Tag: Cloudflare

Cloudflare Turnstile – easy and effective CAPTCHA

Cloudflare Turnstile – easy and effective CAPTCHA

It is estimated that humans collectively spend 500 years solving CAPTCHAs each day, so why does blog/comment spam still make it through to your inbox?

Enter Cloudflare Turnstile a simple and effective CAPTCHA that reduces the spam and is seamless for visitors. You can read more about this free product from Cloudflare here on their blog. Keep in mind that Turnstile plugins and components already exist for WordPress/Joomla etc, so implementation is just a few clicks away.

We’ve been testing Cloudflare Turnstile on WordPress and Joomla sites with great results. Customers are reporting a reduction, or even total elimination of spam via their contact forms and comment plugins/components. Integration is also simple and can be configured in a few minutes. As part of our Managed Hosting approach, if you are a current customer simply get in touch and we can set this up for you.

Are you taking advantage of our Password Privacy Protection service? We’re ready to share our knowledge and skills to help protect your personal information. Need help getting a password manager setup? Not sure how to use 2FA (two factor authentication). Heard about hardware keys for 2FA but don’t know how to use them? These are all part of the service we are now providing, contact us today and we’ll help you keep safe and spam free.

Zero Trust SSH

SSH is arguably the most basic service on a linux based server. It’s secure as well, when using SSH keys (and with root login and passwords disabled) but it’s still a big target for the “bad guys” (mostly automated bots). You can run SSH on a non-standard port (not port 22), but that is just security through obscurity, which really isn’t good practice.

Well, then along came Zero Trust. Cloudflare perhaps didn’t invent this, but they are the biggest proponent of it.
What is it? In my own words, it’s VPN less authentication for web and anything else you can access via the internet. Now we can authenticate down to the user, not just the entire network (like a VPN).
How does it work? You authenticate to the Zero Trust Service via a webpage and once that is done, any applications that you have been given access to are automatically authenticated or protected behind the Zero Trust Provider, in this case Cloudflare
Can you do the same for SSH? YES SECURELY and IN THE BROWSER. It’s not new, it’s free (for up to 50 applications) and it’s easy to setup. See the original blog post here.

The basic steps are:

  • A domain pointed to your Cloudflare account
  • Setup a Cloudflare tunnel
  • Add an application, making sure you follow these specific steps
    At this point you can actually login to SSH in the browser, but you will need to authenticate yourself
  • Configure a short lived certificate to allow automatic login to SSH in the browser
    A word of warning, the SSO identity you use to authenticate with Cloudflare access will be the username passed to your server, read this section to understand this

The possibilities are endless once you get your head around this. You could protect a WordPress admin login page (though automatic login to WordPress is not something I’ve explored yet). Grant secure access to a server running in another location, and as discussed here, actually login to SSH in the browser.

With this done (Zero Trust SSH) you can go ahead and close port 22 of your server. How much safer do you feel?

Further Cloudflare Security – Authenticated Origin Pulls

Further Cloudflare Security – Authenticated Origin Pulls

Previously we posted about the importance of ensuring that all traffic to your website is actually going via Cloudflare (if you use Cloudflare in this way).

Quick recap, why is this so important?

Unless you ensure this is the case a malicious actor could possibly reach your content/website via your server IP address. Ensuring that only traffic via Cloudflare is accepted secures your web site or app and means that other tools (like Cloudflare Access, Workers etc can work correctly) can also be used to enhance your security.

So, Authenticated Origin Pulls

In plain English, your web server presents a cryptographic signature and says that only if the visitor presents the other part of the certificate should they be allowed to load the web page. Your web server actually enforces this. This way, if traffic does not come from Cloudflare, it will be rejected.

Limitation: You will only be able to configure this if you have full access to your web server ie root access, VPS, dedicated server etc. A basic level of knowledge of server administration is required.

Setup

There are 3 steps involved. I’ll provide an example below for NGINX. Apache is just as easy.

  1. In your Cloudflare dashboard enable Authenticated Origin Pulls, a quick link to this page in your account is here. Please note, enabling this now is a good idea, it will allow Cloudflare the few minutes it needs to start sending the one part of the cryptographic signature from all parts of their network. Until you start to enforce it (step 3) there will be no change or downtime on your web site.
  2. Download the certificate Cloudflare provides for this purpose. You can find it here. Save this to your server, a good location is:

    /etc/ssl/certs/cloudflare.crt

    (other locations are probably quite acceptable)
  3. Now update your Nginx configuration to use Authenticated Origin Pulls. Open the configuration file for your domain, or include the following: 
ssl_client_certificate /etc/ssl/certs/cloudflare.crt;
ssl_verify_client on;

At this point, the moment you restart NGINX, your web server will ensure that only traffic via Cloudflare will be permitted.

Test

Test things by visiting your website directly via the IP address. You should see something like:

400 Bad Request

No required SSL certificate was sent

openresty

That’s it! A huge step in securing your server has now been completed. Any issues/questions please let us know in the comments below. Keep safe!

Scroll to Top