Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I spend my first 5 minutes on a server

plusbryan.com

Post reply on HN
Print view View original

271–280 of 355 posts

Re: How I spend my first 5 minutes on a server

#271

Post by pavel_lishin »

shabble wrote: post #265
martinced wrote: post #219

I honestly do not understand why you need a deploy account with sudo access. I much prefer a deploy accound which DOES NOT have sudo access. I add firewall rules transparently redirecting 80/443 to non-privileged ports that the webapp is actually listening to. Hence no need to be root / sudo'ed for the deploy account. You then could get a bit fancier and set the login shell for the deploy account to /bin/false or som…

> I'd also say that during the first five minutes you should set the default firewalling rules to REJECT anything and then only whitelist what is actually allowed. At which point your 'net connection blips and suddenly you wish you'd paid extra for console access.

That's how I felt about the line where he recommends only allowing the deploy user to connect from a certain number of white-listed IPs. That's great and secure until you get a phone call while you're at the airport or on vacation, and then you hope that you can SSH into a machine at the office just so you can tunnel through from a white-listed IP.

Re: How I spend my first 5 minutes on a server

#272

Post by gre »

belorn wrote: post #258

> No secure server is complete without a firewall. Comments like those are why I normally point people to actual security expects (like, say, Schneier), and why I recommend that new admins should ignore as much as possible the practices chanted by the industry. A secure server does not need a firewall. A firewall can be used to secure a server against a specific threat, but that's it. The days of ping of death are be…

  The days of ping of death are behind us.
Packet of death. Hmm.

http://www.kriskinc.com/intel-pod

Re: How I spend my first 5 minutes on a server

#273

Post by jerf »

gre wrote: post #272
belorn wrote: post #258

> No secure server is complete without a firewall. Comments like those are why I normally point people to actual security expects (like, say, Schneier), and why I recommend that new admins should ignore as much as possible the practices chanted by the industry. A secure server does not need a firewall. A firewall can be used to secure a server against a specific threat, but that's it. The days of ping of death are be…

The days of ping of death are behind us. Packet of death. Hmm. http://www.kriskinc.com/intel-pod

Software firewalls can't prevent that problem.

Re: How I spend my first 5 minutes on a server

#274

Post by thoughtpolice »

linker3000 wrote: post #222
packetslave wrote: post #130

Earlier quoted context omitted.

SSH keys also never expire and are easy to copy/steal. Key-based auth is officially discouraged at the day job (for laptop-to-desktop type things) for exactly this reason.

We throw an OTP (One time Password) into the mix using Yubikeys: http://www.yubico.com/products/yubikey-hardware/yubikey/

Yep, I've been meaning to get one of these. I really dislike being unable to enforce a password on your private keys.

I've also been using Duo Security as my new 2FA solution and I like it a lot (it also has support for using Yubikeys to provide your OTP.)

Re: How I spend my first 5 minutes on a server

#276

Post by krenel »

hazov wrote: post #186
networked wrote: post #10

Beginner or not, you should probably use visudo [1] instead of vim /etc/sudoers for the sanity checks that it provides, if nothing else. A botched edit of /etc/sudoers that locks you (along with every other user) out of administrative access is an unpleasant way to learn this. [1] http://linux.die.net/man/8/visudo

On debian or ubuntu you can also include a user on the sudo group: usermod -a -G sudo username

I prefer the "adduser" way (easier to remember):

$ sudo adduser username sudo

Re: How I spend my first 5 minutes on a server

#277

Post by gvb »

gre wrote: post #272
belorn wrote: post #258

> No secure server is complete without a firewall. Comments like those are why I normally point people to actual security expects (like, say, Schneier), and why I recommend that new admins should ignore as much as possible the practices chanted by the industry. A secure server does not need a firewall. A firewall can be used to secure a server against a specific threat, but that's it. The days of ping of death are be…

The days of ping of death are behind us. Packet of death. Hmm. http://www.kriskinc.com/intel-pod

Ping of death is a ping that claims to have a 65536 byte payload: http://en.wikipedia.org/wiki/Ping_of_death

Flashback quite a few years. I was working in IT and my coworker asked me if my WinXP (IIRC) machine was up to date. I said "yes". Next thing I know, it crashed hard. Oops, my buddy just hit me with a ping of death.

Re: How I spend my first 5 minutes on a server

#278

Post by oconnore »

belorn wrote: post #258

> No secure server is complete without a firewall. Comments like those are why I normally point people to actual security expects (like, say, Schneier), and why I recommend that new admins should ignore as much as possible the practices chanted by the industry. A secure server does not need a firewall. A firewall can be used to secure a server against a specific threat, but that's it. The days of ping of death are be…

Schneier recommends use of a firewall: http://www.schneier.com/blog/archives/2004/12/safe_personal_...

You are correct that a firewall will not magically solve all your problems, but it does help to protect against programs that open ports you didn't know about.

Recommending against them doesn't make sense, and implying that they are only useful to prevent TCP/IP zero day vulnerabilities is silly (especially since the firewall likely wouldn't protect against that anyway).

Re: How I spend my first 5 minutes on a server

#279

Post by giulivo »

I think you're doing it wrong.

Having a _shared_ account, with sudo privileges and a common password doesn't look smart.

Also, you're forcing devs to copy their public keys around.

I think you underestimate the benefits brought in by a centralized system, like LDAP, which would also allow you to manage the permissions with some more granularity

Re: How I spend my first 5 minutes on a server

#280

Post by robomartin »

I went through the article and then read every single post on this thread. I am not a security expert so I won't even try to contribute except to say that I see a lot of people offering criticism without taking the extra step of explaining how they would go about hardening a fresh Linux install (or a pile-o-servers in a rack, whatever is applicable).

It'd sure be nice for those of us who are not security experts to read alternative approaches rather than, paraphrasing and not picking on anyone, "using a firewall is dumb" or "blocking ssh is pointless".

I like isolated ideas such as using a script to completely automate the provisioning of new boxes. Kind of a no-brainer if you ask me. The problem is that such recommendations are not followed by something like "Here's the script I use on Ubuntu 12.04 LTS".

How about it guys? Would you care to attempt to produce a canonical HN "How to harden your server" reference?

Maybe one of the security experts on HN can start a repository on Github to evolve a canonical script. I'm pretty much 100% Ubuntu 12.04 LTS, so it is my hope that this is one of the platforms that is addressed.

I did some looking around and this is what I found (I am in no position to evaluate the merits of any of these at anything beyond an intermediate level):

https://github.com/bluedragonz/server-shield

https://github.com/eglimi/linux_hardening

http://www.cyberciti.biz/tips/linux-security.html

http://ubuntuforums.org/showthread.php?t=1002167

http://www.thefanclub.co.za/how-to/how-secure-ubuntu-1204-lt...

http://www.andrewault.net/2010/05/17/securing-an-ubuntu-serv...

http://ubuntuforums.org/showthread.php?t=1919111

https://help.ubuntu.com/12.04/serverguide/security.html

http://www.sans.org/score/checklists/linuxchecklist.pdf

http://nvd.nist.gov/scap/content/stylesheet/scap-rhel5-docum...

http://blogs.csoonline.com/ubuntu_lts_vulnerability_scrub_ag...

http://ubuntuforums.org/showthread.php?t=510812

Post reply on HN