Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My First 10 Minutes on a Server

codelitt.com

Post reply on HN
Print view View original

71–80 of 298 posts

Re: My First 10 Minutes on a Server

#71

Post by throwanem »

stephenr wrote: post #64
throwanem wrote: post #46

Earlier quoted context omitted.

It'd be perfectly reasonable if libpam-google-authenticator relied on Google's infrastructure, but despite the infelicitous name, it does not; it just implements the server side of TOTP. The authentication flow is identical to any other correct TOTP implementation, and you can use any compatible client; no integration with Google services or infrastructure is required. (In fact, I don't think it's even possible.) Spe…

Hurricane Electric's network tools iOS app is free and has an OTP client built in, with iCloud Keychain sync. OTP Auth is another excellent, free OTP client. Edit: clarified both are free.

While I'm not in the market for an OTP client, this is the network tools app I've been looking for since I bought my first iPod Touch. If you have remote beer-buying support, point me to it.

Re: My First 10 Minutes on a Server

#72

Post by e1ven »

Someone1234 wrote: post #61

Why do people install fail2ban then disable password based authentication entirely? I legitimately don't understand the purpose. Also, they complain about log spam (from failed SSH attempts) this is one reason to move SSH to a different port. It does NOT increase security, but it DOES reduce log spam from bots trying for easy targets.

Fail2ban can be used to block IPs based on any log file, not just SSH - I believe the author uses an Apache log in the example.

Re: My First 10 Minutes on a Server

#73

Post by eropple »

ryanmarsh wrote: post #48

I don't mean to sound flippant but why can't these "lock down your new box" tutorials just be a bash script? Shouldn't they be?

They could be, or you could take the route you won't regret later and use a configuration management system. Deutsche Telekom has open-sourced system-hardening cookbooks for Chef, Puppet, and Ansible.

Re: My First 10 Minutes on a Server

#74

Post by throwanem »

JdeBP wrote: post #54
throwanem wrote: post #44

Earlier quoted context omitted.

The problem isn't that it's long; the problem is that it's not navigable - there needs to be a table of contents. There's great stuff in here, but it's hard to sort out what I already know how to do from what I can actually use.

There is a table of contents in the PDF version.

Yeah, but it's a PDF. Anyway, why can't you generate a TOC into the HTML version from whatever format you're actually authoring in? Good tooling support should make this not hard.

EDIT: And now the HTML version has a TOC, too! Talk about immediate gratification -- kudos to whoever did that!

Re: My First 10 Minutes on a Server

#75

Post by listerOfSmeg »

ec109685 wrote: post #15

It would be useful to discuss what prevents the server from being rooted without a trace during the 10 minutes it takes to execute these steps.

I build images locally in virtualbox/vmware player/kqemu/whatever and upload or copy the image over after they are configured minimally.

Re: My First 10 Minutes on a Server

#76

Post by raimue »

ryanmarsh wrote: post #48

I don't mean to sound flippant but why can't these "lock down your new box" tutorials just be a bash script? Shouldn't they be?

You are supposed to understand the implications of all of these steps. If by accident you ever lock yourself out, you will need to know how you set it up. If you just recommend running a script, most people will not learn what they are doing.

Re: My First 10 Minutes on a Server

#77

Post by eropple »

jboynyc wrote: post #45

I'm finding that another important step is this one: apt-get install etckeeper && cd /etc && etckeeper init Keeps your /etc under version control so you know what kinds of configuration changes you've perpetrated.

I used to use this, but I found that it's significantly less useful than a git repo with my server-specific Chef cookbook in it.

Manually modifying servers was never a good idea; it's worse now, even with tools like this.

Re: My First 10 Minutes on a Server

#78

Post by porker »

throwanem wrote: post #52
tmaly wrote: post #43

Earlier quoted context omitted.

I recommend iptables-persistent because fail2ban is adding rules dynamically, and it just makes it easier to handle with that aspect automated.

I didn't notice that iptables-persistent actually saves the currently configured rules periodically. That's both kinda neat and a little scary, and I'm not entirely sure I see much value in persisting dynamic rules; it seems like it'd be easy to end up with a long chain of stale rules that way. Still worth knowing about the automatic persistence, though.

Surely as rules are deleted they disappear from the saved copy?

Or is the issue that fail2ban et al don't remove stale rules?

Re: My First 10 Minutes on a Server

#79

Post by vidarh »

tmaly wrote: post #34

I have been meaning to write up a similar guide. I would like to recommend using just iptables instead of ufw, I had a case on my vps where an update to ufw failed and then the firewall was not working. With iptables, install iptables-persistent package so they are saved when you do restarts. Do not try to block entire country ip ranges as this slows the machine down substantially. fail2ban is great, I would recommen…

Ferm [1] is wonderful as an iptables frontend. Apart from making it simpler to read, it can avoid a lot of repetition with handy shortcuts such as ability to group things. E.g.:

    proto tcp dport (smtp ssmtp qmtp pop3 pop3s imap2 imap3 imaps) ACCEPT;
.. creates rules for each of the ports listed. You can use multiple groups in the same statement as well (lets say all the services above for some crazy reason also listened to udp - you'd just replace "tcp" with "(tcp udp)").

Being able to set variables is also fantastic. E.g.:

    @def $DEV_PRIVATE = (eth0 eth1);
[1] https://github.com/MaxKellermann/ferm

Re: My First 10 Minutes on a Server

#80

Post by codelitt »

VLM wrote: post #23

Technically you don't need the root password, you can always password recovery if you have access to the box. And how exactly did you lock yourself out of every account with sudo? Of course there's always "messed up my ldap or general network settings, can't log in to fix them". There's nothing wrong with setting your root password to a random string and throwing it away, after verifying your sudo works, I guess. I w…

Thank you for the notes. I'm on the go right now so sorry for the short reply, but I agree with what you've said. This was more of a primer with some hope to quickly explain the basic steps and what they were doing to younger engineers who don't have a ton of experience with it.

RE ssh note: That's the second time someone has linked it to me. It looks really good. I haven't had a chance to read it yet though. Will do.

Post reply on HN