THIS GUIDE IS OUTDATED!!
Be sure to check out the Definitive Guide to Hosted UniFi 2021 – all of this same info, but updated for 2021!
———————————————————————–
But…if you’re feeling nostalgic, go ahead and keep reading.
*** Updated 4/25/2019 – Updated Step 18 to use OpenJDK-8 instead of Oracle’s Java 8.
*** Updated 8/15/2019 – Ran through this entire setup – no problems – still working great!
*** Updated 12/2/2019 – Added a step to re-import renewed Let’s Encrypt certificates into UniFi (daily cron job)
This is the Definitive Guide to Hosted UniFi.ย In this guide, we will set up a hosted server using Vultr (I have confirmed that all of these steps work fine on Digital Ocean as well, but Vultr will be our example in this guide), going through some best practice security settings such as enabling secure certificate authentication, installing UniFi, and finally setting up Let’s Encrypt.
The first thing you need for this guide is an account set up with Vultr (or Digital Ocean) – if you click on the Vultr link below, you can sign up using my referral code which gets me a few bucks for the referral – thanks!
SPECIAL OFFER!ย With my Vultr link – you currently get $100.00 FREE CREDIT towards your virtual servers for signing up!ย Click the Vultr logo below or use this link:ย https://www.vultr.com/?ref=8473585-6G
*** NOTE:ย As I said, the rest of this document will be focused on a Vultr install.ย I will be keeping this guide up to date periodically as things change with the setup – check back if you ever find that something isn’t working, and comment below if you have any trouble with any of the steps!
Also – here’s a Digital Ocean referral link if that floats your boat (pun intended):ย https://m.do.co/c/6de2bc2df3b8
If you’re already signed up with Vultr and/or Digital Ocean, but you still appreciate the work that went into this guide – you can always:
Part 1 – Install Vultr Virtual Server
Log into Vultr and get to the main dashboard.ย Click on โServersโ from the left hand menu followed by the blue circled โ+โ symbol in the upper right.ย This will bring you to the new server setup page.
The first step of the server creation is to select your location.ย Pick whichever data center you want โ I however, tend to choose the data center closest to my (or my clientโs) geographic location.ย In this case, Iโm going to pick Seattle.
The next step is where we select our server type.ย Click on Ubuntu and choose โ16.04 x64โ from the drop-down.
*** Tech note:ย You may be asking โWhy not the latest and greatest Ubuntu 18.04??โย Well, as of the writing of this blog post, UniFi still does not install properly on Ubuntu 18.04 without downgrading the default version of MongoDB.ย So, until Ubiquiti standardizes on the latest version of Mongo, I prefer to stick with the OS I know works great right out of the box.ย That being said though โ this same process should work fine on Ubuntu 18.04 given the extra step of downgrading the database.
Next, select your server size.ย UniFi will run on anything in the $3.50/month size or higher.ย For testing purposes, the $3.50/month tier is fine.ย For a production system with only a few sites, the $5.00/month tier would be the best option, and then scale up from there.
Finally, you can select any options (Auto Backups are highly recommended for a production server), and then give your server a hostname.ย Hostname should be something like unifi.company.com.ย For our demo, we’re going to use vultrunifi.crosstalksolutions.com.ย This step is NOT optional – using an FQDN to inform your UniFi equipment is best practice to ensure that you can migrate later on down the road without much issue.ย In addition, Let’s Encrypt is going to depend on this DNS name as well.ย Startup script and SSH Keys can be left blank.
Click โDeploy Nowโ and youโre off to the races!ย You are taken back to the server summary screen.ย It will take 1-2 minutes for the server to spin up, so be patient.ย Once the โStatusโ changes from โInstallingโ to โRunning,โ you should wait about another 30 seconds, and then youโre good to go.ย Click on the name of your server to see its detail screen.
Once the server is in a โRunningโ state, youโll see your IP address.ย Copy or make note of that IP address โ weโre going to use it to create our DNS A record in the next step.ย Youโll also want to make note of or copy your default root password.ย (We will change that password immediately upon logging in).ย You can show the password by clicking the โeyeโ icon, or simply copy it to your clipboard by clicking the copy icon.
Part 2 – Create DNS A Record
Since you now know your IP address, you should log into your DNS hosting provider or DNS server and create a new A record that points the hostname that you created in Step 1 to the IP address of your Vultr server. This will be needed in the future when we create the secure SSL certificate for the UniFi Controller, as well as for Let’s Encrypt.
Part 3 – Log into your new server
At this point, you should have your Vultr username (root) and password from the server details.ย Copy the password to your clipboard and then open up PuTTY.
Enter in the IP address or hostname of your server and then click โOpen.โ
PuTTY will open up a terminal window and first ask you if you want to accept the new host (click โYESโ).ย Then you will be given a login prompt.ย Use the information from the Vultr server properties:
User:ย ย root
Password:ย (the password from the Vultr server properties โ you can do SHIFT+INS or right-click to paste it in)
The very first thing that you should do is change your root password.
passwd root
You will be asked to enter your root password twice – make sure it is a STRONG password.ย We will be disabling root access to this box later in this guide, but you will still need to know the root password in order to run sudo commands.
Part 4 โ Create New User
Most Linux machines in the world have root as the default user.ย The first line of defense is to create a separate login account with the same privileges and then disable root.
Start by creating a new user โ for simplicity, for this exercise, our username will be โunifiadminโ:
adduser unifiadmin
This command will have you set a password for the new user, and you can also optionally enter in some additional information such as their real name and contact info.
Next give root (sudo group) privileges to the newly created user:
usermod -aG sudo unifiadmin
This new user will now be able to use the โsudoโ command to run commands as root.
At this point, we have created our new user, but we havenโt yet disabled root โ we will do that in a moment.ย First, we will enable private key authentication as a second line of defense.
Part 5 โ Create Private Key Pair
Letโs now create our public and private key pair.ย The public key lives on the server, and the private key will be used to unlock access from any device that needs it.
ssh-keygen
When asked where to put the file, take the default.ย You can choose whether or not to enter in a passphrase โ having a passphrase means that you need both the private key and passphrase to gain access.ย It provides an additional layer of security.
Once your keys have been created, you will find them in /home/root/.ssh โ there should be id_rsa (private key) and id_rsa.pub (public key) files in that directory.
Next, we need to copy that key to the newly created userโs account:
ssh-copy-id unifiadmin@[server IP]
Choose โyesโ when asked if you want to continue, and enter unifiadminโs password when prompted.
This command will copy the public key to the unifiadmin userโs ~/.ssh directory as an authorized_keys file.ย You can now use the private key to authenticate with this server as user unifiadmin.
Part 6 โ Modify SSH Settings
The next step is to modify the SSH settings so that we will both disable root user access and password authentication.ย Start by editing the SSH configuration file:
nano -w /etc/ssh/sshd_config
Now scroll down until you find the line that says:
PermitRootLogin yes
And change โyesโ to โnoโ:
PermitRootLogin no
This disables root user login.ย Next scroll down further and find:
PasswordAuthentication yes
And again change โyesโ to โnoโ:
PasswordAuthentication no
This disables password based authentication.ย (Private key authentication should already be enabled by default โ you can verify this by ensuring thatย PubkeyAuthentication is set to โyesโ in the SSH config file).
