3 ms·

I've added some comments to the ssh config to be more clear and provided some examples and a citation to the shared memory line.

tripzilch 14y ago
I found your article to be an interesting start-off point to read up more about certain tools and techniques on securing Ubuntu Linux machines. So it's absolutely useful, good of you to put it there. Some criticisms on, however: If the above was the goal, for an advanced audience, it could have been way way shorter. More like a checklist of tools and techniques, short paragraph explaining your choice and maybe a link to your particular config file if you think that's applicable. And that'd be fine, even if it means that I personally would have to Google most things to find out what they're for, it's a great starting point. If, however, your goal was introducing securing an Ubuntu box to relative newbies, by which I mean people who are quite familiar on the Linux command line (like me) but lack specific knowledge about networking, iptables and the tools of the trade (again, like me), your article should have been way way longer than it is :) Or maybe not longer necessarily, but way more in-depth. Maybe a series, even (that would be awesome, but perhaps a lot of work, I'm not saying you should put in a lot of time that you maybe don't have, just that what you do write ought to be optimal for the effort put in ;) ). Most of what seems to be missing in your article are answers to the questions "why (should I use this)?" and "what (is this for)?", both for the "advanced" audience, as for the "newbies". Probably most important is that you must state upfront that this article is about securing a web server. Some of the choices you make are relevant only for web servers, but it wasn't until halfway that you mention "since this machine will be running as a web server ..." and before there were some points I was wondering "hm I'm not sure if I'd want to lock my (desktop) box so tight, but hey this guy seems to know what he's talking about" ... maybe I'm stupid and I should have noticed earlier. In all fairness, if you'd have just titled your article "Securing an Ubuntu web server", I probably wouldn't even have clicked the link (cause I don't have much use for that info right now) and you wouldn't have got all this feedback ;-) You should have a short sentence explaining "Fail2ban is a program that ...", and another sentence going "iptables is a tool/configfile part of .../command/(no idea honestly[0]) that is used for ...". Not asking for an in-depth explanation, but a one-sentence "what it is". Most of your checklist of Bastille settings are just cryptic enough that I cannot guess what they would exactly do and whether my settings should be the same as yours. If you target an "advanced" audience, you could suffice with "I'm using Bastille for XYZ because it's good at doing PQR, check its manual, here's my config, in particular pay attention to options ABC". For a more "newbie" audience you might want to say "Bastille is a hardening program, it consists of a set of tools and programs and configures them and your system to harden it. A few examples are PQR, but there's much more". "These are my settings" (do these go into a config file or is it a list of questions that the sudo bastille command asks? you can assume that most of your audience is not using your article as a step-by-step tutorial, so this is not obvious), and then explain succinctly what each of them does. Maybe just copy bits from the Bastille manpage. Or maybe just explain the ones that are different from the default options, and/or the ones that you suppose people might want to change, and say for the others just "make JKL extra secure, leave this set to 'on', <link to docs> for more info". Hope that was useful for you! (And I don't mean you should do a complete rewrite of this article btw, you can also just take this general advice for the next one you write) [0] I'm guessing "configfile" and part of some low level Linux networking thing? If I had been sitting in front of a Linux desktop I'd have been reading the manpage on it by now.
- Benferhat 14y ago
  > If, however, your goal was introducing securing an Ubuntu box to relative newbies, by which I mean people who are quite familiar on the Linux command line (like me) but lack specific knowledge about networking, iptables and the tools of the trade (again, like me), your article should have been way way longer than it is :) Or maybe not longer necessarily, but way more in-depth. Maybe a series, even (that would be awesome, but perhaps a lot of work, I'm not saying you should put in a lot of time that you maybe don't have, just that what you do write ought to be optimal for the effort put in ;) ). Recommend any good articles?

tripzilch 14y ago

I found your article to be an interesting start-off point to read up more about certain tools and techniques on securing Ubuntu Linux machines. So it's absolutely useful, good of you to put it there. Some criticisms on, however: If the above was the goal, for an advanced audience, it could have been way way shorter. More like a checklist of tools and techniques, short paragraph explaining your choice and maybe a link to your particular config file if you think that's applicable. And that'd be fine, even if it means that I personally would have to Google most things to find out what they're for, it's a great starting point. If, however, your goal was introducing securing an Ubuntu box to relative newbies, by which I mean people who are quite familiar on the Linux command line (like me) but lack specific knowledge about networking, iptables and the tools of the trade (again, like me), your article should have been way way longer than it is :) Or maybe not longer necessarily, but way more in-depth. Maybe a series, even (that would be awesome, but perhaps a lot of work, I'm not saying you should put in a lot of time that you maybe don't have, just that what you do write ought to be optimal for the effort put in ;) ). Most of what seems to be missing in your article are answers to the questions "why (should I use this)?" and "what (is this for)?", both for the "advanced" audience, as for the "newbies". Probably most important is that you must state upfront that this article is about securing a web server. Some of the choices you make are relevant only for web servers, but it wasn't until halfway that you mention "since this machine will be running as a web server ..." and before there were some points I was wondering "hm I'm not sure if I'd want to lock my (desktop) box so tight, but hey this guy seems to know what he's talking about" ... maybe I'm stupid and I should have noticed earlier. In all fairness, if you'd have just titled your article "Securing an Ubuntu web server", I probably wouldn't even have clicked the link (cause I don't have much use for that info right now) and you wouldn't have got all this feedback ;-) You should have a short sentence explaining "Fail2ban is a program that ...", and another sentence going "iptables is a tool/configfile part of .../command/(no idea honestly[0]) that is used for ...". Not asking for an in-depth explanation, but a one-sentence "what it is". Most of your checklist of Bastille settings are just cryptic enough that I cannot guess what they would exactly do and whether my settings should be the same as yours. If you target an "advanced" audience, you could suffice with "I'm using Bastille for XYZ because it's good at doing PQR, check its manual, here's my config, in particular pay attention to options ABC". For a more "newbie" audience you might want to say "Bastille is a hardening program, it consists of a set of tools and programs and configures them and your system to harden it. A few examples are PQR, but there's much more". "These are my settings" (do these go into a config file or is it a list of questions that the sudo bastille command asks? you can assume that most of your audience is not using your article as a step-by-step tutorial, so this is not obvious), and then explain succinctly what each of them does. Maybe just copy bits from the Bastille manpage. Or maybe just explain the ones that are different from the default options, and/or the ones that you suppose people might want to change, and say for the others just "make JKL extra secure, leave this set to 'on', <link to docs> for more info". Hope that was useful for you! (And I don't mean you should do a complete rewrite of this article btw, you can also just take this general advice for the next one you write) [0] I'm guessing "configfile" and part of some low level Linux networking thing? If I had been sitting in front of a Linux desktop I'd have been reading the manpage on it by now.

Benferhat 14y ago
> If, however, your goal was introducing securing an Ubuntu box to relative newbies, by which I mean people who are quite familiar on the Linux command line (like me) but lack specific knowledge about networking, iptables and the tools of the trade (again, like me), your article should have been way way longer than it is :) Or maybe not longer necessarily, but way more in-depth. Maybe a series, even (that would be awesome, but perhaps a lot of work, I'm not saying you should put in a lot of time that you maybe don't have, just that what you do write ought to be optimal for the effort put in ;) ). Recommend any good articles?