Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I spend my first 5 minutes on a server

plusbryan.com

Post reply on HN
Print view View original

31–40 of 355 posts

Re: How I spend my first 5 minutes on a server

#31

Post by anderiv »

numbsafari wrote: post #17
denrober wrote: post #15

Earlier quoted context omitted.

My only thought is even with password auth. turned off hostile persons can still connect to the ssh daemon and might discover and unknown vulnerability or some type of dos. If you know someone is trouble why let them in even if you are wearing armor?

It'd really suck if they could forge traffic from you that looked like a failed login attempt and that resulted in you getting banned.

That is why fail2ban allows you to configure a whitelisted IP (your office, VPN, etc.) that will never get banned.

Re: How I spend my first 5 minutes on a server

#35

Post by jedberg »

To prevent having to log into root via remote console, set up a second backup account with an ssh key and sudo access, and then put that key somewhere safe.

The chances of both that and the deploy user getting corrupted at the same time is unlikely.

Re: How I spend my first 5 minutes on a server

#36

Post by rdl »

My big thing is making sure 1) the machine comes back up cleanly after a reboot and 2) is current on all patches 3) is running as little as possible.

Also a big fan of externally verifying what ports are open, and making sure the system is in monitoring, backup, config management systems. Config management is kind of optional if you have a small number of servers which don't duplicate configurations, though, and there's often no need to back up the OS, but any data should be backed up automatically.

Re: How I spend my first 5 minutes on a server

#38

Post by WALoeIII »

ams6110 wrote: post #13
zrail wrote: post #3

The first five minutes on any of my servers involve giving it a name, installing puppet and adding the server name to my central puppet config. You seriously do this by hand for every server? That seems error prone and a huge waste of time when tools like puppet and chef exist.

Puppet and Chef are yet another thing to learn and maintain, if the guy is a part-time admin with a lot of other responsibilities and a small number of servers it may not be worth it.

You don't have to re-learn puppet/chef/cfengine/bash script every time. You learn it once. It requires much less effort to "maintain" than manually updating more than 1 box.
Post reply on HN