How I spend my first 5 minutes on a server • Hacker News Board

Re: How I spend my first 5 minutes on a server

#101

Post by gingerlime » Mon, Mar 04, 2013, 6:16 AM UTC

dbarlett wrote: post #51

ams6110 wrote: post #13

Earlier quoted context omitted.

Puppet and Chef are yet another thing to learn and maintain, if the guy is a part-time admin with a lot of other responsibilities and a small number of servers it may not be worth it.

I was in the same position - too many distinct environments for bash/Fabric, too little time to learn Chef/Puppet/CFEngine. Ansible [1] seems like a good compromise: you get the simplicity (runs over SSH) and host targeting of Fabric with the declarative nature and idempotency of the more complex tools. You can start with all-in-one "playbooks" [2], then split out tasks, handlers, Jinja2 templates, files, and variabl…

I'm using fabric quite frequently, and am trying to understand what makes a configuration management tools a much better choice. I'm currently using fabric for anything from bootstrap a new environment from scratch, via restoring a snapshot from backups, to pushing code updates stored on git. Perhaps I'm being really daft, but it always evades me why something as simple as

    sudo("apt-get install -y ")

needs to be replaced with

    - name: Install prerequisites for PPA management
      apt: pkg=$item state=present update_cache=yes
      with_items:
      - python-software-properties
      - software-properties-common

I do use a pretty homogeneous environment, which makes things simpler, but this is a deliberate choice to avoid complexity. If I know all my hosts are e.g. debian 6, then what makes ansible/chef/puppet so much better than fabric?

I'm not trying to be provocative or negative. I'm really trying to understand the supposedly big difference between what's labelled a deployment tool, and configuration management tools.

Re: How I spend my first 5 minutes on a server

#102

Post by leetrout » Mon, Mar 04, 2013, 6:19 AM UTC

luser001 wrote: post #94

andrewvc wrote: post #47

Earlier quoted context omitted.

FWIW I never understood UFW over straight IP tables, is it really easier to read?

IMHO, yes. At least on Ubuntu, it's never been too clear to me how I should save my rules so that they come back on startup. The ufw man page is pretty decent.

I've not tried anything complex with UFW so I still use iptables on my bastion host that handles my vpn tap. It's not terribly complex to make rules come back on startup (but probably more involved than one would hope).

For anyone else that followed the thread to this point- this advice on bringing iptables back up on reboot worked for me http://rackerhacker.com/2009/11/16/automatically-loading-ipt... YMMV

Re: How I spend my first 5 minutes on a server

#103

Post by jiggy2011 » Mon, Mar 04, 2013, 6:22 AM UTC

plusbryan wrote: post #100

jiggy2011 wrote: post #97

The guide recommends blocking SSH access to anything other than your own IP address. The problem is that my IP number sometimes changes at which point I end up locked out totally. So to get around this you either have to allow SSH from anywhere or you have to use some remote KVM system. Most of the remote KVM systems seem to be based on Java applets which is not really something you want to enable on your system. So…

This may not work for you, but I have a similar situation when I'm at home or I'm travelling. To solve it I set up a VPN at the office (we use Meraki hardware, so it was literally just a click) and connect to this first - then connect to the server.

I did consider that approach, but the closest thing I have to an office is my home (with a dynamic IP) anyway!

I thought of setting up a VPN on a server, but all that would really do is move the problem from securing SSH to securing VPN.

Re: How I spend my first 5 minutes on a server

#104

Post by ck2 » Mon, Mar 04, 2013, 6:30 AM UTC

bcl wrote: post #58

Don't forget: netstat -ntap | less ps aux | less Also check to see what's enabled to run at boot time via whatever your flavor uses. Check for unusual daemons, ssh running on other ports (yes, the provider pre-loaded systems with a back-door ssh without disclosing it to us). This is especially important when you are taking over admin on a server you didn't setup yourself. Other folks have weird ideas on how to admin…

to see what's enabled to run at boot time

what's good beyond this:

  chkconfig
  cat /etc/rc.local

Re: How I spend my first 5 minutes on a server

#105

Post by vacri » Mon, Mar 04, 2013, 6:32 AM UTC

dbarlett wrote: post #51

ams6110 wrote: post #13

Earlier quoted context omitted.

Puppet and Chef are yet another thing to learn and maintain, if the guy is a part-time admin with a lot of other responsibilities and a small number of servers it may not be worth it.

I was in the same position - too many distinct environments for bash/Fabric, too little time to learn Chef/Puppet/CFEngine. Ansible [1] seems like a good compromise: you get the simplicity (runs over SSH) and host targeting of Fabric with the declarative nature and idempotency of the more complex tools. You can start with all-in-one "playbooks" [2], then split out tasks, handlers, Jinja2 templates, files, and variabl…

Eh, I didn't like Ansible. Every command is done over SSH, so you don't need an agent/ssh to box and run locally, but... scripts would take much longer to execute than in puppet.

