How I spend my first 5 minutes on a server • Hacker News Board

Re: How I spend my first 5 minutes on a server

#301

Post by lmm » Mon, Mar 04, 2013, 7:16 PM UTC

vidarh wrote: post #166

lmm wrote: post #132

Earlier quoted context omitted.

Your outermost server is the one where you should be most worried about having vulnerabilities - if you have a VPN as the outer layer that means the VPN server must be exposed to the public internet, and anyone who compromises it is in a pretty good position. And I'd rate the odds of a 0-day being found at higher for most VPN software than for SSH.

> and anyone who compromises it is in a pretty good position. You are assuming the VPN host is trusted any more than most people trusts random servers on the internet.

I am, just from my experience in real-life companies. It takes an awful lot of discipline to treat servers as if they were exposed to the public internet when you know full well that they're not.

Re: How I spend my first 5 minutes on a server

#302

Post by lmm » Mon, Mar 04, 2013, 7:17 PM UTC

drivebyacct2 wrote: post #162

lmm wrote: post #149

Earlier quoted context omitted.

Why would they bother? Script-kiddie is just playing the numbers, any machine with a slightly non-default configuration is not worth the effort. Disabling password authentication is better for "real" security, but doesn't stop those dictionary attacks spamming your logfile. (I still feel there should be better solutions to that problem than changing the port though)

I guess my response to all of these is... using key based auth is so much more secure than changing the port that changing the port seems to me, completely, pointless. Especially considering that: - password auth = me having to type my password everytime, likely to have a less secure password - key based auth = me never having to type it in, with a key length so long that it's completely inconceivable it'll be cracke…

The advantage of changing the port is to reduce the spam in your logs. Checking your server logs regularly really does increase your real-world security.

Re: How I spend my first 5 minutes on a server

#303

Post by justincormack » Mon, Mar 04, 2013, 7:17 PM UTC

dave1010uk wrote: post #179

justincormack wrote: post #170

Earlier quoted context omitted.

Re 2 yes that is true. You need to build this in to your maintenance.

Do you just reboot all machines every month or so or do you keep track of when kernel security patches come out some how?

Given that there have been real kernel security issues recently I would reboot sooner. You can do a risk assessment per issue. Monthly automated doesn't seem the best option.

Re: How I spend my first 5 minutes on a server

#304

Post by oconnore » Mon, Mar 04, 2013, 7:19 PM UTC

cbr wrote: post #288

oconnore wrote: post #278

Earlier quoted context omitted.

Schneier recommends use of a firewall: http://www.schneier.com/blog/archives/2004/12/safe_personal_... You are correct that a firewall will not magically solve all your problems, but it does help to protect against programs that open ports you didn't know about. Recommending against them doesn't make sense, and implying that they are only useful to prevent TCP/IP zero day vulnerabilities is silly (especially since th…

That's from 2004 and is about firewalls on desktops, not servers.

IP hasn't changed much since then, and I'm not sure server vs desktop is a relevant distinction here.

Re: How I spend my first 5 minutes on a server

#305

Post by RobAley » Mon, Mar 04, 2013, 7:42 PM UTC

marcosdumay wrote: post #296

RobAley wrote: post #178

Earlier quoted context omitted.

Bear in mind that in small company, developer == dev op == sys op == network manager = testers == toilet cleaner. i.e. they do everything, dev or production. As regards to unattended upgrades, again in small companies the choice is usually between them or no upgrades (no time for the test/deploy cycle across all platforms in use etc., less frequently used systems get forgotten and so on). As the article points out, i…

If you don't have time to test, you have yet another reason to not automate updates. It's better to run them only when you are around and have some time to fix whatever goes wrong.

We're talking security updates here, by the time you've found time to test, your server may well be hacked.

