How I spend my first 5 minutes on a server • Hacker News Board

Re: How I spend my first 5 minutes on a server

#261

Post by richardwhiuk » Mon, Mar 04, 2013, 4:01 PM UTC

beagle3 wrote: post #55

1. You should do "apt-get dist-upgrade" to get new kernel packages as well, otherwise you are stuck on an old kernel. (You might want that. I prefer updated kernel for the security, firefoxen, etc.). "apt-get upgrade" will only update existing packages - but the kernel updates require new packages to be installed. 2. If you're on ubuntu, root already has no password, and your initial setup user (whether it is called…

Indeed dist-upgrade should be used - it isn't just kernel updates either.

The server should also be rebooted. Applying kernel updates makes no good if you never apply them!

screen -x is equivalent to screen -xR afaict:)

I'd also add @reboot screen to crontab, which will recreate a session on startup - in my bashrc I have :

if [ "a$STY" == "a" ]; then screen -x fi

Other useful things include actually setting up backups (duplicity is a useful first step here), installing munin/nagios to monitor the new box.

Realistically if you are doing this more than once per blue moon, then you should be using something like puppet to do this automagically.

Re: How I spend my first 5 minutes on a server

#262

Post by Shorel » Mon, Mar 04, 2013, 4:05 PM UTC

jiggy2011 wrote: post #97

The guide recommends blocking SSH access to anything other than your own IP address. The problem is that my IP number sometimes changes at which point I end up locked out totally. So to get around this you either have to allow SSH from anywhere or you have to use some remote KVM system. Most of the remote KVM systems seem to be based on Java applets which is not really something you want to enable on your system. So…

I do this:

Set up a small AWS server to use as a Web proxy and SSH proxy.

Connect from you home with a remote forward port (for example 2222 to 22) additional to any other local forward ports. Put this tunnel in the startup scripts.

When you are away, connect to your AWS server, then connect locally to port 2222.

Now you've got SSH access to your home machine from anywhere.

Re: How I spend my first 5 minutes on a server

#263

Post by pindi » Mon, Mar 04, 2013, 4:21 PM UTC

beagle3 wrote: post #255

ceejayoz wrote: post #249

Earlier quoted context omitted.

Isn't the point of Chef/Puppet that you never do that, and if you do, they get reverted automatically?

It is the point that you "never do that". However, it's been my experience that e.g. when troubleshooting, people always make local modifications, and don't always remember to revert them / restore from configuration management. I have no experience with chef/puppet, so I might be mistaken, but I'm under the impression that they only push changes when asked to - which means a local change may survive for several week…

When run in client-server mode, Puppet will run every 30 minutes by default, overwriting local changes with the configuration on the server.

Re: How I spend my first 5 minutes on a server

#264

Post by npsimons » Mon, Mar 04, 2013, 4:21 PM UTC

passwd

Change the root password to something long and complex.

And bam! Not even a full paragraph in and security fail. root login should be disabled completely, and all use of privileges should be through sudo. Debian sets this up for you automatically upon install if you supply an empty root password. Of course, disabling root is just the beginning (and the first user created needs to be locked down, as they are now essentially root).

Re: How I spend my first 5 minutes on a server

#265

Post by shabble » Mon, Mar 04, 2013, 4:22 PM UTC

martinced wrote: post #219

I honestly do not understand why you need a deploy account with sudo access. I much prefer a deploy accound which DOES NOT have sudo access. I add firewall rules transparently redirecting 80/443 to non-privileged ports that the webapp is actually listening to. Hence no need to be root / sudo'ed for the deploy account. You then could get a bit fancier and set the login shell for the deploy account to /bin/false or som…

> I'd also say that during the first five minutes you should set the default firewalling rules to REJECT anything and then only whitelist what is actually allowed.

At which point your 'net connection blips and suddenly you wish you'd paid extra for console access.

Re: How I spend my first 5 minutes on a server

#266

Post by pindi » Mon, Mar 04, 2013, 4:24 PM UTC

crucialfelix wrote: post #201

dave1010uk wrote: post #136

Couple of related questions: 1) Many people seem to be recommending Puppet / Chef. How many servers or installs do you need before this is a good ROI? (Over using odd bash scripts or cPanel/WHM) 2) Am I right in thinking kernel updates don't get applied until the server is rebooted? If so, how / when do you manage this?

I wasted several days trying to get a good puppet setup. In the end it still needs more work, and the deploy system is complicated. I only have 4 boxes to manage. Ansible looks great. Much lighter weight but it can still scale up. Puppet and chef would both benefit by supporting single run light weight modes of usage.

Puppet does have a single run mode of usage: http://docs.puppetlabs.com/man/apply.html

I use it to manage just 5 servers, with a Fabric script that rsyncs the manifests up to the servers then runs `puppet apply` to apply the changes.

Re: How I spend my first 5 minutes on a server

#267

Post by npsimons » Mon, Mar 04, 2013, 4:27 PM UTC

jasonlotito wrote: post #241

shizcakes wrote: post #48

The premise of this thing is not good advice. 1) Your first couple minutes on a server should be used to install a configuration management client, if your bootstrap policies somehow don't already install one. 2) Everything else listed in this document should be configured by a configuration management system. 3) "User account sync tools" should have no place in a modern infrastructure, you should use your configurat…

> This stuff isn't hard. It's worth doing right. Can you provide an article as equally succinct as the OP's that provides this information? Your list is painfully devoid of anything of true value. Since it's not hard, and worth doing right, I imagine something should already be written.

If Bastille was still in working order, I'd recommend it as a very good starting point for locking down a configuration. Actual configuration deployment setups I don't put much stock in because I'm not managing enough machines for it to be worthwhile. Would love to hear from someone who manages a large farm/cluster/VM hosting on a very clean and straightforward way to manage configurations. Last I looked, most setups were custom, or some hobbled together packages that didn't "hang" together very well.

Re: How I spend my first 5 minutes on a server

#268

Post by ceph_ » Mon, Mar 04, 2013, 4:47 PM UTC

belorn wrote: post #258

> No secure server is complete without a firewall. Comments like those are why I normally point people to actual security expects (like, say, Schneier), and why I recommend that new admins should ignore as much as possible the practices chanted by the industry. A secure server does not need a firewall. A firewall can be used to secure a server against a specific threat, but that's it. The days of ping of death are be…

ACL based firewalls are the foundation of real network security. I'm not saying every server needs to be running its own firewall. But these security measures need to be implemented at some level, whether it's at a network level or on an individual machine basis.

Re: How I spend my first 5 minutes on a server

#269

Post by kaoD » Mon, Mar 04, 2013, 4:51 PM UTC

alan_cx wrote: post #259

Imagine you are a fairly normal windows user or even sysadmin. Imagine you are considering Linux to replace some task that a windows server performs. Now imagine the conclusion after reading this thread. As some one who can just about get something useful done in Linux, this thread makes me want to never use it again, it just looks too scary. Loads of disagreements which seems to have lots of dire consequences. OK, g…

This IS great advert for Linux. It's just that newbies are not this ad's target audience.

Sure, you can put Ubuntu in your mom's laptop and she'll be up and running in a breeze, but hey, she's won't be reading Hacker News.

Re: How I spend my first 5 minutes on a server

#270

Post by kaoD » Mon, Mar 04, 2013, 4:53 PM UTC

itry wrote: post #115

I use "adduser" instead of "useradd". Its more convinient as it does the remainings steps automatically for your. It comes with ubuntu by default. Any downsides?

For some reason it's not working in last Arch's build. Manual "useradd" is such a pain in the ass...