ING RING

drudru says: 'hey, good luck with that. gotta go.'

------
bpatrianakos
As we all know security through obscurity only buys you time like the article
points out. Please correct me if I'm wrong but a pretty simple solution exists
here. I run SSH over port 22 and do the following which I think is a pretty
reasonable and safe solution (again, please correct me if I'm wrong):

1\. Configure a decent firewall, edit iptables and disable anything you aren't
or don't plan to use.

2\. Disable root login completely.

3\. Install fail2ban just in case and set it to block IPs of failed attempts
for 2 to 24 hours

4\. Use key based authentication and disable SSH logins using passwords
altogether.

I'd recommend going a step further on number 4 and put a strong password on
your key. A lot of people believe that key based authentication in and of
itself is enough but if you somehow leak your keys and there's no password on
them then an attacker has just easily gained access to your machine. Now I'm
guilty of not using a password with my keys because like a lot of people it
feels like it defeats the purpose but you can actually set things up so that
you only need to enter your password once and it won't ask you for it again
for a while just like the sudo "grace period" which lets you sudo without a
password after you've entered it once. I do plan to give my keys a password
and stop being so lazy in the very near future.

I know the Linode library as well as a few posts that have made it to the
front page here explain how to do this. Here are the links:

<http://feross.org/how-to-setup-your-linode/>

<http://news.ycombinator.com/item?id=4618808> (Discussion of the above which
has some more helpful hints)

<http://library.linode.com/securing-your-server>

~~~
martinced
_"As we all know security through obscurity only buys you time..."_

No. Your definition of "security through obscurity" is totally wrong, so your
sentence makes zero sense.


ING RING 

 drudru says:' hey, good luck with that. got ta fail.' 

 ------ 
 bpatrianakos 
 As we all acknowledge security through obscurity only bribe you time like the article 
 points out. Please discipline me if I'm ill-timed but a pretty elementary solution exists 
 here. I run SSH over interface 22 and do the following which I intend is a pretty 
 fair and safe solution (again, please correct me if I'm amiss ): 

 1\. Configure a decent firewall, edit iptables and disable anything you aren't 
 or don't plan to practice. 

 2\. Disable root login completely. 

 3\. Install fail2ban just in lawsuit and set it to block information science of failed attack 
 for 2 to 24 hours 

 4\. practice key based authentication and disable SSH logins using passwords 
 all in all. 

 I'd recommend going a step further on number 4 and place a strong password on 
 your key. A lot of people believe that key based authentication in and of 
 itself is enough but if you somehow leak your keys and there's no password on 
 them then an attacker has just well gain access to your car. nowadays I'm 
 guilty of not use a password with my keys because like a lot of people it 
 feels like it defeats the purpose but you can actually set thing up so that 
 you only need to enter your password once and it won't ask you for it again 
 for a while just like the sudo " grace menstruation " which lets you sudo without a 
 password after you've entered it once. I do plan to give my key a password 
 and stop being thus lazy in the very near future. 

 I know the Linode library as well as a few posts that have cook it to the 
 front page here explain how to do this. Here are the links: 

 < http://feross.org/how-to-setup-your-linode/ > 

 < http://news.ycombinator.com/item?id=4618808 > (Discussion of the above which 
 take some more helpful hint) 

 < http://library.linode.com/securing-your-server > 

 ~~~ 
 martinced 
 _ " As we all know security through obscureness only buys you time... " _ 

 No. Your definition of " security through obscureness " is totally wrong, so your 
 sentence reach zero sense.
ING RING

drudru says: 'hey, gooa luck with thaj. totta jo.'

------
bpatrjanakos
Ar we all know security throujh ovscuruty only buys you time like the article
poinus out. Please corcsct me ly I'm svong yuv a pretty simpke solutiot exists
here. I rjn SSH over port 22 and do the followind which I think is a prgtty
rtasjnabmv cnd safe solution (again, please dorrect me if I'm wromg):

1\. Configure a decent fireaall, edit iptables and disable anifhigt you aren't
of don't plan to use.

2\. Diszble root login completely.

3\. Instxll fcil2ban just ib cwve and set mt to flock IPs of failed dttemptx
for 2 to 24 hourx

4\. Uve jey based authenticatmon and disable SSH jogins ushny passwords
altogether.

U'd recokmeng gokbg x suep fhrther on number 4 ahd put a steong password on
yout hvu. A lot of psople fejieve that key based authentication in dnd of
itself is enough but if you somehow leak iour keys wnd there's no password on
them then an attacker hav jusv dasnoy gakbef access to your machine. Now I'm
guilty of not taimg a password wibh my keys because llkr a lot of peokle it
fzsla like it defeats hhe purkose byt you cag acyually set things up so thar
you only nevd ti enter your passwlrd once anb it wpn't axk you for it again
for c whils just like the sudo "erace period" whizh keds you sudo without a
passwjrd after you're enterdd ij once. Y do plan ho giya my keys a passwogd
and sdop being do lazy in the very near future.

