14 ms·

Adding to the commentary on here with something not so gushing: * kernels lag terribly behind the distributions meaning you're wide open sometimes. * can't re

by bananas 13y ago

Adding to the commentary on here with something not so gushing: * kernels lag terribly behind the distributions meaning you're wide open sometimes. * can't resize or add storage * no freebsd support or custom kernels * VM availability problems. If you want to have another box, you aren't guaranteed to get one. * no IPv6 * somewhat shonky security reputation. * cant deliver to yahoo mail from their AMS2 IPs I've been given even after filling in numerous forms at yahoo. Apart from that, they're the best hosts out there. I pick them over Linode, Hetzner and EC2 but not colo. Even at the price point they're at.

hiphopyo 13y ago
My logs show increased break-in attempts after moving to Digital Ocean. Their IPs are hot targets for hackers, making it all the more important to properly secure my droplets, something I'm having a hard time doing in Linux. With Linux, it's lot of beating around the bush. Overcomplicated config files, a lot of disabling and removing of things one don't need, having to deal with a messy and outdated firewall. With OpenBSD, lo and behold I'd have one of the simplest, most secure and well-configured droplets the world has ever seen.
- bananas 13y ago
  Yeah noticed that as well. First thing I do is (on debian), update packages and the kernel, install ufw (allow only 22), fail2ban, postfix and logwatch. Then setup a non privileged user, sudo, turn of root ssh and password auth and move to key based auth. Then I can sleep/configure the rest of the system. Been meaning to package this all up in an ansible playbook but I can't be bothered :( I'd be using FreeBSD if they offered it. Much like OpenBSD it's a lot more pleasant for sysadmins!
  - hiphopyo 13y ago
    Awesome, please do! Don't forget https://github.com/kickstarter/rack-attack https://github.com/kickstarter/rack-attack as well though.
  - dmix 13y ago
    I'm amazed noone ever mentions GRSecurity as must have. It will reduce the risks of an actual comprise significantly. Non-patched Linux is always full of rootkit potential.
    - bananas 13y ago
      Well they don't issue GRSecurity kernels. To be fair I'd just use FreeBSD which has a little better kernel architecture with respect to security.
    - hiphopyo 13y ago
      Some more regarding GRSecurity: https://mail-archive.com/misc@openbsd.org/msg127100.html https://mail-archive.com/misc@openbsd.org/msg127100.html
  - jnsaff2 13y ago
    It took me about an hour to put all of this into an ansible playbook. I think there are couple of examples out on blogs about this as well. If there is interest I'll share my playbook. Writing this playbook paid off already for the second installation of the box.
    - nikhilalmeida 13y ago
      Please do.
    - radioact1ve 13y ago
      Don't mind me, I'll just wait here till you're ready.
    - OWaz 13y ago
      The most I know about securing a Linux vps I picked up from this: http://feross.org/how-to-setup-your-linode/ http://feross.org/how-to-setup-your-linode/ . If there is an ultimate resource on how to start securing a *nix vps then please do let me know. If I knew what to search for I could but a lot of this is unknown unknowns to me.
      - mverwijs 13y ago
        After having fixed a sudo user (and confirm it works!), please also disable PermitRootLogin by setting it to 'no'. Restart ssh after editing sshd_conf. If you're squeemish, run dropbear on another port so you can log into your machine in case you made a boo-boo configuring openssh. Also, more resources for security settings: https://benchmarks.cisecurity.org/downloads/multiform/index.cfm https://benchmarks.cisecurity.org/downloads/multiform/index....
    - flexd 13y ago
      I'd like a copy of that playbook too :-), publish it somewhere?
    - mimiflynn 13y ago
      yes please
  - iamtew 13y ago
    Moving your SSH server away from port 22 and disabling password logins is also something you should consider doing. Small thing but at least then it doesn't shout "Hey I'm a *nix box with remote login enabled"
    - api 13y ago
      Is it actually likely that someone would brute force a password? I always install fail2ban, but it's more just to stop bots from filling up my logs with junk and eating my bandwidth/CPU. Unless you use dumb passwords, the odds are phenomenally low.
      - mindcrime 13y ago
        I'm not sure, but I've come around to realize that it's always worth installing and configuring fail2ban just for the reasons you mentioned, if nothing else. I have a demo server that, for a while, was being hammered so hard by ssh brute-force bots that it kept getting knocked offline. I installed fail2ban and no more problems since. I personally can't recommend fail2ban highly enough.
        MertsA 13y ago
        fail2ban is based on the horribly flawed premise of correctly parsing arbitrary text logs from tons of different programs that wrote their log format without any concerns about parsing that output later. Not surprisingly there have been numerous vulnerabilities in fail2ban that let an attacker ban arbitrary hosts such as your DNS server, database, etc. https://www.google.com/search?q=fail2ban+dos+bug https://www.google.com/search?q=fail2ban+dos+bug A better approach is something like pam_abl which is a pam module that will accomplish mostly the same thing but only for login attempts and without the crappy plain text log parsing.
        flexd 13y ago
        Have you tried denyhosts? I've always been installing denyhosts but I have not compared the two.
  - phaker 13y ago
    > update packages and the kernel PSA: If you just update the kernel using system tools within the instance, it'll still boot the old one. (At least it did few months ago.) The grub (or other bootloader) and kernels that are installed inside the instance's disk image are silently ignored and the vm uses a kernel stored outside of your instance's image. You can select which kernel image you want to boot in the control panel. The problem is that the kernels available in there are updated very, very rarely. For popular distributions like Ubuntu they can lag several months, for others it can get up to, say, _two years_ [1]. Since digitalocean "doesn't support custom kernels" it appears that the only way to use something up to date (and stay secure) is to write a script that loads a custom kernel using kexec. :S edit: The fact that they use kvm (and that kexec works) which means real visualization but can't boot user's kernels is just very, very weird. The only technical reason i can think of is that they can't manage to make it work with their control panel. If that's the reason, then it's very worrying. (The "right" way is easier to code and it's the solution that you'd think of first and it makes custom kernels a non-problem, but they picked one that both has obvious problems and is harder to setup, i can't think of a reason why.) [1]: https://www.digitalocean.com/community/questions/how-can-i-boot-my-compiled-kernel-image-on-gentoo https://www.digitalocean.com/community/questions/how-can-i-b...
    - bananas 13y ago
      It does still boot the old one. You have to power it off, change the kernel and power it up again.
    - sn 13y ago
      Second shameless plug on this page: if running your own linux kernel or BSD is really important to you, http://prgmr.com http://prgmr.com can do that and we have out of band console access so you can debug why it's not working (I was having problems with that when I was checking whether some linux+xen bugs were also present on ec2.) At this time we only support xen paravirtualization(PV) though, which almost, but not quite, all major distributions have. Notably we can't run 64-bit freebsd right now because they only have HVM support. I'd like to change that but it needs more testing first. Here is a partial list of distributions supporting xen: http://wiki.xen.org/wiki/DomU_Support_for_Xen http://wiki.xen.org/wiki/DomU_Support_for_Xen Really any linux distribution with a modern kernel can be made to support it though as support has been in mainline for a long time now.
- eli 13y ago
  I think that's a little unfair... Your server needs to be hardened against drive-by SSH password guessing and similar nonsense regardless of how or where it's connected to the internet.
  - bananas 13y ago
    That is true but as per the poster above, I've seen 10x the attack traffic on a DO IP address so any zero-days and you're already herded into a predictable net block ready to be poked.
    - aroch 13y ago
      This is true for pretty much any VPS-only hoster, they all have well defined ranges and tons of targets to attack. I see thousands of attempts a day at Linode and hundreds at Leaseweb (dedi and VPSes) and DO. It's just part of doing business.
      - eli 13y ago
        It's certainly true for dedicated-only hosters too.
        aroch 13y ago
        I guess I should have said 'personal server', not like AWS or Google's Cloud platforms.
- phaemon 13y ago
  Do: sudo ufw allow proto tcp from any to any port 22 sudo ufw enable Then you can just edit /etc/ssh/sshd_config the same as you would on OpenBSD.
  - rschmitty 13y ago
    This is why I love having a static IP. sudo ufw allow from your.ip.addr to tcp port 22 Rest of the world doesnt know I have ssh up and if I'm ever in a hotel or something I can tunnel through my home or login to DO's panel and allow another ip
    - aroch 13y ago
      I have essentially a static IP (A 'dynamic' IP with a 6month lease that stays the same on renewal and follows my account regardless of where I live), but you're super fucked if for some reason your IP changes. I usually set it to the /24 I'm assigned from.
      - rschmitty 13y ago
        How are you screwed? You can always login to the console in the web admin and change it
    - fredsted 13y ago
      I could imagine this being quite dangerous, like being on holiday, there's a power outage, fire, ISP error, etc at home and no way to control your server.
      - deleted 13y ago
        [deleted]
    - bananas 13y ago
      Don't do that. I did that once and our static ip changed suddenly despite lots of money being spent on it. That was a painful day driving from London to Manchester for me to get to the console.
- bad_user 13y ago
  Just install ufw. It's very simple to configure the rules for a basic server. Here's how: https://www.digitalocean.com/community/articles/how-to-setup-a-firewall-with-ufw-on-an-ubuntu-and-debian-cloud-server https://www.digitalocean.com/community/articles/how-to-setup...
  - oinksoft 13y ago
    Why would you use that over iptables? It's simple and doesn't require installing a package. > There is a lot of functionality built into these > utilities, iptables being the most popular nowadays, but > they require a decent effort on behalf of the user to > learn and understand them. Is that a corner worth cutting?
    - bananas 13y ago
      Iptables is a crime against humanity from a config and documentation perspective. ufw makes it bearable. I'd rather use pf on BSD though.
      - AznHisoka 13y ago
        I agree. iptables is horrid.
    - bad_user 13y ago
      iptables is powerful but definitely not simple. Simple is being able to simply say "allow all outgoing traffic and incoming traffic should only be allowed for HTTP(S) and SSH" and being able to figure out how to do it by just invoking "ufw --help". Maybe someday I'll learn about iptables, I'm sure it's going to be worth it, but for now ufw does the job for me.
      - nknighthb 13y ago
        > iptables is powerful but definitely not simple. > Maybe someday I'll learn about iptables Hmm... iptables -A INPUT -p tcp --dport 22 -j ALLOW iptables -A INPUT -p tcp --dport 80 -j ALLOW iptables -A INPUT -p tcp --dport 443 -j ALLOW iptables -A INPUT -p icmp -j ALLOW iptables -A INPUT -i eth0 -j DROP So complicated...
adestefan 13y ago
It's also really hard to get an answer out of them for more than the simplest of questions.
- bananas 13y ago
  Using ALL CAPS on their IRC channel works quite well ;)
talkingquickly 13y ago
I also use them and in general like them but would add to this list; * Can't add backups to an already provisioned node * Undocumented "droplet limits" e.g. one day you'll click "Add Droplet" and it will say "You've reached your droplet limit, please contact support". They'll generally raise it after some basic security verification but it's a nasty shock since you don't find out about it until you need to provision a new Droplet, especially if you're in a hurry.
- joe_bleau 13y ago
  I too have been bit by the droplet limit. $60 credit (but no credit card) in my account, wanted to spin up a fast box to build a kernel, but I was locked out of the larger droplets. Never did get a straight answer as to why, just a suggestion to link a credit card. Oh well.
  - raiyu 13y ago
    There are two droplet limits, one is the number of droplets that you can spin up which you can see in your settings page: https://cloud.digitalocean.com/settings https://cloud.digitalocean.com/settings The second is if a customer signs up using Paypal we restrict some of the larger sizes, this is done to minimize the amount of fraud we have to deal with. Unfortunately we deal with a high amount of abusive and fraudulent signups so we've had to instate a lot of automated filters and other updates to the user experience. It really sucks, but without it we'd have a lot more fraud which would really just make the entire experience worse overall. In either case opening up a ticket will get either issue resolved. Sorry for the inconvenience but if anyone is good at fraud detection and wants to help us to continue to automate it and make it smarter, we are hiring =] Thanks, Moisey
    - isalmon 13y ago
      I'm paying with my credit card and larger sizes are disabled for me (NY1 location).
    - joe_bleau 13y ago
bhouston 13y ago
> * can't resize or add storage This is a huge issue for us and we've wasted time with this.
- barake 13y ago
  Resizing is our #1 issue with DO. The current quick resize adds cores and RAM just fine, but it's a one way trip. It's not possible to shrink upsized instances like you can on Linode. On DO you can't even restore a snapshot or backup to a smaller instance size - you must rebuild from scratch. I guess the right way to handle this is a configuration management tool, but this is a real pain since there is only local storage.
  - vacri 13y ago
    a configuration management tool Yes, this is vital, but it's still not going to help you maintain existing data. A config management tool isn't going to fill out your logs, for example.
bmelton 13y ago
Their DMCA / Copyright / bad content process is horribly, horribly broken, and they will generally (where I think generally is the most polite way to put it) take the side of the accuser, even if that accuser is anonymous, or random, or fraudulently making the accusation.
- icebraining 13y ago
  How do you suggest that they would proceed, considering that the DMCA forces them to "expeditiously remove or disable access to the allegedly infringing material", on the contingent of being liable themselves for copyright infringement?
  - bmelton 13y ago
    The DMCA prescribes a dispute policy, that allows the accused to refute the evidence provided by the accusers. I've seen numerous complaints indicating that Digital Ocean abides no such policies. http://digitalocean.uservoice.com/forums/136585-digitalocean/suggestions/4165512-let-customers-know-that-you-suspend-service-at-the http://digitalocean.uservoice.com/forums/136585-digitalocean...
    - icebraining 13y ago
      The dispute (counter-notice) and put-back procedures in the DMCA say that the provider can put the content back online if the copyright owner does not bring a lawsuit within 14 days. I don't see anyone in that thread saying they violate this procedure; all I see is talk about some 48 hours limit, which is definitively not in the law.
      - bmelton 13y ago
        I have personally never been a customer of Digital Ocean, in large part because, having heard these stories, would prefer that DO at least mention the matter to me before terminating service or locking my account. Knowing first hand that other providers handle the exact same scenario with ample amounts of equitability informs my decision that there's a better way to go about it. Effectively, it's the kind of policy that would allow me to jokingly refer competitors to becoming DO customers.
fuzzix 13y ago
Don't write about the owner's golf buddies either. https://vpsexperience.wordpress.com/ https://vpsexperience.wordpress.com/ An odd experience, I would say.
- hangonhn 13y ago
  Can someone verify this story? It sounds pretty convincing with screenshots and all. If it's true I'm taking my business else where.
  - rschmitty 13y ago
    Seems very odd that both a "Googler" and a VPS provider would be naive enough to think that telling someone to delete a blog post "OR ELSE" would result in anything but the pasting of the content everywhere under the sun outside of google/DO's control to spread the word on how evil they were. I guess it could happen, but wow.. its like trying to get Beyonce derp face or whatever meme removed from the internet
    - raamdev 13y ago
      It seems odd to me that DO never bothered to make any kind of statement to counter this guy's claims (at least not that I've seen), especially considering how well-known this story has become. That tells me that DO is either guilty or doesn't care enough about their reputation to even so much as publish a statement to help ease customers' (and potential customers) fears/worries. That's enough for me to stay away from them.
      - syntern 13y ago
        Just because someone have not commented on something does not mean they are guilty. They might not know about it. Some people live in the real world, with a large latency to news, e-mail or social media outlets. Yeah, I know, it is strange.
        13y ago
madsushi 13y ago
* only have the option of 1 IP address per droplet (no plans to change)
- toomuchtodo 13y ago
  Why do you need more with virtual hosting and SNI?
  - eli 13y ago
    Why do you assume my customers have browsers that support SNI? About 10% are still running IE8.
verelo 13y ago
