Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I spend my first 5 minutes on a server

plusbryan.com

Post reply on HN
Print view View original

51–60 of 355 posts

Re: How I spend my first 5 minutes on a server

#51

Post by dbarlett »

ams6110 wrote: post #13
zrail wrote: post #3

The first five minutes on any of my servers involve giving it a name, installing puppet and adding the server name to my central puppet config. You seriously do this by hand for every server? That seems error prone and a huge waste of time when tools like puppet and chef exist.

Puppet and Chef are yet another thing to learn and maintain, if the guy is a part-time admin with a lot of other responsibilities and a small number of servers it may not be worth it.

I was in the same position - too many distinct environments for bash/Fabric, too little time to learn Chef/Puppet/CFEngine. Ansible [1] seems like a good compromise: you get the simplicity (runs over SSH) and host targeting of Fabric with the declarative nature and idempotency of the more complex tools. You can start with all-in-one "playbooks" [2], then split out tasks, handlers, Jinja2 templates, files, and variables [3].

As an aside, I think the default fail2ban config is too loose and quiet. Here's [4] an Ansible task file that configures it to be more aggressive and send notification emails.

[1] http://ansible.cc/

[2] https://gist.github.com/dbarlett/5079802

[3] https://github.com/fdavis/ansible-best-practices

[4] https://gist.github.com/dbarlett/5079715

Re: How I spend my first 5 minutes on a server

#52

Post by baghali »

zrail wrote: post #3

The first five minutes on any of my servers involve giving it a name, installing puppet and adding the server name to my central puppet config. You seriously do this by hand for every server? That seems error prone and a huge waste of time when tools like puppet and chef exist.

Without Chef there would be no way for me to rollout a new server in our cluster. Investing time into Chef was one of the greatest things I ever did. Chef is the best documentation of our infrastructure. The second best tool I'm using is fpm[1] to make custom debian packages.

[1] https://github.com/jordansissel/fpm

Re: How I spend my first 5 minutes on a server

#53

Post by magnetikonline »

I wouldn't bother with fail2ban considering password based SSH logins are disabled (which is good).

Since the author is using ufw to control iptables, better to just use "ufw limit" rules for SSH port 22 to slow down the rate of any automated SSH bots trying to give your server a workout.

Re: How I spend my first 5 minutes on a server

#54

Post by corin_ »

kristofferR wrote: post #50
afhof wrote: post #33

Earlier quoted context omitted.

Don't do this. It adds almost no extra security and makes it hard for routers that prioritizes port 22 traffic as interactive.

Sure, it'll not stop dedicated manual intrusion attempts, but it will actually prevent a ton of automated bots from even just trying to connect with common passwords through SSH.

Which is irrelevant if you have any one of: strong passwords, no passwords, fail2ban

Re: How I spend my first 5 minutes on a server

#55

Post by beagle3 »

1. You should do "apt-get dist-upgrade" to get new kernel packages as well, otherwise you are stuck on an old kernel. (You might want that. I prefer updated kernel for the security, firefoxen, etc.). "apt-get upgrade" will only update existing packages - but the kernel updates require new packages to be installed.

2. If you're on ubuntu, root already has no password, and your initial setup user (whether it is called "deploy" or "kilroy") is in the sudoers file.

3. Other things I install in the "5 minutes with server" are: htop molly-guard screen git-core etckeeper

git-core because I prefer my etckeeper in git, but if you want it in bzr you don't need git-core. INSTALL AND CONFIGURE ETCKEEPER AS SOON AS YOU CAN, seriously. You need it. You'll thank me when you try to figure out when and how something in /etc got borked. (you need to edit /etc/etckeeper/etckeeper.conf if you use gif. You need to do "etckeeper init" and then "etckeeper commit" to establish the baseline)

molly-guard stops you from rebooting the wrong server

screen (or alternatively tmux) lets you keep your session open through ssh session disconnects (e.g. when moving from wifi to 3G, or between 3G towers that give you different external IP). The most useful way to use screen is "screen -xR" which also lets you share your session with someone else should you need to.

Re: How I spend my first 5 minutes on a server

#56

Post by falcolas »

kristofferR wrote: post #50
afhof wrote: post #33

Earlier quoted context omitted.

Don't do this. It adds almost no extra security and makes it hard for routers that prioritizes port 22 traffic as interactive.

Sure, it'll not stop dedicated manual intrusion attempts, but it will actually prevent a ton of automated bots from even just trying to connect with common passwords through SSH.

Worth looking at:

http://bsdly.blogspot.com/2013/02/theres-no-protection-in-hi...

Re: How I spend my first 5 minutes on a server

#57

Post by pseudonym »

rdl wrote: post #28
vahe wrote: post #21

I also recommend changing the default SSH port.

I hate it when people do that, myself. Especially when you have a lot of other tools, many of which don't take port arguments easily. IMO best practice is to firewall off everything except some bastion hosts or VPN gateway.

I actually do this on my personal server because more than one public wifi (and one of my previous jobs, at a public high school) disallowed outbound 22 connections.

Re: How I spend my first 5 minutes on a server

#58

Post by bcl »

Don't forget:

  netstat -ntap | less
  ps aux | less
Also check to see what's enabled to run at boot time via whatever your flavor uses.

Check for unusual daemons, ssh running on other ports (yes, the provider pre-loaded systems with a back-door ssh without disclosing it to us).

This is especially important when you are taking over admin on a server you didn't setup yourself. Other folks have weird ideas on how to admin things. Like webmin for example...

I also like epylog for finding unexpected stuff in the logs.

Re: How I spend my first 5 minutes on a server

#59

Post by slurgfest »

dbarlett wrote: post #51
ams6110 wrote: post #13

Earlier quoted context omitted.

Puppet and Chef are yet another thing to learn and maintain, if the guy is a part-time admin with a lot of other responsibilities and a small number of servers it may not be worth it.

I was in the same position - too many distinct environments for bash/Fabric, too little time to learn Chef/Puppet/CFEngine. Ansible [1] seems like a good compromise: you get the simplicity (runs over SSH) and host targeting of Fabric with the declarative nature and idempotency of the more complex tools. You can start with all-in-one "playbooks" [2], then split out tasks, handlers, Jinja2 templates, files, and variabl…

What do you usually do with these fail2ban notifications?

Re: How I spend my first 5 minutes on a server

#60

Post by bluesmoon »

We do something similar, though we have a script that sets up the box. We use linode as well, so the script deploys a new box with a complex root password and my id_dsa.pub file. It also sets up /etc/skel and the profile files so that useradd uses them later.

We don't use a single deploy user though, instead, each user with deploy perms is in the sudo group.

Post reply on HN