Skip to content

Conversation

@c-w
Copy link
Contributor

@c-w c-w commented Dec 4, 2017

See CatalystCode/project-fortis-pipeline#239:

  • Ensure packages are up to date
  • Remote outdated deploy script
  • Disable ssh password authentication
  • Enable fail2ban

@c-w c-w requested a review from anthturner December 4, 2017 19:38
# setup
build_dependencies='curl git build-essential'
sudo apt-get update > /dev/null
sudo apt-get upgrade > /dev/null
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add -y to this line to avoid blocking on user input.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, got it locally, just need to push it.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See 26fc2f1

Copy link
Member

@anthturner anthturner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

One minor note is that fail2ban uses iptables by default IIRC, so we should verify that bringing up iptables via fail2ban doesn't overzealously block access to anything else on the server (like the nodejs app).

@c-w
Copy link
Contributor Author

c-w commented Dec 4, 2017

Already tried this on a deployment and everything seems to be working fine :) http://fortis-features.eastus.cloudapp.azure.com/features/name/bogota

Thanks for the review!

@c-w c-w merged commit 17e6044 into master Dec 4, 2017
@c-w c-w deleted the harden branch December 4, 2017 19:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants