Bryan Helmig

Security Engineering: A Guide to Building Dependable Distributed Systems by Ross Anderson is available online for reading -- http://www.cl.cam.ac.uk/~rja14/book.html A couple of other resources: - 7 Security Measures to Protect Your Servers [0] - SSH best practices [1] In case one doesn't prefer to be overwhelmed with documentation, one could refer to: My First 5 Minutes On A Server; Or, Essential Security for Linux Servers [2]. [0] https://www.digitalocean.com/community/tutorials/7-security-measures-t… [1] http://www.cl.cam.ac.uk/~rja14/book.html [2] https://plusbryan.com/my-first-5-minutes-on-a-server-or-essential-secu…

Digital Ocean hits the sweet spot for me with both pricing, availability, speed, and ease of getting up and running for a project like this. You can have a new server up and running in 30 seconds and locked down within 10. Bryan Kennedy has a great write up to help you get it set up and locked down: http://plusbryan.com/my-first-5-minutes-on-a-server-or-essential-secur… We put our own twist on it which improves on his base (mostly security related): https://github.com/codelittinc/incubator-resources/blob/master/best_pr…

Disable password access, use keys instead. And install fail2ban to prevent brute force attempts. Here is a good read about basic security: http://plusbryan.com/my-first-5-minutes-on-a-server-or-essential-secur…

I know this might is not the best approach but I also only manage one or two servers... http://plusbryan.com/my-first-5-minutes-on-a-server-or-essential-secur…

It's not magic indeed: —— Looking up and down the aisles at Lowes and not finding a raised garden bed that met my needs, I inquired with a staff member: “Sorry, we don’t carry anything like that.” “Darn. Ok, I’ll try another store then,” I sighed with resignation. “You know,” he said to me, “it’s just wood.” It took me a moment to realize how liberating this statement was. To him, woodworking held no mystery at all - it was just a thing you did. If he wanted a garden bed, there’d be no question in his mind that he’d make it himself. Why spend more on something suboptimal when you can build exactly what you want? — Bryan Kennedy (http://plusbryan.com/its-just-wood)

I used to think that the Redhat security guides were good [1], but would also go through the NSA guide to securing Redhat [2]. Seems a little ironic nowadays. Recently, we had Bryan Kennedy's "first 5 minutes" [3], linked from Drew Crawford's guide to "NSA proofing" email [4] (pretty good guide to securing a mail server). [1] https://access.redhat.com/site/documentation/Red_Hat_Enterprise_Linux/ [2] http://www.nsa.gov/ia/mitigation_guidance/security_configuration_guide… [3] http://plusbryan.com/my-first-5-minutes-on-a-server-or-essential-secur… [4] http://sealedabstract.com/code/nsa-proof-your-e-mail-in-2-hours/

See also http://plusbryan.com/my-first-5-minutes-on-a-server-or-essential-secur… Discussed here: https://news.ycombinator.com/item?id=5316093

these are pretty decen outlines http://www.quantisan.com/securing-a-fresh-ubuntu-server-with-fabric-ta… http://plusbryan.com/my-first-5-minutes-on-a-server-or-essential-secur…

As soon as you have to buy something that takes up physical space, the "skills", or maybe better put the "mindset", becomes quite different. I don't think I can explain it very well. In principle someone who can understand a flow diagram (which is, to only mildly exaggerate, all a circuit diagram is) and master the complexity of getting a web application published online should be able to do what you did with the $3.50 board. They almost certainly could do everything in a short amount of time at a workshop with all the hardware provided and a printout of instructions. But once they're home, without a similar set of instructions for "buy this here, do this, do that, to accomplish this" it's unlikely you're going to see much robotic/smart-home creativity even after a workshop. Meanwhile unlimited complexity and creation can be had in the web app realm without having to leave the comfort of your keyboard, or even having to buy anything. I just remembered this post which I think helps better capture some of what I'm talking about: https://plusbryan.com/its-just-wood But I think there's something else besides avoiding things that are mysterious. I think it has something to do with the physicality of the thing. At least something else is needed to understand the weird reluctance with working with hardware that a lot of software-only people have, who differently from the general public (who can't even use their computers) are sharp enough to battle with mind blowing complexity and…

Same here, and as long as you understand how mysql replication works it's not too much effort to deal with. Performing the initial sync without downtime is a bit tricky, but can be done with a well-designed database and some thought. Basically you need to at least temporarily make the bulk of your data read-only, so that you can do most of the data transfer while things are running, and then only briefly lock tables on the source server for long enough to copy the stuff that has changed since the dump, and grab the binlog position. Then you copy that stuff over to the slave as well, update the slave to the correct position, and then start the slave. That's master/slave, but to get master/master, all you need to do is start a slave on the original master and point it at the current master position on the original slave (which should be static since it isn't yet accepting any queries directly). These posts may be helpful: https://www.digitalocean.com/community/tutorials/how-to-set-up-mysql-m… http://plusbryan.com/mysql-replication-without-downtime Once it's running, as long as you're not running autoincrement queries or other things that can conflict on both servers at the same time, without taking appropriate precautions, it should chug away without any intervention. If something does go wrong, you can often figure it out by looking at the slave status, fixing the inconsistency manually, skipping the bad query, and then starting the slave. If…