3 ms·

Curious if you're not a dev how do you know this (no offense meant). Surprised about Ubuntu, what about Debian? Share same... Hmm... A lot of these I have to

by ge96 9y ago

Curious if you're not a dev how do you know this (no offense meant). Surprised about Ubuntu, what about Debian? Share same... Hmm... A lot of these I have to tick off.

rpod 9y ago
As a sysadmin, you'd have to have first-hand experience on what can go wrong on the dev side. Also curious as to why Ubuntu isn't suitable for production.
- ge96 9y ago
  Maybe I have been lucky I am using nginx now on top of centos for one site but the reverse proxy for example not using that. I am on an Amazon EC2 in this particular case, also curious that Apache was also on there but only nginx is running. Had a long TTFB was trying to figure out what was wrong. Upon restart (new instance) I guess I got lucky, now back to regular site speed around 2 seconds load (full page). Sorry rambling, cool stuff. Been on VPS, I guess EC2 is still the same thing but next would be serverless I guess.
jonssons 9y ago
I am a sysadmin with approx 15 years of experience running linux systems and open source software. When I set things up, I tend to form things my way. I usually have little resources for monitoring or staff, so automation is the best to do. A server serves, it may produce errors and you can act upon that (error 404 for not finding phpmyadmin (which should _never_ be public => add ip to drop table). There are scripts that can do this for you. However, the application which is being served, may produce different errors (failed login attempt, attempt for sql injection, cross site attack, ...). Some things are better logged by the application, Then the application needs to produce these logs. An awful lot of applications do nothing when presented with any of these type of attacks, making them extremely vulnerable. It's the dev's job to provide logging. Debian: fine if you like pain :) it's stable.
- ge96 9y ago
  How do you make PHPMyAdmin not public aside from say using one of those directory passwords. Also it is somewhat of a similar question as to how Git is public but private.(Not GitHub your own setup)
  - jonssons 9y ago
    There are lots of possibilities. For example: Only allow web connections through localhost and start an x session through ssh. This would require you to install a webbrowser though, so that's another security risk. Perhaps you could set up a VM with a dedi IP and only allow connections from there. (secure it well) Another possibility would be to first pass a reverse proxy that will request a client-side certificate. That'd make it pretty secure. A password protected directory is just asking for a brute force through a botnet. Your failtoban won't even block anything because the attacker would only let 1 host attempt a password once per 30 min or per hour. But if he has thousands of bots to his disposal, he can still bruteforce a couple times a second. That's OK you say. I have a strong password. Don't forget: Each connection and failed login attempts is logged. Your logfile will quickly grow. If you did not set a seperate VAR partition on your disk, your root disk will quickly get full and server will crash. Additionally, it will fill up your bandwith and be as effective as a ddos attack. Don't use passwords. Use certificates. easier for you, impossible to hack. There are other methods of course, but these would be my preferred methods. Setting phpmyadmin publically is asking to get your data stolen. Do not assume there are not exploits in the latest phpmyadmin. But don't forget to update it within the first 10 minutes when a security patch comes along, otherwise your data may well already be compromised.
    - ge96 9y ago
      Oh man I feel so dumb, you know despite what I can do. I guess that's the problem of trying to do everything you can only get so deep. Use certificates? What is that not keypairs? I logged into this Digital Ocean droplet and was surprised to see 15,000+ failed login attempts to SSH. I hadn't seen that before. I don't know if using PHPMyAdmin is noobish. I still primarily use MySQL/Maria (only). Thanks for the tips. I learn a lot though HN.

by ge96 9y ago

Curious if you're not a dev how do you know this (no offense meant). Surprised about Ubuntu, what about Debian? Share same... Hmm... A lot of these I have to tick off.

rpod 9y ago

As a sysadmin, you'd have to have first-hand experience on what can go wrong on the dev side. Also curious as to why Ubuntu isn't suitable for production.

ge96 9y ago
Maybe I have been lucky I am using nginx now on top of centos for one site but the reverse proxy for example not using that. I am on an Amazon EC2 in this particular case, also curious that Apache was also on there but only nginx is running. Had a long TTFB was trying to figure out what was wrong. Upon restart (new instance) I guess I got lucky, now back to regular site speed around 2 seconds load (full page). Sorry rambling, cool stuff. Been on VPS, I guess EC2 is still the same thing but next would be serverless I guess.

jonssons 9y ago

I am a sysadmin with approx 15 years of experience running linux systems and open source software. When I set things up, I tend to form things my way. I usually have little resources for monitoring or staff, so automation is the best to do. A server serves, it may produce errors and you can act upon that (error 404 for not finding phpmyadmin (which should _never_ be public => add ip to drop table). There are scripts that can do this for you. However, the application which is being served, may produce different errors (failed login attempt, attempt for sql injection, cross site attack, ...). Some things are better logged by the application, Then the application needs to produce these logs. An awful lot of applications do nothing when presented with any of these type of attacks, making them extremely vulnerable. It's the dev's job to provide logging. Debian: fine if you like pain :) it's stable.

ge96 9y ago
How do you make PHPMyAdmin not public aside from say using one of those directory passwords. Also it is somewhat of a similar question as to how Git is public but private.(Not GitHub your own setup)
- jonssons 9y ago
  There are lots of possibilities. For example: Only allow web connections through localhost and start an x session through ssh. This would require you to install a webbrowser though, so that's another security risk. Perhaps you could set up a VM with a dedi IP and only allow connections from there. (secure it well) Another possibility would be to first pass a reverse proxy that will request a client-side certificate. That'd make it pretty secure. A password protected directory is just asking for a brute force through a botnet. Your failtoban won't even block anything because the attacker would only let 1 host attempt a password once per 30 min or per hour. But if he has thousands of bots to his disposal, he can still bruteforce a couple times a second. That's OK you say. I have a strong password. Don't forget: Each connection and failed login attempts is logged. Your logfile will quickly grow. If you did not set a seperate VAR partition on your disk, your root disk will quickly get full and server will crash. Additionally, it will fill up your bandwith and be as effective as a ddos attack. Don't use passwords. Use certificates. easier for you, impossible to hack. There are other methods of course, but these would be my preferred methods. Setting phpmyadmin publically is asking to get your data stolen. Do not assume there are not exploits in the latest phpmyadmin. But don't forget to update it within the first 10 minutes when a security patch comes along, otherwise your data may well already be compromised.
  - ge96 9y ago
    Oh man I feel so dumb, you know despite what I can do. I guess that's the problem of trying to do everything you can only get so deep. Use certificates? What is that not keypairs? I logged into this Digital Ocean droplet and was surprised to see 15,000+ failed login attempts to SSH. I hadn't seen that before. I don't know if using PHPMyAdmin is noobish. I still primarily use MySQL/Maria (only). Thanks for the tips. I learn a lot though HN.