Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linode introduces StackScripts - Custom recipes for your Linode

blog.linode.com

Post reply on HN
Print view View original

1–10 of 31 posts

Re: Linode introduces StackScripts - Custom recipes for your Linode

#2

Post by fortes »

This is neat. Similar to EC2 AMIs, right?

Something I've these -- who is responsible for security updates? I assume it's the deployer, which can often be someone who may not have much experience as an sysadmin. What's the best way to keep a system secure? Cron + Apt-get update?

Re: Linode introduces StackScripts - Custom recipes for your Linode

#3

Post by poutine »

fortes wrote: post #2

This is neat. Similar to EC2 AMIs, right? Something I've these -- who is responsible for security updates? I assume it's the deployer, which can often be someone who may not have much experience as an sysadmin. What's the best way to keep a system secure? Cron + Apt-get update?

I wouldn't suggest cron'ing apt-get update, it may break something while you're not there. Better to do a manual update once a month or so and do a quick test afterwards. Ideally you'd do this on a identical non-production QA machine, but if you're only a one box sorta guy then you can likely get away with no issues.

Of course, security issues these days are more often the result of misconfiguration but if you're doing something simple like a single box with a localhost only MySQL, Apache/Nginx and Rails/Python/PHP or the like then it's pretty straight forward. Don't really even need a firewall.

What I would suggest is locking down SSH to not allow root login and to require key authentication and deny password auth. So much automated SSH password guessing bot spam out there.

Re: Linode introduces StackScripts - Custom recipes for your Linode

#4

Post by jackowayed »

Pretty cool feature, but it seems like they're working at the wrong layer of abstraction.

It seems like that's really best left up to Capistrano, Puppet, etc. Stuff you run from your shell where you run the "setup the server with ip/hostname of x", and it does it.

But they want you to raise the barrier of exit for their customers and want to differentiate themselves, so it makes sense. Plus a lot of the stacks say they're tuned for Linode's exact resources. That might be more selling point than actual special setup, but there is potential for them to tweak it for better performance on their exact machines.

Re: Linode introduces StackScripts - Custom recipes for your Linode

#5

Post by JshWright »

jackowayed wrote: post #4

Pretty cool feature, but it seems like they're working at the wrong layer of abstraction. It seems like that's really best left up to Capistrano, Puppet, etc. Stuff you run from your shell where you run the "setup the server with ip/hostname of x", and it does it. But they want you to raise the barrier of exit for their customers and want to differentiate themselves, so it makes sense. Plus a lot of the stacks say th…

I'm not sure I see the lock in... Other than being a little distro specific, I don't see any reason the scripts would run on any linux platform.

The "tweaking" in most cases just seems to be modifying the default configs for Apache and MySQL to something a lot more sane for a limited memory environment.

Re: Linode introduces StackScripts - Custom recipes for your Linode

#8

Post by fortes »

poutine wrote: post #3
fortes wrote: post #2

This is neat. Similar to EC2 AMIs, right? Something I've these -- who is responsible for security updates? I assume it's the deployer, which can often be someone who may not have much experience as an sysadmin. What's the best way to keep a system secure? Cron + Apt-get update?

I wouldn't suggest cron'ing apt-get update, it may break something while you're not there. Better to do a manual update once a month or so and do a quick test afterwards. Ideally you'd do this on a identical non-production QA machine, but if you're only a one box sorta guy then you can likely get away with no issues. Of course, security issues these days are more often the result of misconfiguration but if you're doi…

Thanks for the info. Are exploits rare enough these days that updating once a month good enough for a well-configured machine? (If so, that's great -- I was worried about taking a vacation :))

Re: Linode introduces StackScripts - Custom recipes for your Linode

#10

Post by slig »

ryanwaggoner wrote: post #7

I would love it if they had this at Slicehost. It seems so stupid to have to configure a basic web server from scratch again when it's been done millions of times before me. Set up a great standard setup and then let me tune from there.

From what I've seen, the scripts looks like shell script, so they can be used elsewhere, or am I missing something?
Post reply on HN