I wanted a cheap VPN proxy service. As per my previous post I set up a small cloud server with openvpn plus dnscache. You add squid proxy too depending on your needs.
I decided to use a Raspberry Pi as a cheap router. I bought a Edimax USB ethernet adaptor to give me two ports.
I got myself a stripped down version of Wheezy (I wasn't up to tackling that piece of junk called systemd)
This is for a V1 Pi :
https://www.linuxsystems.it/raspbian-wheezy-armhf-raspberry-pi-minimal-image/
There are others for a v2 out there. The choice is yours.
Once installed we need to do the following:
apt-get install fake-hwclock ntp ntpstat lsusb usbutils firmware-realtex nmap vnstat nload bmon htop mc openvpn dnsmasq net-tools resolvconf
# Make sure dnsmaq for dhcp/dns is running
root@raspberry-pi:~# grep -v '^$\|^#' /etc/default/dnsmasq
ENABLED=1
# Setup the interfaces and DHCP range it wil serve to clients
root@raspberry-pi:/etc# grep -v '^$\|^#' /etc/dnsmasq.conf
interface=eth1
domain=local.net
dhcp-range=192.168.50.50,192.168.50.150,12h
# Make sure forwarding is set
root@raspberry-pi:/etc# grep -v '^$\|^#' /etc/sysctl.conf
net.ipv4.ip_forward=1
vm.min_free_kbytes = 8192
# Forward everything to the VPN tunnel
root@raspberry-pi:/etc# grep -v '^$\|^#' /etc/iptables.conf
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:LOGGING - [0:0]
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.50.0/24 -o tun0 -j MASQUERADE
COMMIT
# SSHD
# Set some keys in ssh, change the default port and and disable ssh password authentication !
# Copy your keys and configs to /etc/openvpn
# For DNS you can use /etc/openvpn/update-resolv-conf
# add this to your client config /etc/openvpn/myclient.conf
# It could be added to your server so it is added to the conf
up /etc/openvpn/update-resolv-conf
#We can also add this but if you run as a restricted user e.g. nobody it will fail
down /etc/openvpn/update-resolv-conf
# If you don't use resolvconf, make sure your DNS is sent to your resolver - you will have to set a static IP on eth0
# or this wil get overwrittent
root@raspberry-pi:/etc# cat /etc/resolv.conf
nameserver 192.168.95.1
root@raspberry-pi:/etc# cat /etc/network/interfaces
# interfaces(5) file used by ifup(8) and ifdown(8)
auto lo
iface lo inet loopback
allow-hotplug eth0
# Note above comments re DNS
iface eth0 inet dhcp
allow-hotplug eth1
iface eth1 inet static
address 192.168.50.1
netmask 255.255.255.0
network 192.168.50.0
broadcast 192.168.50.255
# Make sure you have some time servers...
root@raspberrypi:/etc/resolvconf# grep -v '^$\|^#' /etc/ntp.conf
driftfile /var/lib/ntp/ntp.drift
statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable
server 0.debian.pool.ntp.org iburst
server 1.debian.pool.ntp.org iburst
server 2.debian.pool.ntp.org iburst
server 3.debian.pool.ntp.org iburst
restrict -4 default kod notrap nomodify nopeer noquery
restrict -6 default kod notrap nomodify nopeer noquery
restrict 127.0.0.1
restrict ::1
# Connect to your Pi
Check that your connection works with places like whatsmyip.net and dnsleaktest.com
Showing posts with label VPS. Show all posts
Showing posts with label VPS. Show all posts
Tuesday, December 22, 2015
Thursday, December 17, 2015
Cheap VPN server using openvpn and Centos
Well, VPN servers are all the rage since Mr Snowden blew the gaff on the NSA & GCHQ et al ,and Nanny states clamping down and spying on your every move.
And the BBC iPlayer got blocked as the BBC shut out swathes of VPN addresses in yet another attempt to monetise their media.
When will they realise that blocking the internet and trying to block encryption and geoip blocking etc is just a path to madness. I have no problems with them checking my data if they have suspicion I have done something illegal like make a bomb. But they can go through the normal channels and get a warrant to do so. I am innocent until proven guilty.