Press CTRL+X followed by โYโ and โEnterโ to save and exit.
*** NOTE:ย This next command commits these changes.ย If you lose connectivity because you made any mistakes, you should just destroy the Vultr server and start over.ย ALSO โ keep this original PuTTY session open as you go through the next few stepsโฆeven after we restart SSH, this session will still be connected, so if you canโt connect in with the private key, you still have the opportunity to make changes.
Restart SSH with:
sudo systemctl reload sshd
Part 7 โ Download Private Key File
Now we need to download our private key file.ย Start by showing the contents of the id_rsa file:
cat ~/.ssh/id_rsa
Select the entire contents of the file with your mouse and press CTRL+INS to copy the text to your clipboard.
Next, open up a text editor such as Notepad and paste the entire block of text into a blank file.ย Save this file in a secure location.
Once saved, you can delete the id_rsa file from the server (though, you should probably test connectivity first if this is your first time making these changes):
rm ~/.ssh/id_rsa
Part 8 โ Covert Private Key to PuTTY format
Beforeย you can use your private key withย PuTTY, you need to convert it to .PPK format.ย To do this, weโll use another free program from the creators of PuTTY called PuTTYgen (you can download it from the same link as PuTTY above).
First, run PuTTYgen and click the โLoadโ button.ย Browse to the private key file that you saved in step 7.ย When browsing for your private key, change the file type you are searching for from โPuTTY Private Key Files (*.ppk)โ to โAll Files (*.*).โ
Open your private key file, and you should receive a notice that the private key was successfully imported.ย Click OK to get off of this notification.
Now, click the โSave private keyโ button and save your private key as a .ppk file (I usually just use the same directory that I used to save the original private key).ย You can now close PuTTYgen.
Part 9 โ Log in as New User
Start a new PuTTY session โ you can do this from the existing window by clicking the PuTTY icon in the upper left-hand corner and choosing โNew Session.โ
In the PuTTY window, enter the hostname of the server in the Host Name field.
Then, in the left-hand menu, expand the โSSHโ section underneath โConnection.โย Then click on โAuth.โย Here you will see a place to browse to your PuTTY .PPK private key file.ย Click โBrowseโฆโ and find the .PPK file we created in step 8.
Once you have the file loaded, click back on โSessionโ at the top of the left-hand menu.
If you want to SAVE these connection details, you should now enter in a friendly name into the โSaved Sessionsโ box and click the โSave.โ button.
Now click โOpen,โ and you should get a โLogin as:โ prompt.ย Enter in the name of the user that you created in Part 4 (in our case, it was unifiadmin) and you should now connect to the server.ย If you have a passphrase on your private key pair, you will also be prompted for that passphrase.
Part 10 โ Change SSH port
Now that we can log in with our secure key, letโs take our SSH security even further by changing the default SSH port from 22 to something non-standard.
Edit the SSH config file again with:
sudo nano -w /etc/ssh/sshd_config
Find the line that says:
Port 22
And change it to:
Port [different port number]
You can use any port number for your SSH connection, but I typcially use port 2222 when I change to something non-standard.ย CTRL+X followed by โYโ and โEnterโ to save and exit Nano.
Restart SSH again with:
sudo systemctl reload sshd
Next, letโs start a new PuTTY session using all of the same settings from Part 9, but this time also change the port to whichever port you changed SSH to.ย In our case, it was port 2222.ย If you previously saved your PuTTY session, you should save it again with the new port number.
Part 11 โ Enable UFW Firewall
At this point, we have now secured our SSH connection pretty well.ย Now, letโs secure our server even more by using some firewall rules to lock everything down.
Ubuntu uses the UFW firewall, however it is not enabled by default.ย First, we are going to add all of the firewall rules that we need to connect to UniFi, and then we will turn it on.
First, letโs allow our new SSH port and lock it down so that connections to this port are only allowed from our IP address:
sudo ufw allow fromย [IP address] to any port [SSH port number]
In this example, if your IP address is 1.2.3.4, and your SSH port is 2222, the command should be:
sudo ufw allow from 1.2.3.4 to any port 2222
Let’s also add a rule for Cockpit – which is an optional server monitoring GUI (don’t add this rule if you don’t plan on running Cockpit – it is optional…more info on Cockpit in Part 16 below):
sudo ufw allow from 1.2.3.4 to any port 9090
Once again, substitute 1.2.3.4 with your own IP address.
Next, letโs open up access to the UniFi GUI.ย Important note here โ you donโt actually HAVE to open up this port to the outside world if you are instead using Ubiquitiโs Single Sign On (SSO) account to access your UniFi Controller through https://unifi.ubnt.com.ย BUT โ you will have to use this port at least once to enable cloud access in UniFi.ย You can either wait to do your firewall rules until after cloud access has been enabled, or you can disable this rule afterwards.
sudo ufw allow from 1.2.3.4 to any port 8443
Next, there are a couple of ports that we need open to the whole wide world.ย These are the STUN port and the UniFi inform port:
sudo ufw allow 3478/udp sudo ufw allow 8080
Note that the STUN port running on 3478 is UDP.
If you are going to be using a guest portal with UniFi, you will also want to open these ports:
sudo ufw allow 8880 sudo ufw allow 8843
We’re also going to need to open up ports 80 and 443 for Let’s Encrypt.ย If anyone browses directly to those services, they will get a connection refused response.
sudo ufw allow 80 sudo ufw allow 443
At this point, we will now turn on our UFW firewall and take a look at the rules that we created.
sudo ufw enable
When prompted whether or not to proceed, choose yes.
Letโs take a look at our rules:
sudo ufw status
You should see something similar to this (note that I did not add the ports for guest portal access in my example):
The firewall is now running, and if you test your PuTTY connection again, you should still be able to connect.ย But โ if you test connecting in on the standard SSH port 22, you will not be able to connect.
Part 12 โ Update Server
Now that access to the server is secured, letโs run our system updates.
sudo apt-get update sudo apt-get upgrade -y sudo apt-get dist-upgrade -y
Itโs possible that no updates will be needed, but if you are asked whether or not to proceed on any of these steps, just answer Y.
Once the updates are done, let’s give the server a reboot:
sudo reboot
The server should only take about 2 minutes to reboot, and then you can reconnect.
Part 13 – Configure Time Zone
Set up your Time Zone by running:
sudo dpkg-reconfigure tzdata
A pink bordered window will appear โ select your geographic area (use America for United States) and then select your city/time zone from the list. ย You can press TAB, arrow keys, and SPACE to move around these screens and make selections.
Once your time zone has been selected, press OK, and youโre done with Step 6.
Part 15 – Configure NTP
NTP (Network Time Protocol) should already be installed to keep everything in sync, but to double-check, run:
service ntp status
You should see that NTP is ‘active (running.’ย If you type:
date
Your local time should show correctly (in 24-hour format).
Part 15 – Set Up a Swap File
Setting up a swap file is completely optional – I have had some folks tell me that it isn’t necessary, and others tell me that performance is much improved when a swapfile is configured.ย The truth probably lies somewhere in the middle, but I tend to set up a swapfile anyway – I have never noticed a decrease in performance by setting this up, so what’s the harm?
