Forum OpenACS Q&A: How much time does it takes to set up bboard from scratch

My background: I am an erstwhile technical marketing guy; I was briefly a web/db programmer. My educational background is liberal arts. I've been on UNIX/Linux boxes for about eight years. I've been involved with the ACS/OpenACS for about three years. I'm not really a programmer; I used to be an okay sysadmin many moons ago.

From what I've seen in both the ArsDigita bboards and this OpenACS one, people with limited UNIX experience will need to allocate more time to learn some of the *nix nuts and bolts. There are some "Learn Linux in 21 Days", but that will take you, uh, 21 days, I suppose.

Also, from what I've seen, the vast majority of problems seem to related to A.) botched editing of the nsd.tcl configuration file, B.) botched editing of the ad.ini configuration file (or whatever it's called), C.) incorrect/botched TCP/IP network configuration, and D.) not paying close enough attention to the documentation. The first two mistakes are often explained later as "Uh, I was really tired when I was doing this". The third mistake is usually a *NIX newbie mistake. The fourth mistake cannot be attributed to any particular reason other than some people have better reading comprehension than others.

Thankfully, you do not have to install Oracle, another big can of worms that could add days and/or weeks to your installation.

Just to clarify/summarize:

• web/db UNIX programmers: 1-2 days
• other UNIX programmers: 2-4 days, maybe a week
• web/db non-UNIX programmers: 1-4 weeks
• other non-UNIX programmers: 4-8 weeks
• all others: 2-12 months

Oh, I forgot to mention: anyone who could pick up enough *nix in a few weeks/months to install OpenACS still would not be qualified to administer a production-grade, publicly-accessible web/db box. A small intranet box, maybe, but not the real thing on the Internet.

You've probaly already thought about this, but it's worth mentioning in light of a recent thread about security and who is concievably qualified to administer public web servers.

I have a static IP and SDSL connection. I've installed various versions of ACS and OpenACS, I can type man RPM, but I am definitely a security naif.

I am slowly getting better with Linux, Oracle, and OpenACS etc. I'm sure I can follow directions on removing unwanted packages, installing patches, recompiling, etc. However, as I'm really still learning much of Gnu/Linux CVS, Jade, DocBook, Emacs, LaTex, Postgress, etc. I like to install the new disrtros when they become available - is there a way around having to reharden your machine following every installation.

Thanks.

Certainly, there's no way that a Linux newbie can go out and buy a Sonicwall, and be done with it.

For Red Hat Linux, there are a significant amount of security work that needs to take place. I've been using Red Hat the past three years, and it has gotten better, but it's still designed for maximum hardware compatability and installation ease. Each time I install Red Hat from scratch, it takes me a couple of days to really lock down the box; there is no way to get around hardening your box every time you reinstall the OS.

In any case, security holes are discovered all the time. Even if you had a snapshot of an allegedly secure system from three months ago, today, it would not be as secure. The Bastille Linux hardening scripts might be of some use to you; basically, it's a checklist of stuff that a real UNIX sysadmin would consider anyhow, but by packaging it this way, you're less prone to forget something critical. Of course, the Bastille scripts aren't going to replace sendmail with qmail or BIND with djbdns.

I'd try the Bastille scripts, in conjunction with the nmap port scanner and Nessus vulnerability assessment utility. Naturally, you would still want a security guru to look at your firewall settings and your server's security anyhow. I don't know anything about any other Linux distributions (I tried Gentoo Linux once), but Red Hat needs a sizable amount of work before it could be considered as a fairly secure box.

New topic: installing Oracle and installing Postgres are like night and day. Oracle installation has gotten easier and there's a lot more user-contributed documentation nowadays. The very worst Oracle on Linux version was 8.1.5 (the original Oracle8i). Installing that was an absolute nightmare. The last version of Oracle8i I installed was Release 3 (8.1.7). That one went fairly smoothly, but even a straightforward Oracle installation could take half or all day (especially if you're using a journalled filesystem).

Some of the Bastille scripts (and other security hardening measures) have to do with local exploits and security holes, i.e., local users being stupid and/or malicious. You have to consider things like setuid bits on certain binaries, not giving out root passwords and restricting people to sudo, etc.