We're currently using local runs of puppet, and it's easy to do dry-runs and see what fails before applying when testing. I'm not sure how Ansible gives feedback on that (I assume it must) but I find puppet pretty good about it.

Re: How I spend my first 5 minutes on a server

#106

Post by vacri » Mon, Mar 04, 2013, 6:37 AM UTC

gingerlime wrote: post #101

dbarlett wrote: post #51

Earlier quoted context omitted.

I was in the same position - too many distinct environments for bash/Fabric, too little time to learn Chef/Puppet/CFEngine. Ansible [1] seems like a good compromise: you get the simplicity (runs over SSH) and host targeting of Fabric with the declarative nature and idempotency of the more complex tools. You can start with all-in-one "playbooks" [2], then split out tasks, handlers, Jinja2 templates, files, and variabl…

I'm using fabric quite frequently, and am trying to understand what makes a configuration management tools a much better choice. I'm currently using fabric for anything from bootstrap a new environment from scratch, via restoring a snapshot from backups, to pushing code updates stored on git. Perhaps I'm being really daft, but it always evades me why something as simple as sudo("apt-get install -y ") needs to be repl…

that same line in puppet is "package { 'packagename': ensure => installed }". Or you can use 'latest' to keep it updated.

multiple packages can be done this way if you have a lot:

$prep_packages = ['package1', 'package2', 'blahblah']

package { $prep_packages: ensure => installed }

You can of course use extra arguments if you need them.

Re: How I spend my first 5 minutes on a server

#107

Post by vacri » Mon, Mar 04, 2013, 6:41 AM UTC

kbuck wrote: post #95

Why install fail2ban? You already have SSH password auth disabled, and you only allow SSH connections from your office. Won't this just risk banning your own office if someone's SSH client is misconfigured?

fail2ban is useful for things other than SSH - I've seen it deal handily with people probing our asterisk server.

Re: How I spend my first 5 minutes on a server

#108

Post by [deleted] » Mon, Mar 04, 2013, 6:42 AM UTC

luser001 wrote: post #90

joelesalas wrote: post #85

Earlier quoted context omitted.

It's a basic principle of security. Each account represents one person so that you have a full audit of who did what by watching the activity of a given user account. If everything is run as "devops" user for example, you have no idea who actually performed a given task. Was it Bill, or was it an automated job? PCI-DSS requirements also affect your model for user accounts (hint: shared users are often not compliant).…

Why do you say a VPN server is more secure? Which one? I, for one, trust ssh more than any other software wrt security, especially with password login disabled. Disclaimer: I am not a security expert.

[deleted]

Re: How I spend my first 5 minutes on a server

#109

Post by zargon » Mon, Mar 04, 2013, 6:42 AM UTC

gingerlime wrote: post #101

dbarlett wrote: post #51

Earlier quoted context omitted.

I was in the same position - too many distinct environments for bash/Fabric, too little time to learn Chef/Puppet/CFEngine. Ansible [1] seems like a good compromise: you get the simplicity (runs over SSH) and host targeting of Fabric with the declarative nature and idempotency of the more complex tools. You can start with all-in-one "playbooks" [2], then split out tasks, handlers, Jinja2 templates, files, and variabl…

I'm using fabric quite frequently, and am trying to understand what makes a configuration management tools a much better choice. I'm currently using fabric for anything from bootstrap a new environment from scratch, via restoring a snapshot from backups, to pushing code updates stored on git. Perhaps I'm being really daft, but it always evades me why something as simple as sudo("apt-get install -y ") needs to be repl…

Deployment tools like fabric are imperative, and configuration management tools are declarative. With configuration management, you define the final state you want the server to be in, and it will do whatever is needed to get it into that state. Some or all of the parts might already be done, and it won't change the parts that are already correct (the declarative configuration is idempotent).

Deployment tools just execute whatever script you hand them, and so the scripts are either more brittle (server must be in a precise state beforehand or it doesn't work right), or require more effort to duplicate the work that the configuration management software does to only make the needed changes.

If your deployment scripts get complex, it's more difficult to see at a glance what the end configuration is supposed to be.

Re: How I spend my first 5 minutes on a server

#110

Post by waverider » Mon, Mar 04, 2013, 6:49 AM UTC

1. I don't think it's a good idea to use the same account by multiple people.

2. And you're not using a configuration management tool (like SaltStack, which is also a remote execution engine) this will give you: - a central point to manage all your server - predictable configuration on all servers with the same role - a configuration documentation place (and even history if you git the confs) - will make managing multiple users a breeze

3. Use VPN and private services on private IP.