Live data from Hacker News

Securing your Linux web server

medium.com

41–50 of 54 posts

Re: Securing your Linux web server

#41
Here are the basics of users and groups!

And now, here's containerization and complicated awk commands!

I get that it's Chapter 9 in a book, so there is missing context. But I'm also wondering why users and groups seem to be getting intro'd in Chapter 9. And why the author thinks that a person who is learning about users and groups is in any position to consider containers.

Re: Securing your Linux web server

#42
post #39
post #33

Earlier quoted context omitted.

It is not about learning everything by doing it yourself from scratch. Hosting a service yourself on your own server is becoming simpler and simpler by the day. Capable hardware is cheaply available in the form of single board computers and projects like Freedombox[0] and Yunohost[1] make the hosting part simple for the services they preconfigure. I don't know why you write such a confrontative comment. Hosting your…

Yup, I have an Odroid X running Ubuntu (I couldn't find a Debian that was set up to run on it). It's my mail server, apache server, has an outward facing SSH server, and acts as a sensor data logger. It's pushed pretty much as far as it will go, for a little system like that, with a fairly high load average at times. Recently had a power cut that killed the system, but rather than reinstall I poked around for a few h…

I have an A20-Olinuxino-Micro with a battery, so the device can cleanly shutdown when power is lost.

I strongly recommend only buying devices that are compatible with Debian main, or mainline Linux at least. Usually I just check if it's compatible with Debian main, and if it's not, I move on. The latest shiney SoC is not worth the software pain caused by uncooperative manufacturers.

Re: Securing your Linux web server

#43

Earlier quoted context omitted.

Yep, you should definitely host your own server. And build your own Linux distro. And your own computer. Then weave your own cloth, sew your own clothes, cobble your own shoes. Build a car. Buy some land. Build a house. Move to the country. Raise chickens. Till and sow land. Get off the grid. Abandon the modern world. It's perfectly possible to drive a car without building one, or to become technically proficient wit…

You could have said that without the snark.

[deleted]

Re: Securing your Linux web server

#44
post #33

Earlier quoted context omitted.

Yep, you should definitely host your own server. And build your own Linux distro. And your own computer. Then weave your own cloth, sew your own clothes, cobble your own shoes. Build a car. Buy some land. Build a house. Move to the country. Raise chickens. Till and sow land. Get off the grid. Abandon the modern world. It's perfectly possible to drive a car without building one, or to become technically proficient wit…

It is not about learning everything by doing it yourself from scratch. Hosting a service yourself on your own server is becoming simpler and simpler by the day. Capable hardware is cheaply available in the form of single board computers and projects like Freedombox[0] and Yunohost[1] make the hosting part simple for the services they preconfigure. I don't know why you write such a confrontative comment. Hosting your…

First of all, it wasn't a confrontational comment, it was irony.

And no, self-hosting does not help you control your data. Control would imply some kind of access control or lock, which all hosted services provide. Privacy would imply encryption, which you should be applying to your self-hosted service's files anyway, and can also apply to a hosted service.

Re: Securing your Linux web server

#45
post #19

Earlier quoted context omitted.

You should be using public key authentication: https://www.digitalocean.com/community/tutorials/how-to-set-... If you insist on using passwords, make sure you at least install something like fail2ban or denyhosts to block the compromised machines which are hammering your server trying to guess passwords. Clients can see which authentication methods are allowed so they know which machines to attack (i.e., yours, if yo…

Or for something even cleaner than a program trying to parse plaintext logs you can use a PAM module. https://wiki.archlinux.org/index.php/Pam_abl

How would you compare it with fail2ban?

Re: Securing your Linux web server

#46
post #33

Earlier quoted context omitted.

It is not about learning everything by doing it yourself from scratch. Hosting a service yourself on your own server is becoming simpler and simpler by the day. Capable hardware is cheaply available in the form of single board computers and projects like Freedombox[0] and Yunohost[1] make the hosting part simple for the services they preconfigure. I don't know why you write such a confrontative comment. Hosting your…

First of all, it wasn't a confrontational comment, it was irony. And no, self-hosting does not help you control your data. Control would imply some kind of access control or lock, which all hosted services provide. Privacy would imply encryption, which you should be applying to your self-hosted service's files anyway, and can also apply to a hosted service.

It was confrontational because you ridiculed a point of what I said by extremely overdoing it.

Even the part you ridiculed — which wasn't the main point — is important. Learning and figuring stuff out by doing it yourself is very important. One doesn't need to go to the absurdly extreme like you ironically promoted.

I host my own server and virtually only I have access to it. Clearly, that gives me privacy to a large degree.

Re: Securing your Linux web server

#49
post #38

Earlier quoted context omitted.

Its a free way to test he knows how to use SSH w/o a SSH server to talk to on the other end.

One can simply start an openssh-server on localhost with some unused port for testing. There is no need for the internet, other computers or let alone other computers from somebody else over the internet for that.

Yeah I'm sure they are running linux. Actually just have them build openssh from source first. Much easier then signing up for GitHub and following their guide to do a test push for a litmus test.

Re: Securing your Linux web server

#50
post #38

Earlier quoted context omitted.

Its a free way to test he knows how to use SSH w/o a SSH server to talk to on the other end.

One can simply start an openssh-server on localhost with some unused port for testing. There is no need for the internet, other computers or let alone other computers from somebody else over the internet for that.

The person in question is a project manager and may be using something other than linux or mac.
Post reply on HN