But with the way the law is going, we are all tarred as guilty, and should all be spied on. Orwellian.
Anyway, for a variety of reasons I wanted a cheap little VPN with a UK IP address.
After a bit of advice (and a referral to save me a few pounds) I got me a droplet over at www.digitalocean.com to act as server. I use all sorts of devices to connect including a Raspberry Pi as a simple VPN router for some kit I have.
From choice as a systemd loather I decided to install CentOS 6.x with openvpn and tinydns and dnscache as I am familiar with it from my server of choice Koozali SME Server. I could install squid/danguardian etc as well, but this suits purpose for now
Roughly speaking this is how to do it..... I'll add a note on the Rasberry Pi config in the next post
# install wget
yum install wget
wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
wget http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el6.rf.x86_64.rpm
# Get epel & rpmforge repos
yum localinstall epel-release-6-8.noarch.rpm rpmforge-release-0.5.3-1.el6.rf.x86_64.rpm
# Add the webmin repo
cat < /etc/yum.repos.d/webmin.repo
[Webmin]
name=Webmin Distribution Neutral
#baseurl=http://download.webmin.com/download/yum
mirrorlist=http://download.webmin.com/download/yum/mirrorlist
enabled=1
EOF
# And keys
wget http://www.webmin.com/jcameron-key.asc
rpm --import jcameron-key.asc
# Add some stuff
mc openvpn wget mutt mailx man syslog traceroute nload iptraf vnstat webmin ntpdate bind-utils daemontools elinks ndjbdns htop
# Allow access to webmin with your own IPs
mcedit /etc/webmin/miniserv.conf
allow=127.0.0.1 1.2.3.4 5.6.7.8 LOCAL
# Sort the time out
Webmin - set timezone in System Time
cat < /etc/ntp/ntp.conf
server 0.uk.pool.ntp.org
server 1.uk.pool.ntp.org
server 2.uk.pool.ntp.org
server 3.uk.pool.ntp.org
EOF
# Sort out ssh to prevent password access - make sure you add your keys
scp ~/.ssh/id_rsa.pub root@1.2.3.4://root/.ssh/id_rsa.pub.mykey
cat /root/.ssh/id_rsa.pub.mykey /root/.ssh/authorized_hosts
# Change the default port please.
mcedit /etc/ssh/sshd_config
Port 2244
PasswordAuthentication no
# Sort out iptables - see the file below
# adjust your IPs/VPN accordingly in it
copy to /etc/sysconfig/iptables
# Add Openvpn module
# Webmin/Configuration/Add module
http://www.openit.it/downloads/OpenVPNadmin/openvpn-2.6.wbm.gz
# You don't really need tinydns unless you are answering queries for the 'domain' on the server. dnscache will handle it.
# Sort out cache
mcedit /etc/ndjbdns/dnscache.conf
# Choose your VPN IP range here
IP=192.168.x.1
cp /etc/ndjbdns/ip/127.0.0.1 192.168.x
# Webmin adjust Bootup & shutdown - tinydns & dnscache
openvpn starts at S24 and dnscache at S20 so I set dnscache to S30
modify # chkconfig: - 30 80
Then
chkconfig dnscache off and then on
# Webmin Openvpn - First sort your certs
New CA Authority
Make sure country code is two letters e.g. UK or ES
In CA list
VPN Server list select Keys List
New Server and generate key
# Get coffee
# Now
VPN List
New VPN Server
# Basic minimal settings
Management Yes 8876
Net Ip - your tunnel IP
Persist Yes
router client to client Yes
option cipher AES-256-CBC
user/group nobody
verb 5
tun-mtu 1500
fragment 1300
mssfix 1300
push "dhcp-option DNS 192.168.x.1"
push "route 192.168.x.0 255.255.255.0"
push "redirect-gateway def1"
Go back to CA list
Select Keys List
Add New key
Key Name - whatever
Pass - no
KeyServer Client
Go to VPN List, Client List
