6 ms·

Is there an up to date version of this?

vbezhenar 5y ago
While I don't agree to this article, from quick glance it does not seem to be obsolete and everything should work on modern Ubuntu. One thing that's not immediately obvious is that docker does not care about your firewall.
solfox 5y ago
Not by me (author) :)
xcambar 5y ago
AFAICT, the contents is still up to date and solid advice (except IP locks, but YMMV)
shric 5y ago
One thing I'd update for today is use Ed25519 keys instead of RSA
3np 5y ago
Two changes I would make: * use -t ed25519 to generate keys, much more efficient for same security compared to RSA * don’t use ufw. It easily becomes a big mess and is a pain to manage with ansible. firewalld is a much better high-lever firewall. Preferably with nftables backend. If you have a bit bigger fleet and manage a CA you could look into using signed SSH certificates instead of public keys. That way you can provision access centrally without adding individual keys to individual servers.
- cheshire_cat 5y ago
  Do you switch Debian based systems to firewalld or do you just prefer RedHat based systems?
  - 3np 5y ago
    I'm running mostly Debian, actually. No issues.
hamburglar 5y ago
It’s all still what I’d call “good advice if you refuse to take some better advice”. The caveat at the beginning acknowledges that this is a pragmatic approach rather than the best approach, and I think in the intervening time I’ve become more convinced that the better approach is the only approach: namely to automate a lot more of these things, which is alluded to at the end. I’d also ditch the use of any shared credential other than the emergency root password, which should be locked away and not actually known by any people. Your mechanism for syncing ssh pubkeys (which, btw, isn’t specified in the article, which in my experience means it doesn’t really exist :D) on the shared account should instead populate the user keys directory and there should be one logon per user.

While I don't agree to this article, from quick glance it does not seem to be obsolete and everything should work on modern Ubuntu. One thing that's not immediately obvious is that docker does not care about your firewall.

solfox 5y ago

Not by me (author) :)

xcambar 5y ago

AFAICT, the contents is still up to date and solid advice (except IP locks, but YMMV)

shric 5y ago

One thing I'd update for today is use Ed25519 keys instead of RSA

3np 5y ago

Two changes I would make: * use -t ed25519 to generate keys, much more efficient for same security compared to RSA * don’t use ufw. It easily becomes a big mess and is a pain to manage with ansible. firewalld is a much better high-lever firewall. Preferably with nftables backend. If you have a bit bigger fleet and manage a CA you could look into using signed SSH certificates instead of public keys. That way you can provision access centrally without adding individual keys to individual servers.

cheshire_cat 5y ago
Do you switch Debian based systems to firewalld or do you just prefer RedHat based systems?
- 3np 5y ago
  I'm running mostly Debian, actually. No issues.

hamburglar 5y ago

It’s all still what I’d call “good advice if you refuse to take some better advice”. The caveat at the beginning acknowledges that this is a pragmatic approach rather than the best approach, and I think in the intervening time I’ve become more convinced that the better approach is the only approach: namely to automate a lot more of these things, which is alluded to at the end. I’d also ditch the use of any shared credential other than the emergency root password, which should be locked away and not actually known by any people. Your mechanism for syncing ssh pubkeys (which, btw, isn’t specified in the article, which in my experience means it doesn’t really exist :D) on the shared account should instead populate the user keys directory and there should be one logon per user.