undefined | Better HN

0 pointsehonda6y ago0 comments

apt-get install nginx goaccess

cd website

cp * /var/www/html

Yearly maintenance required: apt-get update, apt-get upgrade

View traffic stats: goaccess -f /var/log/nginx/access.log

I'd say its just as easy and seamless to do it yourself on a cheap VPS for a static website. HTTPS isn't that much extra work either.

0 comments

mises6y ago

Maybe I'm just a security nut, but I would probably also relegate ssh to a non-default port, allow key-only authentication, narrow ciphers, close all other ports (except 80, 443, and 53). Also fail2ban, sysctl tweaks (networking, disable coredumps), and a whole bunch of other things I have in a script.

I've seen way too many people get their boxes trashed to leave an internet-accessible one exposed and unsecured.

KingFelix6y ago

What are your thoughts on sharing your script? I have a few VPS and would love some new tools / proper setup. I have been learning as I go, learned a few day 1 things not to do, but would like to learn more about networking/coredumps. Cheers!

mises6y ago

I'd have to clean it up first. I wrote it for a competition, and it does its job well; I may clean it up and improve it soon. Right now, it's a mess of a monolithic script.

1 more reply

clintonb6y ago

That's great that you have enough time and experience to consider all of this easy. As someone who works a bit higher up the stack, I rarely go as deep as configuring Nginx. This setup may take you a few minutes, but I usually end up spending an entire Saturday on stuff like this. Having done this for a few years, I would rather spend my free time on other things.

viraptor6y ago

> Yearly maintenance

I'd say continuous maintenance with response to specific issues. Also debian updates don't restart services which rely on updated shared libraries, which means you need to restart your nginx after openssl updates. Also restarts when kernel is updated. Also...

There's really more to it than just an annual upgrade. You're likely not going to be affected if you ignore this, but why risk it?

ehondaOP6y ago

Ok, I forgot to add 'reboot' to yearly maintenance :). And change the ssh port or consider a private key. But if its just for a personal static website, I wouldn't get overly concerned about being hacked. Assuming you have backed up your page, its another handful of simple commands to rebuild the whole thing anyway. They are also quite fun for other uses, like setting up a squid proxy, messing with an email server or irc server, just having a personal mini-cloud you can easily access from anywhere.

viraptor6y ago

It's not about rebuilding if your website is defaced. It's the possibility of someone (for example) adding a client side exploit / throttled miner to your existing website. Without more monitoring, you won't know it happened, and neither will most of your visitors.

1 more reply

j / k navigate · click thread line to collapse

0 comments

mises6y ago

I've seen way too many people get their boxes trashed to leave an internet-accessible one exposed and unsecured.

KingFelix6y ago

mises6y ago

I'd have to clean it up first. I wrote it for a competition, and it does its job well; I may clean it up and improve it soon. Right now, it's a mess of a monolithic script.

1 more reply

clintonb6y ago

viraptor6y ago

> Yearly maintenance

There's really more to it than just an annual upgrade. You're likely not going to be affected if you ignore this, but why risk it?

ehondaOP6y ago

viraptor6y ago

1 more reply

j / k navigate · click thread line to collapse