Add Client
# Then get your client certificates out and installed. Minimal opvn file below
# Modify Logging for openvpn and iptables
mcedit /etc/openvpn/{your-server}.conf
status /var/log/openvpn/openvpn-status.log
# log-append servers/DigiDrop-SVR/logs/openvpn.log
touch /etc/rsyslog.d/10-iptables.conf
cat </etc/rsyslog.d/10-iptables.conf
:msg, startswith, "IPTables-Dropped: " -/var/log/iptables.log
& ~
EOF
touch /etc/rsyslog.d/20-ovpn.conf
cat < /etc/rsyslog.d/20-ovpn.conf
# Create a template for the vpn log location
$template OpenVPN,"/var/log/openvpn/openvpn.log"
if $programname startswith 'openvpn' then /var/log/openvpn/openvpn.log
& ~
EOF
touch /etc/logrotate.d/ovpn
cat < /etc/logrotate.d/ovpn
/var/log/openvpn/*.log {
weekly
size 100M
rotate 4
compress
delaycompress
missingok
notifempty
create 640 syslog adm
}
EOF
# Set DNS to OpenDNS if you want
/etc/sysconfig/network-scripts/ifcfg-eth0
DNS1=208.67.222.222
DNS2=208.67.220.220
# And get beer :-)
----------------------------------
# Generic opvn for Android - add your keys in the relevant sections
client
dev tun
proto udp
remote 46.101.92.188 1194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
cipher BF-CBC
comp-lzo
verb 3
#mute-replay-warnings
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
----------------------------------
/etc/sysconfig/iptables
# /etc/sysconfig/iptables
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.x.0/24 -o eth0 -j MASQUERADE
# Pre Route OpenVPN
-A PREROUTING -p udp -m udp --dport 1194 -j ACCEPT
COMMIT
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*filter
:FORWARD ACCEPT [0:0]
:INPUT DROP [0:0]
:OUTPUT ACCEPT [0:0]
:LOGGING - [0:0]
# Allow tunnel out forward
-A FORWARD -o tun+ -j ACCEPT
# Allow tunnel out
-A OUTPUT -o tun+ -j ACCEPT
# Allow tunnel in forward
-A FORWARD -i tun+ -j ACCEPT
# Allow tunnel in
-A INPUT -i tun+ -j ACCEPT
# Accept traffic from internal interfaces
-A INPUT ! -i eth0 -j ACCEPT
# Accept traffic with the ACK flag set
-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT
# Allow incoming data that is part of a connection we established
-A INPUT -m state --state ESTABLISHED -j ACCEPT
# Allow data that is related to existing connections
-A INPUT -m state --state RELATED -j ACCEPT
# Accept responses to DNS queries
-A INPUT -p udp -m udp --dport 1024:65535 --sport 53 -j ACCEPT
# Accept responses to our pings
-A INPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT
# Accept notifications of unreachable hosts
-A INPUT -p icmp -m icmp --icmp-type destination-unreachable -j ACCEPT
# Accept notifications to reduce sending speed
-A INPUT -p icmp -m icmp --icmp-type source-quench -j ACCEPT
# Accept notifications of lost packets
-A INPUT -p icmp -m icmp --icmp-type time-exceeded -j ACCEPT
# Accept notifications of protocol problems
-A INPUT -p icmp -m icmp --icmp-type parameter-problem -j ACCEPT
# Allow connections to our SSH server
-A INPUT -p tcp -m tcp --dport 2222 -j ACCEPT
# Allow connections to our IDENT server
-A INPUT -p tcp -m tcp --dport auth -j ACCEPT
# Allow Webmin
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
# Allow OpenVPN
-A INPUT -p udp -m udp -i eth0 --dport 1194 -j ACCEPT
# Logging
-A INPUT -j LOGGING
-A LOGGING -m limit --limit 2/sec -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
-A LOGGING -j DROP
COMMIT
And the BBC iPlayer got blocked as the BBC shut out swathes of VPN addresses in yet another attempt to monetise their media.
