Devs love being told to set up servers! And always do so well. After all, computer person is a fungible skill set.
I mean, it is fungible enough that they can learn, but they'll probably make a lot of mistakes along the way and be less efficient.
I mean, it is fungible enough that they can learn, but they'll probably make a lot of mistakes along the way and be less efficient.
Yes I exaggerate a bit, but I do so to make a point stand out.
- Disable password-based auth for ssh (require key-based auth) - Enable fail2ban or similar to slow down brute-force login attempts - Configure firewall - Install monitoring tools, antivirus, possibly backup daemons, etc - Setup a sane swapfile for your use case, and configure monitoring tools to alert when memory pressure gets too high - Setup disk mounts, configure monitoring tools to alert when disk space is low, and consider a cron job to automatically clean up tempfiles - Either set up automated updates (typically excluding kernel upgrades), or have a standard schedule for manually applying updates
...and probably other things that I'm forgetting because I'm a developer, and it has been years since I've been a sysadmin.
A couple of others spring to mind:
- if you're not regularly testing your backups, you don't have backups
- monitor SSL certs for expiry. It's amazing how many outages I've seen because this was missed.
- are you allowing direct connection to your server from the internet, or do you want to go through a bastion host. Do you need 2FA on this, say because you need to meet ISO27001.
- do all the above through CM (like Ansible or Puppet) for obvious reasons.
You don't hire a dedicated sys admin because they know some voodoo magic developers don't, you hire a sys admin because they have the _TIME_ to watch for security updates. And you _PAY_ a company like RedHat to ease that burden.
A dedicated sysadmin will typically do a better job than a non-dedicated developer, but if that developer cannot do a passable job, that's a gap in their skillset.
I may not be a network engineer, but I damned well understand DNS, MPLS, networking, gateways, and the like. Any developer who doesn't has gaps.