Hacker News Reader

Comment by dfranke | Hacker News Reader

Put it in a chroot jail on a dedicated server with SELinux, GRSec, and AppArmor all running at the same time, behind at least four layers of firewalls. Store the server in a lead-lined room with no net connection, and a good sturdy lock on the door whose opening requires a smart card, fingerprint and iris scans, and presidential orders filed in triplicate. Erase the smart card, spread acid on your fingertips, gouge your eyes out, and impeach the president. Pass HTTP correspondence in and out on floppy disks doused in holy water. Keep the server powered off at all times.

View on HN

One aspect of VPS's and (eugh) cloud computing, is the additional security. I don't think this aspect gets trumpeted enough.

Instead of having a single big kick ass dedicated server running everything, you can have maybe 10 VPS's each doing a different thing. You can group things together in terms of risk - put wordpress on its own vps, put your customer db on another, etc etc. At least then, if someone hacks into wordpress, it doesn't really matter that much - they only get wordpress, nothing else, and you just clean off that machine from backups.

(Obviously have completely different login credentials for each VPS, and only grant access from one VPS to another when really necessary, and restrict it).

"You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes." - Theo De Raadt

But yes, you are right for the most part. However, just throwing apps in VPS doesn't automatically solve your security issues.

Having 2 completely separate VPSs, in different data centers, secured with different passwords, seems pretty much more secure than having a single server to me.

Yes, there could theoretically be a way to punch through from an insecure VPS into a secure VPS on the same host, but I think the chances are pretty slim there.

It's wonderful for redundancy as well. I recently migrated our DNS from two dedicated servers in the same data centre, to three $20/month VPSs all on different continents. I don't need power or bandwidth, what I need is super-redundancy. These new VPS deals just hand it to me on an ultra-cheap platter. Couldn't be happier.

The security is just an added bonus.

Reply on news.ycombinator.com