Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

If I modified something like this into a server similar to the one described here with a minimal set of services (what you need for ssh, basically) would it be reasonably secure?

sovereign: A set of Ansible playbooks to build and maintain your own private cloud: email, calendar, contacts, file sync, IRC bouncer, VPN, and more.)

In other words, do devops automation tools make it possible to create your own secure VPS without knowing a lot about security and without doing a lot of upkeep a simple update command a couple of days a week, or even daily assuming you pretty much only need ssh?

References to concrete examples of why an approach like this could be risky would be appreciated.

share|improve this question

closed as off-topic by Katherine Villyard, EEAA, Sven, mdpc, Wesley Apr 21 '14 at 4:16

This question appears to be off-topic. The users who voted to close gave these specific reasons:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – mdpc, Wesley
  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – EEAA, Sven
If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

In short: no.

This is sort of like asking if having a tool like a scalpel makes you a good surgeon.

Ansible and any other CM are just an automation tool, no more. You still need to learn, research, and understand the concepts you're implementing.

share|improve this answer
@KarlBecker It does not matter, if you do not know what to do to keep a system secure. – Michael Hampton Apr 21 '14 at 0:50
Security is not an end point. It's a process, and not an easy one to keep abreast of at that. Maintaining proper security does involve keeping the system updated, but that is only one tiny piece of the puzzle. How you have things configured and the security of the applications deployed are a much larger piece, and that part is what takes years of experience, constant learning, and deep understanding. – EEAA Apr 21 '14 at 0:50
You're comparing apples and oranges. Keeping a workstation running is a far cry from keeping a server system secure. With your desktop machine, you don't have thousands of people around the world who are constantly trying to break in. I can tell - you're trying to reason your way out of needing to learn proper systems administration. I urge you now - stop trying to convince yourself that there is a shortcut here. There isn't. – EEAA Apr 21 '14 at 1:02
But a basic linux desktop install is pretty secure. What makes you say that? Would you expose that desktop to the Internet with no firewall and store your financials on it or other sensitive information? If you don't claim to know much about security, how are you qualified to claim that a default install of an unspecified Linux distro is secure? – MDMarra Apr 21 '14 at 1:06
Heartbleed is huge in the media now. If you used these Ansible playbooks to configure all of these services, how would you know if you were vulnerable? Would you have the skill to patch all of these services? Configuration Management is a way to automate what you already know how to do, it's not a substitute for learning and if you use it as such, you will be burned. – MDMarra Apr 21 '14 at 1:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.