Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Securing your Linux web server

medium.com

Post reply on HN
Print view View original

31–40 of 54 posts

Re: Securing your Linux web server

#31

Post by NinjaKitten »

peterwwillis wrote: post #29
madez wrote: post #20

Earlier quoted context omitted.

Who is giving the advice to not host your own server? My advice is to do host your own server.

Yep, you should definitely host your own server. And build your own Linux distro. And your own computer. Then weave your own cloth, sew your own clothes, cobble your own shoes. Build a car. Buy some land. Build a house. Move to the country. Raise chickens. Till and sow land. Get off the grid. Abandon the modern world. It's perfectly possible to drive a car without building one, or to become technically proficient wit…

You could have said that without the snark.

Re: Securing your Linux web server

#32

Post by KeybInterrupt »

brianjking wrote: post #21
Sir_Cmpwn wrote: post #3

I have a little checklist I use to cover the basics: https://drewdevault.com/new-server.html

Changing the default SSH port is a great idea too.

Yeah, it is security through obscurity, I do it anyway on my Internet facing systems because then I don't have to bother with most automated SSH Scanners.

Re: Securing your Linux web server

#33

Post by madez »

peterwwillis wrote: post #29
madez wrote: post #20

Earlier quoted context omitted.

Who is giving the advice to not host your own server? My advice is to do host your own server.

Yep, you should definitely host your own server. And build your own Linux distro. And your own computer. Then weave your own cloth, sew your own clothes, cobble your own shoes. Build a car. Buy some land. Build a house. Move to the country. Raise chickens. Till and sow land. Get off the grid. Abandon the modern world. It's perfectly possible to drive a car without building one, or to become technically proficient wit…

It is not about learning everything by doing it yourself from scratch. Hosting a service yourself on your own server is becoming simpler and simpler by the day. Capable hardware is cheaply available in the form of single board computers and projects like Freedombox[0] and Yunohost[1] make the hosting part simple for the services they preconfigure.

I don't know why you write such a confrontative comment. Hosting your server is important to have control over your data. You don't need to build your own Linux distro for that...

[0] https://freedombox.org/

[1] https://yunohost.org/

Re: Securing your Linux web server

#34

Post by madez »

rodolphoarruda wrote: post #6
Sir_Cmpwn wrote: post #3

I have a little checklist I use to cover the basics: https://drewdevault.com/new-server.html

I'm a generalist project manager. When you say "Disable password login via ssh", what is going to be the login method from this point onwards? Via a personal certificate? Tks

I use a gpg smartcard to log into SSH. That way I don't need a password (technically, the smartcards reader wants the PIN, but the computer sees no PIN) and the key can't be stolen easily.

Re: Securing your Linux web server

#35

Post by [deleted] »

throwawayReply wrote: post #23
jimmies wrote: post #22

I am so glad nowadays to get websites for my hobby projects going, I just have to do a Github page, and don't have to worry about all that stuff (and don't have to pay, either). Github pages + Static content generators are among the best advancements in the recent years.

Back in the day we used to call that "Shared hosting" and it was looked down on by the in-crowd.

[deleted]

Re: Securing your Linux web server

#36

Post by jimmies »

dspillett wrote: post #25
throwawayReply wrote: post #23

Earlier quoted context omitted.

Back in the day we used to call that "Shared hosting" and it was looked down on by the in-crowd.

In my experience shared hosting was looked down upon (and still is) not because we were high-and-mighty better-than-thou you-know-nothing toffee-nosed snobs about the entire idea[1], but because of the many (the majority?) of hosts who were absolutely terrible at security (and stability, and performance both generally & through silly levels of over-selling, and everything else, but security is most important). In thi…

Years ago someone I used to know ;-) used to upload php scripts to traverse the ".." dir to shared hosts. You can do that with 9 out of 10 smaller shared hosts. It was hillarious. There is a whole lot less of attack surface when it comes to static content generators.

Re: Securing your Linux web server

#37

Post by [deleted] »

brobinson wrote: post #10
rodolphoarruda wrote: post #6

Earlier quoted context omitted.

I'm a generalist project manager. When you say "Disable password login via ssh", what is going to be the login method from this point onwards? Via a personal certificate? Tks

You should be using public key authentication: https://www.digitalocean.com/community/tutorials/how-to-set-... If you insist on using passwords, make sure you at least install something like fail2ban or denyhosts to block the compromised machines which are hammering your server trying to guess passwords. Clients can see which authentication methods are allowed so they know which machines to attack (i.e., yours, if yo…

[deleted]

Re: Securing your Linux web server

#38

Post by madez »

AFNobody wrote: post #27
Sir_Cmpwn wrote: post #13

Earlier quoted context omitted.

What does GitHub have to do with it?

Its a free way to test he knows how to use SSH w/o a SSH server to talk to on the other end.

One can simply start an openssh-server on localhost with some unused port for testing. There is no need for the internet, other computers or let alone other computers from somebody else over the internet for that.

Re: Securing your Linux web server

#39

Post by dvtv75 »

madez wrote: post #33
peterwwillis wrote: post #29

Earlier quoted context omitted.

Yep, you should definitely host your own server. And build your own Linux distro. And your own computer. Then weave your own cloth, sew your own clothes, cobble your own shoes. Build a car. Buy some land. Build a house. Move to the country. Raise chickens. Till and sow land. Get off the grid. Abandon the modern world. It's perfectly possible to drive a car without building one, or to become technically proficient wit…

It is not about learning everything by doing it yourself from scratch. Hosting a service yourself on your own server is becoming simpler and simpler by the day. Capable hardware is cheaply available in the form of single board computers and projects like Freedombox[0] and Yunohost[1] make the hosting part simple for the services they preconfigure. I don't know why you write such a confrontative comment. Hosting your…

Yup, I have an Odroid X running Ubuntu (I couldn't find a Debian that was set up to run on it). It's my mail server, apache server, has an outward facing SSH server, and acts as a sensor data logger. It's pushed pretty much as far as it will go, for a little system like that, with a fairly high load average at times.

Recently had a power cut that killed the system, but rather than reinstall I poked around for a few hours until I discovered the bootloader's zImage had been corrupted. Copied another over from the original install image, and away it went.

When I find myself a decent job, I'll dedicate a more powerful system to the task, maybe virtualize a few of the servers.

Fun projects, although there are many head-hit-keyboard moments in setting it up.

Re: Securing your Linux web server

#40

Post by HankB99 »

A minor nit, I suppose. Formatting of cli commands has mangled them to the point they cannot be used. For example

# dpkg — list

will not work. The correct command is

dpkg --list

I suppose I'm particularly sensitive to this because I ran into a problem copying some commands from a terminal window into a Google Document and then copying/pasting them back to the command line. Google Docs had changed some of the spaces to something that looked like a space (both in the doc and in the shell) but was not and caused inexplicable error messages.

Anyway... I prefer stuff where I can copy/past directly to a terminal window and have it work as the author expected.

Post reply on HN