Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to set up a safe and secure Web server

arstechnica.com

Post reply on HN
Print view View original

61–70 of 148 posts

Re: How to set up a safe and secure Web server

#61

Post by 10098 »

dschiptsov wrote: post #51

Vurtualization is not for production. Why to have this useless layer, which messes up your CPU caches even more, interfere with you IO and complicates memory model? What for? Virtualization was build for server providers to make easy money, not for server owners to gain performance advantages. Vistualization is not for production. Production servers need less code, not more. It is the same kind of mistake as JVM - we…

This is a pretty bold statement to make considering the fact that there are a lot of companies who do use virtualization in production and do so quite successfully.

Re: How to set up a safe and secure Web server

#62

Post by lemieux »

dschiptsov wrote: post #59
te_chris wrote: post #52

Earlier quoted context omitted.

How is this the top comment? I'm sure some of your points may be salient, but practical experience says virtualization works just fine for production. Same with the JVM.

1. at what cost? 2. just fine is not enough. 3. for some reasons all sites uses nginx, not jetty.)

Nginx and jetty are not the same thing. Nginx is a web server optimized to deliver content. Jetty is an application server built to run the applications. Both can be used together.

Also...Is Amazon EC2 considered virtualization for you?

Re: How to set up a safe and secure Web server

#63

Post by buster »

mylittlepony wrote: post #49
buster wrote: post #31

Ah well, it's rather a "how i set up a small web server for fiddling around with stuff" not so much a professional article about security. Sorry, but the first page is like "mhh, yeah, geeks hate MS, let's use the other choices" under the hood. Why? Because it doesn't really mention a technical choice against MS. Don't get me wrong i would never ever use Windows Server but when i'd write such an article i'd have to f…

As a professional developer and amateur sysadmin, I have to say Ubuntu is a great choice, and I will never use CentOS again. The main reason being how updated packages are in Ubuntu, and outdated in CentOS. I don't know about the other options.

I would much more care for timely security updates. Servers are the parts where you don't need the latest software, in my opinion. Not if it comes for less stability or security. In the best case i have a very secure default installation, install the software i need from updated repositories, let the server update itself (or let it remind me of updates) and be gone with touching the shell ever again. The goal is to have the server running safe and secure for years and not to have the latest pre-beta release versions of NoSQL-engine XYZ "just because". Personally on my Desktop i have been a Debian guy (and after that Ubuntu), but it all depends on the requirements.

My personal view:

- my personal server runs Debian but i would place ubuntu a second for a one-person thing with no personal data on it. I know it runs a stable and updated OS and it just runs and runs and runs. You need a newer software version? You can selectively take some from testing or even unstable if you have to. You still get timely updates and live in an eco-system that is largely seen as proven, stable, excellent. Ubuntu (afaik) only get's Debian testing packages anyway, but still needs to patch them or tweak them. Or you get non-upstream packages. Also my experience is that Debians configuration is quite secure by default. Whereas Ubuntu tries to make it easy for you but also more open to security flaws.

- for an enterprise i can totally see why many choose RHEL (because of support, fast security updates and great in-house know-how. Do you know how many kernel developers are employed by Ubuntu? You don't want to know.. I give a lot of Kudos to RedHat for being such an open and contributing company.)

- for a start-up i can totally see how FreeBSD might fit as an internet-facing frontend. It's a stable and fast workhorse, and you'll end up compiling, configuring, installing the core components of your system all the time anyway.

Talking about it i feel a bit sad of not mentioning Solaris anymore. Solaris "was" awesome.

Re: How to set up a safe and secure Web server

#64

Post by [deleted] »

dschiptsov wrote: post #51

Vurtualization is not for production. Why to have this useless layer, which messes up your CPU caches even more, interfere with you IO and complicates memory model? What for? Virtualization was build for server providers to make easy money, not for server owners to gain performance advantages. Vistualization is not for production. Production servers need less code, not more. It is the same kind of mistake as JVM - we…

[deleted]

Re: How to set up a safe and secure Web server

#65

Post by andyjohnson0 »

hristov wrote: post #40
barefoot wrote: post #14

"...being locked to IIS as a Web server (or dependent on crippled Windows ports of better Web servers) means you'll be playing in the bush leagues. IIS is found running many huge and powerful websites in the world, but it's rarely selected in a vacuum..." I sense a little bit of bias. As a multiplatform developer I can think of a number of reasons why someone might opt to go the Windows Server route. ASP.NET MVC 4 is…

I tried to read the Bizspark FAQ, and now my head hurts. But anyways, what I think I was able to get out of it is that: 1. You have to apply. 2. You have to be approved, which takes a minimum of 5 business days, and you may not get approved. 3. At some point you "graduate" and lose your licenses and have to pay for software. The faq does not say when this graduation happens, but I seem to remember hearing something a…

BizSpark membership lasts for up to three years. In the three months up to the end of the membership, you 'graduate' and get access to discounted msdn subscriptions and support.