Re: How I spend my first 5 minutes on a server

#306

Post by MikeKusold » Mon, Mar 04, 2013, 7:46 PM UTC

tucosan wrote: post #286

robomartin wrote: post #280

I went through the article and then read every single post on this thread. I am not a security expert so I won't even try to contribute except to say that I see a lot of people offering criticism without taking the extra step of explaining how they would go about hardening a fresh Linux install (or a pile-o-servers in a rack, whatever is applicable). It'd sure be nice for those of us who are not security experts to r…

This is great! I was thinking exactly along those lines, and started looking for puppet/chef scripts that are readily available. It seems that using puppet has a pretty steep learning curve, at least from what I could gather skimming the docs. Actually what I would really like to see is an interactive script, which then guides me through the process of hardening a fresh ubuntu server install, offering sane suggestion…

I'm in the process of automating the configuration of my VPS using Ansible. This tutorial is an excellent introduction http://lextoumbourou.com/blog/posts/getting-started-with-ans...

Re: How I spend my first 5 minutes on a server

#307

Post by lotsofcows » Mon, Mar 04, 2013, 7:55 PM UTC

moe wrote: post #237

lotsofcows wrote: post #231

Earlier quoted context omitted.

Logging the ssh key used sounds interesting - not something I've tried before. I think you're doing something wrong with sudo. I'm not talking about "reentering your password" in the Ubuntu or Mac sense. I'm talking about giving access to specific limited commands. And what distro are you running where local privilege escalation is common?

I'm talking about giving access to specific limited commands. By definition the set is either so limited as to be essentially useless, or it opens (usually multiple) straightforward paths to a root-shell. Pretty much all sudoers-files I have seen fall in the latter category ("but he can only write the apache config-file!"). And what distro are you running where local privilege escalation is common? https://www.google…

"only write the apache config-file" Ha!

Local privilege: yeah, that's a lot but over a long time span and none should be current on decently maintained box. I've never even seen anyone attempt a 0 day on my boxen.

Re: How I spend my first 5 minutes on a server

#308

Post by tucosan » Mon, Mar 04, 2013, 7:59 PM UTC

MikeKusold wrote: post #306

tucosan wrote: post #286

Earlier quoted context omitted.

This is great! I was thinking exactly along those lines, and started looking for puppet/chef scripts that are readily available. It seems that using puppet has a pretty steep learning curve, at least from what I could gather skimming the docs. Actually what I would really like to see is an interactive script, which then guides me through the process of hardening a fresh ubuntu server install, offering sane suggestion…

I'm in the process of automating the configuration of my VPS using Ansible. This tutorial is an excellent introduction http://lextoumbourou.com/blog/posts/getting-started-with-ans...

ansible looks pretty good. thx for the link.

Re: How I spend my first 5 minutes on a server

#309

Post by tucosan » Mon, Mar 04, 2013, 8:01 PM UTC

ajdecon wrote: post #289

tucosan wrote: post #286

Earlier quoted context omitted.

This is great! I was thinking exactly along those lines, and started looking for puppet/chef scripts that are readily available. It seems that using puppet has a pretty steep learning curve, at least from what I could gather skimming the docs. Actually what I would really like to see is an interactive script, which then guides me through the process of hardening a fresh ubuntu server install, offering sane suggestion…

It hasn't been updated too much recently, but I've used Bastille for this in the past, and it's in the Ubuntu repos. http://bastille-linux.sourceforge.net/

Yeah, I forgot about bastille. On their news page they claim that development has been restarted recently. Lets hope that it gains enough momentum again.

Re: How I spend my first 5 minutes on a server

#310

Post by epo » Mon, Mar 04, 2013, 8:18 PM UTC

shizcakes wrote: post #256

jasonlotito wrote: post #241

Earlier quoted context omitted.

> This stuff isn't hard. It's worth doing right. Can you provide an article as equally succinct as the OP's that provides this information? Your list is painfully devoid of anything of true value. Since it's not hard, and worth doing right, I imagine something should already be written.

This is an excellent request. Reading through all the comments here, it seems like a lot of people are feeling frustrated with the variety of information available and no clear way to discern what is "good". I don't typically publish writings, but this seems like a good place to start. I'll write something up and post it here for the same critique that we've given Bryan :-) In the meantime, a decent source of general…

That site is useless, sample pages I looked contained brief overview paragraphs and no real content. Many contained "todo" items.

So you criticised the original article, but when asked to provide information or advice of your own merely came up with something entirely content free. The original article provided succint, useful advice, something you have failed to do.