When will they realise that blocking the internet and trying to block encryption and geoip blocking etc is just a path to madness. I have no problems with them checking my data if they have suspicion I have done something illegal like make a bomb. But they can go through the normal channels and get a warrant to do so. I am innocent until proven guilty.
But with the way the law is going, we are all tarred as guilty, and should all be spied on. Orwellian.
Anyway, for a variety of reasons I wanted a cheap little VPN with a UK IP address.
After a bit of advice (and a referral to save me a few pounds) I got me a droplet over at www.digitalocean.com to act as server. I use all sorts of devices to connect including a Raspberry Pi as a simple VPN router for some kit I have.
From choice as a systemd loather I decided to install CentOS 6.x with openvpn and tinydns and dnscache as I am familiar with it from my server of choice Koozali SME Server. I could install squid/danguardian etc as well, but this suits purpose for now
Roughly speaking this is how to do it..... I'll add a note on the Rasberry Pi config in the next post
# install wget
yum install wget
wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
wget http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el6.rf.x86_64.rpm
# Get epel & rpmforge repos
yum localinstall epel-release-6-8.noarch.rpm rpmforge-release-0.5.3-1.el6.rf.x86_64.rpm
# Add the webmin repo
cat <
[Webmin]
name=Webmin Distribution Neutral
#baseurl=http://download.webmin.com/download/yum
mirrorlist=http://download.webmin.com/download/yum/mirrorlist
enabled=1
EOF
wget http://www.webmin.com/jcameron-key.asc
rpm --import jcameron-key.asc
mc openvpn wget mutt mailx man syslog traceroute nload iptraf vnstat webmin ntpdate bind-utils daemontools elinks ndjbdns htop
# Allow access to webmin with your own IPs
mcedit /etc/webmin/miniserv.conf
allow=127.0.0.1 1.2.3.4 5.6.7.8 LOCAL
# Sort the time out
Webmin - set timezone in System Time
cat <
server 0.uk.pool.ntp.org
server 1.uk.pool.ntp.org
server 2.uk.pool.ntp.org
server 3.uk.pool.ntp.org
EOF
# Sort out ssh to prevent password access - make sure you add your keys
scp ~/.ssh/id_rsa.pub root@1.2.3.4://root/.ssh/id_rsa.pub.mykey
cat /root/.ssh/id_rsa.pub.mykey /root/.ssh/authorized_hosts
# Change the default port please.
mcedit /etc/ssh/sshd_config
Port 2244
PasswordAuthentication no
# Sort out iptables - see the file below
# adjust your IPs/VPN accordingly in it
copy to /etc/sysconfig/iptables
# Add Openvpn module
# Webmin/Configuration/Add module
http://www.openit.it/downloads/OpenVPNadmin/openvpn-2.6.wbm.gz
mcedit /etc/ndjbdns/dnscache.conf
IP=192.168.x.1
cp /etc/ndjbdns/ip/127.0.0.1 192.168.x
# Webmin adjust Bootup & shutdown - tinydns & dnscache
openvpn starts at S24 and dnscache at S20 so I set dnscache to S30
modify # chkconfig: - 30 80
Then
chkconfig dnscache off and then on
# Webmin Openvpn - First sort your certs
New CA Authority
Make sure country code is two letters e.g. UK or ES
In CA list
VPN Server list select Keys List
New Server and generate key
# Get coffee
# Now
VPN List
New VPN Server
# Basic minimal settings
Management Yes 8876
Net Ip - your tunnel IP
Persist Yes
router client to client Yes
option cipher AES-256-CBC
user/group nobody
verb 5
tun-mtu 1500
fragment 1300
mssfix 1300
push "dhcp-option DNS 192.168.x.1"
push "route 192.168.x.0 255.255.255.0"
push "redirect-gateway def1"
Go back to CA list
Select Keys List
Add New key
Key Name - whatever
Pass - no
KeyServer Client
Go to VPN List, Client List
Add Client
# Then get your client certificates out and installed. Minimal opvn file below
# Modify Logging for openvpn and iptables
mcedit /etc/openvpn/{your-server}.conf
