Jupyter VPS: Notebook Khoa Hoc Du Lieu An Toan

Chay Jupyter Lab tren laptop ca nhan co bon han che chinh: hieu nang yeu khi xu ly dataset lon, dependency conflict khi cai nhieu thu vien, kho chia se notebook voi cong tac vien, va de mat du lieu khi may bi mat hoac hong. Jupyter Hub tren VPS Iceland giai quyet ca bon.

Cac nhom su dung huong loi nhieu nhat:

• Nha nghien cuu doc lap: Co the chay notebook chay phan tich qua dem, sang ngay kiem tra ket qua tu laptop hoac tablet. Khong bi gioi han boi pin laptop.
• Doi data science nho: JupyterHub multi-user cho ca team chia se cung CPU/GPU va dataset, voi authentication rieng cho moi nguoi.
• Nha bao dieu tra: Phan tich du lieu nhay cam tren VPS Iceland, dam bao du lieu khong roi khoi jurisdiction bao ve quyen rieng tu manh.
• Sinh vien thac si/tien si: Truy cap moi truong nghien cuu tu campus, quan, hay nha rieng - tat ca trong cung mot URL.

VPS Pro AnubizHost voi 8GB RAM va 4 vCPU du chay Jupyter cho 1-3 user dong thoi. Voi team lon hon hoac workload GPU, mo rong sang VPS Pro+ hoac add GPU.

Cai dat JupyterHub tren Ubuntu 22.04 voi Python 3.11:

apt update && apt install -y python3-pip nodejs npm
pip install jupyterhub notebook jupyterlab
npm install -g configurable-http-proxy
jupyterhub --generate-config
# Sua jupyterhub_config.py
# c.JupyterHub.bind_url = 'http://127.0.0.1:8000'
# c.Spawner.default_url = '/lab'

De moi user co conda environment rieng, cai miniconda system-wide:

wget https://repo.anaconda.com/miniconda/Miniconda3-latest-Linux-x86_64.sh
bash Miniconda3-latest-Linux-x86_64.sh -b -p /opt/conda
echo 'export PATH=/opt/conda/bin:$PATH' >> /etc/profile.d/conda.sh

Tao environment khoa hoc du lieu mac dinh:

conda create -n datasci python=3.11 -y
conda activate datasci
conda install -y numpy pandas matplotlib seaborn scikit-learn jupyter
pip install ipykernel
python -m ipykernel install --name datasci --display-name "Data Science"

Tao user system cho moi thanh vien team:

useradd -m -s /bin/bash alice
passwd alice  # set strong password
echo "alice" >> /etc/jupyterhub/userlist

Voi cau hinh tren, moi user co thu muc rieng /home/<user>/ va notebook khong xung dot.

JupyterHub MAC DINH KHONG an toan de mo public. Phai dat sau reverse proxy voi HTTPS va co them lop authentication.

Buoc 1 - HTTPS bat buoc: Su dung Caddy cho do cau hinh don gian va auto Lets Encrypt:

# /etc/caddy/Caddyfile
jupyter.yourdomain.com {
    reverse_proxy 127.0.0.1:8000
    encode gzip
    log {
        output file /var/log/caddy/jupyter.log
    }
}

Buoc 2 - 2FA voi Authelia hoac google-authenticator: Tu choi truy cap khi chi co password. Hacker brute force password se bi chan boi yeu cau OTP.

Buoc 3 - Fail2ban: Tu dong chan IP sau 3-5 lan login that bai. Bao ve khoi credential stuffing attack.

# /etc/fail2ban/jail.d/jupyter.conf
[jupyter-auth]
enabled = true
filter = jupyter-auth
port = http,https
logpath = /var/log/jupyterhub.log
maxretry = 5
findtime = 600
bantime = 3600

Buoc 4 - IP allowlist: Neu chi truy cap tu vai IP co dinh, them rules vao UFW hoac Caddy de chan moi IP khac:

@allowed {
    remote_ip 1.2.3.4 5.6.7.8
}
handle @allowed {
    reverse_proxy 127.0.0.1:8000
}
respond 403

Buoc 5 - Backup notebook tu dong: Cron hourly snapshot toan bo /home sang storage offsite encrypted. Khong de mat ket qua phan tich.

Voi 5 lop nay, Jupyter Lab cua ban tren VPS AnubizHost vua de truy cap vua an toan tuyet doi - mot moi truong khoa hoc du lieu chuyen nghiep voi chi phi co dinh nho.