Run the following commands to create and use a swap file.
sudo fallocate -l 4G /swapfile
This allocates 4GB as a swapfile in the /swapfile directory.
sudo chmod 600 /swapfile
Sets permissions on the swap file directory.
sudo mkswap /swapfile
Formats the swap file directory for use as a swap file.
sudo swapon /swapfile
Tells the server to use that directory as a swap file.
Finally, we need to make sure that the swap file turns on every time we reboot the server. ย Run the following command to add the swap file information to the /etc/fstab file:
sudo sh -c 'echo "/swapfile none swap sw 0 0" >> /etc/fstab'
To verify that the command worked, type:
cat /etc/fstab
and look for a line (at the bottom of the file) that says:
/swapfile none swap sw 0 0
If that line exists in the /etc/fstab file, youโre all good.
Part 16 – Install Misc. Programs
Now, we’re going to install a few misc. programs to improve our installation.ย All of these are recommended, but completely optional.
The first is Cockpit – Cockpit is a system monitoring software for viewing CPU/RAM/Disk space.ย You can read more about Cockpit here:ย https://cockpit-project.org/
Install Cockpit by running:
sudo apt-get install cockpit -y
Once installed, you should be able to browse to https://[server IP or FQDN]:9090.ย Log in with the credentials you created in Part 4.
Next, let’s install htop – htop is an enhanced version of the ‘top’ command which shows system resources in realtime.ย To be clear – top is included by default, and works perfectly fine…but I prefer the colors and layout of htop instead:
sudo apt-get install htop -y
Once installed, you can run:
htop
To see the system resources.ย Press Q to exit htop.
Finally, let’s install haveged.ย Haveged is an unpredictable random number generator for Linux.ย This program has historically helped to speed up launching UniFi.
sudo apt-get install haveged -y
Once finished, we’re all done with the optional programs.
Part 17 – Set up autoremove
As you run updates to your server, older versions of the Linux kernel are no longer needed, and they can potentially fill up your boot volume.ย To prevent this from happening, we can run:
sudo apt autoremove -y
(Go ahead and run this now).ย This clears out older versions that are no longer necessary, but this command should also be scheduled to run on a regular basis.ย To do this,
sudo sh -c 'echo "sudo apt autoremove -y" >> /etc/cron.monthly/autoremove'
This creates a new file called ‘autoremove’ in the /etc/cron.monthly directory which will automatically run once a month – but in order to run, this file must be made executable:
sudo chmod +x /etc/cron.monthly/autoremove
Now we’re good to go.
Part 18 – Install Java 8
*** Updated 4/25/2019 – Oracle’s Java 8 now requires an Oracle login to download, and is no longer free.ย So instead, I am changing these instructions to use OpenJDK-8 instead.
Install OpenJDK-8
sudo apt update sudo apt install openjdk-8-jdk -y
That’s it (actually, this install is much easier than the Oracle one, and still works great).
Part 19 – Install UniFi
Finally, we’re going to install UniFi.ย There are a few different ways to download and install UniFi, but for me, the easiest way to install and maintain the UniFi package is to use apt, so that is what we will do in our example.
First, we need to add an apt source for UniFi.ย To do this, run the following commands:
echo 'deb http://www.ubnt.com/downloads/unifi/debian stable ubiquiti' | sudo tee /etc/apt/sources.list.d/100-ubnt-unifi.list
sudo wget -O /etc/apt/trusted.gpg.d/unifi-repo.gpg https://dl.ubnt.com/unifi/unifi-repo.gpg
These commands set up the apt repository for UniFi and install the trusted GPG key.ย Now letโs install UniFi:
sudo apt-get update sudo apt-get install unifi -y
You should now have installed the latest stable version of UniFi, which is version 5.10.19 as of the writing of this article.
Part 20 โ UniFi Setup Wizard
Next, we need to go through the UniFi Setup Wizard.
Open a browser and connect to https://[server IP or FQDN]:8443.ย Note that this URL should ONLY be available to the WAN IP that you set up in Part 11.
You will be prompted with a warning screen that is warning you the site may be unsafe.ย This is because we have not yet installed our secure SSL certificate.ย Click through the warning.
Check your timezone and click โNext.โย Note that if you are restoring from backup, use the link on this page.
The next step is for configuring devices โ at this stage, we donโt have any devices to configure, and since this is a hosted server, any LAN devices you have plugged in would not be discovered anyway.ย Click Next to continue.
Here you can add a wireless network.ย For our purposes however, we are going to click โskipโ since this post does not deal with actual UniFi setup (see one of my manyย YouTube videosย for that).
The next step is to choose a username and password for the UniFi admin account.ย I went with โunifiadminโ as the user in order to match what we are using in SSH.ย For the password, note that it will not let you move forward to the next step until your password meets their strength requirements.
Click โNextโ when finished followed by โFinishโ on the summary screen.ย You will then be asked if you want to set up your Ubiquiti Cloud Access:
You can enter in your cloud access account information if you have it, but if you donโt have or donโt know this information, you can always enable it later within UniFi.
Once you proceed or skip the UniFi cloud access setup, you will be redirected to the UniFi login screen.
But we’re not done yet!!
Part 21 – Set Up Let’s Encrypt
We’re going to set up Let’s Encrypt for secure HTTPS communication with the server (and to get rid of those pesky security screens when we browse to UniFi).ย We’re going to use Certbot to set up Let’s Encrypt – this well help to automate the entire process.
Install Certbot:
sudo add-apt-repository ppa:certbot/certbot
Press ENTER to continue when prompted.
sudo apt-get update sudo apt-get install python-certbot-apache -y
Now Certbot is installed, so the next step is to generate our SSL certificate.
sudo certbot --apache -d vultrunifi.crosstalksolutions.com
Substitute your own FQDN instead of vultrunifi.crosstalksolutions.com.ย When prompted, enter in an email address for use with the SSL cert.ย Then press A to Agree when prompted followed by Y or N to share your email address with the Electronic Frontier Foundation (I said N).ย Next you will be asked if you want to redirect all HTTP traffic to HTTPS – choose option 2.ย Your Let’s Encrypt certificate has now been installed.
Next, we need to import that SSL certificate into UniFi – or in other words, we have to tell UniFi to use the Let’s Encrypt certificate.
A developer namedย Steve Jenkins created a really great script that automates the rest of the process, making it super easy.ย So, thanks to Steve, and letโs download his script and modify a few settings.
sudo wget https://raw.githubusercontent.com/stevejenkins/unifi-linux-utils/master/unifi_ssl_import.sh -O /usr/local/bin/unifi_ssl_import.sh sudo chmod +x /usr/local/bin/unifi_ssl_import.sh
Next, edit the /usr/local/bin/unifi_ssl_import.sh file that we imported:
sudo nano -w /usr/local/bin/unifi_ssl_import.sh
Find the line that says โUNIFI_HOSTNAMEโ and change it to your own FQDN:
UNIFI_HOSTNAME=vultrunifi.crosstalksolutions.com
Next, since we are on a Ubuntu Vultr server instead of a flavor of RedHat (which the script was based on), we need to comment out the RedHat stuff and uncomment the Debian/Ubuntu stuff:
# Uncomment following three lines for Fedora/RedHat/CentOS #UNIFI_DIR=/opt/UniFi #JAVA_DIR=${UNIFI_DIR} #KEYSTORE=${UNIFI_DIR}/data/keystore # Uncomment following three lines for Debian/Ubuntu UNIFI_DIR=/var/lib/unifi JAVA_DIR=/usr/lib/unifi KEYSTORE=${UNIFI_DIR}/keystore
Next, enable Lets Encrypt mode (change LE_MODE=no to LE_MODE=yes):
LE_MODE=yes LE_LIVE_DIR=/etc/letsencrypt/live
Save and exit nano by doing CTRL+X followed by Y.
