<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>
<div>
<div>I work for Opscode so I'm a bit biased, but this is the sort of problem Chef was created to solve. I define all configuration in Chef stored in git repos( but any version control will work). This serves as both documentation and automation for consistency,
and has the added bonus of making infrastructure wide changes a snap. As an example imagine the case of an old compromised key or bad password from an ex-admin.</div>
<div><br>
</div>
<div>We manage our users through a sys-admins cookbook and our servers check in every 30 mins. This means I can change a key or disable a user and even if I forget to push to a particular server it will catch up within 30 minutes. Also because there's code
around how this is accomplished if I wanted to set passwords (I prefer not to set passwords and disable password logins entirely) I could enforce complexity around them in the cookbook.</div>
<div><br>
</div>
<div>I used creating users/keys as an example but that's only a small piece of the base role in my case. So every server runs the base role by default, which handles users, ntp, chef-client, iptables, ect. But all other configuration is also driven by Chef
and put into roles, so I can provision a new web server by simply applying the web role.</div>
<div>
<div>
<div>-- </div>
<div>
<div style="font-family: Consolas; font-size: medium; ">Paul Mooring</div>
<div style="font-family: Consolas; font-size: medium; ">Systems Engineer and Customer Advocate</div>
<div style="font-family: Consolas; font-size: medium; "><br>
</div>
<div style="font-family: Consolas; font-size: medium; ">www.opscode.com</div>
</div>
</div>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Vimal Shah <<a href="mailto:vimals@sokikom.com">vimals@sokikom.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Main PLUG discussion list <<a href="mailto:plug-discuss@lists.phxlinux.org">plug-discuss@lists.phxlinux.org</a>><br>
<span style="font-weight:bold">Date: </span>Monday, March 11, 2013 11:40 AM<br>
<span style="font-weight:bold">To: </span>Main PLUG discussion list <<a href="mailto:plug-discuss@lists.phxlinux.org">plug-discuss@lists.phxlinux.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: server compromised?<br>
</div>
<div><br>
</div>
<div>
<div>Thank you for the advice. The necessary security layer that was missing has been identified and is being incorporated.
<div><br>
</div>
<div>Deploying a server from scratch has been tedious (running each command manually). Capturing all of these commands into a python script seems obvious. The python script is slow to develop due to the fact that I'm trying to learn it and code it at the same
time.</div>
<div><br>
</div>
<div>Has anyone had any experience with Vagrant? Is it worth the time to investigate?</div>
<div><br>
</div>
<div>Lastly, if anyone is available for some consulting on these matters (server security and deployment), please contact me.</div>
<div><br>
</div>
<div><br>
<div class="gmail_quote">On Thu, Mar 7, 2013 at 4:25 PM, Paul Mooring <span dir="ltr">
<<a href="mailto:paul@opscode.com" target="_blank">paul@opscode.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="font-size:14px;font-family:Calibri,sans-serif;word-wrap:break-word">
<div>
<div>
<div>It's likely that if he left that key in there with a valid e-mail address then whoever compromised the server wasn't trying to be discrete. I would check my auth logs to see when/if someone was logging in from somewhere suspect. Next if the server was
compromised, it's done, you can never trust it again, no amount of clean up or post-mortem investigation can ever give reasonable confidence that there's no back door on it. Move the services and data and make a new server/clean install, then look very carefully
at what attack vector was exploited and close it (like if it was brute force you should have ssh for root turned off, more restrictive firewall rules and ssh guard).</div>
<div><br>
</div>
<div>Having a server compromised can be a huge headache, good luck.</div>
<span><font color="#888888">
<div>
<div>
<div>-- </div>
<div>
<div style="font-family:Consolas;font-size:medium">Paul Mooring</div>
