Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I spend my first 5 minutes on a server

plusbryan.com

Post reply on HN
Print view View original

71–80 of 355 posts

Re: How I spend my first 5 minutes on a server

#71

Post by mef »

shizcakes wrote: post #48

The premise of this thing is not good advice. 1) Your first couple minutes on a server should be used to install a configuration management client, if your bootstrap policies somehow don't already install one. 2) Everything else listed in this document should be configured by a configuration management system. 3) "User account sync tools" should have no place in a modern infrastructure, you should use your configurat…

For #4, wouldn't the only change when someone leaves the organization be to remove their key from authorized_keys for the shared account? Why would anyone else have to be updated?

Re: How I spend my first 5 minutes on a server

#74

Post by jebblue »

Maxious wrote: post #18
networked wrote: post #10

Beginner or not, you should probably use visudo [1] instead of vim /etc/sudoers for the sanity checks that it provides, if nothing else. A botched edit of /etc/sudoers that locks you (along with every other user) out of administrative access is an unpleasant way to learn this. [1] http://linux.die.net/man/8/visudo

Similarly "ufw allow from {ipaddress-you-will-access-from} to any port 22" sounds like a good way to accidentally lock yourself out unless you have an out of band backup

He does he's on a Linode he has LISH.

Re: How I spend my first 5 minutes on a server

#75

Post by voltagex_ »

berlinbrown wrote: post #72

It may seem like a waste of $20 a month if you aren't doing anything big with it. But you can setup a linux virtual server on linode and go through all of those steps on your own. Also test out your setup. http://library.linode.com/

EC2 is cheaper if you're using the server for hours in a month - i.e. to learn, like I am.

Re: How I spend my first 5 minutes on a server

#76

Post by vahe »

harshreality wrote: post #70
vahe wrote: post #16

Earlier quoted context omitted.

Here's something I wrote very quickly (bash script): https://github.com/vahek/vSetup It does most of the stuff mentioned in the post, however doesn't setup automatic updates or Logwatch.

(to both corin and vahe): That kind of shell scripting is the horrorshow that motivated configuration management tools* in the first place. Shell scripts require a lot of added complexity to manage multiple heterogeneous servers, or to be idempotent. * Puppet, Chef, Ansible, Salt, CFEngine, etc.

I agree. However, there is no learning curve to get started using this script and was put together in a few minutes.

Re: How I spend my first 5 minutes on a server

#77

Post by mbreese »

mef wrote: post #71
shizcakes wrote: post #48

The premise of this thing is not good advice. 1) Your first couple minutes on a server should be used to install a configuration management client, if your bootstrap policies somehow don't already install one. 2) Everything else listed in this document should be configured by a configuration management system. 3) "User account sync tools" should have no place in a modern infrastructure, you should use your configurat…

For #4, wouldn't the only change when someone leaves the organization be to remove their key from authorized_keys for the shared account? Why would anyone else have to be updated?

But they still would know the 'deploy' password needed for sudo access. And while you could be relatively sure that they couldn't get access, you still couldn't be completely sure since they did have sudo access to begin with. So, the best thing would be to change the shared password. That could be avoided with non-shared accounts.

Re: How I spend my first 5 minutes on a server

#78

Post by wvenable »

shizcakes wrote: post #48

The premise of this thing is not good advice. 1) Your first couple minutes on a server should be used to install a configuration management client, if your bootstrap policies somehow don't already install one. 2) Everything else listed in this document should be configured by a configuration management system. 3) "User account sync tools" should have no place in a modern infrastructure, you should use your configurat…

Is there a free and recommended configuration management system that does all this?

Re: How I spend my first 5 minutes on a server

#79

Post by davidbanham »

wvenable wrote: post #78
shizcakes wrote: post #48

The premise of this thing is not good advice. 1) Your first couple minutes on a server should be used to install a configuration management client, if your bootstrap policies somehow don't already install one. 2) Everything else listed in this document should be configured by a configuration management system. 3) "User account sync tools" should have no place in a modern infrastructure, you should use your configurat…

Is there a free and recommended configuration management system that does all this?

We use Chef, many people run Puppet.

http://www.opscode.com/chef/

https://puppetlabs.com/

Re: How I spend my first 5 minutes on a server

#80

Post by jebblue »

kristofferR wrote: post #50
afhof wrote: post #33

Earlier quoted context omitted.

Don't do this. It adds almost no extra security and makes it hard for routers that prioritizes port 22 traffic as interactive.

Sure, it'll not stop dedicated manual intrusion attempts, but it will actually prevent a ton of automated bots from even just trying to connect with common passwords through SSH.

It's what I do, you can't break in a door that doesn't exist, only those you know exist.
Post reply on HN