Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If I modified something like this into a server similar to the one described here with a minimal set of services (what you need for ssh, basically) would it be reasonably secure?

sovereign: A set of Ansible playbooks to build and maintain your own private cloud: email, calendar, contacts, file sync, IRC bouncer, VPN, and more.)

In other words, do devops automation tools make it possible to create your own secure VPS without knowing a lot about security and without doing a lot of upkeep a simple update command a couple of days a week, or even daily assuming you pretty much only need ssh?

References to concrete examples of why an approach like this could be risky would be appreciated.

share|improve this question

closed as off-topic by Katherine Villyard, EEAA, Sven, mdpc, Wesley Apr 21 at 4:16

This question appears to be off-topic. The users who voted to close gave these specific reasons:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – mdpc, Wesley
  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – EEAA, Sven
If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

In short: no.

This is sort of like asking if having a tool like a scalpel makes you a good surgeon.

Ansible and any other CM are just an automation tool, no more. You still need to learn, research, and understand the concepts you're implementing.

share|improve this answer
    
Maybe. But a basic linux desktop install is pretty secure. My question is are servers there yet? Can you get a pretty secure install with limited functionality and then keep it secure by updating it frequently. I suspect the answer is no, but I'd like some concrete examples of why that is. –  Karl Becker Apr 21 at 0:43
    
@KarlBecker It does not matter, if you do not know what to do to keep a system secure. –  Michael Hampton Apr 21 at 0:50
2  
You're comparing apples and oranges. Keeping a workstation running is a far cry from keeping a server system secure. With your desktop machine, you don't have thousands of people around the world who are constantly trying to break in. I can tell - you're trying to reason your way out of needing to learn proper systems administration. I urge you now - stop trying to convince yourself that there is a shortcut here. There isn't. –  EEAA Apr 21 at 1:02
1  
But a basic linux desktop install is pretty secure. What makes you say that? Would you expose that desktop to the Internet with no firewall and store your financials on it or other sensitive information? If you don't claim to know much about security, how are you qualified to claim that a default install of an unspecified Linux distro is secure? –  MDMarra Apr 21 at 1:06
1  
Heartbleed is huge in the media now. If you used these Ansible playbooks to configure all of these services, how would you know if you were vulnerable? Would you have the skill to patch all of these services? Configuration Management is a way to automate what you already know how to do, it's not a substitute for learning and if you use it as such, you will be burned. –  MDMarra Apr 21 at 1:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.