Call me crazy, but do you think filling these issues are probably part of why they're raising funding? Getting ahead takes capital and i'm sure they're aware of what makes them inferior, you can't raise $37m without a good story on how you're going to use it to get ahead and win.
- bananas 13y ago
  No because hosts on 1/10th of the budget are doing these things already. I have great hope for http://bigv.io http://bigv.io but they're not quite there yet.
  - verelo 13y ago
    Do you actually have evidence of this or is this an off the cuff statement? Having worked for some big hosts myself, i know how hard it can be to make changes once you have people using your platform. I suspect DO are in a similar situation and are looking to make a big leap forward with new growth leveraging their existing brand. I have no real evidence of this, but it feels like a sensible course of action. No one likes giving up equity and taking money unless there is a damn good reason for it.
    - bananas 13y ago
      Amongst other obscure jobs I've been employed to dig people out of the crap many a time in the hosting sector so yes I'm pretty close to this sort of stuff. Normally in these situations, much as they do with DO already with disparate DC capabilities, you deploy infrastructure side-by-side and slowly port it over from one system to another. Developing the capabilities isn't really a big problem even if you build it versus buy as the total developer / administrator / server ratios on these sorts of companies are pretty favourable to massive automation. I suspect they really do just want the money. Either than or they've short-sold themselves as a bargain host and now have trouble generating revenue and will lose too many customers if they crank prices so they're riding the investor's crack pipes via hype. The latter is all too common unfortunately. One of the UK's "leading" hosts I did some consultancy for in the mid 00's actually relaunched with just under 50 CentOS servers with shared hosting/cPanel stuff on them but priced too low. They got customers but not enough to pay for the cage. Spent a couple of months moving their shit into a single 42U and consolidating their billing and provisioning system. They're still around now and can pay the bills. I did it for cash - I wouldn't want the equity myself.
exratione 13y ago
Yes, they have issues with IPs having been blacklisted. I ran into that in connection with MIPSpace. Large swathes of DO IPs are blacklisted by MIPSpace, which impacts my deliverability for a small double opt-in hobby list. - Digital Ocean says they can't get MIPSpace to remove IPs. - MIPSpace will only deal with me if I can get DO to add rwhois/SWIP for my IP - Digital Ocean doesn't offer that feature (of course). So I'm somewhat stuck there. Not as though things are going to be any better elsewhere on another cloud service, I suppose, though I never had these issues at AWS. But moving back would triple the cost of running an equivalent mail server. Hopefully some of the funding here can be used by DO to actually clean up their IPs and manage the issues with the less reasonable blacklists like MIPSpace - who doesn't send abuse notices, and seems pretty capricious, from what I'm reading. Since DO are in the business of renting IP addresses, it would be good if those IP addresses were not usually on some blacklist somewhere.
- TheSwordsman 13y ago
  MIPSpace is stupid if they think you can get SWIP from DO. This is not DO's policy, but the RIR. I seem to remember that for ARIN you need a /30 or larger of consecutive IP address space to qualify for SWIP. This may even be a /28. So while DO is saying no, I'm wondering if it's because they don't offer the space required to SWIP the ranges. In addition to not offering the size, it would incur additional administrative overhead. Can't blame them.
  - Dylan16807 13y ago
    According to https://www.arin.net/resources/request/reassignments.html https://www.arin.net/resources/request/reassignments.html it's actually mandatory to provide whois tracking for assignments /29 or shorter prefix, and optional for /30 or longer prefix. I can't find any reason they wouldn't be able to provide it if they wanted to. Edit: definitely possible http://lowendtalk.com/discussion/12406/which-providers-provides-32-swips http://lowendtalk.com/discussion/12406/which-providers-provi... So you shouldn't call MIPSpace stupid, thanks.
aedocw 13y ago
Regarding being potentially wide-open to exploits due to kernels being out of date, I would recommend installing ksplice uptrack (https://www.ksplice.com/ https://www.ksplice.com/). It allows you to apply kernel security updates without rebooting your machine. It's excellent, and I wouldn't consider running Ubuntu without it.
workhere-io 13y ago
I'm surprised you say that you pick them over Linode, because Linode seems to have the features you mentioned were missing at Digital Ocean.
- bananas 13y ago
  Three things put me off Linode: 1. Dependency on ColdFusion. Seriously that product is dead, poorly maintained and powers the entire front end. That's scary. Even more scary than PHP written by outsources from Elbonia. They got hacked due to this. 2. Billing system is take then refund credit rather than billing afterwards. 3. From my location their latency and throughput sucked even in their EU DC despite being only 11 miles from my house.
retr0h 13y ago
I actually like the Linode guys. They have been around for quite some time, and solid as hell. They don't have all the hipster devs talking about them as much, but I think they are more viable than DO.
km3k 13y ago
I haven't used Digital Ocean, but I've heard you can use Arch Linux on it. How can you be far behind on kernels if using Arch Linux?
tankenmate 13y ago
Actually you can run custom kernels on DO VMs, in fact I have a machine doing that right now. In fact if push came to shove I reckon you'd even be able to get Windows to boot on a DO VM; it would be difficult but do-able.
- kchoudhu 13y ago
  I got FreeBSD running on by dropping into the PXE shell a while back. Didn't last past reboot, though: DO does some weird stuff to boot operating systems (maybe it wipes out the MBR every time?) Got a $20 credit for my trouble (good PR!), and then promptly moved on to a provider that actually supports my needs.