<div style="font-family:Consolas;font-size:medium">Systems Engineer and Customer Advocate</div>
<div style="font-family:Consolas;font-size:medium"><br>
</div>
<div style="font-family:Consolas;font-size:medium"><a href="http://www.opscode.com" target="_blank">www.opscode.com</a></div>
</div>
</div>
</div>
</font></span></div>
<span><font color="#888888"></font></span></div>
<span><font color="#888888">
<div><br>
</div>
</font></span><span><span><font color="#888888">
<div style="border-right:medium none;padding-right:0in;padding-left:0in;padding-top:3pt;text-align:left;font-size:11pt;border-bottom:medium none;font-family:Calibri;border-top:#b5c4df 1pt solid;padding-bottom:0in;border-left:medium none">
<span style="font-weight:bold">From: </span>Vimal Shah <<a href="mailto:vimals@sokikom.com" target="_blank">vimals@sokikom.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Main PLUG discussion list <<a href="mailto:plug-discuss@lists.phxlinux.org" target="_blank">plug-discuss@lists.phxlinux.org</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, March 7, 2013 4:49 PM<br>
<span style="font-weight:bold">To: </span>Main PLUG discussion list <<a href="mailto:plug-discuss@lists.phxlinux.org" target="_blank">plug-discuss@lists.phxlinux.org</a>><br>
<span style="font-weight:bold">Subject: </span>server compromised?<br>
</div>
</font></span>
<div>
<div>
<div><br>
</div>
<div>
<div>Hello all,
<div><br>
</div>
<div>While randomly looking into the .ssh/authorized_keys file, I noticed a line that shouldn't have been there. This was concluded based on the last portion of the line. This portion was in the form of
<i><a href="mailto:user@domain.com" target="_blank">user@domain.com</a></i>, where the domain was one of a likely competitor. Does this automatically mean that this server has been compromised? The line has been removed.</div>
<div><br>
</div>
<div>Thanking everyone in advance.</div>
<div>
<div><br>
</div>
-- <br>
<font size="3">
<div style="border-collapse:collapse;font-family:arial,sans-serif;font-size:13px">
<font face="arial,helvetica,sans-serif">Vimal <br>
</font></div>
</font>
<div></div>
</div>
</div>
</div>
</div>
</div>
</span></div>
<br>
---------------------------------------------------<br>
PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.phxlinux.org" target="_blank">
PLUG-discuss@lists.phxlinux.org</a><br>
To subscribe, unsubscribe, or to change your mail settings:<br>
<a href="http://lists.phxlinux.org/mailman/listinfo/plug-discuss" target="_blank">http://lists.phxlinux.org/mailman/listinfo/plug-discuss</a><br>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<font size="3">
<div style="border-collapse:collapse;font-family:arial,sans-serif;font-size:13px">
<font face="arial,helvetica,sans-serif">Vimal (rhymes with Kimmel) Shah</font></div>
<div style="border-collapse:collapse;font-family:arial,sans-serif;font-size:13px">
<span style="font-size: 13px; font-family: arial, helvetica, sans-serif; ">Front-End / Infrastructure Engineer</span></div>
<span style="border-collapse: collapse; font-size: 13px; font-family: arial, sans-serif; "><font face="arial,helvetica,sans-serif">Sokikom<br>
Mobile: <a href="tel:%28480%29%20752-9269" value="+14807529269" target="_blank">(480) 752-9269</a><br>
Email:<font color="#500050"> </font><a href="mailto:vimals@sokikom.com" style="color:rgb(42,93,176)" target="_blank">vimals@sokikom.com</a></font></span>
<div style="border-collapse:collapse;font-family:arial,sans-serif;font-size:13px">
<font face="arial,helvetica,sans-serif">Web:<font color="#500050"> </font><font color="#3333FF" style="color:rgb(42,93,176)"><a href="http://www.sokikom.com/" style="color:rgb(42,93,176)" target="_blank">www.sokikom.com</a></font></font></div>
<div><font face="arial,helvetica,sans-serif"><br>
</font></div>
</font>
<div>
<div style="border-collapse:collapse;font-family:arial,sans-serif;font-size:13px">
Follow us: <a href="http://www.twitter.com/sokikom" style="color:rgb(42,93,176)" target="_blank">twitter.com/sokikom</a></div>
<div style="border-collapse:collapse;font-family:arial,sans-serif;font-size:13px">
Like us: <a href="http://www.facebook.com/sokikom" style="color:rgb(42,93,176)" target="_blank">facebook.com/sokikom</a></div>
</div>
</div>
</div>
</div>
</span>
</body>
</html>