3 ms·

Remove all the executables on your servers that don't actually need to be there. Any executable at all is a potential toehold for an intruder. Especially remo

Remove all the executables on your servers that don't actually need to be there. Any executable at all is a potential toehold for an intruder. Especially remove your compilers. Consider that the Morris worm, as well as lots of malware, enables portability by distributing itself in source code form.

cpach 12y ago
But if OP use S3, he’s not running the OS himself, right? Otherwise it sounds reasonable to keep compilers away from the production servers. On that note, what are some good schemes for installing self-compiled software to a server? For example, let’s say I run Ubuntu on my servers. On dev host X I have compiled a specific version of Ruby on Rails. Then I want to install that version of Rails to production server Y. I could make a .deb package, but I get a feeling there are other good alternatives as well?
- dagw 12y ago
  Containers of some kind. Once you have a working system on your dev machine, copy the whole setup from your dev machine to your production machine. This way you are absolutely sure that everything is identical and that you aren't accidentally running different versions of some binary and end up with a situation where you have a bug on your production machines that you cannot reproduce on your test machine. I learnt that lesson the hard way once when I was running python 2.7.3 on my test machine and python 2.7.2 in production.
  - cpach 12y ago
    So something like Docker?
    - dagw 12y ago
      Docker works, but there are lots of ways to get the same result. I'm not trying preach any specific method.
- MichaelCrawford 12y ago
  I build my own .debs and .rpms. They're not hard once you learn how. For a simple program, one that has only an executable, just scp it to /usr/local/bin on your server. I haven't actually done this but it would help to keep a list of all the files you've added, in case you want to remove them later, or reproduce the configuration elsewhere.

cpach 12y ago

But if OP use S3, he’s not running the OS himself, right? Otherwise it sounds reasonable to keep compilers away from the production servers. On that note, what are some good schemes for installing self-compiled software to a server? For example, let’s say I run Ubuntu on my servers. On dev host X I have compiled a specific version of Ruby on Rails. Then I want to install that version of Rails to production server Y. I could make a .deb package, but I get a feeling there are other good alternatives as well?

dagw 12y ago
Containers of some kind. Once you have a working system on your dev machine, copy the whole setup from your dev machine to your production machine. This way you are absolutely sure that everything is identical and that you aren't accidentally running different versions of some binary and end up with a situation where you have a bug on your production machines that you cannot reproduce on your test machine. I learnt that lesson the hard way once when I was running python 2.7.3 on my test machine and python 2.7.2 in production.
- cpach 12y ago
  So something like Docker?
  - dagw 12y ago
    Docker works, but there are lots of ways to get the same result. I'm not trying preach any specific method.
MichaelCrawford 12y ago
I build my own .debs and .rpms. They're not hard once you learn how. For a simple program, one that has only an executable, just scp it to /usr/local/bin on your server. I haven't actually done this but it would help to keep a list of all the files you've added, in case you want to remove them later, or reproduce the configuration elsewhere.