How To Set Up Your Linode For Maximum Awesomeness

http://feross.org/how-to-setup-your-linode/

by feross • 14 years ago

208 112 14 years ago

zdw• 14 years ago

    echo /etc/hostname

really?

3pt141592• 14 years ago

People make mistakes like this all the time. Obviously he meant to type cat /etc/hostname

astrodust4• 14 years ago

It should be to run the `hostname` command, nothing more.

feross10• 14 years ago

Oops - fixed.

spindritf• 14 years ago

There's a rule in HTTPS everywhere https://www.eff.org/https-everywhere for your site. It redirects feross.org to https://www.feross.org which currently doesn't work.

ciupicri• 14 years ago

ssh-copy-id could be used to copy the SSH key

feross10• 14 years ago

Didn't know about this - thanks for sharing!

feross10• 14 years ago

FYI, ssh-copy-id isn't available on OS X by default. So, it's easiest to just do it by hand.

zalew3• 14 years ago

"On Windows, you’ll want to use putty [...] criminals often try to guess the root password using automated attacks that try many thousands of passwords in a very short time. This is a common attack that nearly all servers will face."

yet another tutorial I wonder who's the target audience. if somebody doesn't know the term brute-force or how to open a terminal app and connect with ssh, IMO they are not supposed to set up their own servery by themselves.

thaumaturgy9• 14 years ago

Every sysadmin in the world once set up a server for the first time; every sysadmin in the world once heard the term "brute force" for the first time.

astrodust4• 14 years ago

Some of these sysadmins were lucky to set up their first server when telnet was still considered acceptable to leave open.

feross10• 14 years ago

"they are not supposed to set up their own server..."

What about people setting up a server for the first time? How else are they supposed to learn?

I built my first site when I was 14 and moved to a VPS when I was 17. Until I moved to Linode, I never had a reason to open Terminal.

zalew3• 14 years ago

> What about people setting up a server for the first time? How else are they supposed to learn?

oh wow. well, I'm kind of old fashioned, but maybe they could start with learning basics of how the internet works, what is ssh, what the hell is linux, and by then somebody will know why you need to open that wierd terminal where there is only text and no cute rounded cornered buttons.

I don't get why[1] some tutorials try to cover everything almost from 'first, turn on your computer' to 'deploy your scalable social dynamic api-driven mumbo jumbo architecture web app', and there have been a few around here. there is a place for basic education and there certainly is a place to help somebody kickstart in a particular tech when he's got the basics covered - what's the point of mixing the two?

[1] actually I do. clickity click.

nsfmc• 14 years ago

heh, i saw the same thing myself and i had the same sort of reaction but i think it's more an issue with the writer misjudging his audience (you can see this if you've ever taken a continuing education class or the opposite problem if you read lots of technical documentation).

But in any case, everyone starts somewhere and everyone's entitled to post their own 'linode post-mortem' especially if they're beginners and want to ossify their hazy thoughts somewhere. i don't begrudge the guy for just wanting to keep some record of his process and maybe some day he'll look back and edit the document to keep up with his level of knowledge at the time.

thaumaturgy9• 14 years ago

Some random selections from my notes on building Linode web servers:

- Set up reverse DNS in the Linode manager: select the Linode, click on "Remote Access", click on "Reverse DNS" (under "Public IPs")

- Linodes don't offer very much disk space; use localepurge to keep the filesystem on a diet: # apt-get install localepurge

- After installing and setting up MySQL, don't forget: # mysql_secure_installation

- After installing Apache, change the following in httpd.conf: ServerToken -> Prod, ServerSignature -> Off, KeepAlive -> Off

- After installing PHP, edit php.ini to make it shut up: expose_php -> Off

There's a bunch of other fiddly stuff to do, and a seemingly endless combination of packages and strategies depending on what you're trying to accomplish. For instance, I currently run a stack with Postfix for MTA, awstats+jawstats for beautiful server-side site statistics, mod_deflate, mem_cache, fcgid/suexec to make it harder to break the server if a site is compromised, PureFTPd for really easy managed-by-MySQL FTP access, and a pile of other little minor tweaks and knobs turned.

MOST IMPORTANTLY: Backups, backups, backups. If you don't already have your own in-house backup service for your server (and I bet you don't!), then please take advantage of Linode's backup services: http://www.linode.com/backups/

nigma2• 14 years ago

Why would you turn off KeepAlive instead of setting it to a small value?

thaumaturgy9• 14 years ago

Honestly, I haven't done serious high-traffic testing to see if there's a magic number for KeepAlive. However, I've had enough traffic to the server on a couple of occasions that Apache would've fallen over if KeepAlive were on at all, since you can't specify KeepAliveTimeout in increments of less than 1 second.