status /var/log/openvpn/openvpn-status.log
# log-append servers/DigiDrop-SVR/logs/openvpn.log
touch /etc/rsyslog.d/10-iptables.conf
cat <
:msg, startswith, "IPTables-Dropped: " -/var/log/iptables.log
& ~
EOF
touch /etc/rsyslog.d/20-ovpn.conf
cat <
# Create a template for the vpn log location
$template OpenVPN,"/var/log/openvpn/openvpn.log"
if $programname startswith 'openvpn' then /var/log/openvpn/openvpn.log
& ~
EOF
touch /etc/logrotate.d/ovpn
cat <
/var/log/openvpn/*.log {
weekly
size 100M
rotate 4
compress
delaycompress
missingok
notifempty
create 640 syslog adm
}
EOF
# Set DNS to OpenDNS if you want
/etc/sysconfig/network-scripts/ifcfg-eth0
DNS1=208.67.222.222
DNS2=208.67.220.220
# And get beer :-)
----------------------------------
# Generic opvn for Android - add your keys in the relevant sections
client
dev tun
proto udp
remote 46.101.92.188 1194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
cipher BF-CBC
comp-lzo
verb 3
#mute-replay-warnings
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
----------------------------------
/etc/sysconfig/iptables
# /etc/sysconfig/iptables
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.x.0/24 -o eth0 -j MASQUERADE
# Pre Route OpenVPN
-A PREROUTING -p udp -m udp --dport 1194 -j ACCEPT
COMMIT
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*filter
:FORWARD ACCEPT [0:0]
:INPUT DROP [0:0]
:OUTPUT ACCEPT [0:0]
:LOGGING - [0:0]
# Allow tunnel out forward
-A FORWARD -o tun+ -j ACCEPT
# Allow tunnel out
-A OUTPUT -o tun+ -j ACCEPT
# Allow tunnel in forward
-A FORWARD -i tun+ -j ACCEPT
# Allow tunnel in
-A INPUT -i tun+ -j ACCEPT
# Accept traffic from internal interfaces
-A INPUT ! -i eth0 -j ACCEPT
# Accept traffic with the ACK flag set
-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT
# Allow incoming data that is part of a connection we established
-A INPUT -m state --state ESTABLISHED -j ACCEPT
# Allow data that is related to existing connections
-A INPUT -m state --state RELATED -j ACCEPT
# Accept responses to DNS queries
-A INPUT -p udp -m udp --dport 1024:65535 --sport 53 -j ACCEPT
# Accept responses to our pings
-A INPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT
# Accept notifications of unreachable hosts
-A INPUT -p icmp -m icmp --icmp-type destination-unreachable -j ACCEPT
# Accept notifications to reduce sending speed
-A INPUT -p icmp -m icmp --icmp-type source-quench -j ACCEPT
# Accept notifications of lost packets
-A INPUT -p icmp -m icmp --icmp-type time-exceeded -j ACCEPT
# Accept notifications of protocol problems
-A INPUT -p icmp -m icmp --icmp-type parameter-problem -j ACCEPT
# Allow connections to our SSH server
-A INPUT -p tcp -m tcp --dport 2222 -j ACCEPT
# Allow connections to our IDENT server
-A INPUT -p tcp -m tcp --dport auth -j ACCEPT
# Allow Webmin
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
# Allow OpenVPN
-A INPUT -p udp -m udp -i eth0 --dport 1194 -j ACCEPT
# Logging
-A INPUT -j LOGGING
-A LOGGING -m limit --limit 2/sec -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
-A LOGGING -j DROP
COMMIT
Thursday, February 2, 2012
Looking for VPS ?
Me too.
I decided that the time has come to get myself a VPS. I have a perfectly nice HP server running at my office in the UK that quietly chugs away minding its own business. Local access is fine. The only down side is that I live in Spain with my wife, and one of our other employees works from home for half the week. And that's where you discover all the shortcomings of ADSL.
It's Asymetric, both by name and buy nature.
So though the server runs splendidly, access to it for email and our Web/PHP based CRM from outside of the office can be very slow.
