3 ms·

I would love to do this, but handling the security of your own server to me seems labor intensive. How easy is it for you to manage keeping your server and dat

I would love to do this, but handling the security of your own server to me seems labor intensive. How easy is it for you to manage keeping your server and data secure? I would really like to do this, but my fears of getting hacked have kept me from doing it.

rsync 11y ago
Well, my system runs nothing but sendmail, lighttpd (with no modules or features) and sshd. That's it. So there's not much to lock down. sshd is hidden behind port knocking, for what that's worth. (No, I do not want to have a religious argument about port knocking this morning) The real key to the simplicity and security of my setup is email over SSH with a console client. Not only does that remove oceans of attack surface, but it also means you can read email without the emails themselves traversing the network. I guess the characters go over SSH, but that's not quite the same thing...
- xtrumanx 11y ago
  Thank you for introducing me to port knocking (wikipedia link for the unintiated [0]). Not trying to lure into an argument you're trying to avoid but I'm just curious; what is the religious argument about regarding port knocking? I know about both sides to tabs/spaces and vim/emacs but am curious what people have against port knocking. [0] http://en.wikipedia.org/wiki/Port_knocking http://en.wikipedia.org/wiki/Port_knocking
  - rsync 11y ago
    Heh. In short, port knocking is a very, very short/weak password. And is a very weak authentication measure. This is absolutely true and nobody could argue that. So if you only did port knocking, or if you depended on port knocking, you're making a bad decision. I believe in defense in depth, and therefore I think that port knocking on top of everything else you already do has good value - especially considering how simple and lightweight knockd is and my experience of it running stably for years at a time.
  - danwakefield 11y ago
    Many say it is useless. With passwords + root login disabled to login someone must break your keypair, unlikely to be accomplished by anyone who wouldn't also have the resources to knock ports.

rsync 11y ago

Well, my system runs nothing but sendmail, lighttpd (with no modules or features) and sshd. That's it. So there's not much to lock down. sshd is hidden behind port knocking, for what that's worth. (No, I do not want to have a religious argument about port knocking this morning) The real key to the simplicity and security of my setup is email over SSH with a console client. Not only does that remove oceans of attack surface, but it also means you can read email without the emails themselves traversing the network. I guess the characters go over SSH, but that's not quite the same thing...

xtrumanx 11y ago
Thank you for introducing me to port knocking (wikipedia link for the unintiated [0]). Not trying to lure into an argument you're trying to avoid but I'm just curious; what is the religious argument about regarding port knocking? I know about both sides to tabs/spaces and vim/emacs but am curious what people have against port knocking. [0] http://en.wikipedia.org/wiki/Port_knocking http://en.wikipedia.org/wiki/Port_knocking
- rsync 11y ago
  Heh. In short, port knocking is a very, very short/weak password. And is a very weak authentication measure. This is absolutely true and nobody could argue that. So if you only did port knocking, or if you depended on port knocking, you're making a bad decision. I believe in defense in depth, and therefore I think that port knocking on top of everything else you already do has good value - especially considering how simple and lightweight knockd is and my experience of it running stably for years at a time.
- danwakefield 11y ago
  Many say it is useless. With passwords + root login disabled to login someone must break your keypair, unlikely to be accomplished by anyone who wouldn't also have the resources to knock ports.