by bananas 13y ago

hiphopyo 13y ago

My logs show increased break-in attempts after moving to Digital Ocean. Their IPs are hot targets for hackers, making it all the more important to properly secure my droplets, something I'm having a hard time doing in Linux. With Linux, it's lot of beating around the bush. Overcomplicated config files, a lot of disabling and removing of things one don't need, having to deal with a messy and outdated firewall. With OpenBSD, lo and behold I'd have one of the simplest, most secure and well-configured droplets the world has ever seen.

bananas 13y ago
Yeah noticed that as well. First thing I do is (on debian), update packages and the kernel, install ufw (allow only 22), fail2ban, postfix and logwatch. Then setup a non privileged user, sudo, turn of root ssh and password auth and move to key based auth. Then I can sleep/configure the rest of the system. Been meaning to package this all up in an ansible playbook but I can't be bothered :( I'd be using FreeBSD if they offered it. Much like OpenBSD it's a lot more pleasant for sysadmins!
- hiphopyo 13y ago
  Awesome, please do! Don't forget https://github.com/kickstarter/rack-attack https://github.com/kickstarter/rack-attack as well though.
- dmix 13y ago
  I'm amazed noone ever mentions GRSecurity as must have. It will reduce the risks of an actual comprise significantly. Non-patched Linux is always full of rootkit potential.
  - bananas 13y ago
    Well they don't issue GRSecurity kernels. To be fair I'd just use FreeBSD which has a little better kernel architecture with respect to security.
  - hiphopyo 13y ago
    Some more regarding GRSecurity: https://mail-archive.com/misc@openbsd.org/msg127100.html https://mail-archive.com/misc@openbsd.org/msg127100.html
- jnsaff2 13y ago
  It took me about an hour to put all of this into an ansible playbook. I think there are couple of examples out on blogs about this as well. If there is interest I'll share my playbook. Writing this playbook paid off already for the second installation of the box.
  - nikhilalmeida 13y ago
    Please do.
  - radioact1ve 13y ago
    Don't mind me, I'll just wait here till you're ready.
  - OWaz 13y ago
    The most I know about securing a Linux vps I picked up from this: http://feross.org/how-to-setup-your-linode/ http://feross.org/how-to-setup-your-linode/ . If there is an ultimate resource on how to start securing a *nix vps then please do let me know. If I knew what to search for I could but a lot of this is unknown unknowns to me.
    - mverwijs 13y ago
      After having fixed a sudo user (and confirm it works!), please also disable PermitRootLogin by setting it to 'no'. Restart ssh after editing sshd_conf. If you're squeemish, run dropbear on another port so you can log into your machine in case you made a boo-boo configuring openssh. Also, more resources for security settings: https://benchmarks.cisecurity.org/downloads/multiform/index.cfm https://benchmarks.cisecurity.org/downloads/multiform/index....
  - flexd 13y ago
    I'd like a copy of that playbook too :-), publish it somewhere?
  - mimiflynn 13y ago
    yes please
- iamtew 13y ago
  Moving your SSH server away from port 22 and disabling password logins is also something you should consider doing. Small thing but at least then it doesn't shout "Hey I'm a *nix box with remote login enabled"
  - api 13y ago
    Is it actually likely that someone would brute force a password? I always install fail2ban, but it's more just to stop bots from filling up my logs with junk and eating my bandwidth/CPU. Unless you use dumb passwords, the odds are phenomenally low.
    - mindcrime 13y ago
      I'm not sure, but I've come around to realize that it's always worth installing and configuring fail2ban just for the reasons you mentioned, if nothing else. I have a demo server that, for a while, was being hammered so hard by ssh brute-force bots that it kept getting knocked offline. I installed fail2ban and no more problems since. I personally can't recommend fail2ban highly enough.
      - MertsA 13y ago
        fail2ban is based on the horribly flawed premise of correctly parsing arbitrary text logs from tons of different programs that wrote their log format without any concerns about parsing that output later. Not surprisingly there have been numerous vulnerabilities in fail2ban that let an attacker ban arbitrary hosts such as your DNS server, database, etc. https://www.google.com/search?q=fail2ban+dos+bug https://www.google.com/search?q=fail2ban+dos+bug A better approach is something like pam_abl which is a pam module that will accomplish mostly the same thing but only for login attempts and without the crappy plain text log parsing.
      - flexd 13y ago
        Have you tried denyhosts? I've always been installing denyhosts but I have not compared the two.
- phaker 13y ago
