[Ask HN] Server Security and Hardening. How to non Sysadmins do it? | Hacker News Reader

[Ask HN] Server Security and Hardening. How to non Sysadmins do it?

3 pointspmjoyce6 comments

I have a new web project about to surface for which I'm moving away from Rackspace Sites. After reading around I've decided to opt for a Linode VPS.

The problem is that I have no experience in systems administration and in particular the initial setup and security. In addition this is not something I wish to learn or experiment with right now - I have more than enough on my plate.

I'm considering farming out the initial setup and a monthly maintenance to a third party possibly via Elance.

Has anyone here had any experience with this approach? What are the pitfalls? Is there another method I should consider?

View on HN

I'm with Linode as well but I have to say Slicehost has awesome guides that can really show you everything you need to do to setup your vps.

Have a look at the following link for example. [1]

[1] http://articles.slicehost.com/2008/4/25/ubuntu-hardy-setup-p...

Thanks for the link - makes for a good practical starting point if I decide I need to do this by myself.

A) since you have a relationship with Rackspace, why not rackspace cloud?

B) Unless this is a multi user system with the most likely vector of attack is your application itself not system level.

Having said that here are some common tips: run ssh on a nonstandard port, Restrict who can log in via ssh (PermitRootLogin no) and only allow a few people remote access (AllowUsers foo bar) install a firewall (iptables) that blocks all ports except the ones you need publicly available (probably 80, 443).

It is worth taking the time to learn the basics. This is not something you want to outsource to elance.

I'm more than willing to learn the basics - my fear is that the basics simply aren't good enough. I can be confident in the things I have done but being unaware of thing I should be doing and not is what would keep me awake. I totally agree that most vulnerable attack vector is the app itself but that, I feel, I have control over. This is why I thought I'd hand this part over to a professional.

If Elance is not the place to go does anyone know of any reputable companies or individuals who would be able to offer a service like this? Surely I'm not the only non systems administrator that has faced this issue - or is it as simple as following the steps outlined above and that's generally enough?

The reason I don't want to go with Rackspace is that I've been having intermittent problems with them on Rackspace Sites for a few months. I know their Cloud product is not the same but my experience of their support and the fact that the technical issues haven't been ironed out in a few months hasn't given me a warm and cozy feeling.

Running ssh on a nonstandard port does NOT make ssh more secure. A better step would be setting up something like fail2ban.

There is nothing wrong with outsourcing this to someone who knows what they are doing.

The Linode Library may be of interest to you as well: http://library.linode.com/

Reply on news.ycombinator.com