How I spend my first 5 minutes on a server • Hacker News Board

Re: How I spend my first 5 minutes on a server

#81

Post by chrisbolt » Mon, Mar 04, 2013, 5:35 AM UTC

wvenable wrote: post #78

shizcakes wrote: post #48

The premise of this thing is not good advice. 1) Your first couple minutes on a server should be used to install a configuration management client, if your bootstrap policies somehow don't already install one. 2) Everything else listed in this document should be configured by a configuration management system. 3) "User account sync tools" should have no place in a modern infrastructure, you should use your configurat…

Is there a free and recommended configuration management system that does all this?

Puppet, chef, cfengine, ansible, and salt are a few.

Re: How I spend my first 5 minutes on a server

#82

Post by ashray » Mon, Mar 04, 2013, 5:35 AM UTC

berlinbrown wrote: post #73

What do you about all of those chinese hackers hitting your sshd server. I have 30 different ips and fail2ban doesn't seem to ban them.

Try csf. Works like a charm for me.

Re: How I spend my first 5 minutes on a server

#83

Post by shizcakes » Mon, Mar 04, 2013, 5:35 AM UTC

wvenable wrote: post #78

shizcakes wrote: post #48

The premise of this thing is not good advice. 1) Your first couple minutes on a server should be used to install a configuration management client, if your bootstrap policies somehow don't already install one. 2) Everything else listed in this document should be configured by a configuration management system. 3) "User account sync tools" should have no place in a modern infrastructure, you should use your configurat…

Is there a free and recommended configuration management system that does all this?

Chef or Puppet are common choices. There are many others, but those two are modern, have large communities, and decent documentation. There's a decent chance someone has already open sourced a cookbook/module for each of many of these items!

Re: How I spend my first 5 minutes on a server

#84

Post by Volpe » Mon, Mar 04, 2013, 5:37 AM UTC

zrail wrote: post #3

The first five minutes on any of my servers involve giving it a name, installing puppet and adding the server name to my central puppet config. You seriously do this by hand for every server? That seems error prone and a huge waste of time when tools like puppet and chef exist.

While not directly related to this article, last I checked Puppet/Chef don't have particularly useful windows support. Is there an chef like solution for windows?

Re: How I spend my first 5 minutes on a server

#85

Post by joelesalas » Mon, Mar 04, 2013, 5:39 AM UTC

mef wrote: post #71

shizcakes wrote: post #48

The premise of this thing is not good advice. 1) Your first couple minutes on a server should be used to install a configuration management client, if your bootstrap policies somehow don't already install one. 2) Everything else listed in this document should be configured by a configuration management system. 3) "User account sync tools" should have no place in a modern infrastructure, you should use your configurat…

For #4, wouldn't the only change when someone leaves the organization be to remove their key from authorized_keys for the shared account? Why would anyone else have to be updated?

It's a basic principle of security. Each account represents one person so that you have a full audit of who did what by watching the activity of a given user account. If everything is run as "devops" user for example, you have no idea who actually performed a given task. Was it Bill, or was it an automated job? PCI-DSS requirements also affect your model for user accounts (hint: shared users are often not compliant).

From the perspective of a sysadmin, this article has a lot of issues and it's inadvisable to follow its recommendations. Who doesn't use a hardware firewall? Who exposes ssh to the internet (requiring fail2ban) when a VPN server is much more secure and easier to use? Setting up an LDAP server is really easy and costs nothing. There's no excuse for shared accounts.

Re: How I spend my first 5 minutes on a server

#86

Post by robflynn » Mon, Mar 04, 2013, 5:42 AM UTC

brokentone wrote: post #68

afhof wrote: post #33

Earlier quoted context omitted.

Don't do this. It adds almost no extra security and makes it hard for routers that prioritizes port 22 traffic as interactive.

Going back to the classics, is port knocking still a thing? (I've been out of this discussion for a while, serious question)

One of my freelance projects uses port knocking, but they're the only one I've worked with that have used it in recent years.

Re: How I spend my first 5 minutes on a server

#87

Post by josephkern » Mon, Mar 04, 2013, 5:44 AM UTC

Firstly, a nice checklist. Easy actionable steps, repeatable, and pretty much most of what you need.

Secondly, you are about 4-5 hours away from learning puppet (or Chef) and making this checklist into actual code.

Thirdly, you now have a checklist of items that you can use in a job interview if you get the oppertunity to gain a new-hire or an intern.

Lastly, good on you for submitting this to a peer-review on HN. We can be a picky lot.

TL;DR Checklists are a good first step for building a proper config management system.

Re: How I spend my first 5 minutes on a server

#88

Post by webosb » Mon, Mar 04, 2013, 5:44 AM UTC

afhof wrote: post #33

vahe wrote: post #21

I also recommend changing the default SSH port.

Don't do this. It adds almost no extra security and makes it hard for routers that prioritizes port 22 traffic as interactive.

guess i'm going back to port 22...

Re: How I spend my first 5 minutes on a server

#89

Post by luser001 » Mon, Mar 04, 2013, 5:45 AM UTC

mbreese wrote: post #77

mef wrote: post #71

Earlier quoted context omitted.

For #4, wouldn't the only change when someone leaves the organization be to remove their key from authorized_keys for the shared account? Why would anyone else have to be updated?

But they still would know the 'deploy' password needed for sudo access. And while you could be relatively sure that they couldn't get access, you still couldn't be completely sure since they did have sudo access to begin with. So, the best thing would be to change the shared password. That could be avoided with non-shared accounts.

Are you insinuating that the user could have used sudo access to install a backdoor of some sort? If so, changing the password won't stop them either. Am I missing something?

Re: How I spend my first 5 minutes on a server

#90

Post by luser001 » Mon, Mar 04, 2013, 5:48 AM UTC

joelesalas wrote: post #85

mef wrote: post #71

Earlier quoted context omitted.

For #4, wouldn't the only change when someone leaves the organization be to remove their key from authorized_keys for the shared account? Why would anyone else have to be updated?

It's a basic principle of security. Each account represents one person so that you have a full audit of who did what by watching the activity of a given user account. If everything is run as "devops" user for example, you have no idea who actually performed a given task. Was it Bill, or was it an automated job? PCI-DSS requirements also affect your model for user accounts (hint: shared users are often not compliant).…

Why do you say a VPN server is more secure? Which one?

I, for one, trust ssh more than any other software wrt security, especially with password login disabled. Disclaimer: I am not a security expert.