7 ms·

The part I hate most is the security aspects. Keeping things up to date, port blocking, iptables, firewalls, etc. Anyone know if there’s a SaaS that just ssh’s

The part I hate most is the security aspects. Keeping things up to date, port blocking, iptables, firewalls, etc. Anyone know if there’s a SaaS that just ssh’s in and does that stuff? I use serverpilot.io but it’s aimed specifically at DO + PHP, and would like more flexibility on which core services could be installed.

Tepix 4y ago
Do the initial setup with Ansible. It should be static unless your application changes. Also it's hard to do it as a service because it really depends on your applications. Keep the boxes up-to-date with "unattended-upgrades" or similar.
- conductr 4y ago
  Thanks, I'll check out Ansible
- RealStickman_ 4y ago
  If you use additinal repos, make sure to add those to the unattended-upgrades config as well. And reboot your servers regularly.
d23 4y ago
With respect to port blocking / iptables / firewalls, what do you need to do other than shut off all ports other than the one(s) you're serving on? And for updates, I don't know that any other provider does this any differently. You'll have to do some work, but that's what I'd prefer anyway; the last thing I'd want is AWS automatically upgrading the OS of live production systems without me testing it first.
- conductr 4y ago
  It's a good question and the answer is I don't know what I don't know when it comes to this stuff. Perhaps I've been overthinking it, but I feel like there's some gapping hole I'm leaving exposed. If that's all there is to it then I feel better already about a DIY approach. But for instance, SSH port has to remain open just so I can get in. I read occasionally about OpenSSH, or some foundational level service, being exploited. Is it common to just have to follow the security issues of every service and rush to patch accordingly, or is there something that helps automate this part? I do agree that there are some core services that I don't want changing out from under me without my notice/prior testing. But then there's also a lot of stuff installed that I don't use directly (eg OpenSSH) in my application and I'm not sure if those are attack vectors.
  - stevenhuang 4y ago
    The gist is, yes, that really is all there is to it. Setup unattended upgrades for your distro of choice, setup fail2ban, only make internet accessible the ports you need, upgrade out of date software (i.e., don't fall behind LTS). Make sure your software behaves with good security practices (don't trust user input, etc). Any modern guide these days should just about cover it. For more complex deployments you'll enter the world of reverse proxies, custom VLANs, automation abstraction, intrusion detection systems (i.e., applications that proactively monitor access logs for suspicious activity), logging systems, alerting systems... But for simple app deployments, getting a reasonably secure system setup is actually not that hard. Maintaining it and keeping it secure is another matter (keep private keys secret, don't use simple passwords for SSH, etc), dealing with large upgrades, don't deploy debug to prod...
- beambot 4y ago
  > what do you need to do other than shut off all ports other than the one(s) you're serving on? A bit cheeky, but to highlight the point: you just locked yourself out of SSH.
  - barrucadu 4y ago
    Why would you block the port you're serving SSH on?
megous 4y ago
You don't need any firewall. All you need is to check `ss -ltunpr` and disable all services that are not listening on localhost, which is not usually many services on minimalistic OS installation. And/or make sure [your own] internal services listen only on localhost addresses. So that just leaves keeping things uptodate, which is easy by subscribing to your distro's security mailing list, and updating when something relevant comes up. Which is rarely on a simple webhost VM.
unethical_ban 4y ago
If you're talking host firewall, I would focus more on making sure only the necessary services are installed and configured for startup - meaning only authorized apps are listening inbound. For outbound, I don't have an answer, though I suspect there is one. For network, again, your required services should be somewhat easily definable for inbound unless you're hosting multimedia/UDP/P2P services. This is the basics... for enterprise level stuff you get into application-aware firewalls, IPS, and WAF.

Tepix 4y ago

Do the initial setup with Ansible. It should be static unless your application changes. Also it's hard to do it as a service because it really depends on your applications. Keep the boxes up-to-date with "unattended-upgrades" or similar.

conductr 4y ago
Thanks, I'll check out Ansible
RealStickman_ 4y ago
If you use additinal repos, make sure to add those to the unattended-upgrades config as well. And reboot your servers regularly.

d23 4y ago

With respect to port blocking / iptables / firewalls, what do you need to do other than shut off all ports other than the one(s) you're serving on? And for updates, I don't know that any other provider does this any differently. You'll have to do some work, but that's what I'd prefer anyway; the last thing I'd want is AWS automatically upgrading the OS of live production systems without me testing it first.

conductr 4y ago
It's a good question and the answer is I don't know what I don't know when it comes to this stuff. Perhaps I've been overthinking it, but I feel like there's some gapping hole I'm leaving exposed. If that's all there is to it then I feel better already about a DIY approach. But for instance, SSH port has to remain open just so I can get in. I read occasionally about OpenSSH, or some foundational level service, being exploited. Is it common to just have to follow the security issues of every service and rush to patch accordingly, or is there something that helps automate this part? I do agree that there are some core services that I don't want changing out from under me without my notice/prior testing. But then there's also a lot of stuff installed that I don't use directly (eg OpenSSH) in my application and I'm not sure if those are attack vectors.
- stevenhuang 4y ago
  The gist is, yes, that really is all there is to it. Setup unattended upgrades for your distro of choice, setup fail2ban, only make internet accessible the ports you need, upgrade out of date software (i.e., don't fall behind LTS). Make sure your software behaves with good security practices (don't trust user input, etc). Any modern guide these days should just about cover it. For more complex deployments you'll enter the world of reverse proxies, custom VLANs, automation abstraction, intrusion detection systems (i.e., applications that proactively monitor access logs for suspicious activity), logging systems, alerting systems... But for simple app deployments, getting a reasonably secure system setup is actually not that hard. Maintaining it and keeping it secure is another matter (keep private keys secret, don't use simple passwords for SSH, etc), dealing with large upgrades, don't deploy debug to prod...
beambot 4y ago
> what do you need to do other than shut off all ports other than the one(s) you're serving on? A bit cheeky, but to highlight the point: you just locked yourself out of SSH.
- barrucadu 4y ago
  Why would you block the port you're serving SSH on?

megous 4y ago

You don't need any firewall. All you need is to check `ss -ltunpr` and disable all services that are not listening on localhost, which is not usually many services on minimalistic OS installation. And/or make sure [your own] internal services listen only on localhost addresses. So that just leaves keeping things uptodate, which is easy by subscribing to your distro's security mailing list, and updating when something relevant comes up. Which is rarely on a simple webhost VM.

unethical_ban 4y ago

If you're talking host firewall, I would focus more on making sure only the necessary services are installed and configured for startup - meaning only authorized apps are listening inbound. For outbound, I don't have an answer, though I suspect there is one. For network, again, your required services should be somewhat easily definable for inbound unless you're hosting multimedia/UDP/P2P services. This is the basics... for enterprise level stuff you get into application-aware firewalls, IPS, and WAF.