Provisioning VPS's for customers - security practices

Question

Imagine you deploy Debian-based Xen VMs for customers. How would you hand it over to them with it in the most secure state possible, while keeping the system in a state the customers expect?

I don't like the idea of having the root account accessible via SSH without any IP restrictions - but it seems the most practical. I am personally in favour of, in our automated deployment process, generating SSH keys, creating a non-root user, disabling root logon and only permitting the non-root user to logon with their key - then telling the customer that they can change it how they see fit.

How about giving the key to the customer? Email?

Answer 1

if you want to give root access without giving root then you could use sudo, that way all activity is logged and you should also set up a separate syslog server for the logs that the client does not have access to.

you could use keys, however you will still be allowing any source to connect, the use of a hardware firewall or iptables/ipchains you could lock the source down.

again I wouldn't just have the port open to the internet, change the default 22 to a high end port and have an inline application firewall or IPS unit.

There is some free open source IPS software, however I only have experience of commercial like IBM ISS Proventia

Stuart

Answer 2

while keeping the system in a state the customers expect

I think this is core to the question. There is a continuum between easy of use and tight security for many choices, and ideally you won't find out the hard way (through customer complaints) where your customers expect the line to be drawn.

I would recommend taking the lessons your competitors have learned. Go sign up for a bunch of VPS's from various (well-respected) providers and see how they do it. Then just emulate the same thing (unless everyone is doing it wrong). That way, too, customers switching from your competitor will have familiar setup experience.

Answer 3

This is just an idea I had, but if you have an automated management system in place that assigns usernames and passwords for VPS's after payment has been processed, why not set a 30 minute firewall rule from the IP address used to retrieve the root password from the management system? Afterwards, they change the root password, the management system tries to log in using the original password (just to check and see if the password was changed), and opens the firewall to the VPS.

1. User pays for server through automated payment system
2. Payment is processed through whatever internal procedure or system is at the VPS host.
3. User logs into administrative dashboard to get VPS IP address and password (maybe clicks an "authorize this IP address for 30 minutes" link)
4. Management system sends a request to the firewall in front of the VPS's to authorize $usersip to access $vpsip for 30 minutes
5. User logs into VPS, and changes root password.
6. User clicks an "Open VPS to world" link in the dashboard to set normal firewall restrictions on the VPS.

Probably not the easiest to use, but if you are looking to implement a secure system, this is an idea.