I also recommend changing the default SSH port.
How I spend my first 5 minutes on a server
21–30 of 355 posts
Re: How I spend my first 5 minutes on a server
#22Beginner or not, you should probably use visudo [1] instead of vim /etc/sudoers for the sanity checks that it provides, if nothing else. A botched edit of /etc/sudoers that locks you (along with every other user) out of administrative access is an unpleasant way to learn this. [1] http://linux.die.net/man/8/visudo
Similarly "ufw allow from {ipaddress-you-will-access-from} to any port 22" sounds like a good way to accidentally lock yourself out unless you have an out of band backup
While true, I'd like to note that the article's author does have OOB access.
Re: How I spend my first 5 minutes on a server
#23I find it very bad practice to blindly pass -f to commands.
chown deploy:deploy /home/deploy -RfRe: How I spend my first 5 minutes on a server
#24And, when some dev screws up by pushing a poisonous build, there is no way to figure out who to contact to fix. I generally have an extensive pam+LDAP setup to control Logins. Having said that, if I am trying to use keys, puppet filebucket works for me.
Re: How I spend my first 5 minutes on a server
#25Beginner or not, you should probably use visudo [1] instead of vim /etc/sudoers for the sanity checks that it provides, if nothing else. A botched edit of /etc/sudoers that locks you (along with every other user) out of administrative access is an unpleasant way to learn this. [1] http://linux.die.net/man/8/visudo
You're absolutely right. Thanks for catching that!
Re: How I spend my first 5 minutes on a server
#26I like the KISS aspect of this, though for accountability purposes, I prefer each user to have their own account. One correction for you: the sshd_config lines should have no "=" symbol.
Good catch! Fixed
Re: How I spend my first 5 minutes on a server
#27I find it very bad practice to blindly pass -f to commands. chown deploy:deploy /home/deploy -Rf
"-Rf" not found... :P
flag arguments should go before any other arguments to be compatible with the most Unix systems.
Re: How I spend my first 5 minutes on a server
#28I also recommend changing the default SSH port.
I hate it when people do that, myself. Especially when you have a lot of other tools, many of which don't take port arguments easily.
IMO best practice is to firewall off everything except some bastion hosts or VPN gateway.
Re: How I spend my first 5 minutes on a server
#29I find it very bad practice to blindly pass -f to commands. chown deploy:deploy /home/deploy -Rf
Thanks for the catch! Fixed
Re: How I spend my first 5 minutes on a server
#30I also recommend changing the default SSH port.
I hate it when people do that, myself. Especially when you have a lot of other tools, many of which don't take port arguments easily. IMO best practice is to firewall off everything except some bastion hosts or VPN gateway.
Totally agree. If you stick to good security practices, working around a non-standard port is an unnecessary annoyance imho.