Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My First 10 Minutes on a Server

codelitt.com

Post reply on HN
Print view View original

271–280 of 298 posts

Re: My First 10 Minutes on a Server

#271

Post by codelitt »

geerlingguy wrote: post #196
codelitt wrote: post #171

Earlier quoted context omitted.

I mention Ansible and other tools in the article. The idea, as others have mentioned, is to teach a man to fish. You're much better off with having an automated way to perform this, but you shouldn't ever run anything automated that you don't understand. We'll release an Ansible Playbook over the next week or so that follows these steps.

See related (as inspiration, or an upstream): - https://github.com/openstack/openstack-ansible-security - https://github.com/geerlingguy/ansible-role-security

Thanks man! I'll take a look.

Re: My First 10 Minutes on a Server

#272

Post by arielb1 »

brobinson wrote: post #261
hueving wrote: post #170

Earlier quoted context omitted.

>This is a really bad idea and a good way to get owned. Database backups must be PULLED Just make sure your database server doesn't have permission to delete backups (e.g. Have it POST a backup via HTTPS). There is nothing wrong with db server initiated backups.

This is still open to abuse in the form of your legitimate backup script being disabled and replaced by one uploading false backups. You wouldn't know anything has happened until you go to restore from one. Of course, this is an edge case, but I believe setting up a pull-based backup system is still going to be less work than a write-only push system.

A hacked server can have the backup server pull false backups as well.

Of course, your servers shouldn't be SSHing to your backup servers, but that goes both ways.

Re: My First 10 Minutes on a Server

#273

Post by peterwwillis »

viraptor wrote: post #264
peterwwillis wrote: post #131

Earlier quoted context omitted.

Back in the day, The Linux Documentation Project had a trove of hundreds of HOWTOs covering every facet of using Linux. By today's standards they seem like "books", but in reality they were step-by-step instructions for anything you could ever want to do in Linux. No digging through forums, no combing through man pages, no following broken outdated blog posts that didn't explain what you were doing. I find it sad tha…

I feel like arch wiki is that thing today. It's a bit disorganised and things get outdated while nobody's looking, but there's almost anything you'd every want in there.

It seems like there a bunch of articles there but they're more like notes on how to use a tool specifically with Arch, rather than a guide for everyone.

Compare this page http://www.tldp.org/HOWTO/Quota.html to this page https://wiki.archlinux.org/index.php/Disk_quota . TLDP organized HOWTOs like mini-books; tables of content, multiple authors, versioned releases, and of course, you could download them all and search through them by category. And they didn't assume things like the distribution setting up a bunch of the tools and system for you, so you learned how the tools actually worked.

Re: My First 10 Minutes on a Server

#274

Post by devishard »

ropable wrote: post #233
devishard wrote: post #227

Earlier quoted context omitted.

It depends. I'm a security guy, so it would be embarrassing and possibly bad for my career if any of my servers got hacked, but I actually don't set up servers that often--it's not part of my job. These Web 2.0 configuration management solutions change pretty fast and don't care about reverse compatibility. So between my infrequent setups my configuration scripts pretty much always break. Contrast this with bash, whi…

Would be very interested to review server hardening Bash scripts. Have you published anything on Github or elsewhere?

I have, but I don't want to associate this HN account to my GitHub account, sorry. :/

Re: My First 10 Minutes on a Server

#275

Post by driverdan »

tjohns wrote: post #106

> I check our logwatch email every morning and thoroughly enjoy watching several hundreds (sometimes 1000s) of attempts at gaining access with little prevail. This is something that actually bugs me a bit. These attacks are so common, getting emails like this every day contributes to alarm fatigue. ( https://en.wikipedia.org/wiki/Alarm_fatigue ) I'd love to see the Linux nightly security scripts replaced with somethi…

I used to read logwatch daily when I was at a small shop and only had two servers. It was really interesting to see the attack trends and IP blocks they came from.

It never gave me alarm fatigue because it's not an alarm. It's a log of something that has already passed. Most script kiddies are automatically banned by tools like fail2ban anyway. Seeing the data is pretty interesting.

