Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My First 10 Minutes on a Server

codelitt.com

Post reply on HN
Print view View original

291–298 of 298 posts

Re: My First 10 Minutes on a Server

#291

Post by tqkxzugoaupvwqr »

qmr wrote: post #290
nblr wrote: post #35

Fail2ban? sshguard? unnecessary. Just disable ssh passwd auth (which generally is a good idea) -> done/done If you don't like lognoise from ssh scanners (even if you disable passwd auth), move your sshd port to some random high port and make note of it in your ~/.ssh/config Generally: if in doubt, take the more simple and elegant solution to a problem.

> move your sshd port Sick of seeing this idiotic advice. Standard ports are standard for a reason. Perhaps one should also change their web and mail ports for "security".

He said:

> If you don't like lognoise from ssh scanners [...], move your sshd port [...]

It’s not about security as you claim.

Re: My First 10 Minutes on a Server

#293

Post by larrywright »

devishard wrote: post #227
larrywright wrote: post #101

Earlier quoted context omitted.

Hardening (along with any other server setup/configuration) should be implemented using some idempotent configuration management software (Chef, Puppet, Ansible, etc). It's 2016, there's no need to configure servers manually.

It depends. I'm a security guy, so it would be embarrassing and possibly bad for my career if any of my servers got hacked, but I actually don't set up servers that often--it's not part of my job. These Web 2.0 configuration management solutions change pretty fast and don't care about reverse compatibility. So between my infrequent setups my configuration scripts pretty much always break. Contrast this with bash, whi…

Which is why your hardening code (even if it's bash scripts) should have tests, using something like Test Kitchen. It will provision a VM (or cloud server, or docker container), execute your hardening scripts against them, and then run your integration tests to verify that the machine is hardened to your specifications.

Re: My First 10 Minutes on a Server

#294

Post by solutions16 »

Basically (consultanthackers@outlook.com)he just helps you out with whatever hacking or spying activity,Fix your credit and clean your debts , Change your Uni grades and transcripts, Investigate a cheating spouse anything ! Stay classified stay certified, call (302) 365-0294 Thank me later

Re: My First 10 Minutes on a Server

#295

Post by brobinson »

lebca wrote: post #277
brobinson wrote: post #160

Earlier quoted context omitted.

>2048 bit RSA keys Github recommends 4096 now, for what it's worth. [1] >Pushing database backups offsite This is a really bad idea and a good way to get owned. Database backups must be PULLED from the server, not pushed from it. Separately, you also need to test that you can restore from your backups periodically. There were a couple other things I disagree with, but they're in the realm of personal preference. It's…

Could you recommend another hosting service with better security practices than Linode?

I don't currently use them, but I've had good luck with Vultr and they haven't had any incidents like Linode AFAIK. There's also AWS, Azure, whatever Google's thing is called, and all the other big ones. I have no opinion on DigitalOcean even though I currently have a VPS with them since I'm not running anything remotely mission critical there.

Re: My First 10 Minutes on a Server

#296

Post by zeeZ »

qmr wrote: post #290
nblr wrote: post #35

Fail2ban? sshguard? unnecessary. Just disable ssh passwd auth (which generally is a good idea) -> done/done If you don't like lognoise from ssh scanners (even if you disable passwd auth), move your sshd port to some random high port and make note of it in your ~/.ssh/config Generally: if in doubt, take the more simple and elegant solution to a problem.

> move your sshd port Sick of seeing this idiotic advice. Standard ports are standard for a reason. Perhaps one should also change their web and mail ports for "security".

But those ports are more or less supposed to be available to the general public. You keep those where they're expected to be. Any other port that "does not concern you, move along" is fair game IMHO.

Standards exist so you know where to find the things you're supposed to find, and how to talk to them.

Re: My First 10 Minutes on a Server

#297

Post by aalbertson »

devishard wrote: post #274
ropable wrote: post #233

Earlier quoted context omitted.

Would be very interested to review server hardening Bash scripts. Have you published anything on Github or elsewhere?

I have, but I don't want to associate this HN account to my GitHub account, sorry. :/

throwaway github account then? :)

Re: My First 10 Minutes on a Server

#298

Post by aalbertson »

mwpmaybe wrote: post #237
mordechai9000 wrote: post #141

Earlier quoted context omitted.

If all you're worried about is keeping the low-level noise out of your logs and discouraging waste of resources on brute-force attacks (which won't work because of course password auth is disabled), I think it's sufficient to use the built-in iptables rate-limit feature on SYN packets. UFW has a feature that will implement this with a limit of 6 SYN packets in 30 seconds from individual IPs. ufw limit ssh/tcp This ma…

This is a much better answer than, "If you're using fail2ban for that reason, you don't know what you're doing," as someone said to me recently, so thank you. :-) I'll explore replacing fail2ban with this mechanism.

I don't think he means replacing fail2ban, but augmenting it with this.
Post reply on HN