Prepare the server network

Guide for securely configuring Alpacon in enterprise environments.

Firewall configuration#

Server systems#

Alpacon agents use outbound HTTPS/WSS connections. If you have whitelist-based firewall or proxy on server systems, you need to allow outbound connections to the following destinations.

Using proxy systems (Optional)#

Alpamon 2.8.5 and later connect through the proxy set in the HTTPS_PROXY or HTTP_PROXY variable of the agent’s service, and reach the hosts listed in NO_PROXY directly. Setting these variables with export in a shell has no effect on the agent. See Proxy support to set them for the agent’s service.

Client systems#

Alpacon clients (Web/CLI) use outbound HTTPS/WSS connections. If you have whitelist-based firewall or proxy on client systems, allow outbound connections to:

Security considerations#

Transitioning from SSH to Alpacon#

With Alpacon, you transition from perimeter-based port protection to zero-trust approach.

Recommended actions#

1. Block SSH port

   • Block user access to port 22
   • Keep only emergency access
   • Simplify firewall configuration

2. Restrict direct SSH access

   bash

   # /etc/ssh/sshd_config example
   PermitRootLogin no
   PasswordAuthentication no
   PubkeyAuthentication no  # For Alpacon-only systems
   AllowUsers emergency-admin  # Allow only emergency accounts

3. Remove VPN dependency

   • VPN access to internal network with unlimited server access is a security threat
   • Complex VPNs or jump hosts reduce visibility
   • Simplify access with Alpacon single platform

Security best practices#

1. Principle of least privilege#

• Allow access only to necessary servers per user
• Use group-based permission management
• Regular permission reviews

2. Audit logging#

Every workspace records audit events automatically.

1. Review activity under Audit → Events (Websh, sudo, commands, files)
2. Set up notifications for privileged operations in your workspace Settings

3. Mandatory MFA#

Configure MFA policies in Policies > Authentication (Superuser only):

1. Go to Policies → Authentication
2. Enable MFA enforced for all users
3. Select the allowed MFA methods (hardware security key, biometric, one-time password). With biometric or hardware security key allowed, a passkey sign-in also counts as MFA; see Passkeys and allowed MFA methods
4. Set the MFA timeout for how long a verification stays valid

Region and service interruptions#

Choose a region#

Choose a hosted region when the workspace is created. The region cannot be changed afterward, so consider where your team and servers work.

During an interruption#

Your servers keep running if Alpacon is unavailable. Agents reconnect when the service returns. An existing session may reconnect while its access window remains valid; new work that needs an Alpacon decision waits for recovery. Check service status for current and past incidents. Keep your own emergency access route if your operations require one.

Compliance#

Regulatory compliance readiness#

Alpacon follows industry-standard frameworks and best practices:

• SOC 2 framework: Audit preparation is underway and currently in the internal-audit stage
• ISO 27001 alignment: Security controls aligned with ISO 27001 standards
• GDPR compliance: Data handling practices designed to support GDPR requirements (EU customers)
• HIPAA readiness: Infrastructure designed with healthcare industry requirements in mind

Data residency#

• Workspace data and core service records are primarily stored in the selected region
• Alpacon AI processing may occur in South Korea
• Customer-controlled cloud and on-premises deployments are available with Alpacon Enterprise
• See Data security for processing-location and deployment details

Troubleshooting#

Connection issues#

Log checking#

# Agent logs
sudo systemctl status alpamon
sudo journalctl -u alpamon -n 50

Migration checklist#

Checklist for transitioning from SSH to Alpacon:

• Install Alpacon agent on all servers
• Invite users to Alpacon workspace
• Configure groups and permissions
• Configure MFA policy
• Update firewall rules
• Block SSH port 22 (except emergency)
• Configure audit logging
• Establish backup and recovery procedures
• Conduct team training

Related documentation#

• How Alpacon works
• Zero trust
• Security configuration
• Monitoring strategy