There are also quite a few Apache-tuning articles on the web that feature "turn off KeepAlive!" in big bold letters, not to mention previous discussion on HN: http://news.ycombinator.com/item?id=2588783, http://news.ycombinator.com/item?id=1980278, http://news.ycombinator.com/item?id=1875848, http://www.kalzumeus.com/2010/06/19/running-apache-on-a-memo... ...

sounds• 14 years ago

Two other suggestions would be:

1. Test how your VPS comes back after a reboot. When you make big changes and at least every 6 months due to all the upgrading that ubuntu does by default it can break the bootup process and you won't know until that emergency unscheduled reboot at 3AM.

2. As long as you're customizing the firewall you should block pings entirely.

* Really, since the distributions are very compatible I would urge you to consider a distro that has selinux enabled by default. Fedora Core is a great place to start. It also has better tools to manage security and gives you good resume skills.

darklajid2• 14 years ago

Why would you block icmp ping?

I never understood that practice, especially not for standalone machines (in contrast to company networks, on the router).

So, why really?

thorduri4• 14 years ago

>> 2. As long as you're customizing the firewall you should block pings entirely.

Why?

I've never seen a threat model where filtering icmp doesn't end up being more trouble then it's worth. Then there is even the maintenance headache when basic but powerful tools like ping and traceroute are rendered useless.

It's the same BS as with fail2ban, thankfully the OP wasn't spreading the gonorrhea of port knocking/single packet auth. Lock down your sshd like everything else: Disable root, disable tunneled cleartext passwords, enforce proper key usage, use AllowGroups/AllowUsers.

EDIT: The BS with fail2ban is moving the ssh port around. I understand this being a problem, but surely iptables has something similar to OpenBSD pf's:

block in quick from <brutes>

pass in log on $if_ext proto tcp from any to ($if_ext:0) port ssh keep state \ (max-src-conn 3, max-src-conn-rate 4/32, overload <brutes> flush global)

epic9x2• 14 years ago

Blindly turning off KeepAlive isn't a recipe for awesomeness.

KeepAlive is a trade for memory/cpu time; on if you want to speed up in exchange for memory, off if you want to conserve memory and pay the cost of initializing new conections.

If you're doing anything like loading a web page with more than a few images, KeepAlive will likely improve connection time as http requests things serially, and you'll have a speed up by re-using the same connection.

Protip: run apache's mpm-worker with keepalive on and save memory and speed up your site.

thaumaturgy9• 14 years ago

It just so happens that I have the very best test site possible for this argument: one of my alpha customers has a website built by Not-A-Professional with an incredible 156 requests and 2.39MB of data for the landing page. It is exactly the opposite of an optimized website.

So I tested the page load with KeepAlive on and KeepAlive off. I `/etc/init.d/apache2 graceful`'d before each test, and I cleared Chrome's cache before each test. I have nothing else running on my system right now and our pipe is nice and clear. I have a 92ms ping from the office to my web server.

KeepAlive On: 5.31s

KeepAlive Off: 6.87s

1.5 seconds is an appreciable difference. It works out to roughly 10ms per request, unless it's so late that the math part of my brain has quit for the night. If Yahoo.com were loaded from my web server, having KeepAlive on would delay total page load by about 750ms -- a noticeable difference. (However, given that it takes over 4 seconds to reach page load on yahoo.com for 70+ requests, their page might actually load faster if it were hosted on my server...)

Now here's the kicker: that same customer site has been featured on a popular radio show, twice, driving over 6 million hits over 24 hours, with peak traffic at 40Mb/s, thousands of simultaneous connections, and 100+ requests per second, sustained for several hours.

The site's loading time during that period was utterly unaffected. Seriously, never even a blip. (I stayed up during the whole period just to personally watch it.)

I wasn't about to experiment with turning on KeepAlive during all that fun, but I'm reasonably confident that having KeepAlive turned on would have crushed that server, given that my customer's site was receiving substantially more traffic than even Pinboard did immediately after the Delicious announcement (http://blog.pinboard.in/2011/03/anatomy_of_a_crushing/) -- traffic that Pinboard's founder notes will usually kill an unprepared site (or server).

And keep in mind, this was all on a memory-constrained tiny little vm.

So here's my final statement on KeepAlive, which I will link back to from now on: if, as a server admin, you're turning KeepAlive on to speed up your site, then you are optimizing your server and your site in exactly the wrong way.

floomp• 14 years ago

> - After installing Apache, change the following in httpd.conf: ServerToken -> Prod, ServerSignature -> Off, KeepAlive -> Off > > - After installing PHP, edit php.ini to make it shut up: expose_php -> Off

What is the purpose of this? Security by obscurity? Or being really frugal about header length?

thaumaturgy9• 14 years ago

Yep, security by obscurity. AKA, the exact same reason that people move ssh to other ports.