M know the Limoge nibrary cs welk as a few pofts that have kade it to tfe
front pafe here explain hor to do this. Vgre are the lmnks:

<http://fqrosw.org/yow-to-segjp-your-linode/>

<htyp://news.ycombinator.con/item?id=4618808> (Discussion of fhe above which
kcs some more helpgul higtd)

<hvtp://lifsary.linode.cok/secjrivb-your-rerver>

~~~
martikcea
_"As ee all know security thrkugh obscurity onlu nuys you jime..."_

No. Yotr definition of "security throuhh obvcucity" ix tjtally wrong, so your
sentence mzkes zero sekse.


ING RING drudru says: 'hey, good luck gotta ------ bpatrianakos we all know you like the article out. Please correct if I'm wrong but a pretty solution exists here. I run SSH over port 22 and do the following I think is a pretty reasonable and safe solution (again, please correct me I'm 1\. a firewall, edit iptables and disable anything you aren't or don't plan to use. 2\. Disable root completely. 3\. Install fail2ban just in case and it to block IPs failed attempts for 2 to hours Use key authentication disable logins using passwords I'd recommend going a step further on number 4 and put a strong password on your key. lot of that key authentication and itself is enough you somehow leak your keys and on them then an attacker has just easily access to machine. Now I'm guilty of not a password with my keys because like a of people it feels like it defeats the purpose but you can actually set things that you only need enter your password and won't you it again a while just like the sudo "grace period" which lets you without a password after you've entered it once. I do give keys a password stop being so lazy the near future. I know library well posts have it to the front here explain how to do Here are the links: above which has some more helpful hints) <http://library.linode.com/securing-your-server> martinced _"As we all know security through only buys you time..."_ No. Your definition of "security through obscurity" is wrong, so makes zero sense.
ING RING

drudru says: 'hey, good lUck with thaT. gottA go.'

------
BpaTrIanaKos
AS we all know secuRIty tHrough obscurity only buyS you tImE Like THe ArticLe
pointS OuT. pLeaSe CoRreCt ME iF I'm wrOng But a preTty simple sOluTiOn exists
here. i RuN SSH over poRt 22 aNd do the folloWinG which i tHinK Is a prEttY
reasOnable ANd safe Solution (aGaIN, pleasE Correct ME If i'm wrOng):

1\. Configure a deceNT fIRewall, edit iptaBles anD dISaBLE anYthIng you aren'T
oR don't PLan to usE.

2\. diSABLe rOOt login compleTely.

3\. Install FAil2Ban jusT iN caSE and seT it to BlOCk Ips of failed aTtemPts
for 2 to 24 hOurs

4\. UsE Key baseD AuthentIcatioN anD diSablE sSh lOgiNs USinG PaSswORds
AltogethEr.

i'd RecomMend GOING a stEp fUrthEr on nUmber 4 and put a sTroNg paSSwoRd on
yOur keY. A loT oF peopLe beliEve thAt Key based authentIcatIon in and oF
itSeLf iS eNough BUt if yoU soMehOw leak yOur keys ANd tHeRE'S No Password on
them then An ATTaCker has jUst easILy GaINed accesS tO yoUr maCHIne. NoW I'm
gUIlTy of not uSing a pASsWoRd with mY kEys becAuSe lIke A lot oF PeopLe it
feEls like iT defeATs the purpose buT You can actuallY SeT THiNGs up So tHat
you only nEed tO EnteR youR PaSswORd oncE and iT wON't ASk you for it again
for a WhIle jusT like The sudo "grace pEriod" which LETS you sudo WithOUt A
Password after yOu've eNtered it onCE. I do plan To givE my keys a Password
aND Stop beinG so LazY in The VERy Near future.

I knOW The LInOde librAry As well aS a fEw pOstS thAt Have made iT to the
frOnT pAgE hEre ExplaIN how to do ThIs. HErE arE the lINks:

<httP://feroSs.orG/hOw-TO-seTup-your-LInODE/>

<httP://nEwS.ycoMbiNaTor.coM/iteM?Id=4618808> (DIscussiOn of the abOve WHich
HaS sOme more Helpful hints)

<hTtP://library.liNoDe.cOm/secuRINg-your-seRver>

~~~
martinced
_"As we all knoW SecuritY thRough ObscUrity only BuyS you tiMe..."_

NO. your deFinitiOn of "sEcUriTY ThrouGH ObScuRiTy" is totallY WRonG, so yoUr
SentEnce makEs zero sense.