You also get to keep any software downloaded during the time you were a member. This includes licensing for servers in production.

There is a fairly clear explanation at http://www.microsoft.com/bizspark/about/Graduation.aspx

Re: How to set up a safe and secure Web server

#66

Post by BigRedS »

dschiptsov wrote: post #59
te_chris wrote: post #52

Earlier quoted context omitted.

How is this the top comment? I'm sure some of your points may be salient, but practical experience says virtualization works just fine for production. Same with the JVM.

1. at what cost? 2. just fine is not enough. 3. for some reasons all sites uses nginx, not jetty.)

Just fine is just fine for me, actually.

Re: How to set up a safe and secure Web server

#67

Post by edtechdev »

This guide doesn't cover important things like the firewall and blocking attackers (shorewall, fail2ban) and properly configuring mysql, php, etc.

If you have a small server, I'd really recommend checking out these scripts that assist with configuring and setting up a server very quickly: http://lowendscripts.com/wiki/shell_scripts

I personally used a fork of lowendscript last year to set up some servers, but if I had to set up a new server today, I'd check out some of the other other options at that link, like Minstall: https://github.com/maxexcloo/Minstall But this Xeoncross lowendscript fork is still very active: https://github.com/Xeoncross/lowendscript

Re: How to set up a safe and secure Web server

#68

Post by kryptiskt »

sliverstorm wrote: post #26
zdw wrote: post #12

Better hardware would be an HP Microserver (which should win the contest for "worst URL ever"): http://h10010.www1.hp.com/wwpc/us/en/sm/WF05a/15351-15351-42... Has ECC RAM support. Takes 4 3.5" hard disks, and runs very quiet and cool.

I looked at getting one of those. However, it seems like HP is sunsetting the Microserver line, which is a real shame.

Which is a good reason to get one now. I have one (running FreeBSD and ZFS), and it has been great. I does what I ask of a homeserver: it runs silently and is pretty good at saturating a 1Gb connection, the RAM really helps the performance. All at a great price.

Re: How to set up a safe and secure Web server

#69

Post by Pwnguinz »

sliverstorm wrote: post #25
stephen_g wrote: post #15

Earlier quoted context omitted.

Do those versions let you use the products on production web servers though?

Isn't that what "full versions" means?

Not sure if you're being sarcastic or not, but "no".

Whether or not a particular software can be used in a commercial context has more to do with licensing than how "full version" it is. In fact, even Trial versions of softwares can often be used in a commercial context during the trial period.

Versus, say, the full version of VMware Player, which while full featured and having no trial period, is prohibited via license to be used commercially.

Re: How to set up a safe and secure Web server

#70

Post by rbanffy »

dschiptsov wrote: post #51

Vurtualization is not for production. Why to have this useless layer, which messes up your CPU caches even more, interfere with you IO and complicates memory model? What for? Virtualization was build for server providers to make easy money, not for server owners to gain performance advantages. Vistualization is not for production. Production servers need less code, not more. It is the same kind of mistake as JVM - we…

Use virtualization (or LXC containers) for ease of management and to better allocate complementary workloads according to the resources they require and to how redundant you need them to be.

Chances are your physical boxes will have one resource almost always 100% idle and having your workloads virtualized allows you to better use them.

Also, virtualization allows you to more easily fix problems - you just delete the box and rebuild it from a base image and the packages you need. Reimaging a physical box is a pain.

Obviously, if you are into HPC and very low-latency, you need physical hardware. You probably need some specialty networking hardware too and maybe less OS than most of us would like to have. But then we are no longer in the general purpose amd64 box world anymore.

I remember one instance where we were having some trouble with one batch-processing workload. The amd64 box we had for that was not enough, despite having much more memory and processing cores than its peers. I suggested we moved the workload to an almost abandoned Itanium box we had played with for some time. The HP machine crunched the workload more than 3 times as quickly. I noticed the working datasets could fit completely inside its (then) huge L3 cache (16MB, IIRC) but not in the 4MB of the amd64 machine, more or less eliminating the external memory bus penalties.

Post reply on HN