4 ms·
Ask HN: How do you keep your servers/sites safe from hackers?
Hi,
This week I expect to receive delivery of a server with which I'll be building a prototype of an OpenStack server whose purpose will be to rent VPS instances to the public. I haven't yet figured out how, but somehow there will be a public facing customer portal providing management access to the rented server instances, and I'm interested in making the security which protects this management panel strong enough to be a selling point when I go live.
I'm a little concerned that by making it a selling point I may be inadvertantly inviting hackers to come attack my site, but its a chance I'm willing to take.
I haven't figured out how OpenStack handles its customer portal yet, but I imagine however it works, it would help to protect it by placing it behind my own customer login system of some sort. I don't know how to code, so I'd have to figure out how to write something to implement this sort of thing- maybe I could crowdsource its development, but even then I would need to know enough about how it would need to be designed so that it would be secure from hackers.
All I know about hacker-proofing is that there's an app that exists called fail2ban that locks out repeated ssh login attempts. I don't know if it could be adapted to work for a site somehow.
How would HN readers make hacker safety a selling point in this case?
Many thanks in advance.
-c
- mike-cardwell 13y agoWork under the assumption that it will be hacked, and try to minimise the damage that will occur when it does. Hashing/salting passwords is a commonly used example of doing this.
- t0 13y agoThere are a lot of misconceptions about hacking. If someone were to target your site and try to "hack" it, they'd simply be checking for vulnerabilities. A few simple steps can secure you from 99% of them. For example, securing inputs. Any time data is sent to your site, check it for injection attacks or password guessing. >I don't know how to code That might be an issue. But, a management console isn't too complex. You just need to offer the ability to turn off, turn on, reboot, and a couple of other functions. I personally use http://www.proxmox.com/proxmox-ve http://www.proxmox.com/proxmox-ve that has an API you can perform most server operations with a line of code.
- tptacek 13y agoWould that it were so that simply checking inputs would eliminate 99% of vulnerabilities; the diversity of different "checks" you need for every input reduces that suggestion to the moral equivalent of "just program better".
- alinajaf 13y ago> Any time data is sent to your site, check it for injection attacks or password guessing. That's two classes of exploit out of a very, very long list. The set of things that could possibly be wrong with software that reads HTTP requests out of a tcp socket is legion.
- cdvonstinkpot 13y agoI personally love PVE & was using it in 2009-2010, back when vhost=on was new & before v2 with the new clustering engine. I originally wanted to use it for my VPS backend just because I knew it well, but opted for OpenStack because it has a billing & metering component, which would be more difficult to implement with PVE. Its nice to hear from someone else who uses it.
- cdvonstinkpot 13y agoI was thinking to use Yubikey MFA, and _not_ to make there be a link to bypass it if you don't have your key with you, so that no one can brute force anything ever.