Adapt, adopt, improve!

I have to apologize to everybody who’s been unable to visit my blog the past week or so. There’s been some downtime, but I hope that the issues are sorted out by now. Here’s the story behind the outages.

The whole summer I’ve been planning a major overhaul of the servers I’m running in the cellar, and this last week I’ve been working hard on effecting these changes. Shutting down a server that has been running continuously for 480 days is never easy, but there was no option because of the extremely serious sock_sendpage vulnerability recently found in the Linux kernel. The updates I’ve done have been the focused around security, and since I’ll be abroad for the next year everything needs to work with minimal need for maintenance.

The new setup is a combination of one server running the very secure operating system OpenBSD spiced with additional measures such as chrooting and intrusion detection, and one server with six virtual computers running Ubuntu through Xen. All machines are protected with an advanced intrusion detection system and a separated logging server, hopefully making any intrusion attempts detectable and void. But no-one can achieve perfect security, and I won’t say I’m immune to attacks though I hope I’ve made the systems robust enough. In the process I have learned a new operating system, OpenBSD, and I’ve almost fallen in love with it :) I must be a strange person.

Now everybody back home knows enough to keep the servers running when I’m away, and I’ve specifically asked them to make sure things stay afloat in the event of a power failure. The battery backups are cheap and not very reliable, but they protect against the minor outages and prevent the most annoying sub-second power spikes.

Enough of this technical mumbo-jumbo, here follows a picture of these new computers that will be working hard to serve you these web pages! (Nothing would work without that typewriter.)

52199

2 Comments

  1. Posted Monday, August 31, 2009 at 10:02 | Permalink

    I have found that having a HW FW/Router as the first node on my network decreases the number of attacks that reach node two (which runs OpenBSD).

  2. Posted Monday, August 31, 2009 at 10:24 | Permalink

    @MHWC,

    Maybe, but I doubt that the TCP/IP stack in a HW router can even begin to match the security in OpenBSD.
    Also, it is better to *see* the attacks as they are happening, a HW router doesn’t have intusion detection.

    Jonathan

Post a Comment

Your email is never shared. Required fields are marked *

*
*