Finally, run the script!
sudo /usr/local/bin/unifi_ssl_import.sh
If you now close your browser and then re-open it to https://[your UniFi FQDN]:8443, you should no longer have the security warnings, and you will have a valid HTTPS certificate installed.ย And no more pesky security warnings.
This is excellent – BUT – every time certbot automatically renews your Let’s Encrypt certificate, it has to be re-imported into UniFi.ย So we need to run this same command on a regular basis.ย To do so, we’re going to create a small script and put it into the /etc/cron.daily folder.
sudo nano -w /etc/cron.daily/unifi_ssl_import
Add these lines to the file:
#!/bin/bash
/usr/local/bin/unifi_ssl_import.sh
CTRL+X followed by Y to save and exit.
Now we need to set the permissions on the file so that it runs as root and as an executable script.
sudo chown root:root /etc/cron.daily/unifi_ssl_import sudo chmod +x /etc/cron.daily/unifi_ssl_import
Let’s test this certificate further by running it against an SSL Server Test from SSLLabs.com.ย Open the following URL in your browser:
https://www.ssllabs.com/ssltest/analyze.html?d=vultrunifi.crosstalksolutions.com&latest
Substitute my FQDN for your own.ย This test takes a couple of minutes to run, but when complete, it should verify that everything is A-OK.
Finally, when it comes to Let’s Encrypt certificate renewals, Certbot handles this automatically.ย You can verify this by checking out the cron file that Certbot created in /etc/cron.d:
cat /etc/cron.d/certbot
This will give you some info about the renewal process and let you know that it will try to renew the cert twice daily, which is really overkill since the certificate is good for 90 days.
If you want to test the certificate renewal process to make sure everything will renew properly, run the following command:
sudo certbot renew --dry-run
This will simulate the renewal process and you should see a ‘Congratulations all renewals succeeded’ message when complete assuming everything went OK.
Conclusion
Well, that’s it – the Definitive Guide to Hosted UniFi.ย If you have any questions, comments, updates, or suggestions on how this process can be made even more definitive, put those in the comments below.ย A ton of work went into the creation of this document – please subscribe to the Crosstalk Solutions YouTube page, and use our referral links for Vultr and/or Digital Ocean if you appreciate the effort!ย Also, we do full network deployment projects for businesses if you are interested in those services – be sure to click ‘Contact’ above to get in touch with us – thanks!
-Chris
Did you enjoy this guide?ย Great!ย You can always:
Comments 150
This is an amazing step-by-step tutorial; thank you for not only listing the steps, but explaining each one. Used affiliate link for Vultr. Thanks.
Author
Cheers – thanks!
I used the following command but controller will not update past 6.4.54
sudo apt update && sudo apt upgrade -y
any idea why?
You should do one for UNMS
There’s a typo in the AWF command: sudo ufw allow 8843
should be: sudo ufw allow 8443
Please change 8843 to 8443
8843 is for the Guest Portal ?
Question – Weโre also going to need to open up ports 80 and 443 for Letโs Encrypt. If anyone browses directly to those services, they will get a connection refused response.
sudo ufw allow 80
sudo ufw allow 443
I don’t get connection refused but just get generic apache page that is accessible. What did i miss?
I also get a generic apache page? I’m getting failures when trying to renew letcyencrypt, it says unable to find virtualhost listening on port 80? Any thoughts? Thanks!
Short form:
sudo ufw allow 80,443/tcp
Im getting Non secure using 8443 on the unifi portal. But straight to the domain is secure bringing up the default ubuntu page.
Can anyone help ?
did you ever get an answer on this? same issue
I have the same issue – certificate is valid on root domain but now at controller site on port 8443. It worked when the hosted controller was first set up but now that the certificate has renewed it no longer works. Do I have to run the import script again manually?
Same problem and it is massing with Facebook log-in. Any ideas?
need to import that SSL certificate into UniFi โ or in other words, we have to tell UniFi to use the Letโs Encrypt certificate.
https://crosstalksolutions.com/definitive-guide-to-hosted-unifi-2021/
Setup
Unifi Controller hosted on Digital Ocean (Fixed IP)
Site 1 USG with Dynamic Public IP
Wan1 192.168.0.254
Lan1 10.31.27.1/25
Wan1 192.168.2.1
Site 2 USG with Dynamic Public IP
Wan 1 192.168.1.1
Lan 1 10.31.26.1/25
Hey, is it possible connect site 1 and site 2 via StS-VPN using the Cloud Hosted UniFi Controller
After doing PART 12, I can not connect to the SSH, connection refused, I don’t know why.
Sorry, I don’t read it carefully. Now it works like a charm. Thank you for your amazing tutorial (step by step in the details).
Author
Cheers – thanks!
Ibraham, I get the same problem when I enable the firewall, I’m not able to hit any of the ports in the firewall rules.
Hi Felix, after changing the SSH port you may need to “ufw allow NewPortNumber/tcp”
At the very end, when you run the script, you get this as below :
$ sudo /usr/local/bin/unifi_ssl_import.sh
Starting UniFi Controller SSL Import…
Running in Let’s Encrypt Mode…
Inspecting current SSL certificate…
Updated SSL certificate available. Proceeding with import…
Missing one or more required files. Check your settings.
I’m also have the same problem. Did you get yours resolved?
Admin, please delete previous comment.
I am having this issue as well and not sure what went wrong, did anyone resolve this?
Resolved: I did not have an A Record in my DNS Management for unifi. In my case I was hosting the domain I chose in GoDaddy, so I needed an A record for just unifi (no .com, just unifi) pointing to the IP of my Vultr server. All good now!
Great article. I used your link to sign up with Vultr. I followed the instructions but now I am stuck at step 20. When I go to the url of my unifi controller all I see is UniFi Controller is starting up…Please wait a moment. I have waited quite a while and refreshed but it still does not go to the wizard. I have restarted the unifi service as well as rebooted the server. Would you have any ideas what might be causing this? Thanks!
Hello, I have some questions about SSL Certs, I configured UniFi and UNMS on same server (with same IP and hostname) , I have configured a CNAME to redirect the public ip to my domain and enter this hostname into my UniFi and UNMS, is there any problem if I use same hostname on both?
On the other hand, when trying to open the GUI in a browser UNMS is opening when I use the hostname for example, https://unifi.EXAMPLE.com in the past I used to open UniFi with https://unifi.EXAMPLE.com:8443 but now I have a certificate issue and cannot be opened, I’m using the IP instead to open it which is not a big deal but I want to know if in the future I will have any problem.
I tried to generate another SSL cert as per your tutorial but it seems that SSL is linked to the hostname as UNMS already generated a Let’sEncrypt cert
Keep in mind that I’m using the same HOSTNAME: unifi.EXAMPLE.com in both servers.
Thanks in advance.