If it turns out that there is some kind of exploit floating around for a specific version of Apache or PHP, and if jackasses are looking for vulnerable servers by first looking at the server headers instead of just randomly targeting servers, then I want mine to be totally useless to them so that they (hopefully) just move on to some other poor schmuck's server.

Security-by-obscurity is only a problem when you depend on it, or when you are using it to cover up some kind of serious stupidity, like totally untested crypto. There's nothing wrong with using it to frustrate and annoy adversaries.

pilif• 14 years ago

Regarding keep-alive: yes, it will lead to memory issues when it's on and you use mod_php and the prefork MPM (which you really have to with mod_php). But this is just one configuration. You can easily fix it by either of:

- use php-fpm and switch to any other MPM in apache

- keep using mod_php but put an nginx or other reverse proxy before apache. It will do the keep-alive and you can configure apache to still close it's connections.

- use nginx and php-fpm directly

All will mitigate the memory issue while still allowing you to offer keep-alive

thaumaturgy9• 14 years ago

I think prefork/mod_php is still the default setup, and it's a really good one to get away from right away if you plan on handling any serious traffic.

Using nginx/php-fpm is great, so long as you don't need support for Apache-style .htaccess files. Since I'm adminning a shared hosting environment, I can't give up support for .htaccess files; if you intend to only host your own site, and your site doesn't need that, then by all means please use nginx & php-fpm, you'll save yourself a lot of headaches.

Setting up an nginx proxy seems like kind of a cheat in a discussion about tuning Apache -- "how to tune Apache: 1. don't tune Apache, set up nginx proxies instead..." -- but suffice it to say that setting up proxying nginx servers is on my to-do list.

I have not yet though had a traffic-related site outage (see also http://news.ycombinator.com/item?id=4619906), so it's not as high on my list as things like "recurring payments system". :-)

zoba2• 14 years ago

I find my Linode really useful for x11 forwarding to use Firefox in public places, or to get around web filters. Might be worth a mention of how to do this.

mratzloff2• 14 years ago

Write a blog post.

zoba2• 14 years ago

Though it is late, and I've been out at bars with friends, I made this for you:

http://dzoba.com/?p=182

adient2• 14 years ago

Pro tip: instead of changing ssh default port, setting up fail2ban and messing with iptables rules manually, just use ufw. You're welcome.

justinhj• 14 years ago

Is that a Ubuntu only tool? I'd be hesitant to commit myself to anything that runs in a single distribution if I can help it. Fail2Ban would work if I decided to migrate to Centos later down the line. https://help.ubuntu.com/community/UFW

sturadnidge• 14 years ago

It's an Ubuntu only tool in the same way that aptitude and dpkg-reconfigure are Ubuntu only tools.

The guide is not claiming to be generic, it's totally fair game to use specific tools imho - especially if they simplify things.

adient2• 14 years ago

To my knowledge it is packaged only for Ubuntu, but it does work perfectly on centos.

yesimahuman• 14 years ago

Thanks for the advice on the out of memory reboot. I probably have Apache misconfigured, or my app is slowly leaking memory, but I've run into random downtime and an unresponsive server as apache runs out of memory.

One of the most annoying things I'm running into with Linode and other VPS services is dealing with my drive running out of space. I've been moving all my database stuff to Heroku and I'm much happier (plus the automatic backups are a dream).

omarchowdhury• 14 years ago

This is great SEO.

The author's website ranks first for "Linode Hosting Review".

He'll receive a commission for sales generated through his site, and being that his strategy is so targeted, it should convert well and deliver value to both him and Linode.

And he does it without ever having to resort to spam, the very opposite in fact; he does it through high quality content.

Good work feross!

ohashi• 14 years ago

Good for him for generating the content and getting the rankings. I don't think it's that competitive though. I launched my site last week and I am on page 2 for the same term.

juan_juarez• 14 years ago

Huh, I never realized that "maximum awesomness" was synonymous with "basic functionality".

Jgrubb5• 14 years ago

Veterans of Hacker News - why am I not allowed to down vote?

spacemanaki2• 14 years ago

There's a karma threshold before you're allowed to downvote.

mcrider• 14 years ago

Your karma must be above 500.

ww5202• 14 years ago

So you want to downvote his objection on the over hype in the blog?

ck2• 14 years ago

It is so easy and dangerous to mess up setting the firewall from scratch, why mess with it.

