Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My First 10 Minutes on a Server

codelitt.com

Post reply on HN
Print view View original

281–290 of 298 posts

Re: My First 10 Minutes on a Server

#281

Post by tamana »

zeeZ wrote: post #260
mastorrent wrote: post #165

Earlier quoted context omitted.

If a server can push backups, it must necessarily have credentials for and write access to that backup repository. If the server is compromised, that write access could be used to attack the backup repository as well. Pulling backups from a server removes the need for credentials or access to the backup repository.

Plus, if you're super paranoid, pulling doesn't require leaving any ports open and software listening on the repository.

But it requires leaving a port open on the DB server where an attacker can get a whole copy of your database, or destroy it.

Re: My First 10 Minutes on a Server

#283

Post by amdavidson »

tamana wrote: post #281
zeeZ wrote: post #260

Earlier quoted context omitted.

Plus, if you're super paranoid, pulling doesn't require leaving any ports open and software listening on the repository.

But it requires leaving a port open on the DB server where an attacker can get a whole copy of your database, or destroy it.

Many database servers are not serving databases solely to themselves and have that port open as part of the normal course of operation.

Re: My First 10 Minutes on a Server

#284

Post by hueving »

brobinson wrote: post #261
hueving wrote: post #170

Earlier quoted context omitted.

>This is a really bad idea and a good way to get owned. Database backups must be PULLED Just make sure your database server doesn't have permission to delete backups (e.g. Have it POST a backup via HTTPS). There is nothing wrong with db server initiated backups.

This is still open to abuse in the form of your legitimate backup script being disabled and replaced by one uploading false backups. You wouldn't know anything has happened until you go to restore from one. Of course, this is an edge case, but I believe setting up a pull-based backup system is still going to be less work than a write-only push system.

That's ridiculous. The same tricks can be played on a pull based system once you have compromised the DB server.

Re: My First 10 Minutes on a Server

#285

Post by eropple »

jboynyc wrote: post #258
eropple wrote: post #73

Earlier quoted context omitted.

They could be, or you could take the route you won't regret later and use a configuration management system. Deutsche Telekom has open-sourced system-hardening cookbooks for Chef, Puppet, and Ansible.

Good to know. I did some searching and found them here: http://dev-sec.io/

Thanks for linking it - was on my phone.

Re: My First 10 Minutes on a Server

#286

Post by eropple »

jboynyc wrote: post #256
eropple wrote: post #77

Earlier quoted context omitted.

I used to use this, but I found that it's significantly less useful than a git repo with my server-specific Chef cookbook in it. Manually modifying servers was never a good idea; it's worse now, even with tools like this.

I suppose that's true, but in the field where I work (social science), servers are mostly spun up to scratch an immediate and idiosyncratic itch, so configuration tends to happen organically. I agree that's probably not a good idea, and learning Pupchefsible is well worth the effort. In the meantime, though, there's at least some degree of reproducibility with etckeeper.

I do this stuff professionally, and I've learned the hard way that you either have a reproducible environment or you don't. etckeeper isn't reproducible. Actually rolling back with something like etckeeper is much, much more likely to break something (by deleting a config file used by a newer service, say) than to save you. If it did something like separate branches for each service or component within /etc I might be more sympathetic...but at that point you have half of a CM system already and might as well just go the rest of the way.

If you need reproducibility without a CM framework, keep backups of your machines.

Re: My First 10 Minutes on a Server

#287

Post by viraptor »

peterwwillis wrote: post #273
viraptor wrote: post #264

Earlier quoted context omitted.

I feel like arch wiki is that thing today. It's a bit disorganised and things get outdated while nobody's looking, but there's almost anything you'd every want in there.

It seems like there a bunch of articles there but they're more like notes on how to use a tool specifically with Arch, rather than a guide for everyone. Compare this page http://www.tldp.org/HOWTO/Quota.html to this page https://wiki.archlinux.org/index.php/Disk_quota . TLDP organized HOWTOs like mini-books; tables of content, multiple authors, versioned releases, and of course, you could download them all and search…

Sure, it's a different format. But you can always dig into man pages or other documentation to learn the details. Arch wiki is great for practical solutions - for example https://wiki.archlinux.org/index.php/HiDPI is the place to go to for hidpi display configuration. TLDP has not been seriously updated since hidpi even came out. Similar to https://wiki.archlinux.org/index.php/Power_management - there's no recent TLDP equivalent.

I appreciate TLDP for what it is and the details they go to. But Arch wiki can easily be read as a FAQ for all modern systems. And it will usually send you to other places for details (sometimes TLDP as well)

Re: My First 10 Minutes on a Server

#289

Post by neokya »

larrywright wrote: post #101
ryanmarsh wrote: post #48

I don't mean to sound flippant but why can't these "lock down your new box" tutorials just be a bash script? Shouldn't they be?

Hardening (along with any other server setup/configuration) should be implemented using some idempotent configuration management software (Chef, Puppet, Ansible, etc). It's 2016, there's no need to configure servers manually.

You are right about automating.

Here is Ansible playbook I recently created https://github.com/chhantyal/5minutes

Re: My First 10 Minutes on a Server

#290

Post by qmr »

nblr wrote: post #35

Fail2ban? sshguard? unnecessary. Just disable ssh passwd auth (which generally is a good idea) -> done/done If you don't like lognoise from ssh scanners (even if you disable passwd auth), move your sshd port to some random high port and make note of it in your ~/.ssh/config Generally: if in doubt, take the more simple and elegant solution to a problem.

> move your sshd port

Sick of seeing this idiotic advice. Standard ports are standard for a reason. Perhaps one should also change their web and mail ports for "security".

Post reply on HN