Chris,
I was successful at setting up my hosted unifi controller on Vultr, and can access my controller fine with my FQDN from a browser, as well as ping it by FQDN, but when I set the set-inform url with ‘set-inform http://my-inform-url.net:8080/inform‘ it never shows up in my hosted controller. I have checked the server firewall status, and it shows all ports that are supposed to be open as open, per your guide. I’ve also upgraded the firmware on the AP to latest, with the discovery tool in Chrome. Still nothing showing in my device list in my controller. I’ve also tried setting the inform url using the IP of the server, instead of the FQDN, thinking maybe it was DNS issues. Still nothing showing in device list of the hosted controller. I’ve also reset the AP to factory default, then reset inform url. Still nothing. Any tips on what I may be missing? Thank you, in advance!
crisis averted! was a firewall issue on the ubuntu server. for whatever reason, the regular 8080 (not the v6) did not get opened. The 8080(v6) did. I disabled the firewall, tore it all down, and rebuilt all of the rules, and it’s working fine, now. Great guide! Thanks for all that you do!
despite opening the 3478 port, my devices still say cannot connect to the STUN controller. Any suggestions on how to solve this? in the device logs, the stun url shows the correct IP address and the correct port
man you’re the best wish i could subscribe to you about 10,000 more times. give steve jenkins a big thanks from all of us here in the community for those ssl scripts.
Worked perfectly thank you so much! This saved me a lot of time!
I had to install a couple of components listed below for my version of ubuntu 16.04:
*add-apt-repository
*I had to enable backports to install cockpit
*I’m running on a vps and it seems like they limited the ability to install a swapfile
Other than that, everything went exactly as you said it would. Thanks for the detailed how to!
Chris,
When I went through your guide and setup my controller, everything was working perfectly. Now, after about a week, I’m getting the Apache2 Ubuntu Default Page when I go to my controller FQDN. I haven’t made any changes to the site. Any ideas what would cause this? Vultr hosted
If you set up the firewall rule to access the controller page thru port 8443, your IP probably changed and now you can’t access the page. You will have to go into the firewall rules and change the IP to your new one.
Awesome guide. I’ve seen a few other comments about this…when I navigate to my unifi.mydomain.net, it takes me to the default “It works” apache page. Is that correct functionality?
Indeed I noticed that as well, would be nice if we can change that or disable that default page completely.
Hi! Great guide, many thanks! Maybe add a part on how to do regular updates of the controller software?
Great, the post very detailed instructions, clear illustrations. Thank the author very much. Hope to have more new and useful posts.
Great article, thanks! However I think I missed something, the server was running fine for a couple of months until yesterday, “Warning: Potential Security Risk Ahead” messages in the browser. So it seems that the renewal of the certificate did not his complete job … when running a dry run is says Congratulations,
** DRY RUN: simulating ‘certbot renew’ close to cert expiry
** (The test certificates below have not been saved.)
Congratulations, all renewals succeeded. The following certs have been renewed:
Any idea how to further check, and get the valid SSL back?
Thanks in advance ๐
Just to make clear,
the website of Unifi (unifi.mydomain.com) shows invalid cert (expired Friday 13 September 2019).
the server itself shows that the cert is valid (expires 12 November 2019)
myuser@mydomain:~$ sudo certbot renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Processing /etc/letsencrypt/renewal/unifi.mydomain.com.conf
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Cert not yet due for renewal
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
The following certs are not due for renewal yet:
/etc/letsencrypt/live/unifi.mydomain.com/fullchain.pem expires on 2019-11-12 (skipped)
No renewals were attempted.
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
myuser@mydomain:~$
I’ve got the same problem..did you get the warnings when you ran the dryrun for cert? I got user warning” error importing pyasn1″
“no module named pyasn1.
Mine did that this week as well. I had to issue this command to get it to renew manually:
sudo /usr/local/bin/unifi_ssl_import.sh
Not sure why it’s not working automatically.
Thanks so much for this. Mine was doing the same thing. It showed the certificate as renewed through November, but when I went to the controller it was showing as out of date.
Had the same problem, I ran the script and everything is working now. Then I saw what Steve Jenkins wrote about his script:
“If youโre using Letโs Encrypt, however, your certificate will expire every 90 days. Letโs Encrypt recommends running a twice-daily certbot cron job to check the status of your certificate (which can also renew it when necessary). I recommend that Letโs Encrypt users run a cron job that also executes unifi_ssl_import.sh twice daily, about 2-3 minutes after the certbot job. If the certificate is new, it will get automatically imported into the UniFi Controller. If not, the script will exit quietly.”
So I added a cron job as mentioned, I guess that I’ll see in about 3 months if everything is working without hassle ๐
Just noticed the same thing here. With limited knowledge on all this, it seems as if perhaps there’s been a change to the Unifi web server. Certbot is still happily doing it’s job, but the Unifi web server isn’t serving/accessing the certs like it used to. I don’t suppose you’ve found a fix?
Great step-by-step process, but do you have a procedure like this for people that is hosting their Unifi Network Controller on a UCK Gen 2+ cloud key? I have seen some stuffs on the net but they are rather confusing, at least for me.
After doing PART 12, I can not connect through PuTTY.
I have tried several times with same result.
Can someone please help me?
did you get this to work? I can’t connect via Putty after Step 12.
Did you put the right ip address for the firewall rule to port 2222? Or did you ip change?
GREAT !!! HELPED ME MUCH!!
Hey!
Great tutorial.
I followed every step starting from Part 11 as I’m hosting my controller locally.
I tested my site @ SSLLabs and got an A rating…
However my browser still shows the controller as being not secure… I’m not sure exactly whats going on, but any help would be appreciated.
I would prefer not to list any of my speccifics in a reply so email would work best.
Thank you!
Scroll up until you see Mike’s comment September 23, 2019 at 4:44 pm. I had the same issue and his command worked for me.
Hi
Once again a brilliant tutorial from Crosstalk Solutions. Love the Videos and written tutorials, actually set my unifi controller up some months ago using your previous tutorial but found this for a friend.
Keep up the good work.
Regards
Stuart, TCM Telecom, UK.
cant get past step 19, it gives a error “Unable to locate package unifi”
I’m a noob in linux so dont know what to do next.
all help is welcome
That’s GOLD!
thanks a lot!!!
I’m getting hung up on the firewall part and reboot (11 &12). I enter all of the rules with the IP address I believe I should be using. When I reboot, Putty throws an error the connection is lost. When I wait a few minutes and go back to Putty, it’s a blank screen and does not allow me to login. I am assuming I’m entering the wrong IP in step 11 but am not sure. Any clarification on where I should be pulling the IP from would be greatly appreciated.
Worked flawlessly! thank you saving me hours of research and for taking the time to make a well documented guide, as an IT guy myself I know this is painful process with little gain. Thanks for giving back.
Hi Chris,
When installing unifi I am getting
unifi : Depends: mongodb-server (< 1:3.6.0) but 1:3.6.3-0ubuntu1.1 is to be installed or
mongodb-10gen (< 3.6.0) but it is not installable or
mongodb-org-server (< 3.6.0) but it is not installable
E: Unable to correct problems, you have held broken packages.
I added the pre/post hooks to the cert renewal to only open ports 80 and 443 during the renewal process as Chris recommended at the end of the YouTube video that accompanies this post.
