feche o arquivo.

Nesse ponto, apenas essas duas máquinas têm permissão para acessar seu computador ou servidor via SSH. Lembre-se de que o arquivo hosts.deny é lido antes do hosts.allow, portanto, definir sshd: ALL em hosts.deny só é anulado se houver uma entrada em hosts.allow. 

Enable WinRM Windwos server 2025

 Run in CMD

WinRM with TLS/SSL 

winrm quickconfig -transport:https -force -quiet

 

Basic authentication

winrm set winrm/config/service/auth @{Basic="true"}

Remove computer from Azure Arc

  

To fully remove a computer from Azure Arc-enabled servers, follow the official steps in the Uninstall the Azure Connected Machine agent guide to clear extensions, disconnect the agent, and remove the local software.

1. Remove VM Extensions

• Open the Azure portal.

• Go to Azure Arc and select Machines.

• Click your target server, go to Extensions, select any installed extensions, and click Uninstall.

2. Disconnect the Agent from the Server

• Open an administrative command prompt on the physical or virtual machine.

• Run the following command to disconnect the agent and delete the Azure resource representation:

  bash

  azcmagent disconnect

• Sign in with your Azure account when prompted.
  (Note: If the Azure resource was already deleted manually in the portal, run azcmagent disconnect --force-local-only instead).

3. Uninstall the Agent Software

• Windows: Open Control Panel > Programs and Features, select Azure Connected Machine Agent, and click Uninstall.

• Linux: Use your package manager (e.g.,

• sudo apt purge azcmagent or sudo yum remove azcmagent).

• Manually delete leftover configuration folders if needed, such as C:\Program Files\AzureConnectedMachineAgent on Windows.

NGINX as a load balancer for WebSocket

 

To configure NGINX as a secure load balancer for WebSocket (wss://) connections,use an HTTP upgrade map, increase connection timeouts, and configure SSL termination. 

Complete NGINX Configuration Example

Add this configuration inside your nginx.conf or site configuration file:

nginx

http {
    # Map dynamic connection upgrade headers
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

    upstream websocket_backend {
        ip_hash; # Ensures sticky sessions for client connections
        server ://example.com;
        server ://example.com;
    }

    server {
        listen 443 ssl;
        server_name yourdomain.com;

        # SSL/TLS Certificates for WSS termination
        ssl_certificate /path/to/fullchain.pem;
        ssl_certificate_key /path/to/privkey.pem;

        location / {
            proxy_pass http://websocket_backend;
            
            # Required for WebSocket handshake
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            
            # Standard proxy headers
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # Prevent idle timeouts from dropping long-lived connections (set to 24 hours)
            proxy_read_timeout 86400s;
            proxy_send_timeout 86400s;
            
            # Disable buffering for real-time data streaming
            proxy_buffering off;
        }
    }

    # Optional: Redirect HTTP to HTTPS
    server {
        listen 80;
        server_name yourdomain.com;
        return 301 https://$host$request_uri;
    }
}

Apt only upgrade selected packages

 apt list --upgradable | cut -d"/" -f1 > /tmp/apt

pico /tmp/apt

cat /tmp/apt | tr "\n" " "

apt install --only-upgrade <list_of_packages>

Configuring Static Routes with ip commands

As a system administrator, you can configure static routes using the ip route command.

To display the IP routing table, use the ip route command. For example:

~]$ ip route
default via 192.168.122.1 dev ens9  proto static  metric 1024
192.168.122.0/24 dev ens9  proto kernel  scope link  src 192.168.122.107
192.168.122.0/24 dev enp1s0  proto kernel  scope link  src 192.168.122.126

The ip route commands take the following form:

ip route [ add | del | change | append | replace ] destination-address

See the ip-route(8) man page for more details on the options and formats. 

 

To add a static route to a host address, in other words to a single IP address:

~]# ip route add 192.0.2.1 via 10.0.0.1 [dev interface]

where 192.0.2.1 is the IP address of the host in dotted decimal notation, 10.0.0.1 is the next hop address and interface is the exit interface leading to the next hop. 

 

To add a static route to a network, in other words to an IP address representing a range of IP addresses:

~]# ip route add 192.0.2.0/24 via 10.0.0.1 [dev interface]

where 192.0.2.0 is the IP address of the destination network in dotted decimal notation and /24 is the network prefix. The network prefix is the number of enabled bits in the subnet mask. This format of network address slash network prefix length is sometimes referred to as classless inter-domain routing (CIDR) notation.

To remove the assigned static route:

~]# ip route del 192.0.2.1

Check point block a single IP address

 

Using Suspicious Activity Monitoring (SAM)

Connect to the firewall via SSH and log into Expert mode:

expert

Run the fw sam command to block traffic to and from the target IP:
fw sam -t 0 -b -s <IP_Address>
• -t 0 sets the timeout (0 means indefinite, or specify seconds like -t 3600 for 1 hour).
• -b blocks both source and destination directions.
• -s specifies the source IP address to block. [1]

Alternatively, for high-performance accelerated drops using SecureXL, you can use the fwaccel dos deny utility: [1]

fwaccel dos deny -a <IP_Address>

fw samp block -d <IP-Address> -u <Unique-Name>

fw samp unblock -u block_bad_ip