Hacker News Reader

Comment by sergiotapia | Hacker News Reader

If you like this article, I wrote a similar one called Devops for Dummies.

http://tech.pro/tutorial/1335/devops-for-dummies-vps-configu...

It teaches you how to setup a DigitalOcean (or any other) VPS from scratch to host N amount of Rails applications using Nginx and Passenger. It took me some time to get things working properly and I distilled it into this short article that holds your hand and takes you from A to Z.

View on HN

Nice. One step I would add is after restarting ssh and before rebooting while still logged in as root is to start a second ssh session, log in as the new user, and verify you can sudo.

Your current instructions are predicated on success. By verifying your new user login and sudo capability before logging out as root (rebooting), you can fix typos or other Bad Things. Not that I would ever make a typo while editing sudoers. ;-)

One thing I would recommend is searching for deals on LowEndBox[1] blog. Most of the popular VPS's are ridiculously overpriced compared to what you can find on LowEndBox. It's a good site to get advice and reviews of various VPS providers, too.

[1] - http://www.lowendbox.com/

I'm quite familiar with LowEndBox, and I would say my current "Best Value" VPS provider would be Digital Ocean, who I found via HN. I probably can think of at least a dozen with solid reasons to avoid. FYI Digital Ocean's lowest offering is $5/m.

LowEndBox is great for non-mission critical servers. You aren't going to find many top tier providers on there, mostly smaller companies. I got a dedicated box (quad Xeon, 24GB RAM, 500GB) for $49/m.

Who's the provider you're renting the box from ?

I would love to get my hands on one of those. What provider did you get it from?

Why would anyone need to search LowEndBox, when they can get top tier cloud servers from DigitalOcean(which is linked on the original post)? There is absolutely no reason to use providers from LowEndBox with grandma's SolusVM, when you can spin up a server with DO anytime you want and pay by the hour?

And not to mention, how these providers are ddosing and hacking one another regularly.

Not all providers there are bad; BuyVM is one that has treated me excellently

You should probably have people use visudo instead of editing /etc/sudoers directly. If you make a typo or similar that prevents sudo from running correctly it will catch it.

Disabling root login without changing to using ssh-keys for authentication doesn't really buy you a whole lot of security; you can still access the box and root with knowing just one password -- the only thing you've avoided are brute force attempts against the root account.

With sudo and only keys based access, the attacker will need to get a copy of the key (barring any new problems with key generation, like the Debian ssl bug) and the password needed for sudo access (or the root password, for su -).

As other's have said, use visudo (possibly with "EDITOR=nano visudo) -- to avoid leaving your sudoers file in a broken state.

An as others mentioned -- make sure you can login and sudo before you log out of the root shell...

What does visudo do that nano -w doesn't? I've never understood this properly.

Locks to only one editing user and confirms syntax is clean before saving. I'm not aware of nano enforcing correct sudoers syntax. Plus plenty of us don't like nano.

man visudo for more info.

visudo, like vipasswd or crontab -e and other commands, respect the EDITOR environmental variable, so you can edit these files with whatever editor you prefer, while maintaining their protections.

True. Provisioning a new test VM for me usually entails something like this: ssh in; visudo; wtf, this is nano! Boo!; ctrl-x; update-alternatives --config editor... :)

http://manpages.debian.net/cgi-bin/man.cgi?query=visudo

Awesome! If you like to go a bit further I suggest learning Chef in order to automate this kind of tasks. I wrote a tutorial about it: http://matteodepalo.github.io/blog/2013/03/07/how-i-migrated...

Thank you for linking to your article, it was perfect timing as I'm about to throw up a tiny Ruby/Sinatra/PostgreSQL site I've been making for a local need. The quality of my actual code aside, I understand that servers are incredibly complex beasts, especially when it comes to security, and I want to ask (And because of their complexity, I assume it's a small question with a huge, complex answer), how relatively 'safe' would I be following a guide like yours along with other ones that specify some simple, good practices for setting up a server?

By safe, I mean in the context of the server getting hacked. I know people wouldn't bother but I'd rather at least feel a tiny bit safe. I'm going with a VPS (Digital Ocean) too so I can slowly learn all these things.

Hi thanks for your comments, I appreciate you taking the time to read it.

I'm _not_ a devops guy. Following my guide you _will_ get a running production server but I've only distilled things from other blogs I've hunted on the web. I would make sure I hire someone who actually does this for a living before putting production things on something I configured.

So feel safe, but cautiously safe - I'm not a guru.

Could I take your article and use it as a base for a Python version of that?

Feel free to use it. I wrote it to:

A) Solidify what I had learned by putting it into writing.

B) Help others avoid my dumb mistakes.

So if it helps people I'm all for it. :)

My thoughts also. I'm going to start up a blog and get to it after work.

This is great, I've been on the fence about firing up a VPS or two rather than use Heroku, this may be just what I need to get going.

Awesome, thanks @sergiotapia!

Reply on news.ycombinator.com