To do so I added an executable shell file in /etc/letsencrypt/renewal-hooks/pre named enable_firewall_ports.sh, and inside I put the “ufw allow 80” and “ufw allow 443” commands to open the ports up needed for the cert renewal. Then I added another executable shell file in /etc/letsencrypt/renewal-hooks/post named disable_firewall_ports.sh where I put the “ufw delete allow 80” and “ufw delete allow 443” to close the ports back up.
Not necessary, but I like keeping the ports I have open only to those that are absolutely necessary
Awesome tutorial! My only question is what do you do if you are at a customer site where the internet is down and you need to access the cloud controller? With a cloud key on site, obviously this is not an issue. This is the only thing keeping me from moving all my cloud keys to the cloud hosted controller.
Hi Chris,
Great tutorial and I’ve had the controller running for a few months now and not issues. I’m not a linux guy at all and don’t want to mess anything up but how would I upgrade my unifi controller to the latest release now?
Currently running it in a Digital Ocean droplet.
Hi, this script developed by Glenn R. worked perfect for me upgraeing to 5.12.22 from a server based on Chris instruction.
https://community.ui.com/questions/UniFi-Installation-Scripts-or-UniFi-Easy-Update-Script-or-UniFi-Lets-Encrypt-or-Ubuntu-16-04-18-04-/ccbc7530-dd61-40a7-82ec-22b17f027776?page=2
Sam,
i”m currently running my controller on digital ocean and just upgraded to 5.12.22. Ubnt has a great help page.
https://help.ubnt.com/hc/en-us/articles/360012282453-UniFi-How-to-Install-Upgrade-the-UniFi-Network-Controller-Software
then go down to “UniFi Installation and Upgrade on Debian-Based Linux ” just follow steps 1-9.
Just wanted to say I am in the process of upgrading, which I have never done on my production controller. Instead I create a new server, and install the newest version there. Once I am happy I can then migrate (export/import) sites over to that version. I have a pending post about the install of 5.11.50 failing which I am hoping to get help with this. This method doesn’t jeopardize an existing controller/server with issues that can result in downtime. Always backup sites before exporting to another server/controller.
Have been following this thread/process since UBNT raised their hosting fees off the charts. I have had great success. Still on Digital Ocean – not Vultr. Just tried to install Unifi 5.11.50 and get following error:
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:
The following packages have unmet dependencies:
unifi : Depends: mongodb-server (< 1:3.6.0) but 1:3.6.3-0ubuntu1.1 is to be installed or
mongodb-10gen (< 3.6.0) but it is not installable or
mongodb-org-server (< 3.6.0) but it is not installable
E: Unable to correct problems, you have held broken packages.
This is beyond me to figure out.
Well do I feel stupid or what. Thought I chose the correct build of Ubuntu. Looks like I didn’t. Tie to go delete all that work and start again. Good for me – I can obviously use the practice.
Great write up and thanks for keeping it up to date. Worked perfectly!
Hi Chris,
This has been a massive help and worked great. I have been running the server for the past three months and had no issues. However, my original Lets Encrypt certificate has now expired and even though I have manually updated the certificate, Chrome still thinks it has expired and now I am getting a certificate error. Have you got any ideas on where I could start to resolve this issue as I have restarted both Apache and the entire server?
I setup my lets encrypt certificate by the guide (back when you first put this guide out), and it’s been working fine, with no pesky prompts. My cert expired on Dec 1, and now I’m getting the security prompts again, when i login to my controller from Chrome or FF. When i run the SSL server test as SSL labs, it gives me an A, with no expired certs. Why is Chrome or FF saying the cert is expired, when SSL labs says it’s good? And why isn’t the cert auto-renewing? It was setup exactly by this guide, and has been working flawlessly until Dec 1
everything worked fine on your amendment of Dec 2nd, until it got to setting the permissions on the file so that it runs as root and as an executable script. Those two operations are showing as “not permitted” when they are run. I’m assuming this is because of disabling root earlier in the guide?
After performing everything in your Dec 2nd amendment, except setting those un-permitted permissions, my site still gives me an invalid cert error when i navigate to it in Chrome or FF.
I have the same issue as Scott (“Operation not permitted”) with the new unifi_ssl_import amendment which I was grateful for seeing now so that I don’t have to manually import the renewed certificates.
unifiadmin@unifi:~$ chown root:root /etc/cron.daily/unifi_ssl_import
chown: changing ownership of ‘/etc/cron.daily/unifi_ssl_import’: Operation not permitted
unifiadmin@unifi:~$ chmod +x /etc/cron.daily/unifi_ssl_import
chmod: changing permissions of ‘/etc/cron.daily/unifi_ssl_import’: Operation not permitted
Am I missing something here?
I may have figured this out on my own. I am by no means a Linux guy but…
After getting the ‘Operation not permitted’ message
If you type the command: sudo !!
Then enter the password for unifiadmin
The result is that it runs the last entered command with elevated credentials
This appears to resolve the issue as the commands complete with no error message.
Yeah, Chris forgot to put “sudo” in front of the chown and chmod commands. If you’ll just do that, it’ll run the commands.
Just used this to set up Let’s Encrypt.
Thanks Chris and team!
This is an amazingly well-written and well-maintained guide. It should be used as a shining example of how to write a How-To. Thanks so much for creating it.
I set my server up on AWS. Considering that it runs fine on a free-tier EC2 server it might be helpful for folks if you add a section for how to set it up on there. It would just be a few bits on Security Groups and instance spin-up.
Hi,
Thank you for your guide. Will this work on cloud key gen2? Would you post a solution for the cloud key also?
Thanks.
seriously, after searching for a good reliable installation up-to-date guide, you rocks.
everything works as expected. and really good tips for renew ssl and swap file. instead of vultr, we are using GCP on same distribution.
thank you Christ.
This was a brilliant suggestion!! I was really leery about opening 443 and 80 for no real reason other than to verify the SSL cert. I added both these scripts and it works like a charm!
Any ideas on why I wouldn’t be able to adopt a new AP into this setup? I followed your guide step by step and successfully transferred my controller from a laptop to an Ubuntu instance on VULTR. Everything ported over without issue. All existing APs and other hardware devices adopted just fine. However, today I went to add an additional AP Pro and adoption fails. It shows up in the Controller, but will not adopt.
That might not be a fault of the controller, but something going on with the device. It happens to me pretty often that I have to SSH in to the device being adopted and issue the set-inform command a few times during the adoption process for it to complete successfully.
Another question. Because the root account is disabled, how do I go about using something like SCP to manually copy over the config file to my computer? It seems that unless you are logged in as root, it blocks access the location of this file as well as the auto-backup files (as configured in the Unifi software).
I keep getting the error:
Bad Request
This combination of host and port requires TLS.
I’m using a digitalocean droplet. No idea what I’m doing wrong here…
It’s happening at step 20 and 21
You have to put https in front of domain name or ip you are using:
https://yourdomain:8443
https://yourip:8443
I have a weird one. This worked just fine, months ago. Now Im installing a new digitalocean instance, all the same as before, but at step 19 after the command “sudo apt-get install unifi -y” I get no package found. I rebuilt droplet 5-6 times, tried 16.04 and 18.04, its the same. I tried some other install script and that install unifi controller without the issue, but it has issues with lets encrypt. So again I used your lets encrypt method and everything is ok. I suspect somewhere in the process of adding apt source something is different than before. Could you please check? Thank you
What happens if we have a dynamic IP from our ISP?