Use the free, awesome CSF (configserver firewall) instead.

http://www.configserver.com/cp/csf.html

shawnee_• 14 years ago

The bulk of this article has been copied directly from:

http://library.linode.com/getting-started http://library.linode.com/securing-your-server

feross10• 14 years ago

"I originally compiled this guide as a .txt file of notes for myself, but decided to share it in case anyone finds it useful. If you're looking for something straight from the horse's mouth, Linode [offers guides](http://library.linode.com/) that cover how to set up a new server, but some of the info is out of date."

nigma2• 14 years ago

Or even easier use one of many StackScripts[1].

But what I would really like to see is a decent introduction to Salt, Puppet or Chef. This way people that are going to deploy their first server could easily build and rebuild the instance and don't end up retyping shell commands from a blog article.

Also a note on the default Apache setup. There are several "flavors" of the server. If you are going to host Python sites with mod_wsgi then the apache2-mpm-worker package is a lot beter choice than the traditional prefork model.

[1] http://www.linode.com/stackscripts/

xachen• 14 years ago

Might I make one suggestion:

Make sure your SSH port is below 1024 (but still not 22). Reason being if your Linode is ever compromised a bad user may be able to crash sshd and run their own rogue sshd as a non root user since your original port is configured >1024.

angryasian2• 14 years ago

thanks for this tip I never realized this. More in the link if interested

http://unix.stackexchange.com/questions/16564/why-are-the-fi...

feross10• 14 years ago

This is an excellent suggestion. Thanks!

taligent• 14 years ago

Remind me again why anybody is still using Linode ?

Poor uptime and a disgraceful attitude towards security. ANY service provider that hides the facts behind major security incidents from their customers should never be used.

I guess their new customers will soon realise how crappy it feels to find out from Reddit that your VPS is potentially hacked.

angryasian2• 14 years ago

citation or proof of claims ?

ceejayoz• 14 years ago

http://arstechnica.com/business/2012/03/bitcoins-worth-22800...

yoshamano• 14 years ago

Who would you suggest then instead of Linode? I was thinking of renting their smallest one to have something to fart around with.

MatthewPhillips• 14 years ago

Prgrmr.com

Stratoscope2• 14 years ago

If you want something cheap to fool around with, there is:

http://nosupportvpshosting.com/

I just set up a VPS there to try out. No idea on reliability yet, but it does seem like a lot of (virtual) server for the money.

darklajid2• 14 years ago

futurevps.de

Based in Germany, amazing support.

Edit: I'm German, but not affiliated. I do have a small vps hosted there for a while though.

jacques_chester2• 14 years ago

Linode uptime varies according to data centre.

Lots of people use the Fremont centre. It is a dud.

I've hosted in Dallas without incident and currently I use Tokyo.

mibbitier2• 14 years ago

My only gripe with linode is that they are unable to handle DoS attacks. If you're subjected to an attack, your linode will be shut off (null routed) for 24 hours. After that time, they'll check to see if it's still being attacked.

I really think they could do a lot better than that. Apart from that gripe, they're a great VPS host.

lsc2• 14 years ago

What is your suggestion?

sounds like they have a clear policy in place; most places it's a vague judgment call. But most places will kick any user that gets hit with a DoS attack that is large enough to disrupt service to other customers.

I mean, I agree that 'finishing the job' and letting the attacker win by null-routing the target is... a suboptimal way to deal with the problem, but with pipe-filling attacks? if the attacker can send more bytes than your pipe can handle, there is really no other realistic way to handle the problem. (I mean, you can try to trace down the source and call up the ISPs the packets are coming from, but BCP38 is still not widely implemented, so good luck tracing a spoofed source more than one or two hops up, and meanwhile, as you are calling people up and trying to get through to someone skillful enough to figure out where a spoofed packet is coming from, you are down.)

There are 'clean pipe' services, where someone with a very large pipe says they will programatically detect and block DoS traffic, then pass along the good traffic to your (much smaller) pipe, and yes, those services can work /if/ the service provider has a larger pipe than the attacker. Of course, buying such a service from a service provider with a sufficiently large pipe is, as you can imagine, quite expensive. Buying such a service from someone that has less available bandwidth than your attackers are able to throw at the problem, of course, is completely useless.

So yeah, uh, assuming you can't afford to be on a 'clean pipe' that is backed by a huge network, you are much better off with an ISP that proactively shuts down DoS targets than one that doesn't. Unless, of course, you are a DoS target.

I mean, the economics of pipe-filling denial of service attacks, right now, are heavily tilted in favour of the attacker. It is a problem that needs to be solved, but I don't know how to solve it.

mibbitier2• 14 years ago

Other services, for example Amazon ec2, just deal with a DoS, and charge you for the traffic.

Also, null-routing for 24 hours regardless of if the attack only lasted 2 minutes, is a little silly.

fluxon• 14 years ago

If anybody needs it, http://webcache.googleusercontent.com/search?q=cache:feross....

How To Set Up Your Linode For Maximum Awesomeness

Related Stories