bk99.de entertain the web since 1997

bk99.de
HN · Server operationsCurated

The first five minutes on a new server

Summary

Bryan Kennedy describes a short basic hardening of Linux with user accounts, SSH keys, a firewall and automatic security updates. The procedure is aimed at Ubuntu servers. UFW configures the host firewall.

Ideas

  • A personal administrator account replaces logging in directly as root every day.
  • SSH keys remove guessable passwords from network access.
  • The firewall only allows services that are actually needed.
  • Automatic security updates shorten known windows of vulnerability.

Insights

  • Secure defaults work best before the first public service.
  • A short, reproducible procedure prevents forgotten basic steps.
  • Hardening must preserve both access security and maintainability.

Facts

  • Fail2ban is named as an additional layer of protection.

Recommendations

  • Automate the basic configuration with infrastructure as code.
  • Test a second way in before closing the session.

References

Read the original article

Search the Web Archive

HN · 2024

Linux's first Git commit and colliding SHA prefixes

Kees Cook demonstrates in practice why automated Linux tools must not treat Git commit prefixes as unique identifiers. The colliding prefix is 1da177e4c3f4. At the time, 590 Linux commits used this prefix in Fixes tags.

HN · 2024

Linux crisis tools

Brendan Gregg recommends a prepared toolbox so that performance outages can be measured immediately instead of improvised. Gregg's minimum list includes procps, util-linux, sysstat, iproute2 and tracing packages. Once loaded, BCC and bpftrace tools produce comparable BPF bytecode.