Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I spend my first 5 minutes on a server

plusbryan.com

Post reply on HN
Print view View original

111–120 of 355 posts

Re: How I spend my first 5 minutes on a server

#111

Post by waverider »

joelesalas wrote: post #85
mef wrote: post #71

Earlier quoted context omitted.

For #4, wouldn't the only change when someone leaves the organization be to remove their key from authorized_keys for the shared account? Why would anyone else have to be updated?

It's a basic principle of security. Each account represents one person so that you have a full audit of who did what by watching the activity of a given user account. If everything is run as "devops" user for example, you have no idea who actually performed a given task. Was it Bill, or was it an automated job? PCI-DSS requirements also affect your model for user accounts (hint: shared users are often not compliant).…

It's a good idea to use fail2ban even if you use VPN.

Re: How I spend my first 5 minutes on a server

#112

Post by grey-area »

ams6110 wrote: post #13
zrail wrote: post #3

The first five minutes on any of my servers involve giving it a name, installing puppet and adding the server name to my central puppet config. You seriously do this by hand for every server? That seems error prone and a huge waste of time when tools like puppet and chef exist.

Puppet and Chef are yet another thing to learn and maintain, if the guy is a part-time admin with a lot of other responsibilities and a small number of servers it may not be worth it.

Puppet and Chef are yet another thing to learn and maintain, if the guy is a part-time admin with a lot of other responsibilities and a small number of servers it may not be worth it.

Speaking from experience as a part time admin, it is definitely worth it to automate the process, even with one or two servers. Any build system will repay in spades the first time you have to set up a new server or rebuild an old one, esp. if you're in a hurry after a server failure.

That said Linode offers other easier options (Linode specific of course). You can take the commands usually executed, and put them in a shell script in the language of your choice which is uploaded and executed on first run (they call this StackScripts - there are lots of examples and helper scripts on their site, but the scripts are really very basic). It's perhaps easier than learning a DSL as it's just codifying the same commands you would run via ssh by hand. You can also clone nodes so you could set one up in a known good state and clone that each time.

This does tie you to linode, so long term one of the other options available would be worth looking in to.

Re: How I spend my first 5 minutes on a server

#113

Post by grey-area »

wvenable wrote: post #78
shizcakes wrote: post #48

The premise of this thing is not good advice. 1) Your first couple minutes on a server should be used to install a configuration management client, if your bootstrap policies somehow don't already install one. 2) Everything else listed in this document should be configured by a configuration management system. 3) "User account sync tools" should have no place in a modern infrastructure, you should use your configurat…

Is there a free and recommended configuration management system that does all this?

On linode, which he is using, there is one built in - they allow shell scripts to run on first boot which could replay his commands as they are without many changes:

http://www.linode.com/stackscripts/

Re: How I spend my first 5 minutes on a server

#114

Post by kristofferR »

falcolas wrote: post #56
kristofferR wrote: post #50

Earlier quoted context omitted.

Sure, it'll not stop dedicated manual intrusion attempts, but it will actually prevent a ton of automated bots from even just trying to connect with common passwords through SSH.

Worth looking at: http://bsdly.blogspot.com/2013/02/theres-no-protection-in-hi...

2222 is a dumb choice as an alternative port, it's both obvious and quite commonly used. I'm using a port on 4XXXX-range that's normally not used for anything and therefore not scanned by the bots unless all the 65536 ports are. The automated login attempts disappeared almost immediately, except for a few that were quickly blocked.

Now the logs are clean from automated login bots, the only thing left are real dedicated hacking attempts that is worth pursuing further.

Re: How I spend my first 5 minutes on a server

#117

Post by berlinbrown »

luser001 wrote: post #96
berlinbrown wrote: post #73

What do you about all of those chinese hackers hitting your sshd server. I have 30 different ips and fail2ban doesn't seem to ban them.

Just curious. Have you enabled password logins on your servers, or do they only allow RSA key-based logins?

I am new to this. I don't allow ssh logins password based.

The hackers fail according to sshd but logwatch lists a list of chinese and russian attempts.

I was hoping my firewall would block them. I tried entering a block of ips but some of the same ones are connecting.

I don't know what this means:

Illegal users from: undef: 20 times 183.60.177.246: 7 times 217.14.134.68: 7 times 219.149.30.170: 6 times

Re: How I spend my first 5 minutes on a server

#118

Post by plainOldText »

The first two things I prefer to do after I log in for the first time (on ubuntu):

  > ufw enable
  > ufw default deny
This way, after I log in, I will not allow anyone else to connect to my machine (I've had instances when by the time I changed my root password "bad guys" had already tried to connect to my machine).

Of course after I do the server setup (which is usually a script that will change ssh ports, install packages, etc) I will allow other services in ufw.

Re: How I spend my first 5 minutes on a server

#120

Post by cmpitg »

itry wrote: post #116

Is there a benefit of using ufw instead of iptables?

It's easier to get started with UFW, and you don't need to learn much about networking to be able to setup your firewall. I haven't checked this out (I prefer iptables and never actually UFW), but it's said UFW is a front-end to configure iptables.
Post reply on HN