Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to set up a safe and secure Web server

arstechnica.com

Post reply on HN
Print view View original

131–140 of 148 posts

Re: How to set up a safe and secure Web server

#131

Post by sliverstorm »

kryptiskt wrote: post #68
sliverstorm wrote: post #26

Earlier quoted context omitted.

I looked at getting one of those. However, it seems like HP is sunsetting the Microserver line, which is a real shame.

Which is a good reason to get one now. I have one (running FreeBSD and ZFS), and it has been great. I does what I ask of a homeserver: it runs silently and is pretty good at saturating a 1Gb connection, the RAM really helps the performance. All at a great price.

I would have, but at the time I was looking to purchase (very recently) the hardware was already getting a little long in the tooth.

That combined with the costs of getting a static IP and a few other things I'd want for hosting @ home, and I decided to use a VPS instead.

Re: How to set up a safe and secure Web server

#132

Post by pfg »

dschiptsov wrote: post #112
UnoriginalGuy wrote: post #104

Earlier quoted context omitted.

You have no idea how modern virtualisation works. Go read about hardware assisted virtualisation on x86/x86-64. Most server operators don't care about performance. They have performance coming out of their ears. They care about redundancy and maintenance, or to put another way cost centres. Your post is on the wrong side of history. Virtualisation is being rolled out in a massive scale right now. Essentially you can…

You know nothing about me.) Automated server management has been done long before virtualization stacks emerge, and it about utilizing monitoring and network boot. What virtualization stack Google uses on its servers? None.

Google might not run the vast majority of their services on VMs, but they do use virtualization (Xen AFAIK).

They even developed a cluster management tool for Xen/KVM: http://code.google.com/p/ganeti/

Re: How to set up a safe and secure Web server

#133

Post by JC001 »

belorn wrote: post #44
barefoot wrote: post #14

"...being locked to IIS as a Web server (or dependent on crippled Windows ports of better Web servers) means you'll be playing in the bush leagues. IIS is found running many huge and powerful websites in the world, but it's rarely selected in a vacuum..." I sense a little bit of bias. As a multiplatform developer I can think of a number of reasons why someone might opt to go the Windows Server route. ASP.NET MVC 4 is…

If pushing a new website to the webserver is the best argument of WAMP over LAMP, it sounds a bit odd. Pushing a new simplistic website to a LAMP (default one click installed), has as much difficulty as pushing files to a directory (/var/www). Even if Visual Studio gives a one-button-system, I would still not call that a killer feature over placing files in a directory. When one pick between WAMP and LAMP, the questi…

Small comment as I agree with your statement in general. Ease of deployment has never been an issue as they are all very straightforward.

The A in WAMP/LAMP is for Apache, so that does not apply here. I'm not sure what the acronym is for Windows/IIS//.NET.

Re: How to set up a safe and secure Web server

#134

Post by antihero »

jackalope wrote: post #130
e12e wrote: post #124

Earlier quoted context omitted.

That's why I whitelist my IPs in $ignoreip in jail.conf. If you are already able to whitelist your (valid) login points, why would you need fail2ban? Just whilteliste them in your firewall and/or /etc/hosts.allow. Personally I've yet had anyone bruteforce my ssh-key (although, as I run Debian, that is just luck as it turned out...). Still, fail2ban wouldn't really have helped against an attacker that knows/can figure…

I need to support multiple roaming users. Manually maintaining whitelists would be a burden. Fail2ban isn't a firewall. It monitors logs for suspicious activity and responds with an action (not limited to banning an IP). When you expose services publicly, it's one of many tools you can use to limit bad behaviour without penalizing or inconveniencing legitimate users. I also use iptables (including the recent and stri…

Only open SSH port over tun0 and use OpenVPN.

BAM.

Re: How to set up a safe and secure Web server

#135

Post by antihero »

barefoot wrote: post #14

"...being locked to IIS as a Web server (or dependent on crippled Windows ports of better Web servers) means you'll be playing in the bush leagues. IIS is found running many huge and powerful websites in the world, but it's rarely selected in a vacuum..." I sense a little bit of bias. As a multiplatform developer I can think of a number of reasons why someone might opt to go the Windows Server route. ASP.NET MVC 4 is…

The thing I dislike most is that with Python/PHP/Ruby/Perl, developing on Windows is an option. If you choose the MS stack, you are totally locked into Windows unless you are lucky enough that Mono work (unlikely for new things).

