Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to set up a safe and secure Web server

arstechnica.com

Post reply on HN
Print view View original

111–120 of 148 posts

Re: How to set up a safe and secure Web server

#111

Post by jiggy2011 »

colonelxc wrote: post #4
jiggy2011 wrote: post #2

It's also a good idea to install (and configure) at least some basic IDS like tripwire. You should probably have it do checks on a cron job as well as doing chkrootkit. Also a good idea to have your log files backed up somewhere else where your server does not have sufficient access to delete (or modify) them. Also if you have multiple web apps running, chroot them if at all possible so that if something does break o…

> If you are using PHP also bare in mind that a common default is for all sessions to be written to /tmp which is world read and writeable. So if others have access to your server they can steal or destroy sessions easily. I'm slightly confused by this, within the context of this article. Yes, /tmp is readable and writable by all, but that doesn't mean that everything in it is readable or writable to other people. Th…

Yes, that's precisely what I meant. I shouldn't post when I'm tired :)

Re: How to set up a safe and secure Web server

#112

Post by dschiptsov »

UnoriginalGuy wrote: post #104
dschiptsov wrote: post #51

Vurtualization is not for production. Why to have this useless layer, which messes up your CPU caches even more, interfere with you IO and complicates memory model? What for? Virtualization was build for server providers to make easy money, not for server owners to gain performance advantages. Vistualization is not for production. Production servers need less code, not more. It is the same kind of mistake as JVM - we…

You have no idea how modern virtualisation works. Go read about hardware assisted virtualisation on x86/x86-64. Most server operators don't care about performance. They have performance coming out of their ears. They care about redundancy and maintenance, or to put another way cost centres. Your post is on the wrong side of history. Virtualisation is being rolled out in a massive scale right now. Essentially you can…

You know nothing about me.)

Automated server management has been done long before virtualization stacks emerge, and it about utilizing monitoring and network boot.

What virtualization stack Google uses on its servers? None.

Re: How to set up a safe and secure Web server

#113

Post by jackalope »

kahawe wrote: post #110
laumars wrote: post #72

Earlier quoted context omitted.

I disagree with that. Apache's defaults on most distros isn't secure. Even 'enterprise' level distributions often fall into the following traps when packaging Apache: 1-> auto indexing enabled (should be disabled) 2-> user directories enabled (should be disabled) 3-> server signatures 'on' (should be 'off') 4-> server tokens set to 'full' (should be 'prod') 5-> hidden (dot prefixed) files not always blacklisted as un…

This comment together with the ars article just gave me the biggest 90s flashback ever... really, so little has changed in over a decade??? Next up they just HAVE to show us how to setup our own quakeworld or UnrealTournament'99 or Quake3 server! ;-)

Well, rlpb's fundamental point is quite valid: Vendors have done tremendous work in making an OS secure out-of-the-box. I remember exposing default installations to the public Internet a decade or more ago and watching them get compromised in minutes, if not seconds. Virtually every platform required hardening, and the only thing protecting most ordinary users was the fact that exposure was intermittent via expensive, but quite public, dialup connections. Vendors began taking security more seriously by providing sensible defaults, but it's an ongoing battle with zero-day exploits being discovered far too frequently.

Re: How to set up a safe and secure Web server

#114

Post by dschiptsov »

vegardx wrote: post #93
dschiptsov wrote: post #51

Vurtualization is not for production. Why to have this useless layer, which messes up your CPU caches even more, interfere with you IO and complicates memory model? What for? Virtualization was build for server providers to make easy money, not for server owners to gain performance advantages. Vistualization is not for production. Production servers need less code, not more. It is the same kind of mistake as JVM - we…

I think you overstate how much performance hit you get by running things virtually in ex. KVM or Xen. With the first, it's almost negligible, as you don't have to run a paravirtualized kernel in order to gain full access, so for Linux you are basically just limited by other factors, such as disk IO long before anything else start to kick in. I don't buy your argument about latency one bit, do you have ANY data to bac…

but what goes on inside of MySQL, or other applications for that matter, has nothing to do with the consistency of the disk image.

All you can do is instruct MySQL to pause, flush all its write buffers, and then take a snapshot of FS, then move it on. But this procedure has nothing to do with whether or not it runs under, say, VmWare or not. It has anything to do with does this particular disk volume supports FS snapshoting.

The next question is - what use of that snapshot when your system crashes and you got lost all the changes made since the last snapshot? How a VMWare helps you here?

