mike.mainguy

I recently needed to stand up a DB2 server and was going to reach for my trusty rackspace account, but didn't feel like setting up DB2 for an experiment that would only last a few hours. Instead I turned to amazon. It turns out that amazon has preconfigured images for ubuntu/db2 that you can spin up almost instantaneously. In addition, their security model is a little more robust. Key things they do right from a security perspective (compared to rackspace). #1 They never send you a root password (via email or otherwise). You must generate a public/private key pair and download the key via https. Assuming you keep your secret key secure, there is minimal (if any) opportunity for someone to steal this key. Even if they hack your amazon account, I'm not sure they could get to your server immediately, even though they certainly could shut it down. #2 By default you are behind a firewall so that only a minimal set of tcp ports are even open. You need to actually take a...

OK, so I've went round and round trying to figure out how my rackspace server was compromised and have come to the conclusion it was an inside job, but nobody's fessing up. I can see what sort of package was used to compromise my box and I may come back to trying to poison that package, but there isn't enough time in my life to continue to school folks who are hell bent on screwing with other people's property. Instead, I'll give folks a quick primer one how to have a little better security if you choose to use rackspace with ubuntu 10.04. #1 make sure your rackspace console password is secure... some basic rules: 10 chars, no dictionary words, upper and lower case letter, 2 number, at least one special char. #2 Once you get your root password emailed to you, log in via the secure console, and disable both network interfaces. I'm not sure what the 10.* interface is for, I'll figure that out later, but I'm assuming it's some sort of rackspace...

Last month, I had a cloud server exploited and couldn't figure out how it happened. After a little investigation, I've got a good news bad news situation. The good news is that I DID manage to contact someone at rackspace who could help me out and they re-enabled my account. The bad news is that the server wasn't pretty. On the upside it must have been hacked by a script kiddie as they did NOT cover their tracks very well at all. On the downside, they did NOT appear to have used the single user account I created and somehow entered through either the rackspace admin network (SPOOKY, inside job?) or one of the default services installed with Ubuntu 10.04 LTS (still not good) From my root .bash_history, I noticed the following (the first few lines, may have been me): exit w w ...

I've been using Rackspace cloud for testing some server builds and ESB solutions and recently ran into a "gotcha". First off, it looks like maybe the machine was compromised... I HOPE it was an inside job by one of my developer "friends" who happened to know the userid/password. If not, that means the default install of ubuntu 10.04, apache tomcat6, apache2.2, and servicemix is able to be compromised in less that 3 days when left out on the internet. In any event, that particular problem notwithstanding, I now have a different problem... That is, rackspace has suspended my account and I cannot access my server, nor create another one until Monday. Thank god I was only using this machine to test things, I can't image what I would have done if I was actually depending on it to be running. Another problem I'm finding is that I cannot find any reference on Rackspace's web site about acceptable use. They suspended the account for outbound ssh act...

I recently needed a new server instance for some testing. Normally I would go back to AWS as I've had problems with Rackspace in the past . Being open minded and assuming things have changed in the last couple years I thought I'd go back and try out Rackspace cloud for my testing (for reasons I will not name here). My first and most shocking revelation is that they have NOT fixed a key security problem. I'm going to outline this right now and hopefully somebody can fix it Problem #1: Login as root via ssh Guys...guys...guys(or gals)... It is baffling to me that you still allow this. Yes I get that you have a wonderful "Blacklist the my server ip when something goes wrong" and "then disable access to my console to fix" routine going on to protect your network if MY machine gets compromised due to your silly lackadaisical security. Wait, that's actually a negative thing too :) please stop, I'm not going to use you as a provider un...

I finally had time to site down and actually analyze what happened to my box. It was certainly compromised by a script kiddie, but I'm not 100% sure if it was an inside job or not. In any event, I stored off the broken image and re-imaged the machine back to my "last known good" configuration. I subsequently added the account that I thought was used for the attack setting the password back to what it was when the machine was originally compromised, but limited login to the rssh shell. This has been running for almost a week with no problems now. I've had a couple of sniffs of folks trying to connect to my machine as root, but no solid hits. Some initial observations: First the default install of Ubuntu Server on rackspace's cloud accounts enables root login via ssh. This is very strange now that I think about it. Ubuntu, by default disallows this (for very good reasons ), and I think rackspace should seriously consider a change to their default build. ...

OK, I realize from a previous post that it in a previous post it may seem like I think that windows is completely non-functional in a cloud environment. Let me back up a little... From my perspective, running production servers on virtual machines spun up on demand is not useful (yet) with the windows operating system. The windows OS strategy is just not responsive enough to this sort of business requirement (yet). That having been said, I just finished spinning up a windows 2003 server instance on rackspace... Why? I need to investigate some Active Directory problems we're trying to solve at work right now. I spent 4 hours downloading the massive DVD install image (and a bunch of crazy MS registration stuff) for a 10 day TRIAL version of the OS. I then went over to my rackspace account (because of a different problem) and realized they could set up the server I needed. I clicked "create server" and they set up a virtual server in 15 minutes. Yes, it costs ...

Quick question, "why is windows not suited for deployment in the cloud?" Take a look at amazon's pricing . Next, take a look at rackspace linux and windows pricing. Do you notice anything? A keen observer might see: #1 Windows costs between 1.5x - 2.6x more than linux per compute cycle. #2 Windows is in BETA for the rackspace cloud. Now some folks might argue that this cost is offset by fact that windows servers are more managable (after all, you get a nice pointy clicky user interface right?). Those folks should try to push an update to 100 windows servers using the pointy clickly technique. Any administrator worth their salt is going to use scripting and automated deployment techniques which is where linux really shines. Windows as a desktop platform is pretty good (although ubuntu is catching up, but it windows as a server platform still suffers from it's high TCO. All this having been said, I guess I'll restate my subject in a slightly d...

vs I recently did a comparison between Ubuntu 10.04 and RHEL 5.4 to determine what our standard server install should be. Just to be honest, windows server started out to be in the mix but was quickly disregarded as it really doesn't lend itself to scaling out in any reasonable manner. I set these up using the rackspace cloud which I have to say was a dream come true. I had both servers up and running j2ee application servers in less than 1 hour. First off, I first used redhat back when it was shiny and new (94-95) and used it for quite some time afterward. I've also used a variety of other unix and/or linux systems (slackware, debian, ubuntu, suse, caldera, SCO, solaris, aix, hp-ux). That having been said, I am a linux USER, NOT a kernel hacker. So the inner workings are quite as important as much as getting a useful and reliable system together quickly. What I discovered is that Redhat is trying to build a stable platform that doesn't change. They are c...

Looking through cloud literature, it seems we've run out of three letter acronyms (TLA), so we're now using four letter acronyms (FLA?). Chief among these are the "as a service" acronyms which describe what level of stuff is handled by the provider. Wikipidia has some sort of explanation buried in the cloud computing page, but I thought I'd give the abridged version. At the lowest level is "Infrastructure as a Service" (IaaS): You get a virtual server with connectivity to the internet. Examples are Amazon ECS and Rackspace Cloud . In these offerings, you can install almost anything you want (you typically get root access in some manner) and can even install the operating system of your choice. This is a good choice if you're a sysadmin who just doesn't want to muck around with physical hardware. The next level up is "Platform as a Service" (PaaS): You get some sort of development platform hosted remotely and you have a mech...