I've never understood the point of fail2ban if you disable ssh password authentication. Yeah, it might eliminate some spam in the logs, but if you only allow key-based authentication that doesn't really matter.
How I spend my first 5 minutes on a server
11–20 of 355 posts
Re: How I spend my first 5 minutes on a server
#12I dunno about this guy but apt-get update/apt-get upgrade takes upwards of 15 minutes on new installs (as does yum upgrade on rhel-compatible systems). Kinda eats up into my first 5 minutes on a server.
Look into apt-cacher-ng. I have a slow internet connection at home and it made updates go a lot faster for multiple machines. Newer versions (in wheezy, not squeeze) even work with yum.
Re: How I spend my first 5 minutes on a server
#13The first five minutes on any of my servers involve giving it a name, installing puppet and adding the server name to my central puppet config. You seriously do this by hand for every server? That seems error prone and a huge waste of time when tools like puppet and chef exist.
Puppet and Chef are yet another thing to learn and maintain, if the guy is a part-time admin with a lot of other responsibilities and a small number of servers it may not be worth it.
Re: How I spend my first 5 minutes on a server
#14don't vim sudoers.
the days of the password are not over.
fail2ban is next to useless with key auth.
Re: How I spend my first 5 minutes on a server
#15I've never understood the point of fail2ban if you disable ssh password authentication. Yeah, it might eliminate some spam in the logs, but if you only allow key-based authentication that doesn't really matter.
My only thought is even with password auth. turned off hostile persons can still connect to the ssh daemon and might discover and unknown vulnerability or some type of dos. If you know someone is trouble why let them in even if you are wearing armor?
Re: How I spend my first 5 minutes on a server
#16While I agree these practices seem pretty safe/standard, it's still enough manual work that many people will just skip half of it out of laziness for small projects. Does anyone have good reusable Puppet (or bash scripts) published that they use on all new servers?
Here's something I wrote very quickly (bash script): https://github.com/vahek/vSetup
It does most of the stuff mentioned in the post, however doesn't setup automatic updates or Logwatch.
Re: How I spend my first 5 minutes on a server
#17I've never understood the point of fail2ban if you disable ssh password authentication. Yeah, it might eliminate some spam in the logs, but if you only allow key-based authentication that doesn't really matter.
My only thought is even with password auth. turned off hostile persons can still connect to the ssh daemon and might discover and unknown vulnerability or some type of dos. If you know someone is trouble why let them in even if you are wearing armor?
It'd really suck if they could forge traffic from you that looked like a failed login attempt and that resulted in you getting banned.
Re: How I spend my first 5 minutes on a server
#18Beginner or not, you should probably use visudo [1] instead of vim /etc/sudoers for the sanity checks that it provides, if nothing else. A botched edit of /etc/sudoers that locks you (along with every other user) out of administrative access is an unpleasant way to learn this. [1] http://linux.die.net/man/8/visudo
Similarly "ufw allow from {ipaddress-you-will-access-from} to any port 22" sounds like a good way to accidentally lock yourself out unless you have an out of band backup
Re: How I spend my first 5 minutes on a server
#19I've never understood the point of fail2ban if you disable ssh password authentication. Yeah, it might eliminate some spam in the logs, but if you only allow key-based authentication that doesn't really matter.
fail2ban can deal with much more than SSH login attempts. I believe you can configure it to do arbitrary actions on arbitrary log events. Perhaps it comes with a block for HTTP, too?
Seeing as he blocks SSH and only allows it from his IP, there won't be any SSH attempts reaching sshd at all, so fail2ban wouldn't be doing anything if it was looking at SSH only.
Re: How I spend my first 5 minutes on a server
#20While I agree these practices seem pretty safe/standard, it's still enough manual work that many people will just skip half of it out of laziness for small projects. Does anyone have good reusable Puppet (or bash scripts) published that they use on all new servers?
A personal script, focuses more on getting a server ready for my preferences than it does on security: http://pastie.org/pastes/6376503/text