Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I spend my first 5 minutes on a server

plusbryan.com

Post reply on HN
Print view View original

141–150 of 355 posts

Re: How I spend my first 5 minutes on a server

#141

Post by drivebyacct2 »

tomp wrote: post #134
belorn wrote: post #133

It saddens me each time I see a security best practice guide that suggest turning off ssh access for root. Its a very useful feature, and the security industry should focus on the security problems rather than removing features without thinking about the actually benefits of doing so. Sysadmins with root access should be able to handle a random 8 character or longer password, and that number is large enough for a sec…

> Logs wears on the hard drive, so one might want to install fail2ban to lower the number of writes to it. Or change the ssh port.

Another "security through obscurity" pointless trick. If I'm attacking your server and it's not running SSH on port 22, it's a very short matter of time until I've found it anyway.

Re: How I spend my first 5 minutes on a server

#142

Post by stevekemp »

gingerlime wrote: post #123
zargon wrote: post #109

Earlier quoted context omitted.

Deployment tools like fabric are imperative, and configuration management tools are declarative. With configuration management, you define the final state you want the server to be in, and it will do whatever is needed to get it into that state. Some or all of the parts might already be done, and it won't change the parts that are already correct (the declarative configuration is idempotent). Deployment tools just ex…

Thanks for the clarification. I think I get the theory a bit better now. I'm still struggling with seeing some practical examples of those differences. for example, `apt-get` is pretty much idempotent already, no? if I run `apt-get install -y ` x 1000 times in a loop it won't install it 1000 times... Fabric does give you the building blocks for those kind of checks elsewhere, such as `exists`, `contains`, `append` (w…

When you install the package you do it as a on-off. When a configuration system does it then it will keep re-happening if anything changes.

Say you install "less", and I remove it. With Chef this will be fixed the next run - with fabric? You'll need to re-run your magic script.

That's the main difference. Automation like Chef/CFEngine/Slaughter will keep fixing breakages - as defined by differences in state from their rules - whereas you'll be playing a game of catchup.

Re: How I spend my first 5 minutes on a server

#143

Post by tomp »

drivebyacct2 wrote: post #141
tomp wrote: post #134

Earlier quoted context omitted.

> Logs wears on the hard drive, so one might want to install fail2ban to lower the number of writes to it. Or change the ssh port.

Another "security through obscurity" pointless trick. If I'm attacking your server and it's not running SSH on port 22, it's a very short matter of time until I've found it anyway.

Sure. It's only meant to stop automated script-kiddie attacks that target all open SSH servers on the internet. Less logs, less disk usage, ...

Re: How I spend my first 5 minutes on a server

#145

Post by drivebyacct2 »

tomp wrote: post #143
drivebyacct2 wrote: post #141

Earlier quoted context omitted.

Another "security through obscurity" pointless trick. If I'm attacking your server and it's not running SSH on port 22, it's a very short matter of time until I've found it anyway.

Sure. It's only meant to stop automated script-kiddie attacks that target all open SSH servers on the internet. Less logs, less disk usage, ...

Wouldn't the script-kiddie through those hosts into a queue to run a more advanced port scan on? I mean, I see your point, but it seems highly useless compared to, say, simply disabling the password based authentication.

Re: How I spend my first 5 minutes on a server

#147

Post by stevekemp »

plainOldText wrote: post #118

The first two things I prefer to do after I log in for the first time (on ubuntu): > ufw enable > ufw default deny This way, after I log in, I will not allow anyone else to connect to my machine (I've had instances when by the time I changed my root password "bad guys" had already tried to connect to my machine). Of course after I do the server setup (which is usually a script that will change ssh ports, install pack…

Once upon a time somebody wanted to give me access to a new system - they ran "adduser steve", and set the password to be "steve".

Two hours later, when I read the mail, that account had already been compromised. I knew it was a risk, but had no idea that it would happen so __quickly__.

Re: How I spend my first 5 minutes on a server

#148

Post by derefr »

nlew wrote: post #127
gingerlime wrote: post #123

Earlier quoted context omitted.

Thanks for the clarification. I think I get the theory a bit better now. I'm still struggling with seeing some practical examples of those differences. for example, `apt-get` is pretty much idempotent already, no? if I run `apt-get install -y ` x 1000 times in a loop it won't install it 1000 times... Fabric does give you the building blocks for those kind of checks elsewhere, such as `exists`, `contains`, `append` (w…

If you're only doing one or two things, the value is a bit more vague. But consider even the simplest interaction: the config file for a service should look like X, and if it has to be changed, the service needs to be restarted afterward. Oh and there are 10 config files, but you only want to restart the service once if any of them changes, after they've all been changed. That's not hard , but it's already starting t…

When you want to make a configuration change to your servers, and they aren't already in a "known state", why would you think any tool could put them into a known state? When a computer has a virus, say, you don't think it's been put into a "known state" after the anti-virus program gets done with it; the virus may have done any number of things you might be unaware of, altered any number of data or configuration files in subtle ways that the tool doesn't look for, but implicitly relies upon.

Example: what if, say, one of the provisioning requirements is "make sure this gem is installed", but on one of the servers /etc/gemrc has "install: --no-rdoc --no-ri" in it? Now on one server, the docs are missing, while everywhere else they're available. That sort of thing.

If you're already running on an IaaS like EC2, I think there's a simpler, better way: rather than trying to get "unknown state" to "known state", why not use the simplest known state of all--unprovisioned? Write an imperative script that reinitializes a freshly-provisioned IaaS node to your known state, and then do a rolling reprovision, terminating old nodes and provisioning new ones.

An equivalent comparison[1]: would you feel safe running an automated script that would SSH into a production machine and "git pull" a checked-out repo sitting on it, from whatever state it happens to be sitting at, up to refs/heads/master, so as to deploy code from it? Could you guarantee that that repo hadn't been moved to some state where refs/heads/master isn't a fast-forward commit? Or would you rather do a fresh "git clone"?

---

[1] A contrived comparison, though; although the former option is unreliable, the latter is terribly inefficient, and they're both horrible for keeping a .git directory inside of a directory that might very well be web-accessible.

Re: How I spend my first 5 minutes on a server

#149

Post by lmm »

drivebyacct2 wrote: post #145
tomp wrote: post #143

Earlier quoted context omitted.

Sure. It's only meant to stop automated script-kiddie attacks that target all open SSH servers on the internet. Less logs, less disk usage, ...

Wouldn't the script-kiddie through those hosts into a queue to run a more advanced port scan on? I mean, I see your point, but it seems highly useless compared to, say, simply disabling the password based authentication.

Why would they bother? Script-kiddie is just playing the numbers, any machine with a slightly non-default configuration is not worth the effort.

Disabling password authentication is better for "real" security, but doesn't stop those dictionary attacks spamming your logfile. (I still feel there should be better solutions to that problem than changing the port though)

Post reply on HN