Instead of using unattended-upgrade, I prefer to subscribe to mailinglists and see when there are new securtiy updates.
One could combine that with something like rundeck where you run apt-get upgrade.
My First 10 Minutes on a Server
51–60 of 298 posts
Re: My First 10 Minutes on a Server
#52Earlier quoted context omitted.
Seconding the recommendation to avoid ufw. I haven't actually used it or had a problem with it, but if you understand iptables then you don't need it, and if you don't understand iptables, you're better off just learning to use iptables directly so you can handle those cases that ufw doesn't support or clean up after it when it breaks. I didn't know about iptables-persistent, but it's easy enough to just "iptables-sa…
I recommend iptables-persistent because fail2ban is adding rules dynamically, and it just makes it easier to handle with that aspect automated.
I didn't notice that iptables-persistent actually saves the currently configured rules periodically. That's both kinda neat and a little scary, and I'm not entirely sure I see much value in persisting dynamic rules; it seems like it'd be easy to end up with a long chain of stale rules that way. Still worth knowing about the automatic persistence, though.
Re: My First 10 Minutes on a Server
#53It would be useful to discuss what prevents the server from being rooted without a trace during the 10 minutes it takes to execute these steps.
Production boxes are not allowed to be plugged into bare internet or DMZ unless they were seasoned and tested on the LAN first, and the LAN allows no external traffic in (stateful firewall). If people on your own LAN are trying to pown you, you got bigger problems to solve before installing another box.
In the old days this was manually moving ethernet cables, now a days this is changing which VLAN the virtual image talks to or if you use something like openstack that implements its own firewall at the virtualization level you allow no external traffic in until the config and testing is done.
Also you need to verify your install media is not powned, which means you need access to the md5sum of the media (and how do you know someone didn't MITM the correct md5sum?) and you need to verify your md5sum program isn't powned which means you need to verify your verification strategy isn't powned which means this gets recursive real quick.
Re: My First 10 Minutes on a Server
#54Earlier quoted context omitted.
My worry here is that, in posting what seems to be a book, people just won't even do it because we don't have time to do it, unless this is a primary part of their jobs. If a 10 minute guide gets users 90% of the way, then they're more likely to do it. And that's good enough to cover a majority of automated attacks. Update: I take it back – they've provided scripts to run this stuff. I will explore these. Thanks for…
The problem isn't that it's long; the problem is that it's not navigable - there needs to be a table of contents. There's great stuff in here, but it's hard to sort out what I already know how to do from what I can actually use.
There is a table of contents in the PDF version.
Re: My First 10 Minutes on a Server
#55I'd be more curious to see a "My first 10 minutes on an Ubuntu desktop" version of the article.
[deleted]
Re: My First 10 Minutes on a Server
#56Earlier quoted context omitted.
My worry here is that, in posting what seems to be a book, people just won't even do it because we don't have time to do it, unless this is a primary part of their jobs. If a 10 minute guide gets users 90% of the way, then they're more likely to do it. And that's good enough to cover a majority of automated attacks. Update: I take it back – they've provided scripts to run this stuff. I will explore these. Thanks for…
Agreed - it is a bit long. But if you want to set something up from top to bottom it may be worth it. Cool - I saw the link to Github as well, looks like there is code to do much of what the article outlines. Awesome.
The hackthis application that is referenced in the guide is also in Github here:
https://github.com/inversoft/passport-js-example
It uses Ember, Node.js, Express, Sequelize, MySQL and Passport User Database (https://www.inversoft.com/products/user-database-sso).
Re: My First 10 Minutes on a Server
#57I don't mean to sound flippant but why can't these "lock down your new box" tutorials just be a bash script? Shouldn't they be?
I would say the same reason we teach web developers what a linked list is. They might never use it (watch me eat my own boot here) but it's a fundamental principle upon which a lot of the tools they use are built.
It's good to know what's going on under the hood.
Re: My First 10 Minutes on a Server
#58> We don't even have a password for our root user. We'll want to select something random and complex. So you're taking something secure by default -- no password means no login allowed, and making it less secure. And if you have hundreds of these servers, you'll need to rotate them whenever someone on the team leaves. This is painful. Simple solution: leave root password blank, don't forget your sudo password. If you…
Agreed. Stopped reading when I got to that.
Re: My First 10 Minutes on a Server
#59I don't mean to sound flippant but why can't these "lock down your new box" tutorials just be a bash script? Shouldn't they be?
just cut and paste all of the commands into a single script if you want one?
Re: My First 10 Minutes on a Server
#60Earlier quoted context omitted.
Out of curiosity, how does it compare to fail2ban?
Seems more flexible, and has IPv6 support by default.
It also was more robust for me and simpler to configure.
Though I switched from sshguard to fail2ban, because after I started blocking attacks on ssh, script kiddies started to brute fore passwords using other services (SMTP/IMAP/POP3 etc.)
Edit: looks like they added ability to monitor other services, I guess I'll re-evaluate it again.