Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I spend my first 5 minutes on a server

plusbryan.com

Post reply on HN
Print view View original

281–290 of 355 posts

Re: How I spend my first 5 minutes on a server

#281

Post by armored_mammal »

So I'll agree with many of the commentators that several of the practices suggested aren't 'ideal.' However, they are easy and possibly better than having no 'practice' at all.

Just as an example, the shared user account with unique SSH keys per user. Sure, it's obnoxious in some respects, but many of the criticisms I'm reading in the comments like "but they could reinstate their access with a cron job that re-adds their key when they leave" and such are silly - presumably those who are using the shared account are developers/sysadmins with sudo privileges. Regardless of whether they have a shared account they have privileges to do whatever they feel like to the systems in question. Hence I'd argue it's a fairly reasonable solution for the situation when you don't have the time/resources to configure something more complex and you have to trust all parties anyway.

I think there are two larger takeaways:

First - Managing multiple users across many servers and dev systems is not easy enough, particularly for smaller organizations, and only gets worse when you try to get more granular about who can do what.

Second - umm... no idea anymore. Forgot what was second. Automation is good?

Re: How I spend my first 5 minutes on a server

#282

Post by shabble »

pavel_lishin wrote: post #271
shabble wrote: post #265

Earlier quoted context omitted.

> I'd also say that during the first five minutes you should set the default firewalling rules to REJECT anything and then only whitelist what is actually allowed. At which point your 'net connection blips and suddenly you wish you'd paid extra for console access.

That's how I felt about the line where he recommends only allowing the deploy user to connect from a certain number of white-listed IPs. That's great and secure until you get a phone call while you're at the airport or on vacation, and then you hope that you can SSH into a machine at the office just so you can tunnel through from a white-listed IP.

Yeah, I've always felt nervous about doing whitelisting (and to some extent, things like fail2ban) for reasons like that. Having a couple of backup hosts / friends with shell-servers listed who you can bounce through might mitigate it somewhat though, whilst still avoiding 90% of the portscans-from-(china|mars) stuff.

One idea I had was to enable something annoying and kooky like port-knocking or OTP pass/connection enabled 'backdoor entrance' for emergencies, but ended up being too lazy, and realised it was just expanding the attack surface.

To my original point, we had an interesting setup for one network where the firewall changes were all manipulated via a script which required the change to be applied, and then confirmed after a short delay with a different command, otherwise after 5 minutes the ruleset would revert to the previous known-working one. It definitely saved some downtime/late night DC trips.

Re: How I spend my first 5 minutes on a server

#283

Post by luser001 »

kelnos wrote: post #189
lmm wrote: post #132

Earlier quoted context omitted.

Your outermost server is the one where you should be most worried about having vulnerabilities - if you have a VPN as the outer layer that means the VPN server must be exposed to the public internet, and anyone who compromises it is in a pretty good position. And I'd rate the odds of a 0-day being found at higher for most VPN software than for SSH.

anyone who compromises [the VPN server] is in a pretty good position. Sure. But without a VPN, anyone who compromises even one of your other hosts is in the same position. It's a lot easier to audit a single-purpose VPN server for possible security issues than it is to audit all the application code running on the rest of your production systems. And I'd rate the odds of a 0-day being found at higher for most VPN sof…

Ok, just in case it wasn't clear: I am asking about the advantages of having a VPN server as a bastion host instead of another SSH server.

You would ssh to the bastion host, and from there to internal hosts.

With the appropriate ssh config at the client end, the tunneling through the bastion can be scripted away (using the ProxyCommand directive and RSA keys).

Re: How I spend my first 5 minutes on a server

#284

Post by samstave »

jerf wrote: post #273
gre wrote: post #272

Earlier quoted context omitted.

The days of ping of death are behind us. Packet of death. Hmm. http://www.kriskinc.com/intel-pod

Software firewalls can't prevent that problem.

Well, yes they could - if the machine targeted is behind a FW that is blocking that type of traffic.

If the FW itself has that specific NIC, it could be brought down with this attack - but you could prevent SIP traffic from hitting machines which are vulnerable.

Re: How I spend my first 5 minutes on a server

#285

Post by shabble »

mercurial wrote: post #257
beagle3 wrote: post #252

Earlier quoted context omitted.