I found this script below works great when you have a dynamic IP for the ufw firewall rules:
#!/bin/bash
HOSTNAME=your.dyndns.com
if [[ $EUID -ne 0 ]]; then
echo “This script must be run as root”
exit 1
fi
new_ip=$(host $HOSTNAME | head -n1 | cut -f4 -d ‘ ‘)
old_ip=$(/usr/sbin/ufw status | grep $HOSTNAME | head -n1 | tr -s ‘ ‘ | cut -f3 -d ‘ ‘)
if [ “$new_ip” = “$old_ip” ] ; then
echo IP address has not changed
else
if [ -n “$old_ip” ] ; then
/usr/sbin/ufw delete allow from $old_ip to any port 2222
/usr/sbin/ufw delete allow from $old_ip to any port 8443
fi
/usr/sbin/ufw allow from $new_ip to any port 2222 comment $HOSTNAME
/usr/sbin/ufw allow from $new_ip to any port 8443 comment $HOSTNAME
echo iptables have been updated
fi
You can then edit the crontab and update this every 5, 10, 15, etc minutes or whenever you want.
I have a question regarding this step:
Weโre also going to need to open up ports 80 and 443 for Letโs Encrypt. If anyone browses directly to those services, they will get a connection refused response.
Should I be worried about security with ports 80 and 443 from hackers? Is there something I can do to secure these two ports as best as possible?
Thanks!
Excellent guide! You may want to add a little information about using the SSL certificate for cockpit as well. It can be done in the same manner as the unifi_ssl_import cron. Most of this was borrowed from https://www.schotty.com/EL_And_Fedora/EL7_Cockpit/ with a few minor updates:
#!/bin/bash
# Set some variables
FQDN=`cat /etc/hostname`
# Fixes cockpit to use the LetsEncrypt SSL cert
cd /etc/cockpit/ws-certs.d
cat /etc/letsencrypt/live/”$FQDN”/cert.pem > “$FQDN”.cert
cat /etc/letsencrypt/live/”$FQDN”/privkey.pem >> “$FQDN”.cert
systemctl restart cockpit
cd ~
I reasonably new to this, but managed to get the cerificate installed for Unifi, however i’m struggling to do the same for Cockpit, so would appreciate the how-to added to the guide.
Alex – I put some directions for the cockpit SSL on my site along with a few other things I did to further secure my hosted UniFi Controller. I checked with Chris a few days ago and he said it was OK for me to put a link to the directions.
https://www.dr-b.io/post/Secure-Your-Hosted-UniFi-Controller
I am still actively developing the site. Hopefully, I will have comments enabled and/or a contact form added soon.
I just used the Let’s Encrypt steps to get this working on my Azure VM (Ubuntu) that I have hosting my Unifi Controller. Worked perfectly. These are awesome instructions!! Thank you so much for putting this together!
Just a note, when I originally setup my Azure VM I did not open port 80 (since it was not necessary) in the Azure VM ‘s Networking Settings. I had to create a rule to allow port 80 bound traffic in for Lets Encrypt to work. Otherwise you get errors when it runs the challenges because HTTP traffic can’t get through.
FYI, password and alias is different for the unifi-video service ๐
This is such a great guide. While our corporate unifi server is already set up, this made updating our SSL cert which was about to expire (step 21) MUCH easier. Instead of going through the manual process I spent five minutes going through your process to install Let’s Encrypt and get that going. What a gamechanger!
From Unifi’s website for Ubuntu 18.04 install prior to the apt install unify -y
wget -qO – https://www.mongodb.org/static/pgp/server-3.4.asc | sudo apt-key add –
echo “deb https://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/3.4 multiverse” | sudo tee /etc/apt/sources.list.d/mongodb-org-3.4.list
sudo apt update
the above points 18.04 to the correct version of mongo to install for unify.
Is the a :443 reverse proxy virtualhost option in an apache .conf file that I use to access https://sub.example.com:8443 from https://sub.example.com/? I’ve tried searching a ton of code snipits, but none seem to get the job done.
Bravo! Thoroughly impressed with the directions. Super helpful! My Controller is setup and will be able to deploy APs all over the world including some charity work in parts of Africa. Thank you for the extensive write-up. New to Ubuntu and the details were helpful. Even for a Windows guy, the directions were well articulated and easy to follow. Merci!
I succeeded with everything except getting an A+ on the SSL test. It says I’m capped at B because of TLS 1.0 – so how do we change that to something more current like TLS 1.2. Is something that will update itself eventually or something we need to modify directly.
Thanks for great tutorial! It was super helpful.
Dude – Awesome tutorial – tween you and Willie I don’t know what I’d do!
Thank you,
Rod
Hi all. I’m working my way through but I’m stuck on Part 8. (Actually I moved past it and finished the rest, and came back to it). When I try to load my key in to PuTTYgen, I get a PuTTYgen error that reads: ‘Couldn’t load private key (not a recognised key format)’. I followed all the directions correctly, and my key is saved as a simple text file. Does anyone know why I’m getting this error?
(I’ll also point out the typo in the Part 8 title.)
Ope, never mind. I figured it out. I failed to copy the text in the first and last lines of the contents of the file, the Begin and End lines. Once I included those lines in the file, it loaded correctly.
I am having same issue. I see you corrected it but not sure what you did?
I figured it out. I copied what I thought was the key but should have copied from the spot where it says start to where it says end. Picture will help.
Might be worth including that if you run another webserver, you have to stop it for the renewal ๐ (I totally didn’t forget that), in my case it was Nginx ๐
Love the rest though, cheers!
I just got a notification from let’s encrypt that I need to upgrade from ACMEv1 to ACMEv2. How would I go about doing this?
Did you get an answer to this? I am looking for the instructions
Good News and Informaton. internet cepat semarang Thanks for another wonderful post.
Good News and Informaton.
This was a wonderful guide. I used VULTR’s service and followed every step except the SWAP file setup. Thank you Chris!!
When I checked at ssllabs.com I received a B grade for having TLS 1.0 and 1.1 enabled, along with TLS 1.2.
From what I’ve read, the latest standard is to have only TLS 1.2, correct?
Do you have any guides/resources to disable the older TLS versions on the unifi server we just setup?
Thanks again!
@Josue M: Did you find a solution to the TLS 1.0 issue? I just configured a hosted UniFi controller using this guide and also received a grade of B due to this.
@Andy: No I haven’t. I’ve been busy and haven’t been able to research any further.
Seeing as how controller v 5.12.66 was recently made available, what is the process for updating the controller (assuming I followed this guide to the letter)?
Nevermind. Answered my own question.
(Repeat step 12)
Thanks Chris! Great guide. One addition that I needed in Part 21:
Upon issuing
sudo certbot –apache -d [mydomain.com]
I received the following error:
/usr/lib/python3/dist-packages/ndg/httpsclient/subj_alt_name.py:22: UserWarning: Error importing pyasn1, subjectAltName check for SSL peer verification will be disabled. Import error is: No module named ‘pyasn1’
[…]
I had to manually install the pyasn1 package with:
unifiadmin@unifi:~$ sudo apt-get install python3-pyasn1
Hello, When I got to part#4 usermod -aG sudo unifiadmin a command comes back stating: group sudo does not exist I’ missing something some here , Currently I’m logged in as root.
