TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

How to Protect Your Infrastructure Against the Basic Attacker

180 点作者 benarent超过 9 年前

11 条评论

patio11超过 9 年前
One thing you should probably do: establish a VPN. Give staff cert-based credentials to it. Block all inbound traffic to the VPN except a) port 22&#x2F;etc to your bastion host and b) 80&#x2F;443 to your front-end web boxes.<p>This greatly reduces your surface area, and helps prevent easy mistakes later (like leaving a staging server unpatched) from blowing up your whole deployment.<p>Also, admin applications: an easy way for smart teams to lose. These are a great candidate for &quot;only accessible if you&#x27;re VPNing in&quot;, which you can enforce at firewall and again in the application if you want.<p>Password managers; TFA everywhere but especially on corporate email accounts; ask yourself &quot;If I were a hobbyist building a Bitcoin exchange where would I host it?&quot; then don&#x27;t host there.<p>Here&#x27;s a useful but hard-to-implement recommendation: keep an up-to-date list of every box in use and terminate anything you find not on that list. Many compromises start with &quot;The summer intern&#x27;s project from last year was web accessible and...&quot;
评论 #10851927 未加载
评论 #10850694 未加载
pilif超过 9 年前
I really think it&#x27;s time for guides to be written that don&#x27;t contain the advice to disable all IPv6 support. IPv6 is coming. It&#x27;s 2015 and categorically disabling (or actually just breaking) IPv6 definitely isn&#x27;t good advice any more.<p>Yes. The article did qualify that advice with &quot;unless you&#x27;re using it...&quot;, but people should be doing v6, so advice should include v6 too.
评论 #10851830 未加载
评论 #10851687 未加载
评论 #10852138 未加载
jlgaddis超过 9 年前
This is a decent &quot;basic&quot; guide. I look forward to the &quot;intermediate&quot; and &quot;advanced&quot; versions. Hopefully, Mailgun will come through and actually deliver those in the near future.
评论 #10849048 未加载
peterwwillis超过 9 年前
Simplified, generic, basic guide follows. You can probably find a guide for hardening all these individual things on your system, so trying to enumerate them all would be a losing game.<p>Primary question to ask yourself: What connections are allowed from the internet into each host, protocol and port on your network?<p>Primary task: Firewall off all traffic coming into your servers from the internet to be only web and VPN access.<p>Secondary question to ask yourself: What stuff can run on my servers, and by whom, and what access do those users have?<p>Secondary task: Limit the users who can run programs, limit what parts of the system those users can view or modify, limit the programs that can run, limit the files and directories that can be accessed.<p>Tertiary question to ask yourself: Is my software full of bugs or security flaws?<p>Tertiary task: Use software designed to be secure by default, configure it to be secure, and update it for security patches constantly. Note that this does not mean &quot;upgrade it constantly&quot;.<p>Additional considerations: Don&#x27;t use shared accounts, don&#x27;t use root, use keys&#x2F;certificates whenever possible, use a separate machine for the VPN, put some sort of network intrusion detection&#x2F;firewall&#x2F;defense-in-depth&#x2F;blah blah network appliance in front of the public facing servers, use a web application firewall, monitor your logs for unusual behavior, and get someone who&#x27;s very familiar with security to double-check your setup (read: break into your servers and tell you the holes they found)
blakesterz超过 9 年前
&quot;This guide will eventually have three versions, Basic, Intermediate, and Advanced, with each version focused on defending your infrastructure against a different class of attacker.&quot; Love this approach! It must be a different game defending against really talented and dedicated people vs. a bot. I&#x27;m looking forward to parts 2 &amp; 3. Those little &quot;DO&quot; and &quot;DON&#x27;T&quot; bullet points were a good idea too.
评论 #10851937 未加载
notfoss超过 9 年前
Very nice article, even for advanced users (not attackers ;)).<p>I have one question though. What are your thoughts on DROP vs REJECT firewall rules, as some people claim that DROP offers no additional benefits over REJECT while causing inconvenience to legit users. ref: <a href="http:&#x2F;&#x2F;www.chiark.greenend.org.uk&#x2F;~peterb&#x2F;network&#x2F;drop-vs-reject" rel="nofollow">http:&#x2F;&#x2F;www.chiark.greenend.org.uk&#x2F;~peterb&#x2F;network&#x2F;drop-vs-re...</a>
评论 #10851254 未加载
johneth超过 9 年前
Thanks for the guide, very useful. Spotted a very minor typo in the Backups section: &quot;Backups server two primary purposes&quot; (should it be serve?)
评论 #10851854 未加载
mwcampbell超过 9 年前
I&#x27;m surprised the article doesn&#x27;t recommend using ufw or firewalld to set up the firewall. I like ufw, which is available on Ubuntu and Debian at least. Also, what about fail2ban, for automatically banning IPs that repeatedly attempt unauthorized access?
评论 #10852146 未加载
teddyh超过 9 年前
I recommend “Securing Debian”:<p><a href="https:&#x2F;&#x2F;www.debian.org&#x2F;doc&#x2F;manuals&#x2F;securing-debian-howto&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.debian.org&#x2F;doc&#x2F;manuals&#x2F;securing-debian-howto&#x2F;</a>
moviuro超过 9 年前
Every once in a while, you find a jewel in the sea of crappy security guides. This is a jewel: go for it.
mikecb超过 9 年前
Just say no to VPNs.