Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I spend my first 5 minutes on a server

plusbryan.com

Post reply on HN
Print view View original

341–350 of 355 posts

Re: How I spend my first 5 minutes on a server

#341

Post by Moocar »

robomartin wrote: post #280

I went through the article and then read every single post on this thread. I am not a security expert so I won't even try to contribute except to say that I see a lot of people offering criticism without taking the extra step of explaining how they would go about hardening a fresh Linux install (or a pile-o-servers in a rack, whatever is applicable). It'd sure be nice for those of us who are not security experts to r…

I've been using a product called scriptrock (http://scriptrock.com) recently that collects these kinds of best practices and ensures that they actually exist on nodes. I.e, the testing of configuration rather than the execution. I think this is really interesting for two reasons. 1, it's like monitoring for security on my nodes (it runs by default every 5 minutes), and 2, they could build some kind of open repo for people to contribute these best practices (I think they were asking for beta users a while back). Plus it allows me to configure my infrastructure in a kind of TDD way.

Re: How I spend my first 5 minutes on a server

#342

Post by calgaryeng »

berlinbrown wrote: post #72

It may seem like a waste of $20 a month if you aren't doing anything big with it. But you can setup a linux virtual server on linode and go through all of those steps on your own. Also test out your setup. http://library.linode.com/

Or rock Vagrant. The ability to quickly setup & tear down makes for some quick experimentation.

Re: How I spend my first 5 minutes on a server

#343

Post by muster »

robomartin wrote: post #280

I went through the article and then read every single post on this thread. I am not a security expert so I won't even try to contribute except to say that I see a lot of people offering criticism without taking the extra step of explaining how they would go about hardening a fresh Linux install (or a pile-o-servers in a rack, whatever is applicable). It'd sure be nice for those of us who are not security experts to r…

Shocking that no one has mentioned the grsecurity project.

Re: How I spend my first 5 minutes on a server

#344

Post by hakaaaaak »

robomartin wrote: post #280

I went through the article and then read every single post on this thread. I am not a security expert so I won't even try to contribute except to say that I see a lot of people offering criticism without taking the extra step of explaining how they would go about hardening a fresh Linux install (or a pile-o-servers in a rack, whatever is applicable). It'd sure be nice for those of us who are not security experts to r…

The problem I had with the article was that it said what user accounts he set up, how their security was based, etc. Why!? Don't give away that info in a blog post! Even if it is something a hacker could easily find out if they wanted, by doing that, you paint a target on your back.

If you are walking past a dark alley in a big city, you don't say, "I am a blue-belt in karate, and I have a wallet with $300 in it." They have a gun, and they'll take that wallet, thank you.

I totally appreciate you putting all those links together, but I would hope that others remember that loose lips sink ships when it comes to security. And from a hacker's perspective, what's the fun in social engineering if someone just blabs it all in a post?

Re: How I spend my first 5 minutes on a server

#346

Post by belorn »

robomartin wrote: post #331
belorn wrote: post #326

Earlier quoted context omitted.

You are right, and I have some blame here of not including positive criticism in my comments. I do not have a script to offer, but I can go through the process I work by. #1: A good password is a must. During installation, have a second computer generate a good password and either memorize it, or GPG encrypt it somewhere on the second computer. pwgen is decent in generating passwords. 2#, I fully agree with the artic…

> have a second computer generate a good password Why a second computer?

The Ubuntu installer does not ship with pwgen, and its good to have the password done right, right there while installing.

Re: How I spend my first 5 minutes on a server

#347

Post by adamsaleh »

trotsky wrote: post #338
robomartin wrote: post #280

I went through the article and then read every single post on this thread. I am not a security expert so I won't even try to contribute except to say that I see a lot of people offering criticism without taking the extra step of explaining how they would go about hardening a fresh Linux install (or a pile-o-servers in a rack, whatever is applicable). It'd sure be nice for those of us who are not security experts to r…

The reason nobody shared their one true checklist for security is that it doesn't exist. Well secured systems get owned every day, and tons of bad ones never have trouble due to luck and lack of incentive. Most extensive security procedures contain a lot of questionable advice and few will prevent human error which most compromise can be traced back to. The only semi-universal list amounts to 1) use keys for ssh 2) b…

As far as one true checklists go, I really like NSA Guide to securing RHEL.

http://www.nsa.gov/ia/_files/os/redhat/NSA_RHEL_5_GUIDE_v4.2...

and TLDR version: http://www.nsa.gov/ia/_files/factsheets/rhel5-pamphlet-i731....

It is starting to get a little bit dated (RHEL 5 is quite old), but general rules still apply and usually they explain their reasoning.

Re: How I spend my first 5 minutes on a server

#348

Post by cschneid »

wvenable wrote: post #78
shizcakes wrote: post #48

The premise of this thing is not good advice. 1) Your first couple minutes on a server should be used to install a configuration management client, if your bootstrap policies somehow don't already install one. 2) Everything else listed in this document should be configured by a configuration management system. 3) "User account sync tools" should have no place in a modern infrastructure, you should use your configurat…

Is there a free and recommended configuration management system that does all this?

No, chef/puppet/etc are configuration management tools. They automate the manual typing of server setup commands, and then verify that the system stays that way.

They are not security tools. So you're on your own on what to actually tell the tools to do. "Install chef" is not a security tip. It's a repeatability tip, so you can get your system up to a known state repeatedly.

For the security side of things, you're back to figuring out what the right steps are, no matter how they're installed.

Re: How I spend my first 5 minutes on a server

#349

Post by robomartin »

hakaaaaak wrote: post #344
robomartin wrote: post #280

I went through the article and then read every single post on this thread. I am not a security expert so I won't even try to contribute except to say that I see a lot of people offering criticism without taking the extra step of explaining how they would go about hardening a fresh Linux install (or a pile-o-servers in a rack, whatever is applicable). It'd sure be nice for those of us who are not security experts to r…

The problem I had with the article was that it said what user accounts he set up, how their security was based, etc. Why!? Don't give away that info in a blog post! Even if it is something a hacker could easily find out if they wanted, by doing that, you paint a target on your back. If you are walking past a dark alley in a big city, you don't say, "I am a blue-belt in karate, and I have a wallet with $300 in it." Th…

If your system can't survive an attack because the attacker learned from a blog post that you are using tool X then perhaps tool X is the problem and not the blog post.

Real would-be intruders are not dummies. They have a suite of tests they can run to "x-ray" your system to the extent it is possible and discover vulnerabilities.

To some degree it's like encryption code. The safest code has to be open source.

Post reply on HN