Re: Maintaing security on untouchible remote server for years.

[Chuck Yerkes <chuck+obsd_(_at_)_2003_(_dot_)_snew_(_dot_)_com>]

Quoting Brad Brad (braddeicide_(_at_)_hotmail_(_dot_)_com):
> Hi, my small online buisness relies entirly on a very remotely hosted 
> server, if anything happened to that server, it'd be a good while before we 
> could recover.

I have a machine 3000 miles away.  FedEX gives me about 24 hrs to
recover from a disaster.  Worst case, I can toss a machine in a
cage here with a couple hours notice and that's just friends helping
friends, not money involved.

...
> security and achievments, however i also read that the release cycle is too 

"read".  So someone else's opinion on what they think is "too quick".
Me?  I get cranky that Solaris took 9 years to get some useful
tools into userland (PERL was available for Ultrix in 1991 from
DEC on an "unsupported software" tape.  That lack on Sun meant
houses that banned using it because it didn't come with the OS).

I bumped to 3.2-current cause ALTQ support got so easy to manage.
Can we talk about HP-UX bugs that were reported in 1998 that are
still there? (don't stop routing before unmounting NFS partitions;
when your NetApp is across a router, that makes the HP hang).


> quick and upgrades can be "destructive"(?)  Currently I think Debian is 

> Has anyone else handled a remote server over a long period without 
> physically touching it?  How well does OpenBSD really upgrade?

Manage the upgrades.  I upgrade a machine 20 feet away and test.
If all is happy, rsync pushes it out to the remote machine.

Actually the box makes most of the difference.  Having console and
real access helps.  Netra's are great for this, if slow and costly
for the performance.   Any real Unix box will do this for you.
This notion of serial console has been with us since, well, 1968.
My Sun/Alpha/SGI/DEC-MIPs boxes all boot to serial port.
I haven't checked out what the new Macs do without a keyboard/video
card, but they have OpenBootProm like a real machine.

BIOS boxes are the big hassle.  Sure you can get control once your
bootloader starts, but that's sometimes too late.  Current machines
are now understanding that they are no longer 1982 desktop machines.
Best I've seen is Compaq DL{3,5}80's with the Lights Out board let
you upload a floppy image that you can boot from.  The G2/G3 boxes
have it built in, AFAIK.  Oh, and hardware RAID built in.  For
bunches less than the cost of a 2/4 CPU Sun with no RAID and slow
disks.

With the Lights Out board, you can even remotely manage Windows
(which is important 'cause you need to reinstall it every couple
times it gets cracked).

Unix is remote.  That terminal on your desktop (you do run desktop
unix, right?) is logically remote, just with a fast connection to
the machine.  You can do what you want with Solaris, BSD, Linux or
1977's Version 7 Unix.  So now you get to look at other criteria.


> So far we've been running redhat 6.2 but it "expired" and i don't want to
> enter redhats upgrade cycle, or overpriced advanced server. The server
> publicly serves DNS, Email, FTP, HTTP
 
The Advanced Server stuff from RH and SUSE is in reaction to
businesses needs.  Vendors like IBM and others (many others)
complained that they couldn't update every 6 months.  That they
REQUIRED a version that would remain stable for at least a 1 year.
Envision Dell/Compaq/IBM burning 200,000 IDE drives with an image.
Envision them in 4 months when RedHat says: Oh, here's the next
version.  Isn't gonna float.
 
The cost of the OS is trivial compared to the cost of maintainance.
Being able to run "up2date" on your RHAS box and know that it will
patch itself saves the cost of the OS in about 1 update.

OTOH, ports/ manages pretty well.  With staging machines, the OS
stuff is mainly trivial to maintain (all of /usr except /usr/local
is owned by the OpenBSD OS.  Linux shoves every 3rd party thing
into /usr/bin/ so now you NEED package management for every piece.).

But we stray far afield.

yes, OpenBSD can be remotely run. So can any Unix.