Now consider what a bottleneck naively virtualized (represented as a file in a host system) disk volumes become, when I/O operations on, say, your DB's physical (transaction) log got interfered by I/O operations of your syslog daemon, or whatever other activity is going on.

In a database world the solution is about decoupling, partitioning and avoiding any I/O sharing possible. So, virtualization is just another layer of complexity which makes everything less predictable and controllable.

Re: How to set up a safe and secure Web server

#115

Post by jiggy2011 »

antihero wrote: post #108
edtechdev wrote: post #67

This guide doesn't cover important things like the firewall and blocking attackers (shorewall, fail2ban) and properly configuring mysql, php, etc. If you have a small server, I'd really recommend checking out these scripts that assist with configuring and setting up a server very quickly: http://lowendscripts.com/wiki/shell_scripts I personally used a fork of lowendscript last year to set up some servers, but if I ha…

Fail2ban is actually a vulnerability in itself. Say I worked out your home IP (not hard), then sent a large number of failed SSH attempts with the IP address forged as yours. You are now locked out if your home server.

True, but then they would have to know your home IP number which the login-spam bots won't.

I always make sure I have some access to a network KVM or remote console for my servers so I would be able to unblock myself.

Re: How to set up a safe and secure Web server

#117

Post by UnoriginalGuy »

dschiptsov wrote: post #112
UnoriginalGuy wrote: post #104

Earlier quoted context omitted.

You have no idea how modern virtualisation works. Go read about hardware assisted virtualisation on x86/x86-64. Most server operators don't care about performance. They have performance coming out of their ears. They care about redundancy and maintenance, or to put another way cost centres. Your post is on the wrong side of history. Virtualisation is being rolled out in a massive scale right now. Essentially you can…

You know nothing about me.) Automated server management has been done long before virtualization stacks emerge, and it about utilizing monitoring and network boot. What virtualization stack Google uses on its servers? None.

Google doesn't need virtualisation because Google is already deploying a large number of identical nodes which can be easily pulled and replace (i.e. Google's infrastructure is identical to virtualisation, but without the need for it).

Most businesses don't have hundreds of identical servers and services. They have a few dozen very specific or niche ones which need high up-time. This is one area where virtualisation can play a great role.

Another example is someone like a host where they want to distribute resources without any human intervention (e.g. Virtual Private Servers, shared hosting, etc).

All in all you're now starting to see data centres turn into "dumb" hardware farms, with the logical design and deployment being handled up-stream. This even extends to things like networking (routes, switches, etc - all centrally controlled).

Re: How to set up a safe and secure Web server

#118

Post by jackalope »

antihero wrote: post #108
edtechdev wrote: post #67

This guide doesn't cover important things like the firewall and blocking attackers (shorewall, fail2ban) and properly configuring mysql, php, etc. If you have a small server, I'd really recommend checking out these scripts that assist with configuring and setting up a server very quickly: http://lowendscripts.com/wiki/shell_scripts I personally used a fork of lowendscript last year to set up some servers, but if I ha…

Fail2ban is actually a vulnerability in itself. Say I worked out your home IP (not hard), then sent a large number of failed SSH attempts with the IP address forged as yours. You are now locked out if your home server.

That's why I whitelist my IPs in $ignoreip in jail.conf.

Fail2ban is actually a vulnerability in itself.

That's a bit harsh. It's true that you may have to tweak some settings to prevent or minimize DoS attacks, but even that risk is a far cry from an attacker gaining a login or rooting the box. Fail2ban has proven to be safe and reliable in the years I've used it. Nonetheless, the old maxim holds true: Know your tools.

Re: How to set up a safe and secure Web server

#120

Post by dschiptsov »

UnoriginalGuy wrote: post #117
dschiptsov wrote: post #112

Earlier quoted context omitted.

You know nothing about me.) Automated server management has been done long before virtualization stacks emerge, and it about utilizing monitoring and network boot. What virtualization stack Google uses on its servers? None.

Google doesn't need virtualisation because Google is already deploying a large number of identical nodes which can be easily pulled and replace (i.e. Google's infrastructure is identical to virtualisation, but without the need for it). Most businesses don't have hundreds of identical servers and services. They have a few dozen very specific or niche ones which need high up-time. This is one area where virtualisation…

So, unless we are selling CPU hours, like owners of a mainframe or a hosting provider, we don't need any virtualization?

Is it possible that the inefficiency and added unnecessary complexity makes a virtualized servers unusable for the most common server's tasks, due to I/O interference and cache/memory access complications?)

Post reply on HN