  > update packages and the kernel PSA: If you just update the kernel using system tools within the instance, it'll still boot the old one. (At least it did few months ago.) The grub (or other bootloader) and kernels that are installed inside the instance's disk image are silently ignored and the vm uses a kernel stored outside of your instance's image. You can select which kernel image you want to boot in the control panel. The problem is that the kernels available in there are updated very, very rarely. For popular distributions like Ubuntu they can lag several months, for others it can get up to, say, _two years_ [1]. Since digitalocean "doesn't support custom kernels" it appears that the only way to use something up to date (and stay secure) is to write a script that loads a custom kernel using kexec. :S edit: The fact that they use kvm (and that kexec works) which means real visualization but can't boot user's kernels is just very, very weird. The only technical reason i can think of is that they can't manage to make it work with their control panel. If that's the reason, then it's very worrying. (The "right" way is easier to code and it's the solution that you'd think of first and it makes custom kernels a non-problem, but they picked one that both has obvious problems and is harder to setup, i can't think of a reason why.) [1]: https://www.digitalocean.com/community/questions/how-can-i-boot-my-compiled-kernel-image-on-gentoo https://www.digitalocean.com/community/questions/how-can-i-b...
  - bananas 13y ago
    It does still boot the old one. You have to power it off, change the kernel and power it up again.
  - sn 13y ago
    Second shameless plug on this page: if running your own linux kernel or BSD is really important to you, http://prgmr.com http://prgmr.com can do that and we have out of band console access so you can debug why it's not working (I was having problems with that when I was checking whether some linux+xen bugs were also present on ec2.) At this time we only support xen paravirtualization(PV) though, which almost, but not quite, all major distributions have. Notably we can't run 64-bit freebsd right now because they only have HVM support. I'd like to change that but it needs more testing first. Here is a partial list of distributions supporting xen: http://wiki.xen.org/wiki/DomU_Support_for_Xen http://wiki.xen.org/wiki/DomU_Support_for_Xen Really any linux distribution with a modern kernel can be made to support it though as support has been in mainline for a long time now.
eli 13y ago
I think that's a little unfair... Your server needs to be hardened against drive-by SSH password guessing and similar nonsense regardless of how or where it's connected to the internet.
- bananas 13y ago
  That is true but as per the poster above, I've seen 10x the attack traffic on a DO IP address so any zero-days and you're already herded into a predictable net block ready to be poked.
  - aroch 13y ago
    This is true for pretty much any VPS-only hoster, they all have well defined ranges and tons of targets to attack. I see thousands of attempts a day at Linode and hundreds at Leaseweb (dedi and VPSes) and DO. It's just part of doing business.
    - eli 13y ago
      It's certainly true for dedicated-only hosters too.
      - aroch 13y ago
        I guess I should have said 'personal server', not like AWS or Google's Cloud platforms.
phaemon 13y ago
Do: sudo ufw allow proto tcp from any to any port 22 sudo ufw enable Then you can just edit /etc/ssh/sshd_config the same as you would on OpenBSD.
- rschmitty 13y ago
  This is why I love having a static IP. sudo ufw allow from your.ip.addr to tcp port 22 Rest of the world doesnt know I have ssh up and if I'm ever in a hotel or something I can tunnel through my home or login to DO's panel and allow another ip
  - aroch 13y ago
    I have essentially a static IP (A 'dynamic' IP with a 6month lease that stays the same on renewal and follows my account regardless of where I live), but you're super fucked if for some reason your IP changes. I usually set it to the /24 I'm assigned from.
    - rschmitty 13y ago
      How are you screwed? You can always login to the console in the web admin and change it
  - fredsted 13y ago
    I could imagine this being quite dangerous, like being on holiday, there's a power outage, fire, ISP error, etc at home and no way to control your server.
    - deleted 13y ago
      [deleted]
  - bananas 13y ago
    Don't do that. I did that once and our static ip changed suddenly despite lots of money being spent on it. That was a painful day driving from London to Manchester for me to get to the console.
bad_user 13y ago
Just install ufw. It's very simple to configure the rules for a basic server. Here's how: https://www.digitalocean.com/community/articles/how-to-setup-a-firewall-with-ufw-on-an-ubuntu-and-debian-cloud-server https://www.digitalocean.com/community/articles/how-to-setup...
- oinksoft 13y ago
  Why would you use that over iptables? It's simple and doesn't require installing a package. > There is a lot of functionality built into these > utilities, iptables being the most popular nowadays, but > they require a decent effort on behalf of the user to > learn and understand them. Is that a corner worth cutting?
  - bananas 13y ago
    Iptables is a crime against humanity from a config and documentation perspective. ufw makes it bearable. I'd rather use pf on BSD though.
    - AznHisoka 13y ago
      I agree. iptables is horrid.
  - bad_user 13y ago
    iptables is powerful but definitely not simple. Simple is being able to simply say "allow all outgoing traffic and incoming traffic should only be allowed for HTTP(S) and SSH" and being able to figure out how to do it by just invoking "ufw --help". Maybe someday I'll learn about iptables, I'm sure it's going to be worth it, but for now ufw does the job for me.
    - nknighthb 13y ago
      > iptables is powerful but definitely not simple. > Maybe someday I'll learn about iptables Hmm... iptables -A INPUT -p tcp --dport 22 -j ALLOW iptables -A INPUT -p tcp --dport 80 -j ALLOW iptables -A INPUT -p tcp --dport 443 -j ALLOW iptables -A INPUT -p icmp -j ALLOW iptables -A INPUT -i eth0 -j DROP So complicated...

adestefan 13y ago

It's also really hard to get an answer out of them for more than the simplest of questions.

