4 ms·

Hardening (along with any other server setup/configuration) should be implemented using some idempotent configuration management software (Chef, Puppet, Ansible

Hardening (along with any other server setup/configuration) should be implemented using some idempotent configuration management software (Chef, Puppet, Ansible, etc). It's 2016, there's no need to configure servers manually.

eddieroger 10y ago
> there's no need to configure servers manually. Other than to learn how, which is also why I'd provide text on how and now a bash script to just do it. Not everyone's needs are the exact same, and it's better to learn how to fish than be handed a line with one hooked. Maybe I have a strong reason not to go SSH keys only? I should at least understand how they work and why they're important so I can make the decision, wrong as many people think it may be.
pnathan 10y ago
Right, I was thinking myself... why not have a chef recipe do this, and walk through the systems as you do that. Ideally the server comes up and applies chef, doing the needful to secure it. Hand-cooking a server is extremely painful.
- codelitt 10y ago
  I mention Ansible and other tools in the article. The idea, as others have mentioned, is to teach a man to fish. You're much better off with having an automated way to perform this, but you shouldn't ever run anything automated that you don't understand. We'll release an Ansible Playbook over the next week or so that follows these steps.
  - geerlingguy 10y ago
    See related (as inspiration, or an upstream): - https://github.com/openstack/openstack-ansible-security - https://github.com/geerlingguy/ansible-role-security
    - codelitt 10y ago
      Thanks man! I'll take a look.
devishard 10y ago
It depends. I'm a security guy, so it would be embarrassing and possibly bad for my career if any of my servers got hacked, but I actually don't set up servers that often--it's not part of my job. These Web 2.0 configuration management solutions change pretty fast and don't care about reverse compatibility. So between my infrequent setups my configuration scripts pretty much always break. Contrast this with bash, which cares a whole lot about reverse compatibility, and it's a no brainer. I've got scripts where the only modifications I've made since 2005 were to add functionality or increase security, never to fix existing functionality that was broken by a change to the system. I'll take that over Chef or Ansible (both tools I've used) any day.
- ropable 10y ago
  Would be very interested to review server hardening Bash scripts. Have you published anything on Github or elsewhere?
  - devishard 10y ago
    I have, but I don't want to associate this HN account to my GitHub account, sorry. :/
    - aalbertson 10y ago
      throwaway github account then? :)
- larrywright 10y ago
  Which is why your hardening code (even if it's bash scripts) should have tests, using something like Test Kitchen. It will provision a VM (or cloud server, or docker container), execute your hardening scripts against them, and then run your integration tests to verify that the machine is hardened to your specifications.
grymoire1 10y ago
"there's no need to configure servers manually" assuming you have a configuration you can trust. Where are these published? And do you trust them?
neokya 10y ago
You are right about automating. Here is Ansible playbook I recently created https://github.com/chhantyal/5minutes https://github.com/chhantyal/5minutes

eddieroger 10y ago

> there's no need to configure servers manually. Other than to learn how, which is also why I'd provide text on how and now a bash script to just do it. Not everyone's needs are the exact same, and it's better to learn how to fish than be handed a line with one hooked. Maybe I have a strong reason not to go SSH keys only? I should at least understand how they work and why they're important so I can make the decision, wrong as many people think it may be.

pnathan 10y ago

Right, I was thinking myself... why not have a chef recipe do this, and walk through the systems as you do that. Ideally the server comes up and applies chef, doing the needful to secure it. Hand-cooking a server is extremely painful.

codelitt 10y ago
I mention Ansible and other tools in the article. The idea, as others have mentioned, is to teach a man to fish. You're much better off with having an automated way to perform this, but you shouldn't ever run anything automated that you don't understand. We'll release an Ansible Playbook over the next week or so that follows these steps.
- geerlingguy 10y ago
  See related (as inspiration, or an upstream): - https://github.com/openstack/openstack-ansible-security - https://github.com/geerlingguy/ansible-role-security
  - codelitt 10y ago
    Thanks man! I'll take a look.

devishard 10y ago

It depends. I'm a security guy, so it would be embarrassing and possibly bad for my career if any of my servers got hacked, but I actually don't set up servers that often--it's not part of my job. These Web 2.0 configuration management solutions change pretty fast and don't care about reverse compatibility. So between my infrequent setups my configuration scripts pretty much always break. Contrast this with bash, which cares a whole lot about reverse compatibility, and it's a no brainer. I've got scripts where the only modifications I've made since 2005 were to add functionality or increase security, never to fix existing functionality that was broken by a change to the system. I'll take that over Chef or Ansible (both tools I've used) any day.

ropable 10y ago
Would be very interested to review server hardening Bash scripts. Have you published anything on Github or elsewhere?
- devishard 10y ago
  I have, but I don't want to associate this HN account to my GitHub account, sorry. :/
  - aalbertson 10y ago
    throwaway github account then? :)
larrywright 10y ago
Which is why your hardening code (even if it's bash scripts) should have tests, using something like Test Kitchen. It will provision a VM (or cloud server, or docker container), execute your hardening scripts against them, and then run your integration tests to verify that the machine is hardened to your specifications.

grymoire1 10y ago

"there's no need to configure servers manually" assuming you have a configuration you can trust. Where are these published? And do you trust them?

neokya 10y ago

You are right about automating. Here is Ansible playbook I recently created https://github.com/chhantyal/5minutes https://github.com/chhantyal/5minutes