Re: How to set up a safe and secure Web server

#136

Post by antihero »

laumars wrote: post #72
rlpb wrote: post #55

If you want a safe and secure Web server, use what your distribution gives you. Don't add third party sources if you can avoid it, ie. don't need features Instead, go with what your distribution gives you. The people who put your favourite distribution together work on making the system safe and secure as a whole. People who don't think it is safe and secure file bugs and they get fixed. And you have one place to get…

I disagree with that. Apache's defaults on most distros isn't secure. Even 'enterprise' level distributions often fall into the following traps when packaging Apache: 1-> auto indexing enabled (should be disabled) 2-> user directories enabled (should be disabled) 3-> server signatures 'on' (should be 'off') 4-> server tokens set to 'full' (should be 'prod') 5-> hidden (dot prefixed) files not always blacklisted as un…

How does this look?

https://gist.github.com/c6fd22f73468b26e01b0

I built it from scratch (ish) so I know what all the parameters do.

Do you have more info on the SSL PCI compliance?

Re: How to set up a safe and secure Web server

#137

Post by 0ren »

Nitpick:

> Temporary files usually start with a dot or a dollar-sign.. to make sure that Nginx never serves any files starting with either of those characters...

> location ~ ~$ { access_log off; log_not_found off; deny all; }

Wouldn't that regex match temporary files ending with ~ (as it should)?

Re: How to set up a safe and secure Web server

#138

Post by vegardx »

dschiptsov wrote: post #126
UnoriginalGuy wrote: post #122

Earlier quoted context omitted.

I never said anything about selling CPU hours. It has nothing to do with that. In fact my example about organisations directly contradict that. It has to do with organisation and about being able to abstract logical servers away from physical hardware. There is very little inefficiency (see hardware assisted virtualisation point above) and very little overt complexity (go play with any modern HyerVisor solution). As…

Well, I'm really ignorant, when it comes to meaningless sentences like organisation and about being able to abstract logical servers away from physical hardware . You're probably right. On the other hand, I'd been involved in a few projects, which includes optimization of a big centralized databases, so, I think, I know a bit about flows of data, access patterns and where the bottlenecks are (hint: around serializing…

You talk about edge cases. And you actually have yet to provide any data to back up your statement when it comes to penalty because of running it in a virtual environment.

Re: How to set up a safe and secure Web server

#139

Post by vegardx »

dschiptsov wrote: post #114
vegardx wrote: post #93

Earlier quoted context omitted.

I think you overstate how much performance hit you get by running things virtually in ex. KVM or Xen. With the first, it's almost negligible, as you don't have to run a paravirtualized kernel in order to gain full access, so for Linux you are basically just limited by other factors, such as disk IO long before anything else start to kick in. I don't buy your argument about latency one bit, do you have ANY data to bac…

but what goes on inside of MySQL, or other applications for that matter, has nothing to do with the consistency of the disk image. All you can do is instruct MySQL to pause, flush all its write buffers, and then take a snapshot of FS, then move it on. But this procedure has nothing to do with whether or not it runs under, say, VmWare or not. It has anything to do with does this particular disk volume supports FS snap…

Have you actually used any of the products you are talking about? You don't take the filesystem snapshots on the virtual machine, but of the disk image on the host, typically using LVM or something similar. What you want to do with this snapshot later on is up to you, normally people just export it to a remote location.

For total system failures you still need a proper backup solution on the machine. This is true even if it's dedicated hardware or a virtual machine.

You seem to always resort to talking about databases, and this might be true for huge centralized databases, but that is a pretty damn specific task. Also, I thought we were past the "put everything on one box"-model.

The complexity you talk about is just not there. It acts and feels just like a normal machine, and you have yet to provide any data that would support your claim, even for edge cases.

Something worth reading: http://en.wikipedia.org/wiki/X86_virtualization#Hardware_ass...

Re: How to set up a safe and secure Web server

#140

Post by e12e »

jackalope wrote: post #130
e12e wrote: post #124

Earlier quoted context omitted.

That's why I whitelist my IPs in $ignoreip in jail.conf. If you are already able to whitelist your (valid) login points, why would you need fail2ban? Just whilteliste them in your firewall and/or /etc/hosts.allow. Personally I've yet had anyone bruteforce my ssh-key (although, as I run Debian, that is just luck as it turned out...). Still, fail2ban wouldn't really have helped against an attacker that knows/can figure…

I need to support multiple roaming users. Manually maintaining whitelists would be a burden. Fail2ban isn't a firewall. It monitors logs for suspicious activity and responds with an action (not limited to banning an IP). When you expose services publicly, it's one of many tools you can use to limit bad behaviour without penalizing or inconveniencing legitimate users. I also use iptables (including the recent and stri…

Avoiding banning certain ips (to avoid denial of service) is a form of white listing. So either you're open to denial of service, or you're able to whitelist all essential access paths?
Post reply on HN