Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I spend my first 5 minutes on a server

plusbryan.com

Post reply on HN
Print view View original

191–200 of 355 posts

Re: How I spend my first 5 minutes on a server

#191

Post by kelnos »

ams6110 wrote: post #13
zrail wrote: post #3

The first five minutes on any of my servers involve giving it a name, installing puppet and adding the server name to my central puppet config. You seriously do this by hand for every server? That seems error prone and a huge waste of time when tools like puppet and chef exist.

Puppet and Chef are yet another thing to learn and maintain, if the guy is a part-time admin with a lot of other responsibilities and a small number of servers it may not be worth it.

I think being a part-time admin with other responsibilities is a perfect reason to learn something like Chef or Puppet. It'll end up saving you a lot of time that you can devote to other things.

Re: How I spend my first 5 minutes on a server

#192

Post by raverbashing »

kelnos wrote: post #187
raverbashing wrote: post #164

Earlier quoted context omitted.

Ok, great, that's the spirit You can put all his recommendations in a shell script (as the easiest solution) then run it (and if you ever did this more than ONE time you see the value in it)

The problem is that most of the recommendations are bad. Having an up-to-date system and only accepting security updates is a good policy. Fail2ban is a good tool (but it's a starting point; you should be doing other things to detect suspicious behavior). The rest is just bad advice. Having everyone log in using a single user account is a terrible idea. You can't audit who did what, ever. You have to remember to remo…

You are assuming that they have several developers. I bet it's one or two

If you're dealing with more, let's say, 5, your suggestions became relevant

Also you are assuming this servers are staying with the company, which may not be the case

"User account management is a pain, so that's why we have things like LDAP"

Which is a bag of hurt in itself.

Re: How I spend my first 5 minutes on a server

#193

Post by kelnos »

dave1010uk wrote: post #136

Couple of related questions: 1) Many people seem to be recommending Puppet / Chef. How many servers or installs do you need before this is a good ROI? (Over using odd bash scripts or cPanel/WHM) 2) Am I right in thinking kernel updates don't get applied until the server is rebooted? If so, how / when do you manage this?

I think it's more about future planning. If you only have a few hosts now, but know that in the future you'll have many, then you're just going to have to rewrite all your bash scripts anyway. Might as well do them "right" from the start. Learning Chef isn't that hard, and it won't take you that much longer for the first host.

Re: How I spend my first 5 minutes on a server

#194

Post by Wilya »

kelnos wrote: post #187
raverbashing wrote: post #164

Earlier quoted context omitted.

Ok, great, that's the spirit You can put all his recommendations in a shell script (as the easiest solution) then run it (and if you ever did this more than ONE time you see the value in it)

The problem is that most of the recommendations are bad. Having an up-to-date system and only accepting security updates is a good policy. Fail2ban is a good tool (but it's a starting point; you should be doing other things to detect suspicious behavior). The rest is just bad advice. Having everyone log in using a single user account is a terrible idea. You can't audit who did what, ever. You have to remember to remo…

I agree on a lot of things, except LDAP. Of course, it sounds like the ideal way, but in practice, there's a matter of scale to take into account.

Frankly, you need a lot of developers and servers before investing the time to setup a ldap deployment, integrating it with logins, and spending the inevitable hours debugging why nobody can access anything anymore, becomes more worth it than "just rsync/pssh into all servers and edit /etc/passwd".

Actually, if I had to do it, I'd use chef to automate creation (and destruction) of user accounts over an LDAP any day. Chef can be a pain to learn and use, but any sort of LDAP is even worse.

Re: How I spend my first 5 minutes on a server

#195

Post by kelnos »

raverbashing wrote: post #192
kelnos wrote: post #187

Earlier quoted context omitted.

The problem is that most of the recommendations are bad. Having an up-to-date system and only accepting security updates is a good policy. Fail2ban is a good tool (but it's a starting point; you should be doing other things to detect suspicious behavior). The rest is just bad advice. Having everyone log in using a single user account is a terrible idea. You can't audit who did what, ever. You have to remember to remo…

You are assuming that they have several developers. I bet it's one or two If you're dealing with more, let's say, 5, your suggestions became relevant Also you are assuming this servers are staying with the company, which may not be the case "User account management is a pain, so that's why we have things like LDAP" Which is a bag of hurt in itself.

You are assuming that they have several developers. I bet it's one or two

The article presents this as general advice and doesn't make any mention of a team size that's appropriate for the recommendations. Maybe this guy has only 1 or 2 developers working on boxes, but IMO for any number of people >1 you don't want shared accounts.

Also you are assuming this servers are staying with the company, which may not be the case

In many cases they will be, and, again, the article presents this as general advice. If a server is being configured for a client and sent out, then a general process of setting up local user accounts probably doesn't make sense anyway (unless you only have one client).