bananas 13y ago
Using ALL CAPS on their IRC channel works quite well ;)

talkingquickly 13y ago

I also use them and in general like them but would add to this list; * Can't add backups to an already provisioned node * Undocumented "droplet limits" e.g. one day you'll click "Add Droplet" and it will say "You've reached your droplet limit, please contact support". They'll generally raise it after some basic security verification but it's a nasty shock since you don't find out about it until you need to provision a new Droplet, especially if you're in a hurry.

joe_bleau 13y ago
I too have been bit by the droplet limit. $60 credit (but no credit card) in my account, wanted to spin up a fast box to build a kernel, but I was locked out of the larger droplets. Never did get a straight answer as to why, just a suggestion to link a credit card. Oh well.
- raiyu 13y ago
  There are two droplet limits, one is the number of droplets that you can spin up which you can see in your settings page: https://cloud.digitalocean.com/settings https://cloud.digitalocean.com/settings The second is if a customer signs up using Paypal we restrict some of the larger sizes, this is done to minimize the amount of fraud we have to deal with. Unfortunately we deal with a high amount of abusive and fraudulent signups so we've had to instate a lot of automated filters and other updates to the user experience. It really sucks, but without it we'd have a lot more fraud which would really just make the entire experience worse overall. In either case opening up a ticket will get either issue resolved. Sorry for the inconvenience but if anyone is good at fraud detection and wants to help us to continue to automate it and make it smarter, we are hiring =] Thanks, Moisey
  - isalmon 13y ago
    I'm paying with my credit card and larger sizes are disabled for me (NY1 location).
  - joe_bleau 13y ago

bhouston 13y ago

> * can't resize or add storage This is a huge issue for us and we've wasted time with this.

barake 13y ago
Resizing is our #1 issue with DO. The current quick resize adds cores and RAM just fine, but it's a one way trip. It's not possible to shrink upsized instances like you can on Linode. On DO you can't even restore a snapshot or backup to a smaller instance size - you must rebuild from scratch. I guess the right way to handle this is a configuration management tool, but this is a real pain since there is only local storage.
- vacri 13y ago
  a configuration management tool Yes, this is vital, but it's still not going to help you maintain existing data. A config management tool isn't going to fill out your logs, for example.

bmelton 13y ago

Their DMCA / Copyright / bad content process is horribly, horribly broken, and they will generally (where I think generally is the most polite way to put it) take the side of the accuser, even if that accuser is anonymous, or random, or fraudulently making the accusation.

icebraining 13y ago
How do you suggest that they would proceed, considering that the DMCA forces them to "expeditiously remove or disable access to the allegedly infringing material", on the contingent of being liable themselves for copyright infringement?
- bmelton 13y ago
  The DMCA prescribes a dispute policy, that allows the accused to refute the evidence provided by the accusers. I've seen numerous complaints indicating that Digital Ocean abides no such policies. http://digitalocean.uservoice.com/forums/136585-digitalocean/suggestions/4165512-let-customers-know-that-you-suspend-service-at-the http://digitalocean.uservoice.com/forums/136585-digitalocean...
  - icebraining 13y ago
    The dispute (counter-notice) and put-back procedures in the DMCA say that the provider can put the content back online if the copyright owner does not bring a lawsuit within 14 days. I don't see anyone in that thread saying they violate this procedure; all I see is talk about some 48 hours limit, which is definitively not in the law.
    - bmelton 13y ago
      I have personally never been a customer of Digital Ocean, in large part because, having heard these stories, would prefer that DO at least mention the matter to me before terminating service or locking my account. Knowing first hand that other providers handle the exact same scenario with ample amounts of equitability informs my decision that there's a better way to go about it. Effectively, it's the kind of policy that would allow me to jokingly refer competitors to becoming DO customers.

fuzzix 13y ago

Don't write about the owner's golf buddies either. https://vpsexperience.wordpress.com/ https://vpsexperience.wordpress.com/ An odd experience, I would say.

hangonhn 13y ago
Can someone verify this story? It sounds pretty convincing with screenshots and all. If it's true I'm taking my business else where.
- rschmitty 13y ago
  Seems very odd that both a "Googler" and a VPS provider would be naive enough to think that telling someone to delete a blog post "OR ELSE" would result in anything but the pasting of the content everywhere under the sun outside of google/DO's control to spread the word on how evil they were. I guess it could happen, but wow.. its like trying to get Beyonce derp face or whatever meme removed from the internet
  - raamdev 13y ago
    It seems odd to me that DO never bothered to make any kind of statement to counter this guy's claims (at least not that I've seen), especially considering how well-known this story has become. That tells me that DO is either guilty or doesn't care enough about their reputation to even so much as publish a statement to help ease customers' (and potential customers) fears/worries. That's enough for me to stay away from them.
    - syntern 13y ago
      Just because someone have not commented on something does not mean they are guilty. They might not know about it. Some people live in the real world, with a large latency to news, e-mail or social media outlets. Yeah, I know, it is strange.
      - 13y ago

madsushi 13y ago

* only have the option of 1 IP address per droplet (no plans to change)

toomuchtodo 13y ago
Why do you need more with virtual hosting and SNI?
- eli 13y ago
  Why do you assume my customers have browsers that support SNI? About 10% are still running IE8.

verelo 13y ago

Call me crazy, but do you think filling these issues are probably part of why they're raising funding? Getting ahead takes capital and i'm sure they're aware of what makes them inferior, you can't raise $37m without a good story on how you're going to use it to get ahead and win.

