How I spend my first 5 minutes on a server • Hacker News Board

Re: How I spend my first 5 minutes on a server

#91

Post by plusbryan » Mon, Mar 04, 2013, 5:48 AM UTC

thaumaturgy wrote: post #65

A few gentle suggestions: > The days of passwords are over. You’ll enhance security and ease of use in one fell swoop by ditching those passwords and employing public key authentication for your user accounts. ssh keys are better than passwords only because they contain (and require) more information. On the other hand, if your dev's machine is lost or stolen or compromised, so is your ssh key. This is especially a p…

Thank you for the solid suggestions! +1 on protecting your ssh key with a passphrase.

Re: How I spend my first 5 minutes on a server

#92

Post by tedchs » Mon, Mar 04, 2013, 5:49 AM UTC

Volpe wrote: post #84

zrail wrote: post #3

The first five minutes on any of my servers involve giving it a name, installing puppet and adding the server name to my central puppet config. You seriously do this by hand for every server? That seems error prone and a huge waste of time when tools like puppet and chef exist.

While not directly related to this article, last I checked Puppet/Chef don't have particularly useful windows support. Is there an chef like solution for windows?

Puppet has great Windows support nowadays; not sure about Chef.

Re: How I spend my first 5 minutes on a server

#93

Post by vahe » Mon, Mar 04, 2013, 5:49 AM UTC

webosb wrote: post #88

afhof wrote: post #33

Earlier quoted context omitted.

Don't do this. It adds almost no extra security and makes it hard for routers that prioritizes port 22 traffic as interactive.

guess i'm going back to port 22...

I'm convinced too. Back to 22 we go.

Re: How I spend my first 5 minutes on a server

#94

Post by luser001 » Mon, Mar 04, 2013, 5:50 AM UTC

andrewvc wrote: post #47

Maxious wrote: post #18

Earlier quoted context omitted.

Similarly "ufw allow from {ipaddress-you-will-access-from} to any port 22" sounds like a good way to accidentally lock yourself out unless you have an out of band backup

FWIW I never understood UFW over straight IP tables, is it really easier to read?

IMHO, yes. At least on Ubuntu, it's never been too clear to me how I should save my rules so that they come back on startup.

The ufw man page is pretty decent.

Re: How I spend my first 5 minutes on a server

#95

Post by kbuck » Mon, Mar 04, 2013, 5:51 AM UTC

Why install fail2ban? You already have SSH password auth disabled, and you only allow SSH connections from your office. Won't this just risk banning your own office if someone's SSH client is misconfigured?

Re: How I spend my first 5 minutes on a server

#96

Post by luser001 » Mon, Mar 04, 2013, 5:53 AM UTC

berlinbrown wrote: post #73

What do you about all of those chinese hackers hitting your sshd server. I have 30 different ips and fail2ban doesn't seem to ban them.

Just curious. Have you enabled password logins on your servers, or do they only allow RSA key-based logins?

Re: How I spend my first 5 minutes on a server

#97

Post by jiggy2011 » Mon, Mar 04, 2013, 6:07 AM UTC

The guide recommends blocking SSH access to anything other than your own IP address. The problem is that my IP number sometimes changes at which point I end up locked out totally.

So to get around this you either have to allow SSH from anywhere or you have to use some remote KVM system. Most of the remote KVM systems seem to be based on Java applets which is not really something you want to enable on your system.

So what is the best way to get around this? Just open up SSH and be diligent about your SSH security? implement port knocking?

Re: How I spend my first 5 minutes on a server

#98

Post by Axsuul » Mon, Mar 04, 2013, 6:09 AM UTC

wvenable wrote: post #78

shizcakes wrote: post #48

The premise of this thing is not good advice. 1) Your first couple minutes on a server should be used to install a configuration management client, if your bootstrap policies somehow don't already install one. 2) Everything else listed in this document should be configured by a configuration management system. 3) "User account sync tools" should have no place in a modern infrastructure, you should use your configurat…

Is there a free and recommended configuration management system that does all this?

Highly recommend Chef due to its Ruby DSL.

Re: How I spend my first 5 minutes on a server

#99

Post by manish_gill » Mon, Mar 04, 2013, 6:10 AM UTC

dbarlett wrote: post #69

nhebb wrote: post #63

Looking through the responses here, I'm hopeful that someone will launch a "Sysacademy" variant for system administration training. There are tutorials scattered around the web, but (at least for those of us who don't know where to look), there doesn't seem to be one place that puts in under one umbrella.

I have high hopes for Ops School ( https://ops-school.readthedocs.org/en/latest/ ).

Looks really awesome. Thanks! :)

Re: How I spend my first 5 minutes on a server

#100

Post by plusbryan » Mon, Mar 04, 2013, 6:13 AM UTC

jiggy2011 wrote: post #97

The guide recommends blocking SSH access to anything other than your own IP address. The problem is that my IP number sometimes changes at which point I end up locked out totally. So to get around this you either have to allow SSH from anywhere or you have to use some remote KVM system. Most of the remote KVM systems seem to be based on Java applets which is not really something you want to enable on your system. So…

This may not work for you, but I have a similar situation when I'm at home or I'm travelling. To solve it I set up a VPN at the office (we use Meraki hardware, so it was literally just a click) and connect to this first - then connect to the server.