Re: My First 10 Minutes on a Server

#276

Post by grymoire1 »

larrywright wrote: post #101
ryanmarsh wrote: post #48

I don't mean to sound flippant but why can't these "lock down your new box" tutorials just be a bash script? Shouldn't they be?

Hardening (along with any other server setup/configuration) should be implemented using some idempotent configuration management software (Chef, Puppet, Ansible, etc). It's 2016, there's no need to configure servers manually.

"there's no need to configure servers manually" assuming you have a configuration you can trust. Where are these published? And do you trust them?

Re: My First 10 Minutes on a Server

#277

Post by lebca »

brobinson wrote: post #160
brokenwren wrote: post #7

This one is pretty decent but if you want the ultimate guide check out this one: https://www.inversoft.com/guides/2016-guide-to-user-data-sec... It covers 10x what all the other guides cover in terms of server and application security. It was posted a few weeks ago on HN but didn't make the front-page.

>2048 bit RSA keys Github recommends 4096 now, for what it's worth. [1] >Pushing database backups offsite This is a really bad idea and a good way to get owned. Database backups must be PULLED from the server, not pushed from it. Separately, you also need to test that you can restore from your backups periodically. There were a couple other things I disagree with, but they're in the realm of personal preference. It's…

Could you recommend another hosting service with better security practices than Linode?

Re: My First 10 Minutes on a Server

#278

Post by plusbryan »

codelitt wrote: post #268
plusbryan wrote: post #244

What was wrong with 5 minutes? :-)

Nothing! (Except I doubt I can manually get it all done in 5 minutes =) ) Thanks for your great article. We just ended up adapting your approach with a couple modifications (like 2FA) and extending it to be more of a primer and explain the steps a bit more so that the younger engineers understood what each step performed was doing. I found myself pointing them to your article, but then having to explain what was bein…

I love the article, and thanks for the credit.

Re: My First 10 Minutes on a Server

#279

Post by Shorel »

Scarbutt wrote: post #248
Shorel wrote: post #194

Earlier quoted context omitted.

Or alternatively: "My first 10 minutes on an Ubuntu desktop (for users who don't hate Unity, which includes myself)". In my case: Change the Switch workspace keys from Ctrl+Alt+Arrow keys to Super+ Arrow keys. Remove LibreOffice, install WPS Office. Remove Transmission, install Deluge. Install indicator-multiload, indicator-sound-switcher. Install Kodi. Install Steam. A lot more stuff, but I have not written it down.…

First time I hear about wps office, why do you prefer it over libreoffice? mobile support?

It's faster (C++ vs Java) and more compatible with the documents I have to open.

It also pleasantly surprised me once:

I received a Powerpoint presentation, and went to a customer meeting, where said presentation had to be presented.

I plugged the HDMI to VGA adapter for the VideoBeam to the laptop, started the presentation, and the presentation was running in the external display, while the laptop display was still showing the normal 'Powerpoint' view. I could load the web browser in the laptop display to check some things while the presentation was still running undisturbed and the speaker and the audience was happily unaware of it.

That level of professional use in software was something I did not come to expect in Ubuntu for any third party software. In fact I don't know if the other Office suites (including MS) have that feature. I guess they do, but still.

It is wonderful when everything just works as intended.

Re: My First 10 Minutes on a Server

#280

Post by tamana »

brobinson wrote: post #261
hueving wrote: post #170

Earlier quoted context omitted.

>This is a really bad idea and a good way to get owned. Database backups must be PULLED Just make sure your database server doesn't have permission to delete backups (e.g. Have it POST a backup via HTTPS). There is nothing wrong with db server initiated backups.

This is still open to abuse in the form of your legitimate backup script being disabled and replaced by one uploading false backups. You wouldn't know anything has happened until you go to restore from one. Of course, this is an edge case, but I believe setting up a pull-based backup system is still going to be less work than a write-only push system.

If the backup machine is compromised the attacker can corrupt your backups. Either way, if machine is hacked you risk loss.
Post reply on HN