Hacker News Reader

Comment by rsync | Hacker News Reader

I have provided my own cloud, in the form of a 1U server, since 1998. I run my (very tiny) website there as well as my own mailserver, and I read email over SSH using (al)pine.

Backups offsite go to the obvious place :)

This setup might not be that interesting, but I think it's worth noting that a cloud computing paradigm/model has functioned well for 16 years now with no significant changes. I have not had data on my own personal computers for that entire 16 years - all data has been in the "cloud".

I think a decent goal is to be a peer on the network. I think a good step in that direction is to have your own server, with fixed IP, on the network. You can build quite a bit on that.

View on HN

I would love to do this, but handling the security of your own server to me seems labor intensive.

How easy is it for you to manage keeping your server and data secure? I would really like to do this, but my fears of getting hacked have kept me from doing it.

Well, my system runs nothing but sendmail, lighttpd (with no modules or features) and sshd. That's it. So there's not much to lock down.

sshd is hidden behind port knocking, for what that's worth. (No, I do not want to have a religious argument about port knocking this morning)

The real key to the simplicity and security of my setup is email over SSH with a console client. Not only does that remove oceans of attack surface, but it also means you can read email without the emails themselves traversing the network. I guess the characters go over SSH, but that's not quite the same thing...

Thank you for introducing me to port knocking (wikipedia link for the unintiated [0]).

Not trying to lure into an argument you're trying to avoid but I'm just curious; what is the religious argument about regarding port knocking? I know about both sides to tabs/spaces and vim/emacs but am curious what people have against port knocking.

[0] http://en.wikipedia.org/wiki/Port_knocking

Heh.

In short, port knocking is a very, very short/weak password. And is a very weak authentication measure.

This is absolutely true and nobody could argue that.

So if you only did port knocking, or if you depended on port knocking, you're making a bad decision.

I believe in defense in depth, and therefore I think that port knocking on top of everything else you already do has good value - especially considering how simple and lightweight knockd is and my experience of it running stably for years at a time.

Many say it is useless. With passwords + root login disabled to login someone must break your keypair, unlikely to be accomplished by anyone who wouldn't also have the resources to knock ports.

Reply on news.ycombinator.com