Agreed that LDAP isn't the most friendly of things to set up, but there are how-tos for common use-cases, and if you have any skill as a sysadmin, you can do it. As soon as it's set up, it's simple to maintain. Manually keeping accounts in sync across multiple machines is rarely simple. Maybe LDAP is overkill for a handful of hosts and user accounts, but if you expect to grow even a little, expect to need some kind of centralized user account system.

Re: How I spend my first 5 minutes on a server

#196

Post by nimrody »

gingerlime wrote: post #123
zargon wrote: post #109

Earlier quoted context omitted.

Deployment tools like fabric are imperative, and configuration management tools are declarative. With configuration management, you define the final state you want the server to be in, and it will do whatever is needed to get it into that state. Some or all of the parts might already be done, and it won't change the parts that are already correct (the declarative configuration is idempotent). Deployment tools just ex…

Thanks for the clarification. I think I get the theory a bit better now. I'm still struggling with seeing some practical examples of those differences. for example, `apt-get` is pretty much idempotent already, no? if I run `apt-get install -y ` x 1000 times in a loop it won't install it 1000 times... Fabric does give you the building blocks for those kind of checks elsewhere, such as `exists`, `contains`, `append` (w…

Regarding apt-get -- You're right.

If you use a single distribution and can get all your stuff packaged using the distribution's packaging system, you're OK.

It can be more difficult when you get to system configuration (editing files), but you can do it manually like you do with fabric if you're careful.

Re: How I spend my first 5 minutes on a server

#197

Post by kelnos »

Wilya wrote: post #194
kelnos wrote: post #187

Earlier quoted context omitted.

The problem is that most of the recommendations are bad. Having an up-to-date system and only accepting security updates is a good policy. Fail2ban is a good tool (but it's a starting point; you should be doing other things to detect suspicious behavior). The rest is just bad advice. Having everyone log in using a single user account is a terrible idea. You can't audit who did what, ever. You have to remember to remo…

I agree on a lot of things, except LDAP. Of course, it sounds like the ideal way, but in practice, there's a matter of scale to take into account. Frankly, you need a lot of developers and servers before investing the time to setup a ldap deployment, integrating it with logins, and spending the inevitable hours debugging why nobody can access anything anymore, becomes more worth it than "just rsync/pssh into all serv…

I would probably stand up an LDAP server after I had 4 or 5 user accounts to deal with, or, more importantly, more than, say, 3 servers to deal with.

I think there's a lot of fear and hate surrounding LDAP, but that's mostly for historical reasons. LDAP has gotten a lot easier to set up. Even in 2009 a colleague and I set one up (using openldap) and had other machines authenticating off of it in an afternoon. It's gotten even easier than that since then.

And hell, you should be using Chef to set up your LDAP master and slave. So once you have the config correct once, you can bring up another machine without trouble when needed.

Re: How I spend my first 5 minutes on a server

#198

Post by lorenzfx »

raverbashing wrote: post #155
shizcakes wrote: post #48

The premise of this thing is not good advice. 1) Your first couple minutes on a server should be used to install a configuration management client, if your bootstrap policies somehow don't already install one. 2) Everything else listed in this document should be configured by a configuration management system. 3) "User account sync tools" should have no place in a modern infrastructure, you should use your configurat…

You are right, this is a better path But sometimes, and especially for servers that will be delivered to the customer afterwards, it's not practical to use a configuration management tool. Also, millions of servers were deployed before Chef/Puppet appeared. You can't tell they did wrong. Also, Chef/Puppet type solutions may be overkill for some tasks, fabric takes care of the easier cases for example.

I guess it all depends on how often you bootstrap a new server. If you do it infrequently, keeping a configuration management tool updated is probably more work. I do it perhaps every two years and keep a similar list (I try to keep up to date if I change something in the server configuration) for that purpose.

Re: How I spend my first 5 minutes on a server

#199

Post by daemon13 »

matwizzle wrote: post #182

I'd propose using OSSEC over logwatch & fail2ban. Ossec seems to be a bit of an obscure tool, but a thoroughly functional one at that. Logwatch gives a bit too much info at once to interpret properly, while OSSEC will only alert you when something is actually up. Ossec provides (among some other things): * Log file monitoring, with severity levels, occurence counting, time-based rules and auto-response. This means (f…

I have heard good words about OSSEC but never tried it because of it's perception being:

- heavyweight;

- not actively developed.

Are my perceptions right? If no, how would you recommend to start using it? Any good tutorials or other pointers?

Re: How I spend my first 5 minutes on a server

#200

Post by daemon13 »

ashray wrote: post #82
berlinbrown wrote: post #73

What do you about all of those chinese hackers hitting your sshd server. I have 30 different ips and fail2ban doesn't seem to ban them.

Try csf. Works like a charm for me.

Did you use it in production?

Any pointers how to start? Good tutorials or walkthroughs?

Post reply on HN