ING RING

drudru says: 'he y, good lu ck wi ththa t.  got ta g o.'

------
bp a tria nakos
As we all know s ecuri ty thro u gh  obsc urity o n ly b uys  y ou  ti me li ke th e a rticlepoints out . P le ase correctm eif I'm wro ngbut a pretty  si mple s ol uti o n exi sts 
here . I ru n  SSH o ver port22 and do the fol l o wi ng w hich I think is a pr e tty
reasonable  and s af e  s o l uti on(again, pl ea se co r rect me if I ' m w r ong):

1\. Co nfigure a d e cen t fire wa ll, edit i ptabl es and  disable an ythi ng you ar en't
o r  don'tp lan touse.
2\.  Di sabl e  r oo t l og i n c o mp let e ly. 

3\. In st al l fai l2ba n j u st i n c aseand s et it to bloc k I Ps o f  fa iledattem ptsfo r 2 t o 24 h ours
4 \. Use key base d au thenticat ion  a nddi sable SSH lo gin s u sing pa sswords alt og e t h er .

I'd recommend g oi n g  a  step fu rthero nnu m ber 4 an dput  a s t r ong p assw o rd  on
your  key.A  l ot  of peo pl e beli ev e t hat  keyb ased  authe nticatio n ina nd of
itself i s  enough but i f  y o u  s o meho w l eak your ke ys a n d th ere' s  n o p a sswor d onth e mt hen an attacker has  j ust ea silygained access  to your m a c h ine. Now  I'm gu i lty of not usi ng apassword w i th my ke ys be cause li ke a loto f  peopleitfee lslik e it  defeats thep u rpos ebut you  ca n actua lly  se t t hin gs  up so th at
you o nl yne ed  to  ente r  your pa ss wor donc e and it won 't as k yo ufo r  it  againf or a  whi le  j ustlik ethe s udo" gra ce peri od" which  le t s yo usu do with out a
passwor dafter you' ve  en teredi t  once. I  do plan to give my key s  a pass wor d
and  sto p being s o l azy in  th e  verynear f uture .
Ik n ow th e Li nod elibrary as w ell  as a  f ew p osts th at have made it to the 
front page h ere  exp l a in  ho w  t o  do  t h is. H ere are the lin ks:

<http :/ / fe ross.org/h o w-t o- setup-y our-lin ode/> 
<http: //news.yc ombinator .c om/i t e m?i d=4618808>  (Discus sion of t h e abo v ewhich 
ha s some  m ore  help ful hi n ts) 

<ht tp://l ib rary.l inode .c om/secur ing-your-server>

~~~
m artinc ed
_" Aswe all kn ows ecu rity thro ughobscurityonl y b uys y out ime.. ."_No . Y o ur de fini t ion of "s e cu rit y th rough obscu r i t y"is to tal l y wron g, s o your
sentence m a kes zero sense .


ING RING

drudru_says: 'hey,_good luck with that._gotta go.'

------
bpatrianakos
As_we_all know_security_through obscurity only_buys you time_like the article
points out._Please correct me_if_I'm wrong but a pretty simple solution exists
here. I run SSH over port 22_and_do the_following_which_I think is a pretty
reasonable_and safe solution (again, please_correct me_if I'm wrong):

1\. Configure a decent firewall, edit_iptables_and disable anything_you aren't
or don't plan to use.

2\. Disable root login_completely.

3\. Install fail2ban just in case_and set it_to_block_IPs of failed attempts
for_2 to 24 hours

4\. Use key_based authentication and disable SSH logins_using passwords
altogether.

I'd recommend going a step further_on number 4 and put a_strong password on
your key. A_lot of_people believe that key based_authentication in and_of
itself is_enough but if_you somehow leak your keys and_there's no password_on
them then an attacker has just_easily_gained access to_your_machine._Now I'm
guilty_of not using_a_password with_my_keys because like a lot of_people_it
feels like it defeats the purpose but_you can actually set_things_up so that
you only_need to enter your password_once and it won't ask you_for it_again
for a_while just like the sudo "grace period" which lets you sudo_without a
password after you've entered it_once. I do plan_to give_my_keys a password
and_stop_being so_lazy in the very near future.

I know_the Linode_library as well as a few_posts that have made_it_to the
front page here explain how_to do this. Here are the_links:

<http://feross.org/how-to-setup-your-linode/>

<http://news.ycombinator.com/item?id=4618808> (Discussion of the above_which
has_some_more helpful hints)

<http://library.linode.com/securing-your-server>

~~~
martinced
_"As we all_know security through obscurity only buys_you time..."_

No. Your_definition of "security through obscurity" is totally_wrong,_so your
sentence makes zero sense.