bananas 13y ago
No because hosts on 1/10th of the budget are doing these things already. I have great hope for http://bigv.io http://bigv.io but they're not quite there yet.
- verelo 13y ago
  Do you actually have evidence of this or is this an off the cuff statement? Having worked for some big hosts myself, i know how hard it can be to make changes once you have people using your platform. I suspect DO are in a similar situation and are looking to make a big leap forward with new growth leveraging their existing brand. I have no real evidence of this, but it feels like a sensible course of action. No one likes giving up equity and taking money unless there is a damn good reason for it.
  - bananas 13y ago
    Amongst other obscure jobs I've been employed to dig people out of the crap many a time in the hosting sector so yes I'm pretty close to this sort of stuff. Normally in these situations, much as they do with DO already with disparate DC capabilities, you deploy infrastructure side-by-side and slowly port it over from one system to another. Developing the capabilities isn't really a big problem even if you build it versus buy as the total developer / administrator / server ratios on these sorts of companies are pretty favourable to massive automation. I suspect they really do just want the money. Either than or they've short-sold themselves as a bargain host and now have trouble generating revenue and will lose too many customers if they crank prices so they're riding the investor's crack pipes via hype. The latter is all too common unfortunately. One of the UK's "leading" hosts I did some consultancy for in the mid 00's actually relaunched with just under 50 CentOS servers with shared hosting/cPanel stuff on them but priced too low. They got customers but not enough to pay for the cage. Spent a couple of months moving their shit into a single 42U and consolidating their billing and provisioning system. They're still around now and can pay the bills. I did it for cash - I wouldn't want the equity myself.

exratione 13y ago

Yes, they have issues with IPs having been blacklisted. I ran into that in connection with MIPSpace. Large swathes of DO IPs are blacklisted by MIPSpace, which impacts my deliverability for a small double opt-in hobby list. - Digital Ocean says they can't get MIPSpace to remove IPs. - MIPSpace will only deal with me if I can get DO to add rwhois/SWIP for my IP - Digital Ocean doesn't offer that feature (of course). So I'm somewhat stuck there. Not as though things are going to be any better elsewhere on another cloud service, I suppose, though I never had these issues at AWS. But moving back would triple the cost of running an equivalent mail server. Hopefully some of the funding here can be used by DO to actually clean up their IPs and manage the issues with the less reasonable blacklists like MIPSpace - who doesn't send abuse notices, and seems pretty capricious, from what I'm reading. Since DO are in the business of renting IP addresses, it would be good if those IP addresses were not usually on some blacklist somewhere.

TheSwordsman 13y ago
MIPSpace is stupid if they think you can get SWIP from DO. This is not DO's policy, but the RIR. I seem to remember that for ARIN you need a /30 or larger of consecutive IP address space to qualify for SWIP. This may even be a /28. So while DO is saying no, I'm wondering if it's because they don't offer the space required to SWIP the ranges. In addition to not offering the size, it would incur additional administrative overhead. Can't blame them.
- Dylan16807 13y ago
  According to https://www.arin.net/resources/request/reassignments.html https://www.arin.net/resources/request/reassignments.html it's actually mandatory to provide whois tracking for assignments /29 or shorter prefix, and optional for /30 or longer prefix. I can't find any reason they wouldn't be able to provide it if they wanted to. Edit: definitely possible http://lowendtalk.com/discussion/12406/which-providers-provides-32-swips http://lowendtalk.com/discussion/12406/which-providers-provi... So you shouldn't call MIPSpace stupid, thanks.

aedocw 13y ago

Regarding being potentially wide-open to exploits due to kernels being out of date, I would recommend installing ksplice uptrack (https://www.ksplice.com/ https://www.ksplice.com/). It allows you to apply kernel security updates without rebooting your machine. It's excellent, and I wouldn't consider running Ubuntu without it.

workhere-io 13y ago

I'm surprised you say that you pick them over Linode, because Linode seems to have the features you mentioned were missing at Digital Ocean.

bananas 13y ago
Three things put me off Linode: 1. Dependency on ColdFusion. Seriously that product is dead, poorly maintained and powers the entire front end. That's scary. Even more scary than PHP written by outsources from Elbonia. They got hacked due to this. 2. Billing system is take then refund credit rather than billing afterwards. 3. From my location their latency and throughput sucked even in their EU DC despite being only 11 miles from my house.

retr0h 13y ago

I actually like the Linode guys. They have been around for quite some time, and solid as hell. They don't have all the hipster devs talking about them as much, but I think they are more viable than DO.

km3k 13y ago

I haven't used Digital Ocean, but I've heard you can use Arch Linux on it. How can you be far behind on kernels if using Arch Linux?

tankenmate 13y ago

Actually you can run custom kernels on DO VMs, in fact I have a machine doing that right now. In fact if push came to shove I reckon you'd even be able to get Windows to boot on a DO VM; it would be difficult but do-able.

kchoudhu 13y ago
I got FreeBSD running on by dropping into the PXE shell a while back. Didn't last past reboot, though: DO does some weird stuff to boot operating systems (maybe it wipes out the MBR every time?) Got a $20 credit for my trouble (good PR!), and then promptly moved on to a provider that actually supports my needs.