5 ms·
One thing you should probably do: establish a VPN. Give staff cert-based credentials to it. Block all inbound traffic to the VPN except a) port 22/etc to your
by patio11 11y ago
One thing you should probably do: establish a VPN. Give staff cert-based credentials to it. Block all inbound traffic to the VPN except a) port 22/etc to your bastion host and b) 80/443 to your front-end web boxes.
This greatly reduces your surface area, and helps prevent easy mistakes later (like leaving a staging server unpatched) from blowing up your whole deployment.
Also, admin applications: an easy way for smart teams to lose. These are a great candidate for "only accessible if you're VPNing in", which you can enforce at firewall and again in the application if you want.
Password managers; TFA everywhere but especially on corporate email accounts; ask yourself "If I were a hobbyist building a Bitcoin exchange where would I host it?" then don't host there.
Here's a useful but hard-to-implement recommendation: keep an up-to-date list of every box in use and terminate anything you find not on that list. Many compromises start with "The summer intern's project from last year was web accessible and..."
- herbst 11y agoWhile i think this is a great idea. I just thought about the mess i would create setting up continuous deployment and therelike. This fits my paranoia, but not my software environment :/
- tptacek 11y agoIf you use an actual VPN, and not an SSH bastion host, continuous deployment works seamlessly. You can use a client like Viscosity to ensure that you're basically always connected to the VPN. In some ways, this setup is actually more convenient than the standard "SSH to each of the boxes" setup.
- mwcampbell 11y ago> ask yourself "If I were a hobbyist building a Bitcoin exchange where would I host it?" then don't host there. What's the rationale for this? This would seem to rule out inexpensive VPS hosts like DigitalOcean, Vultr, and Linode, that are good not only for hobbyists, but for small companies on a shoestring budget. Are you saying something like AWS is better simply because it's less attractive to hobbyists?
- superuser2 11y agoLinode just had yet another major compromise. Yes, it should probably be ruled out.
- tptacek 11y agoDon't ever use Linode. If you have friends using Linode, tell them to stop.
- euroclydon 11y agoJust went to cancel a VPS I have over there... There's so hosed with the DDOS, I can't even bring up the homepage!