Skip to main content

Recommended VM setup

centron and ccloud³ VMs are virtual machines (VMs) that run on virtualised hardware. Every ccloud³ VM you create is a new server that you can use either on its own or as part of a larger, cloud-based infrastructure.

When you create a ccloud³ VM for the first time, we recommend that you configure it with security and usability in mind, to make it easier to scale and integrate with other products later on. Our recommended setup for a ccloud³ VM running Ubuntu 24.04 LTS includes the following:

Improved security​

SSH key authentication for a non-root user with sudo privileges, no password-based access to root, and a cloud firewall to restrict access to SSH.

Reliability and user-friendliness​

Optional backups via the cBacks add-on product to prevent data loss, as well as network functions such as VPC and IPv6 support without the need for manual configuration.

Capacity and scaling information: The centron-Metrics agent helps you understand your resource usage and make more informed decisions about when and how to scale.

Once you have configured a ccloud³ VM using our recommended setup, configuring subsequent ccloud³ VMs with the same setup simply involves selecting options on the ccloud³ VM creation page.

You can use ccloud³ VMs with this setup to host a website, scale from a single ccloud³ VM to multiple ccloud³ VMs using a load balancer, or add object storage to deliver assets.

To ensure secure access to your ccloud³ VMs at centron, we recommend using SSH keys instead of password-based authentication. Here is a step-by-step guide on how to generate SSH keys and add them to your centron account:

Creating an SSH key pair​

  1. Creating an SSH key pair: If you do not yet have an SSH key pair, create one using OpenSSH, which is included in Linux, macOS and the Windows Subsystem for Linux. To do this, use the following command in your command line:
ssh-keygen

  1. Location of the key pair: By default, the key pair is stored in ~/.ssh/ on Linux and in /Users/Your_Username/.ssh on Windows and macOS. Copy the contents of your public key, which is called id_rsa.pub by default.

  2. Copying the public key: On macOS, you can copy the key directly to your clipboard by using the command

pbcopy < ~/.ssh/id_rsa.pub

use. For Windows and Linux, the command varies depending on the specific distribution, subsystem or command line.

More details on creating SSH keys:​

  1. Creating SSH keys via OpenSSH

  2. Connect via SSH

By using SSH keys, you can significantly improve the security of your ccloud³ VMs and avoid having to manually add or configure keys for each VM.

Configuring your ccloud³ VM​

When creating and configuring your ccloud³ VMs on centron, you should bear in mind the following recommended settings:

  1. VPC (Virtual Private Cloud):

    • Creates a private network interface that is accessible only by resources within the same account or Teams.

    • Offers enhanced security and reduced bandwidth costs for internal communication.

    • Activation at a later stage requires manual network configuration and a restart of the VM.

  2. IPv6:

    • Enable IPv6.

    • This option is free of charge; activating it at a later date also requires manual network configuration and a restart of the VM.

  3. Advanced Monitoring:

    • A metrics visualisation service that displays additional charts in a separate interface.

    • Enables the configuration of alarm policies.

  4. Backups:

    • Backups are not included in the ccloud³ basic service. Using the cBacks add-on, you can create disk images of your VMs at hourly or daily intervals.

    • Allow you to restore a VM to its latest state.

    • In addition, charges will apply for the backup storage used, in accordance with the current cBacks price list.

  5. User Data:

    • Data that CloudInit processes during the VM’s first boot to carry out tasks or run scripts.

    • The user data script used in the tutorial implements two security measures:

      • Disables password-based login, so that access is only possible via SSH keys.

      • Create a non-root user with sudo privileges for day-to-day use, to minimise the risk of accidental destructive changes whilst still allowing privileges to be escalated where necessary.

How do I create a ccloud³ VM?​

The following steps ensure that your ccloud³ VMs are optimally configured for centron to guarantee security, efficiency and scalability:

  1. Open the Create menu:

    • Log in to the centron control panel.

    • Click on ‘Create’ in the top right-hand corner to open the creation menu.

  2. Select ‘ccloud³ VMs’:

    • Click on ‘ccloud³ VMs’ in the creation menu to go to the ccloud³ VM creation page.