Possibly my misunderstanding, but I thought chef and puppet only push changes on the files that they are configured to control - There are tens of files in /etc/, some possibly modified by an "apt-get upgrade", then reverted by chef, some that chef/puppet do not try to modify. etckeeper is a net that gives you an idea of how /etc looked on a given date or apt-run, not just how it was supposed to look (Which is what y…

Yes, it's true that chef/puppet do not overwrite your entire etc, just a subset of it, but presumably, you'll have your critical components backed by it (otherwise, there is not much point in using a configuration management system). So it is still useful on such a system, but not to the same extent of a system without configuration management.

> but presumably, you'll have your critical components backed by it

Often, the way you discover something is critical is after the first time it breaks. Backups may help, but proper version history is probably going to give better insight into what happened.

Definitely less important, but not useless, IMO.

Re: How I spend my first 5 minutes on a server

#286

Post by tucosan »

robomartin wrote: post #280

I went through the article and then read every single post on this thread. I am not a security expert so I won't even try to contribute except to say that I see a lot of people offering criticism without taking the extra step of explaining how they would go about hardening a fresh Linux install (or a pile-o-servers in a rack, whatever is applicable). It'd sure be nice for those of us who are not security experts to r…

This is great! I was thinking exactly along those lines, and started looking for puppet/chef scripts that are readily available.

It seems that using puppet has a pretty steep learning curve, at least from what I could gather skimming the docs.

Actually what I would really like to see is an interactive script, which then guides me through the process of hardening a fresh ubuntu server install, offering sane suggestions along the way.

I am pretty sure such scripts do exist, but having them maintained and regualarly updated somewhere would be quite neat.

Re: How I spend my first 5 minutes on a server

#287

Post by mh- »

petejansson wrote: post #32
cdjk wrote: post #11

I've never understood the point of fail2ban if you disable ssh password authentication. Yeah, it might eliminate some spam in the logs, but if you only allow key-based authentication that doesn't really matter.

Keys can be brute-forced.

uh..

Re: How I spend my first 5 minutes on a server

#288

Post by cbr »

oconnore wrote: post #278
belorn wrote: post #258

> No secure server is complete without a firewall. Comments like those are why I normally point people to actual security expects (like, say, Schneier), and why I recommend that new admins should ignore as much as possible the practices chanted by the industry. A secure server does not need a firewall. A firewall can be used to secure a server against a specific threat, but that's it. The days of ping of death are be…

Schneier recommends use of a firewall: http://www.schneier.com/blog/archives/2004/12/safe_personal_... You are correct that a firewall will not magically solve all your problems, but it does help to protect against programs that open ports you didn't know about. Recommending against them doesn't make sense, and implying that they are only useful to prevent TCP/IP zero day vulnerabilities is silly (especially since th…

That's from 2004 and is about firewalls on desktops, not servers.

Re: How I spend my first 5 minutes on a server

#289

Post by ajdecon »

tucosan wrote: post #286
robomartin wrote: post #280

I went through the article and then read every single post on this thread. I am not a security expert so I won't even try to contribute except to say that I see a lot of people offering criticism without taking the extra step of explaining how they would go about hardening a fresh Linux install (or a pile-o-servers in a rack, whatever is applicable). It'd sure be nice for those of us who are not security experts to r…

This is great! I was thinking exactly along those lines, and started looking for puppet/chef scripts that are readily available. It seems that using puppet has a pretty steep learning curve, at least from what I could gather skimming the docs. Actually what I would really like to see is an interactive script, which then guides me through the process of hardening a fresh ubuntu server install, offering sane suggestion…

It hasn't been updated too much recently, but I've used Bastille for this in the past, and it's in the Ubuntu repos. http://bastille-linux.sourceforge.net/

Re: How I spend my first 5 minutes on a server

#290

Post by luser001 »

linker3000 wrote: post #222
packetslave wrote: post #130

Earlier quoted context omitted.

SSH keys also never expire and are easy to copy/steal. Key-based auth is officially discouraged at the day job (for laptop-to-desktop type things) for exactly this reason.

We throw an OTP (One time Password) into the mix using Yubikeys: http://www.yubico.com/products/yubikey-hardware/yubikey/

Thanks for the link. :)
Post reply on HN