81–90 of 298 posts
I don't mean to sound flippant but why can't these "lock down your new box" tutorials just be a bash script? Shouldn't they be?
I don't mean to sound flippant but why can't these "lock down your new box" tutorials just be a bash script? Shouldn't they be?
You should really automate this process if you create more than one server, ever. It's fairly easy to get the basics, and if you don't automate it, I guarantee you'll miss one or more steps in the setup.
I don't mean to sound flippant but why can't these "lock down your new box" tutorials just be a bash script? Shouldn't they be?
That said, if you do such things at scale, you'll likely have automated provisioning and configuration management systems in place anyway.
For example you could have images that have the static parts already pre-configured, and something like cloudinit for the ssh keys and/or passwords.
Or you provision the systems with foreman, and then use puppet for configuration management.
echo "set background=dark" > /etc/vim/vimrc.local
This one is pretty decent but if you want the ultimate guide check out this one: https://www.inversoft.com/guides/2016-guide-to-user-data-sec... It covers 10x what all the other guides cover in terms of server and application security. It was posted a few weeks ago on HN but didn't make the front-page.
https://github.com/FallibleInc/security-guide-for-developers... (work in progress)
Earlier quoted context omitted.
Hurricane Electric's network tools iOS app is free and has an OTP client built in, with iCloud Keychain sync. OTP Auth is another excellent, free OTP client. Edit: clarified both are free.
While I'm not in the market for an OTP client, this is the network tools app I've been looking for since I bought my first iPod Touch. If you have remote beer-buying support, point me to it.
no beer required :-)
I'm surprised nobody mentioned this is a great way to shoot yourself in the foot if you don't have a static IP.
I don't mean to sound flippant but why can't these "lock down your new box" tutorials just be a bash script? Shouldn't they be?
It would run through a series of questions about your use case to build a security policy, and then edit config files for you.
The problem is that it needs to be aware of all the different flavors of Linux it might be running on, so it's naturally fragile and requires lots of maintenance. Sadly, it hasn't been updated in a few years.
I always worry that adding 2FA could make your machine inaccessible if anything happens to google-authenticator in this case. Maybe it's a little bit of paranoia but I don't like the idea of giving control over my ability to log into my server.
It'd be perfectly reasonable if libpam-google-authenticator relied on Google's infrastructure, but despite the infelicitous name, it does not; it just implements the server side of TOTP. The authentication flow is identical to any other correct TOTP implementation, and you can use any compatible client; no integration with Google services or infrastructure is required. (In fact, I don't think it's even possible.) Spe…