Infrastructure configuration guide

Guide for securely configuring Alpacon in enterprise environments.

Firewall configuration

Server systems

Alpacon agents use outbound HTTPS/WSS connections. If you have whitelist-based firewall or proxy on server systems, you need to allow outbound connections to the following destinations.

⚠️ Note: If you don’t allow these domains, you may not be able to use full Alpacon features. As domains are specific to your organization, there’s no security risk of connecting to third-party workspaces.

Using proxy systems (Optional)

Alpacon agents support proxy connections. If you configure HTTP_PROXY and HTTPS_PROXY environment variables, agents will use these to connect to backend systems.

export HTTP_PROXY=http://proxy.company.com:8080
export HTTPS_PROXY=http://proxy.company.com:8080

Client systems

Alpacon clients (Web/CLI) use outbound HTTPS/WSS connections. If you have whitelist-based firewall or proxy on client systems, allow outbound connections to:

Security considerations

Transitioning from SSH to Alpacon

With Alpacon, you transition from perimeter-based port protection to zero-trust approach.

Recommended actions

1. Block SSH port

   • Block user access to port 22
   • Keep only emergency access
   • Simplify firewall configuration

2. Restrict direct SSH access

   # /etc/ssh/sshd_config example
   PermitRootLogin no
   PasswordAuthentication no
   PubkeyAuthentication no  # For Alpacon-only systems
   AllowUsers emergency-admin  # Allow only emergency accounts

3. Remove VPN dependency

   • VPN access to internal network with unlimited server access is a security threat
   • Complex VPNs or jump hosts reduce visibility
   • Simplify access with Alpacon single platform

Security best practices

1. Principle of least privilege

• Allow access only to necessary servers per user
• Use group-based permission management
• Regular permission reviews

2. Audit logging

Every workspace records audit events automatically.

1. Review activity under Audit → Events (Websh, sudo, commands, files)
2. Set up notifications for privileged operations in your workspace Settings

3. Mandatory MFA

Configure MFA policies in Policies > Authentication (Superuser only):

1. Go to Policies → Authentication
2. Enable MFA enforced for all users
3. Select the allowed MFA methods (hardware security key, biometric, one-time password). With biometric or hardware security key allowed, a passkey sign-in also counts as MFA; see Passkeys and allowed MFA methods
4. Set the MFA timeout for how long a verification stays valid

High availability configuration

Regional configuration

Alpacon supports global regions. Choose the nearest region to minimize latency. The region is set when the workspace is created and cannot be changed afterwards.

Availability posture

• Redundancy: All components redundant
• Auto-failover: Automatic failover on failure
• Outbound reconnection: Agents reconnect on their own, so your servers keep running through a platform interruption
• Service status: Live and historical status at status.alpacax.com

Disaster recovery

1. Agent auto-reconnection

   • Automatic retry on network failure
   • Exponential backoff algorithm

2. Session recovery

   • Automatic session recovery after disconnection
   • Reconnection possible within session timeout

Compliance

Regulatory compliance readiness

Alpacon follows industry-standard frameworks and best practices:

• SOC 2 framework: We align with SOC 2 Type II security principles and are preparing for certification
• ISO 27001 alignment: Security controls aligned with ISO 27001 standards
• GDPR compliance: Data handling practices designed to support GDPR requirements (EU customers)
• HIPAA readiness: Infrastructure designed with healthcare industry requirements in mind

Note: We are actively working toward obtaining SOC 2 Type II and other industry certifications. Updates on our certification status will be announced as they become available.

Data residency

• Workspace data and core service records are primarily stored in the selected region
• Alpacon AI processing may occur in South Korea
• Customer-controlled cloud and on-premises deployments are available with Alpacon Enterprise
• See Data security for processing-location and deployment details

Troubleshooting

Connection issues

Log checking

# Agent logs
sudo systemctl status alpamon
sudo journalctl -u alpamon -n 50

Migration checklist

Checklist for transitioning from SSH to Alpacon:

• Install Alpacon agent on all servers
• Invite users to Alpacon workspace
• Configure groups and permissions
• Configure MFA policy
• Update firewall rules
• Block SSH port 22 (except emergency)
• Configure audit logging
• Establish backup and recovery procedures
• Conduct team training

Related documentation

• Architecture
• Zero trust
• Security configuration
• Monitoring strategy