Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Secure a Linux Server

github.com

Post reply on HN
Print view View original

71–80 of 108 posts

Re: How to Secure a Linux Server

#71

Post by dfed-mpls »

noinsight wrote: post #63
dfed-mpls wrote: post #48

Earlier quoted context omitted.

I use it on ios, and so does most of Red Hat employees (they state it is a preferred version of tfa over the google app.) It's not broken for the 15 or so accounts I use it for.

Try the "scan code" button which should activate the camera and the app will crash. I just tested it with my iPhone and verified. The iOS App Store application was last updated 4 years ago. There's also comments there saying it doesn't work anymore. Reading / using existing codes might work properly, or manually inputting them.

Nope. I used that feature just today to add another account. Works on my iPhone X.

Re: How to Secure a Linux Server

#72

Post by dfed-mpls »

dfed-mpls wrote: post #71
noinsight wrote: post #63

Earlier quoted context omitted.

Try the "scan code" button which should activate the camera and the app will crash. I just tested it with my iPhone and verified. The iOS App Store application was last updated 4 years ago. There's also comments there saying it doesn't work anymore. Reading / using existing codes might work properly, or manually inputting them.

Nope. I used that feature just today to add another account. Works on my iPhone X.

Also, the last commit to the app was a year ago, if you head to their github page.

https://github.com/freeotp/freeotp-ios/commits/master

Re: How to Secure a Linux Server

#73

Post by ozim »

zlynx wrote: post #61
ozim wrote: post #57

Securing ssh, 2FA for ssh, using key authentication... Yes but first and foremost you don't expose ssh to all internet, it should be allowed only from known IP addresses and you should VPN to have connect to that known addresses. Section about firewall config just tells to open ssh...

It might help protect against an OpenSSH zero-day but those are pretty rare. I've been running my home server with an completely open SSH port since 2012 and haven't been hacked yet. And I know since I check occasionally with Tripwire and/or RPM verification from a clean boot. The only downside to an open SSH port is the thousands and thousands of log spams from connection attempts. The upside is that I can log in fr…

That is the thing, if we are talking about my personal linux server I am good with key auth + fail2ban and ssh on high port to have less spam in logs.

For work related stuff if I have to deal with multiple people accessing multiple servers then it is different story. Strictly forbidding ssh to have people connect from one IP is a lot more control. Then also key auth but I don't have to setup some google auth.

Re: How to Secure a Linux Server

#74

Post by imthenachoman »

Hey folks! I am the author of this guide. I did not know this was here or I would have commented sooner.

This is my first time putting a guide like this together. I see a lot of really great feedback and I will be incorporating them into future updates.

I don't have time today but I will reply individually to all the comments that I can.

I appreciate any/all feedback/advice. If possible, could future issues be submitted to GitHub because it is easier for me to manage if everything is in one place. https://github.com/imthenachoman/How-To-Secure-A-Linux-Serve...

But right now I need to find all the other places this guide is linked to with comments so I can address them too. :)

Re: How to Secure a Linux Server

#75

Post by icedchai »

wodny wrote: post #17

This guide contains (at least) inaccurate statements. It's oversimplifying and omitting important things while putting emphasis on some exotic details where defaults would be sane enough. "One key, the public key, can only encrypt data, not decrypt it" - this is cryptographically inaccurate. One should use it that way, though. "Identity is verified by encrypting and decrypting data that both the client and server kno…

For umask, it actually does matter that it's a built-in. If it was an external binary instead, it would not be able to set the umask of the calling process (shell) which is what is important.

Re: How to Secure a Linux Server

#76

Post by dfed-mpls »

noinsight wrote: post #63
dfed-mpls wrote: post #48

Earlier quoted context omitted.

I use it on ios, and so does most of Red Hat employees (they state it is a preferred version of tfa over the google app.) It's not broken for the 15 or so accounts I use it for.

Try the "scan code" button which should activate the camera and the app will crash. I just tested it with my iPhone and verified. The iOS App Store application was last updated 4 years ago. There's also comments there saying it doesn't work anymore. Reading / using existing codes might work properly, or manually inputting them.

Interestingly my wife's XS is having the problem you describe but not my X.

I've sent a note to the maintainers, but there's an open git issue for it. Not sure when their commits will roll to the store.

I'm told by multiple colleagues at redhat that they've raised this with internal support, so it should be sorted eventually. Lots of iphones in redhat and this is the app they officially support for TFA internally.

Re: How to Secure a Linux Server

#77

Post by imthenachoman »

okl wrote: post #22

Is using gmail to send mails from your server a good idea?

There is a balance to be had here. In a high volume, sensitive environment you'd run your own mail server. But that is a challenge in-and-of itself. I don't recommend it for a home setup because there are numerous things to worry about like MX forwarding and what happens if your server goes down -- where does the e-mail go? Granted, using Gmail means if your server is compromised the bad-actor would have your gmail password which is why I recommend enabling 2FA/MFA on Gmail and then using an app password. Check http://reddit.com/r/selfhosted if you want to self-host mail.

Re: How to Secure a Linux Server

#78

Post by imthenachoman »

tlb wrote: post #31
okl wrote: post #22

Is using gmail to send mails from your server a good idea?

It's better than running your own smtp servers. But the article proposes using your own gmail account, to which the server has an app password. So a server compromise leads to your own email being compromised. It should be a separate gmail account.

So I use a separate gmail account for my server but forgot to mention in guide. I will add it.

Although I wonder if its necessary if you use an app password. What is the worst a bad-actor can do with the app password?

Re: How to Secure a Linux Server

#79

Post by imthenachoman »

khamba wrote: post #5

I was pleased to notice that the author used DuckDuckGo search link in their article instead of Google.

Always. Google gives me 5 thousand pages of ads before the results I want. I hate to admit that sometimes I still use Google for searching. Like I love their shopping search.

Re: How to Secure a Linux Server

#80

Post by imthenachoman »

joobus wrote: post #64

Does anyone have experience with deborphan? Not previously aware of it, I installed it, and it reported 2 programs which I use very frequently (conky and cryptsetup) as being orphans. I dare not run the uninstall script in the linked guide.

I have never had issues with it but now you have me worried. I added a warning to the guide and will do some research.
Post reply on HN