  3. Configure your ccloud³ VM:

    • Select an image: Under the 'OS' tab, select the latest LTS version of Ubuntu (24.04 LTS).

    • VPC network: Select the default VPC.

    • Recommended and advanced options: Enable the options for IPv6 and monitoring.

    • Advanced options – User data: Tick the box for user data and paste the Cloud Config script provided into the text field. Edit the highlighted line to set the username.

Here is the script you should use (replace USERNAME=cadmin with your chosen username):

set -euo pipefail

USERNAME=IhrBenutzername # TODO: Passen Sie den sudo Nicht-Root-Benutzernamen hier an

# Benutzer erstellen und sofortiges Passwortablaufen erzwingen
useradd --create-home --shell "/bin/bash" --groups sudo "${USERNAME}"
passwd --delete "${USERNAME}"
chage --lastday 0 "${USERNAME}"

# SSH-Verzeichnis für sudo-Benutzer erstellen und Schlüssel übertragen
home_directory="$(eval echo ~${USERNAME})"
mkdir --parents "${home_directory}/.ssh"
cp /root/.ssh/authorized_keys "${home_directory}/.ssh"
chmod 0700 "${home_directory}/.ssh"
chmod 0600 "${home_directory}/.ssh/authorized_keys"
chown --recursive "${USERNAME}":"${USERNAME}" "${home_directory}/.ssh"

# SSH-Login als root mit Passwort deaktivieren
sed --in-place 's/^PermitRootLogin.*/PermitRootLogin prohibit-password/g' /etc/ssh/sshd_config
if sshd -t -q; then systemctl restart sshd; fi

  1. Authentication:

    • Select 'SSH keys' for authentication and choose one or more keys. These keys will grant you access to the root user. The user data script will add these keys to the non-root user with sudo privileges and disable password authentication.

  2. Tags:

    • Create a tag that corresponds to the intended use of the ccloud³ VM, such as 'webserver'. You can use this tag to apply cloud firewalls in the next step.

  3. Recommended options:

    • Enable the 'Backups' option using Premium Full Managing.

  4. Creating the ccloud³ VM:

    • Once you have selected all the options, click on "Create ccloud³ VM".

Create a cloud firewall​

With centron, you can set up firewall rules similar to those on DigitalOcean Cloud Firewalls to protect your ccloud³ VMs from external attacks. These firewalls act as a barrier and block any traffic that is not explicitly permitted by a rule. Here is a guide on how to configure a firewall for your ccloud³ VMs:

  1. Setting up the firewall:

    • Log in to your centron control panel.

    • Click on ‘Create ccloud³ VM’ in the top right-hand corner to open the creation menu, then select ‘PFSense’ to create a firewall.

  2. Name the firewall:

    • For example, enter "inbound-ssh-only" in the "Name" field.

  3. Configure inbound rules:

    • Leave the default SSH rule as it is. This rule allows incoming SSH connections to the ccloud³ VM via port 22.

  4. Configure outbound rules:

    • Keep the default rules in place, which allow all traffic to any destination on any port. This is important as many basic services rely on outbound communication.

  5. Applying a firewall to ccloud³ VMs:

    • Add the tag you used when creating the new ccloud³ VM. If you create additional ccloud³ VMs and add the same tag, they will automatically be included in this cloud firewall. This will make it easier for you to scale in the future.

  6. Create a firewall:

    • Once you have selected all the options, click on "Create firewall".

Summary​

Once you have set up a ccloud³ VM on centron using the recommended configuration, setting up future VMs is even easier, as you won’t need to repeat most of the steps. The one-off steps include:

  • Creating an SSH key pair.

  • Uploading your public SSH key to your centron account.

  • Setting up the cloud firewall.

To create additional ccloud³ VMs with the same configuration, simply select the configuration options on the ccloud³ VM creation page:

  • Enable the same features (VPC, IPv6, monitoring and backups).

  • Select your SSH key.

  • Insert the Cloud Config script into the user data.

  • Add the tag for the cloud firewall.

Last updated on