Enter VPS. An online server would be a more sensible option, particularly for email and the CRM. We also have something like 100Gb of files, mainly customers artwork, and that won't be feasible to store online. Even pushing my IMAP email stores up will probably be a chore as they are quite large - I'll think about that later. But the CRM will definitely benefit from being up in the cloud.
I also have a variety of other junk that could benefit from being up there so I can get to it from wherever. Currently I use unison to sync between the server at work, the one I have here and one in the teleworkers house - it's not feasible to go carrying round loads of files on USB drives etc. There'll just be the most unholy mess. But with a VPS I can sync up to that which should be fine.
So where do we start ? A friend of mine runs http://www.vpsbible.com which has some interesting stuff.
The first question seems to be a choice between shared hosting and virtual hosting.
I thought this answer seemed to sum things up quite well :
http://stackoverflow.com/questions/454407/is-virtual-hosting-any-better-than-shared-hosting#454428
"Shared hosting is usually defined as having non-privileged access to a server along with multiple other users. You are not able to start/stop services, deploy custom system applications (Apache, MySQL, PHP, etc.) and usually cannot edit things like Apache configuration files (which is why .htaccess files were born). The resources are managed by the host and you share with others. If one site uses all the resources other sites will suffer.
VPS solutions offer more isolation and give you some kind of "root" control. This is accomplished through chrooting, UML or virtualization, usually. More control over your environment is afforded and the isolation is greater, depending on the mechanism used. "
From what I can see, VPS is the way to go for me as I want to run my own distro of choice, SME server, based on CentOS. Installing anything other than the distros on offer doesn't look like it is for the faint hearted, but we'll see.
Next question will be trying to find a provider. From a brief look, it's a minefield. The first one I have seen that I quite like is linode.com, but I'm open to suggestions.
Anyone got anything they can recommend ?
I decided that the time has come to get myself a VPS. I have a perfectly nice HP server running at my office in the UK that quietly chugs away minding its own business. Local access is fine. The only down side is that I live in Spain with my wife, and one of our other employees works from home for half the week. And that's where you discover all the shortcomings of ADSL.
It's Asymetric, both by name and buy nature.
So though the server runs splendidly, access to it for email and our Web/PHP based CRM from outside of the office can be very slow.
Enter VPS. An online server would be a more sensible option, particularly for email and the CRM. We also have something like 100Gb of files, mainly customers artwork, and that won't be feasible to store online. Even pushing my IMAP email stores up will probably be a chore as they are quite large - I'll think about that later. But the CRM will definitely benefit from being up in the cloud.
I also have a variety of other junk that could benefit from being up there so I can get to it from wherever. Currently I use unison to sync between the server at work, the one I have here and one in the teleworkers house - it's not feasible to go carrying round loads of files on USB drives etc. There'll just be the most unholy mess. But with a VPS I can sync up to that which should be fine.
So where do we start ? A friend of mine runs http://www.vpsbible.com which has some interesting stuff.
The first question seems to be a choice between shared hosting and virtual hosting.
I thought this answer seemed to sum things up quite well :
http://stackoverflow.com/questions/454407/is-virtual-hosting-any-better-than-shared-hosting#454428
"Shared hosting is usually defined as having non-privileged access to a server along with multiple other users. You are not able to start/stop services, deploy custom system applications (Apache, MySQL, PHP, etc.) and usually cannot edit things like Apache configuration files (which is why .htaccess files were born). The resources are managed by the host and you share with others. If one site uses all the resources other sites will suffer.
VPS solutions offer more isolation and give you some kind of "root" control. This is accomplished through chrooting, UML or virtualization, usually. More control over your environment is afforded and the isolation is greater, depending on the mechanism used. "
From what I can see, VPS is the way to go for me as I want to run my own distro of choice, SME server, based on CentOS. Installing anything other than the distros on offer doesn't look like it is for the faint hearted, but we'll see.
Next question will be trying to find a provider. From a brief look, it's a minefield. The first one I have seen that I quite like is linode.com, but I'm open to suggestions.
Anyone got anything they can recommend ?
Subscribe to:
Posts (Atom)