Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to set up a safe and secure Web server

arstechnica.com

Post reply on HN
Print view View original

101–110 of 148 posts

Re: How to set up a safe and secure Web server

#101

Post by laumars »

rlpb wrote: post #98
laumars wrote: post #97

Earlier quoted context omitted.

"Getting reports of brute force attacks is useful, but is not an indication of bad security. Hiding the reports under the carpet does not increase security either." I didn't say reports increase security, and Fail2ban does more than just reporting, it actively blocks brute force attacks. It's a bit difficult us discussing the merits of certain security measures when you keep focusing on the irrelevant as if those wer…

"I find it odd that we're actually arguing about whether it's worth making the most basic of changes based on the assumption that those people in question are stupid and their box will probably be ok. Surely a better approach would be to suggest optimisations -guiding them through the process if needs be." Not unless we're people with excellent reputations that "those people" can recognise, or it is possible to deter…

I can see the logic in what you're saying, and in an ideal world I'd agree.

Re: How to set up a safe and secure Web server

#102

Post by babarock »

bad_user wrote: post #90
babarock wrote: post #85

Am I the only one who thinks that SSD are useless since most of the time the processing will be bottlenecked by the network overhead?

Network overhead is just one bottleneck. A harddisk seek + reading 1 MB sequentially is something like 30 times slower than SSD and 120 times slower than reading from RAM. Disk seeks are what really kills you, as a disk seek is 20 times slower than a roundtrip within the same datacenter. Sending 1 MB of data over a 1Gbps network using a disk seek and a sequential read is 3.6 times slower than doing the same with SSD.…

Thank you for the explanation.

Re: How to set up a safe and secure Web server

#103

Post by vegardx »

ciupicri wrote: post #100
vegardx wrote: post #93

Earlier quoted context omitted.

I think you overstate how much performance hit you get by running things virtually in ex. KVM or Xen. With the first, it's almost negligible, as you don't have to run a paravirtualized kernel in order to gain full access, so for Linux you are basically just limited by other factors, such as disk IO long before anything else start to kick in. I don't buy your argument about latency one bit, do you have ANY data to bac…

Since when does Google run huge virtual machine clusters?

I might have exaggerated a little, I have no idea how huge the virtual machine park is, but I would argue that they wouldn't invest in Ganeti with full-time employees if they weren't using it internally. During a talk, one of the developers said that they were running pretty large clusters.

Re: How to set up a safe and secure Web server

#104

Post by UnoriginalGuy »

dschiptsov wrote: post #51

Vurtualization is not for production. Why to have this useless layer, which messes up your CPU caches even more, interfere with you IO and complicates memory model? What for? Virtualization was build for server providers to make easy money, not for server owners to gain performance advantages. Vistualization is not for production. Production servers need less code, not more. It is the same kind of mistake as JVM - we…

You have no idea how modern virtualisation works. Go read about hardware assisted virtualisation on x86/x86-64.

Most server operators don't care about performance. They have performance coming out of their ears. They care about redundancy and maintenance, or to put another way cost centres.

Your post is on the wrong side of history. Virtualisation is being rolled out in a massive scale right now. Essentially you can abstract your entire physical infrastructure away from your logical infrastructure.

You have a physical server die? The HV has already moved the image to a new node and started it. Before you even receive the e-mail notification the new server is already booting.

So now a hardware failure goes from being a massive panic, to being a small annoyance. You pull the dead hardware from the rack, and plug a new generic node in and that now becomes available for the HV to use.

You want to back up a server? Take a copy of the ENTIRE image in one go. You want to deploy a template? Well that's trivial with images. You want to do change management with the servers? Just put the images in GIT. Boom done.

What you're suggesting is essentially taking the cheapest bits of server management (i.e. the physical hardware) and acting like they're the most expensive bits (i.e. people, time, and flexibility).