Thanks!
I just followed your guide to install UniFi in AWS, using a debian instance from Lightsail. Nearly everything was the same, except setting up the networking.
Hi Chris,
Newbie on this, but I’ve got up to between Step 11 and Step 12; I’m unable to connect via ssh and port 2222 while ufw is enabled. I’ve verified via the status that 2222 is allowed with the right IP, but when I disable ufw, it immediately connects. Any tips would be helpful
Love your show!
Did you get an answer to this? I am looking for the instructions
Hi Chris, Great video.
There seems to be some issues with certbot, and I eventually get a warning as below. Any chance you could help me out to resolve so i can get that little green padlock again please?
“Err:5 http://ppa.launchpad.net/certbot/certbot/ubuntu eoan Release
404 Not Found [IP: 2001:67c:1560:8008::15 80]
Hit:6 http://archive.ubuntu.com/ubuntu eoan-backports InRelease
Reading package lists… Done
E: The repository ‘http://ppa.launchpad.net/certbot/certbot/ubuntu eoan Release’ does not have a Release file.
N: Updating from such a repository can’t be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
I have this issue, what is the fix?
For you who cant connect after the firewall is enabled, make sure you have static ip address from your isp. As it mentioned here “Once again, substitute 1.2.3.4 with your own IP address.” You should put your ip address not your cloud hosting ip address i think.
I needed to install mongo-db… you can paste the following… it just needs to happen before install UniFi…..
wget -qO – https://www.mongodb.org/static/pgp/server-3.4.asc | sudo apt-key add –
echo “deb https://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/3.4 multiverse” | sudo tee /etc/apt/sources.list.d/mongodb-org-3.4.list
sudo apt-get update
Running into an issue with the cert. I finally have it issued and installed however, it’s not applied correctly. It’s coming up fine on port 443 (default apache page) but 8443 no longer loads. Has anyone seen this?
Hi,
First, thank you. This has been so useful and helpful.
I have followed the guide and double checked but I am getting a SSL error when I go to https;//unif.mydomain.com:8443, but the SSL works fine on https;//unif.mydomain.com – Have I missed something ?
Any help / pointers would be greatly appreciated.
Thanks
I’m working on this too. I’m no expert, but I think SSL only works on port 443 (which you don’t see when you visit any https:// site). Just like port 80 is for un-secure content. By manually putting in port 8080, you’re bypassing 443.
It sounds like i don’t know the answer. I don’t. Just thinking out loud since Chris doesn’t look at these comments anymore. If I figure it out, I’ll post it.
Typo… port 8443 (not 8080). Long night.
Hi Chris, thanks for the sublime write up. Great step-by-step instructions. Unfortunatly I had problems with the public and private keys in the first few steps. It couldn’t find the keys, so after changing the root disable, I had to start over and over. I skipped this step and i just use my password to log in and everything works great.
Thanks again and I used the affiliated link to Vultr.
Best regards, Lars
Hello guys. When I run:
sudo apt-get install unifi -y
I get that:
unifi is already the newest version (5.12.72-13103-1).
But to this date latest version is 5.13.29
https://community.ui.com/releases/UniFi-Network-Controller-5-13-29/d7647910-77a2-4e61-bbfe-389206f2d6ad
Thanks Chris for this post. I actually followed the steps and it worked out fine though the let’s encrypt steps didn’t work out because of some error in the A address. In the steps where UFW is configured, you made mention of locking SSH to a specific IP address. I’m a bit confused here. By IP address do you mean the server IP or device IP?
Hi Ike,
I believe Chris means your own external WAN IP in this case. That way the remote SSH server won’t allow connections from any IPs other than yours.
Thanks for posting this. Amazing step-by-step tutorial. Used affiliate link for Vultr.
The information on your youtube change has been very helpful.
Keep up the good work.
Thanks.
Hey Chris, thanks for the great article posted. Worked wonderfully on DO.
Have you considered to follow up on the reverse proxy setup on the domain with nginx so one doesn’t have to type in the port for the portal access while maintain the ssl yet still has the websocket and inform url working? I messed around with nginx conf file, has the reverse proxy working, but it failed to detect any remotely adopted devices any more telling me no usg installed and upon opening the portal, it has web socket error notifications.
Thank you
Hey Chris,
A great guide
Have a tiny issue that I have found related to the firewall
The firewall is active it shows all the devices on all my sites as disconnected
The firewall is disabled all devices are connected
I feel we are missing some port that needed for the site to connect to the hosted cloud controller
Any idea what can it be?
do we still need to use ubuntu 16.04 or can we use 18.04 now?
and if we are running this on 16.04 what is the best way to update everything so its all smooth
Neither my clients or myself have a static public IP Address they are all dynamic. What is the preferred method for securing the firewall while using a dynamic IP Address?
Many thanks Chris for the Great guide
Can you post an update with the propper way to upgrade to the latest controller version 5.14.22? Thank you!!!
Great script Chris,
Are you ever going to update this one? Is there a command to use to update the controller software when there is a newer version? And is the TLS in the SSL already fixed?
Thanks!!
to disable unsecure TLS we did this:
SSL config location: /etc/apache2/mods-available/ssl.conf
Default: SSLProtocol -all -SSLv3
Replaced with SSLProtocol -all -SSLv3 -TLSv1 -TLSV1.1
follow up we also changed the letsencrypt piece:
SSL config location: /etc/apache2/mods-available/ssl.conf
Default: SSLProtocol -all -SSLv3
Replaced with SSLProtocol -all -SSLv3 -TLSv1 -TLSV1.1
Also change in:
/etc/letsencrypt/options-ssl-apache.conf
Hey, very nice updated tutorial. Have been running a controller for 2 years now thanks to the previous walktrough but not just setup a new one with Lets Encrypt.
Im getting a B grade though, not A.
Whats your opinion about this?
Cheers
Hi, thank you so much for your step-by-step so well documented and explained.
Everything running like a charm.
Nevertheless, I had a B-note on the qualys/ssl lab report.
Everything is green except the protocol support.
Seems than the support of TLS 1.0 and 1.1 is not good.
Any recommandation to solve this ?
Best regards
Hey Chris … first, thank you big time for all your input to the networking world … your videos are golden, learned mega a lot out of them! ๐
Now, I would ask … why you use older ubuntu distro instead of the latest 20.04? ๐
What could I do after this to secure and harden my server a little more if I plan to use this in a production environment for a small business. Secure it for sure, how do you keep it (the server) and unifi updated?
thanks..
Nice informational.
wow amazing
Many thanks Chris for the Great guide
Good Post
Super helpful, thank you! I wonder if it wouldn’t be even easier / less error prone to add the unifi script as a deploy hook to certbot. This should run the unifi shell script whenever certbot renews a certificate. Just add a symlink to the deploy directory:
$> ln -s /usr/local/bin/unifi_ssl_import.sh /etc/letsencrypt/renewal-hooks/deploy/unifi-import
That should be all. No messing with cron or systemd. Am I missing something?
Amazing Step by Step guide! Thanks for all the hardwork Chris and team :).
Worked like a charm!
Thanks For the step by step guide. Very Helpfull
Thanks chris. Amazing tutorial