I also forgot to mention Tripwire; configure it and run the scan nightly. And don't forget those backups! Your data is the most important thing; if you don't have recent backups, well, you're screwed.

I updated some links on my (very old) doc at dev.jongriffin.com.

These are no where near complete and one day I hope to update it. At a minimum add the grsecurity fixes and recompile without modules. You don't need modules, the distros use them to allow more hardware to be supported. Modules suck, they are a security flaw, did I mention that modules suck?

• Get up2date if you can't/don't have experience upgrading software.
• Delete most of what is in /etc/xinetd.d/.
• Add another user with an id of 0 and never login as root.
• Run Tripwire before you go on the net as you will be probed within minutes of plugging the cable in.
• get and install portsentry and logcheck. Learn to love reading your logs, you will soon find out what is not normal (like login from root).
• NMAP is your friend (just make sure you don't have an automatic lockout program such as portsentry running or you will lock yourself out.)
• Nessus is your friend
• Snort can be a good buddy
• Build a firewall (smoothwall is excellent) and use it in front of your real box. You don't need to buy someones proprietary box.
• SSH is your wife. Don't allow anyone to talk you into ftp/telnet.
• Get on Redhats update list
• Follow some security sites DAILY
• there is more, but you get the idea.
• Most of this applys to ANY OS.

To put it simply, it's war out there. The number of port scans that are performed on a box connected to the internet is astounding. If you don't really care about your data or how your server may be used if it's been hacked into, then your level of security can be arbitrary.

However, if you do care about either of those things, and considering that at the very least port 80 is open on an OACS install, then there is no getting around that running a server is non-trivial if not full time task. If this were not true, then we could rid the world of bearded, corpulent BOFHs that dictate our lives so completely.

Alas, we cannot.

For instance, at one point we were upgrading from one version of SSH to the latest. In the very short time that we left ourselves vulnerable we got hacked with a man in the middle exploit. We may have been a bit careless with our approach, but not so careless that it wasn't a calculated risk. Even still, we got hammered.

AFAIK, Mandrake is more or less developed for the desktop installation rather than for servers. Someone, maybe Ben, once told me that Mandrake is the best selling distro in the US. Of course, this is not a merit of distinction considering that most systems are installed from downloads. (Google, whose data collection system consists of 4,000 Celeron PCs, bought only 50 cds of Redhat linux.)

So the point is that if you're a newbie, you have two choices:

a) get a *nix distro, a good how-to book, throw away your Gillete Mach3 and order a bunch of Big Macs because you need to figure out how to install GCC and all of its dependencies; or

b) save some time and spend some money to have the 11 year old next door who gets his ass kicked at recess set you up with a killer box or boxen.

Just my 0.02.

talli

Talli wrote: "To put it simply, it's war out there. The number of port scans that are performed on a box connected to the internet is astounding. If you don't really care about your data or how your server may be used if it's been hacked into, then your level of security can be arbitrary."

Just to point out, you don't even need a broadband connection to attract the attention of crackers. I'm on plain old dialup PPP over a plain old POTS line and nowadays I get port scanned every other hour or so. I'm tail-ing the syslog in a small terminal window and with PortSentry listening, I can see every time someone comes knocking at my door. You're really gambling with disaster if you're not proactive and taking active, aggressive measures.

The short shrift paid to security and backups by people who run web services is astounding. You'd think that in this day and age people responsible for serious servers would know better, but I guess some people will only learn by getting knocked down. The kuro5hin.org site was down for weeks because they A.) didn't have a warm spare, B.) didn't have cold spares, and C.) worst of all and totally inexcusable, in their own words, they didn't have any useful backups of their database/website. Their tale of woe could easily be retitled: How Not to Run a Database-Backed Web Server.

In their case, they weren't really cracked, but the end result would have been the same, maybe worse, because they didn't care enough about their data to keep backups (and their fancy RAID array didn't serve any pages to site visitors for weeks as it languished in one of Compaq's data recovery labs).

Please upgrade to the latest 1.1 and you will find that iptables/chains blocking works perfect.