Re: How to set up a safe and secure Web server

#105

Post by jackalope »

rlpb wrote: post #55

If you want a safe and secure Web server, use what your distribution gives you. Don't add third party sources if you can avoid it, ie. don't need features Instead, go with what your distribution gives you. The people who put your favourite distribution together work on making the system safe and secure as a whole. People who don't think it is safe and secure file bugs and they get fixed. And you have one place to get…

By all means, buy the car with the best safety record. But you still need to fasten your seatbelt, buy and properly install car seats for your kids, and, above all, learn how to drive safely.

My point is that there is more to security than installing an OS and running regular updates.

Re: How to set up a safe and secure Web server

#107

Post by fduran »

dschiptsov wrote: post #51

Vurtualization is not for production. Why to have this useless layer, which messes up your CPU caches even more, interfere with you IO and complicates memory model? What for? Virtualization was build for server providers to make easy money, not for server owners to gain performance advantages. Vistualization is not for production. Production servers need less code, not more. It is the same kind of mistake as JVM - we…

Virtualization is most definitively not useless, as any sysadmin managing more than a couple servers will tell you. The advantages are so many that in fact it should be the default go-to option when provisioning a server (even a single-purpose one).

Many if not most of the production servers on the web run some sort of virtualization; Xen alone powers EC2, Rackspace, Linode, Rimuhosting and many others. In my experience it only adds about 3% of CPU overhead as a disadvantage.

Re: How to set up a safe and secure Web server

#108

Post by antihero »

edtechdev wrote: post #67

This guide doesn't cover important things like the firewall and blocking attackers (shorewall, fail2ban) and properly configuring mysql, php, etc. If you have a small server, I'd really recommend checking out these scripts that assist with configuring and setting up a server very quickly: http://lowendscripts.com/wiki/shell_scripts I personally used a fork of lowendscript last year to set up some servers, but if I ha…

Fail2ban is actually a vulnerability in itself.

Say I worked out your home IP (not hard), then sent a large number of failed SSH attempts with the IP address forged as yours. You are now locked out if your home server.

Re: How to set up a safe and secure Web server

#109

Post by kahawe »

UnoriginalGuy wrote: post #104
dschiptsov wrote: post #51

Vurtualization is not for production. Why to have this useless layer, which messes up your CPU caches even more, interfere with you IO and complicates memory model? What for? Virtualization was build for server providers to make easy money, not for server owners to gain performance advantages. Vistualization is not for production. Production servers need less code, not more. It is the same kind of mistake as JVM - we…

You have no idea how modern virtualisation works. Go read about hardware assisted virtualisation on x86/x86-64. Most server operators don't care about performance. They have performance coming out of their ears. They care about redundancy and maintenance, or to put another way cost centres. Your post is on the wrong side of history. Virtualisation is being rolled out in a massive scale right now. Essentially you can…

>Go read about hardware assisted virtualisation on x86/x86-64.

To further on this excellent and valid point, very cheap virtualisation was available on a lot of other very solid and very productive architectures and has been for decades; it was just x86 finally catching-up late. There are a whole lot of reasons speaking FOR virtualisation and only a few very specific applications where it might be a bad idea. I have no idea what OP up there is all about and against it, they make no sense.

Re: How to set up a safe and secure Web server

#110

Post by kahawe »

laumars wrote: post #72
rlpb wrote: post #55

If you want a safe and secure Web server, use what your distribution gives you. Don't add third party sources if you can avoid it, ie. don't need features Instead, go with what your distribution gives you. The people who put your favourite distribution together work on making the system safe and secure as a whole. People who don't think it is safe and secure file bugs and they get fixed. And you have one place to get…

I disagree with that. Apache's defaults on most distros isn't secure. Even 'enterprise' level distributions often fall into the following traps when packaging Apache: 1-> auto indexing enabled (should be disabled) 2-> user directories enabled (should be disabled) 3-> server signatures 'on' (should be 'off') 4-> server tokens set to 'full' (should be 'prod') 5-> hidden (dot prefixed) files not always blacklisted as un…

This comment together with the ars article just gave me the biggest 90s flashback ever... really, so little has changed in over a decade???

Next up they just HAVE to show us how to setup our own quakeworld or UnrealTournament'99 or Quake3 server! ;-)

Post reply on HN