5 ms·
They're absolutely correct: " 1. Install Linux on the box. Turn everything off but sshd. Turn off password access to sshd. If you just locked yourself out of s
by mjevans 2y ago
They're absolutely correct:
" 1. Install Linux on the box. Turn everything off but sshd. Turn off password access to sshd. If you just locked yourself out of sshd because you didn't install ssh keys first, STOP HERE. You are not ready for this. "
If you blindly followed the directions and got locked out, you can do exactly the same thing with other directions. You were not ready.
- kijin 2y agoThe great thing about having unfettered physical access to hardware is that you can easily recover from mistakes like this. No need to rebuild that EC2 instance. No need to beg a hosting company for IPMI access. You can just pull the plug and try again as if were your own PC.
- jiggunjer 2y agoIsn't it the same with something like idrac?
- bigiain 2y agoOn the other hand, it's nice to be able to take a no-reboot AMI of the machine you're futzing with, risk breaking it, then just re provision from that AMI if you fucked up. And if you're chasing three or four nines of uptime you do the same but provision a new instance and futz with that one while your working one keeps on keeping on. Even big instances are cheap enough by the hour that you can afford to run and extra one while testing potentially breaking changes.
- nasretdinov 2y agoAt least it doesn't say to set PermitRootLogon and remove the root password :)
- Foobar8568 2y agoAKA, "We are compatible with passwordless authentication mechanism." Or SSO, depending of the use case.... Le sight.
- at_a_remove 2y agoAnd I find this to be mean-spirited ("snarky") and the opposite of instructive. Perhaps I am new, or rusty, and I do not know about SSH keys or remember them. Bang! Trapped! And then how is a newbie to trust the rest of this, much less learn? Good instruction will tell you why and the consequences of missing a step. Perhaps some options. But perhaps I want too much, the title does include the word "terrible," after all.
- hedora 2y agoSay you get stuck at this point, and can’t fix it yourself. That’s a strong indicator you won’t be able to support the setup moving forward. What if apt wedges some firewall rule, or the machine starts OOMing?
- SR2Z 2y agoThen your software will be set back by a day! The horror!
- bigiain 2y agoOr all your cat pictures get crypto lockered. Or your user database full of PII gets popped. Or your html/css/javascript gets modified to send all your supposedly secure Stripe checkout credit card details to eViLHackerz.ru (Or your unmetered 1GBit network connection gets used to host p0rn or stage attacks for Mossad on hospitals and water utilities and power stations...)
- johnklos 2y agoI'm writing a how-to for colocating for people who're closer to newbies. In this case, Rachel's article did suggest it's not for newbies.
- bigiain 2y agoIf you are new or rusty, Stop. You are not ready for this. Seriously. Not knowing or remembering abut ssh keys is way below the minimum baseline of skills that are needed to manage a server connected to the internet. Managing colo-ed servers when you're only just experienced enough to know about and know how to set up ssh keys without being told _is_ a terrible idea.
- hinkley 2y agoRelated to this, is the advice I give everyone for editing the sudoers file: First, open two superuser terminals. The second one is so if you fuck up the sudoers format so it doesn't parse and you accidentally 'exit' one too many times in the first terminal.
- deberon 2y agoThe visudo command is often times available as well. It won’t let you save a malformed sudoers file. Finding other footguns though is an exercise for the reader.
- hinkley 2y agoIt will however let you accidentally break "sudo su -" and happily tell you to go fuck yourself afterward.
- rsyring 2y ago
- Taniwha 2y agoI would add: disable root logins, create exactly one account that can login, require a password for sudo