Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My First 10 Minutes on a Server

codelitt.com

Post reply on HN
Print view View original

141–150 of 298 posts

Re: My First 10 Minutes on a Server

#141

Post by mordechai9000 »

mwpmaybe wrote: post #113
josho wrote: post #69

Earlier quoted context omitted.

I agree that fail2ban for ssh seems unnecessary. But, it also provides monitoring for other services like http and common exploits. I'd be interested in learning from the community if fail2ban adds much value. As I've looked into the service, it seems like simply running the latest security patches obviates the need for fail2ban.

I too am curious to know what the consensus is. People seem to fall into one of two camps: 1. it's unnecessary if you disable password login or 2. it's an easy thing to add as yet another safety net on top of sane service configuration and firewall rules. I've taken some flak here for being in the #2 camp so I'm loathe to expose myself once again, but my thinking is that even with password authentication disabled, ss…

If all you're worried about is keeping the low-level noise out of your logs and discouraging waste of resources on brute-force attacks (which won't work because of course password auth is disabled), I think it's sufficient to use the built-in iptables rate-limit feature on SYN packets.

UFW has a feature that will implement this with a limit of 6 SYN packets in 30 seconds from individual IPs.

    ufw limit ssh/tcp
This may not be ideal for some services like http without persistent connections, and if fail2ban provides extra exploit protection it could be worthwhile.

Re: My First 10 Minutes on a Server

#143

Post by nextos »

adrianmsmith wrote: post #95

What's the reason for using a firewall? Assuming that services which shouldn't be accessible to the outside only listen to localhost not the network (e.g. MySQL on a LAMP stack), isn't that sufficient? (Honest question, I don't have much experience with syadmin.)

Honest question, why does nftables get so little love vs iptables?

Re: My First 10 Minutes on a Server

#144

Post by SXX »

throwanem wrote: post #46
dawkins wrote: post #39

I always worry that adding 2FA could make your machine inaccessible if anything happens to google-authenticator in this case. Maybe it's a little bit of paranoia but I don't like the idea of giving control over my ability to log into my server.

It'd be perfectly reasonable if libpam-google-authenticator relied on Google's infrastructure, but despite the infelicitous name, it does not; it just implements the server side of TOTP. The authentication flow is identical to any other correct TOTP implementation, and you can use any compatible client; no integration with Google services or infrastructure is required. (In fact, I don't think it's even possible.) Spe…

There also FreeOTP Authenticator from Red Hat for both Android and iOS.

It's of course open source.

Re: My First 10 Minutes on a Server

#145

Post by kderbe »

brokenwren wrote: post #7

This one is pretty decent but if you want the ultimate guide check out this one: https://www.inversoft.com/guides/2016-guide-to-user-data-sec... It covers 10x what all the other guides cover in terms of server and application security. It was posted a few weeks ago on HN but didn't make the front-page.

I don't know enough about server security to critique most of that guide, but the Password Security section is clearly behind the times:

> Passwords should always be hashed using a strong, one-way hash algorithm. [...] hashed with an algorithm like SHA-256 7 times.

If they had simply written "just use bcrypt" they'd be much closer to 2016-era security practices.

Re: My First 10 Minutes on a Server

#146

Post by devonkim »

adrianmsmith wrote: post #95

What's the reason for using a firewall? Assuming that services which shouldn't be accessible to the outside only listen to localhost not the network (e.g. MySQL on a LAMP stack), isn't that sufficient? (Honest question, I don't have much experience with syadmin.)

Firewalls are required for compliance in IT in regulated environments that are common in the Fprtune 500. Sometimes an IDS is necessary to supplement it.

Re: My First 10 Minutes on a Server

#147

Post by z3t4 »

If you open up access from/to port 80 or 443, you also open up access to all trojans/spyware/telemetry/auto-update created in the last ten years. You'll want to limit access per user and process.

Re: My First 10 Minutes on a Server

#148

Post by YngwieMalware »

YngwieMalware wrote: post #12

I'd been using this article for a couple years when I was a Linux server neophyte and now some of these things seem obvious to me. A good article for total noobs.

Just realized I'm getting downvoted because I thought this was the first 5 minutes article. Whatever!

Re: My First 10 Minutes on a Server

#149

Post by pnathan »

larrywright wrote: post #101
ryanmarsh wrote: post #48

I don't mean to sound flippant but why can't these "lock down your new box" tutorials just be a bash script? Shouldn't they be?

Hardening (along with any other server setup/configuration) should be implemented using some idempotent configuration management software (Chef, Puppet, Ansible, etc). It's 2016, there's no need to configure servers manually.

Right, I was thinking myself... why not have a chef recipe do this, and walk through the systems as you do that.

Ideally the server comes up and applies chef, doing the needful to secure it. Hand-cooking a server is extremely painful.

Re: My First 10 Minutes on a Server

#150

Post by dredmorbius »

tjohns wrote: post #106

> I check our logwatch email every morning and thoroughly enjoy watching several hundreds (sometimes 1000s) of attempts at gaining access with little prevail. This is something that actually bugs me a bit. These attacks are so common, getting emails like this every day contributes to alarm fatigue. ( https://en.wikipedia.org/wiki/Alarm_fatigue ) I'd love to see the Linux nightly security scripts replaced with somethi…

Among the things I'll do early in system configuration is to reduce such notifications.

Things which should simply be activity logs are moved there. Conditions triggerring notifications are tuned so they don't (failtoban, rate limiting, firewall rules, ...). Makes life much more tractable.

Post reply on HN