Ask YC: Securing your servers? • Hacker News Board

Re: Ask YC: Securing your servers?

#21

Post by edu » Mon, Mar 24, 2008, 12:06 PM UTC

gcv wrote: post #6

I'm not the best person at this, but I do the following on any machine I deal with which does not sit behind a firewall: 1. Disable root logins via ssh (as noted above by bbb). 2. Move ssh port from port 22 to something nonstandard. According to my logs, the number of idiots who try brute-force attacks on my machines dropped from 4/day to 0. 3. Put an iptables script into /etc/init.d and make sure it runs on startup…

This is great advice. I will simply add one more thing (and two bonuses):

4. Disable password authentication for SSH and use a public/private key. Of course, use a good password on the private key.

5. (bonus) keep the installed software to the bare minimum. Less software, less bugs.

6. (extra bonus) look apache's mod_security, it's an application level firewall (filters requests to the application, so, for example, you can filter SQL injections or invalid characters before they reach your app).

Re: Ask YC: Securing your servers?

#22

Post by nweiner » Mon, Mar 24, 2008, 12:57 PM UTC

Keep your software all up to date. For an example, I've seen an old version of a open source calendar be used to send 30,000 spam emails from a server.

Software like Fanstasico can keep your software automatically updated across user accounts.

Re: Ask YC: Securing your servers?

#23

Post by thorax » Mon, Mar 24, 2008, 1:07 PM UTC

Anyone use things like AppArmor? I see it routinely preventing attacks on some of the older software we run. I almost wouldn't think of running a server without something like it.

Re: Ask YC: Securing your servers?

#24

Post by berryg » Mon, Mar 24, 2008, 1:24 PM UTC

Just installed Denyhosts. It immediately blocked 6 ip addresses. Seems to be working just fine. Nice tool.

Re: Ask YC: Securing your servers?

#25

Post by rcoder » Mon, Mar 24, 2008, 11:48 PM UTC

There have been a number of good app-specific recommendations below, but I think there are some more general things to keep in mind, too:

#1: Keep your system up-to-date. Your most likely entry vector is a perfectly legitimate service like Apache or OpenSSH (or even worse, some PHP application) being cracked 'cause you never installed a critical security patch.

#2: Run different services as different users. There's no reason for your Mongrel listeners, cron jobs, reverse proxy, and god knows what else to run as the same user. Basic uid/gid partitioning is at the core of good POSIX security.

#3: Never, ever trust a public web application or server with total access to your data. Use your database server's access controls to limit admin-level access, and consider running your load balancer, public applications, and admin tools on separate hosts.

#4: Find ways to prevent password storage, entry, and checking on your application servers. Read up on and understand Kerberos, even if you aren't going to use it: it's the industry standard for an authentication system that doesn't require clients to expose their password to servers.