Install

curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared $VERSION_CODENAME main" | \
  sudo tee /etc/apt/sources.list.d/cloudflared.list
sudo apt update
sudo apt install -y cloudflared

Login

cloudflared tunnel login
cloudflared tunnel create namatunnel

Setelah jalankan cloudflare tunnel login akan muncul url, buka url di browser dan pilih domain yang akan dipakai

Config

buat file /etc/cloudflared/config.yml yang berisi:

tunnel: TUNNEL_ID
credentials-file: /root/.cloudflared/TUNNEL_ID.json

ingress:
  - hostname: domain.id
    service: http://localhost:8080
  - service: http_status:404

tambahkan DNS record:

cloudflared tunnel route dns domain domain.id

cek konfigurasi:

sudo cloudflared --config /etc/cloudflared/config.yml tunnel ingress validate

jalankan sebagai service systemd:

which cloudflared

sudo tee /etc/systemd/system/cloudflared.service >/dev/null <<'EOF'
[Unit]
Description=Cloudflare Tunnel
After=network-online.target
Wants=network-online.target

[Service]
User=root
ExecStart=/usr/local/bin/cloudflared --config /etc/cloudflared/config.yml --no-autoupdate tunnel run
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now cloudflared
sudo systemctl status cloudflared --no-pager

Cek konfigurasi

curl -I https://domain.id

Before start

sudo -u zimbra -
zmprov mcf +zimbraMailTrustedIP 127.0.0.1 +zimbraMailTrustedIP {IP of Server}
zmcontrol restart

Install fail2ban

yum install epel-release -y
yum install fail2ban -y

Buat jail.conf

nano /etc/fail2ban/jail.local

[DEFAULT]
    # "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts.
    # Fail2ban will not ban a host which matches an address in this list.
    # Several addresses can be defined using space (and/or comma) separator.
    #ignoreip = 127.0.0.1/8 ::1 10.137.26.29/32
    ignoreip = 127.0.0.1/8 IP-ADDRESS-OF-ZIMBRA-SERVER/32 WHITELIST-IP

    banaction = route

Buat file jail untuk Zimbra

nano /etc/fail2ban/jail.d/zimbra.local

[zimbra-smtp]
    enabled = true
    filter = zimbra-smtp
    port = 25,465,587
    logpath = /var/log/zimbra.log
    maxretry = 3
    findtime = 86400
    bantime = 86400
    action = route

    [zimbra-web]
    enabled = true
    filter = zimbra-web
    port = 80,443,7071,9071
    logpath = /opt/zimbra/log/mailbox.log
    maxretry = 5
    findtime = 86400
    bantime = 86400
    action = route

Buat file jail untuk SSH

nano /etc/fail2ban/jail.d/sshd.local

 [sshd]
    enabled = true
    port = 22
    maxretry = 3
    findtime = 600
    bantime = 3600

Buat filter untuk Zimbra

nano /etc/fail2ban/filter.d/zimbra-web.conf

[Definition]
    failregex = .*ip=<HOST>;.*authentication failed for .*$
    ignoreregex =

nano /etc/fail2ban/filter.d/zimbra-smtp.conf

[Definition]
failregex = postfix\/submission\/smtpd\[\d+\]: warning: .*\[<HOST>\]: SASL \w+ authentication failed: authentication failure$
    
postfix\/smtps\/smtpd\[\d+\]: warning: .*\[<HOST>\]: SASL \w+ authentication failed: authentication failure$

ignoreregex =

Enable service

systemctl restart fail2ban
systemctl status fail2ban
systemctl enable fail2ban

Cek statu

fail2ban-client status

Ban & unban

fail2ban-client set sshd banip 10.137.26.29
fail2ban-client set sshd unbanip 10.137.26.29

Sekian

~~~

Karena openSUSE Leap mengutamakan kestabilan maka untuk dapat mencoba kernel 6.* saya harus menunggu cukup lama, pada tulisan kali ini saya akan coba build kernel 6.* di openSUSE Leap 15.4

Persiapan

Install Requirements dan buat folder yang diperlukan

sudo zypper ref && sudo zypper update 
sudo zypper in -t pattern devel_basis bc openssl openssl-devel dwarves rpm-build libelf-devel elfutils-libelf-devel
sudo mkdir ~/kernel

Download Kernel

Download kernel dari https://kernel.org/, saat blog ini dibuat kernel terbaru yaitu 6.0.9

cd ~/kernel
sudo mv ~/Download/linux*.tar.xz .
tar -xafv linux*.tar.xz

Konfigurasi

cd linux*
sudo find /boot/ \( -iname "*config*" -a -iname "*`uname -r`*" \) -exec cp -i -t ./ {} \;
mv *`uname -r`* .config

Berikan comment pada CONFIG_MODULE_SIG_KEY di file *.config*

ls /boot | konfigurasi grep
sudo nano .config
sudo make menuconfig

Build Kernel

sudo make clean

Selanjutnya adalah proses yang paling lama, saya sendiri memakan waktu sekitar 4 jam. Pada langkah ini silahkan sesuaikan dengan spesifikasi hardware,

sudo make rpm-pkg

Setelah selesai silahkan cek dengan perintah

sudo ls /usr/src/packages/RPMS/x86_64/ | grep kernel

Install Kernel

Setelah semua selesai saatnya install kernel yang sudah saya build

sudo su -c "zypper in /usr/src/packages/RPMS/x86_64/kernel*.rpm"

Setelah berhasil install saatnya saya update bootloader dan reboot

grub2-mkconfig -o /boot/grub2/grub.cfg
sudo reboot

Cek apakah sudah berhasil terpasang dengan perintah

uname -r

Do it at your own risk

~~~