making a home server

I am looking into getting a mini-desktop computer to use as a home server which I could access from anywhere using DynDNS.

I was wondering if yall had any suggestions regarding this.

I have considered primarily 2 computers:

Mac Mini
Dell Inspiron Zino HD

The Dell is certainly the better of the two in terms of costs. For about $400, I could get a dual-core AMD processor, a 250 GB drive, wireless adapter, dvd drive, and 2 GB of memory. I'd probably repartition it and put Linux on it, and run LAMP.

The Mac Mini depends on the model I would get...if I went that route. All models are more expensive than the Dell. The $599 Mac Mini would be roughly equivalent in terms of specs to the Dell Zino HD that I've configured, while the $999 server edition would supercede it quite a bit by offering double the memory, an extra hard drive, and Apple's Mac OS X Server operating system, but at a sacrifice of the optical drive. The optical drive I'm not too worried about, but the price tag definitely is a factor.

If I did the $599 Mac Mini, I'd probably run MAMP, whereas if I did the $999 Mac Mini I'd probably use the server software that comes with Mac OS X Server (which I do have experience with from past jobs).

I'd like to get yall's input on what you think the best option is, or maybe even get ideas from yall based on solutions that you have implemented in your own homes.

I would use the server for the following:
1. backup data from my primary computer
2. use it as a code repository that i can access from anywhere
3. host a website
4. store audio/video media for personal use

Thanks for any input.

Personally, I feel that for #2 and #3 a VPS would be a better option. For #1 and #4 an external hard disk drive would be a better option, except that it would still be better to use a VPS (or other online storage) to backup important data at a location away from your home.

Yeah, I have a VPS and it's great. Certainly, it's a way better option that running a dedicated box just for a web site and your own remote use.

Drawbacks:

1) if you can't deal with an unmanaged account (where you set up and run the server with no help), then it is going to be at least $20-30+ a month.

2) Storage space is limited, which laserlight addresses.

Beyond that, unless you are expecting a consistent load of several dozen clients or more, 24/7, just use a cheap old piece of junk. A half dozen instances of apache take up less than 100 mb of ram, and the OS itself (linux, sans GUI) only needs a few gigs of hard drive. The processor usage is also minimal. Serving web pages and other remote services on a small scale is very low stress and requires next to nothing WRT to hardware. If remote access for issues #1 and #4 are essential (hence, you don't want to pay monthly for storage) then it's just a bigger HD that's needed -- the rest of a nice new system will just be going to waste.

Quote:

---

Originally Posted by MK27

Beyond that, unless you are expecting a consistent load of several dozen clients or more, 24/7, just use a cheap old piece of junk. A half dozen instances of apache take up less than 100 mb of ram, and the OS itself (linux, sans GUI) only needs a few gigs of hard drive. Serving web pages and other remote services on a small scale is very low stress and requires next to nothing WRT to hardware.

---

Incidentally, if the website that you plan to host is completely static, you could consider using something like Nginx instead of Apache. (If it is not, you could still use Nginx to serve the static files and proxy to Apache for the dynamic stuff, but that may be considerably more work with little gain for you.)

Quote:

---

Personally, I feel that for #2 and #3 a VPS would be a better option.

---

I had never really considered a VPS. I found these options going along that road that seem reasonably priced:

SliceHost
Linode

In terms of just using an older machine:

I currently have 2 older desktops at my disposal, but I am hesitant to use either for the purposes I described. One of the desktops is a 486 running Windows 3.1, and I'd like to keep it that way :)

The other is a computer I built myself several years ago with an AMD Athlon processor (somewhere around the 1 GHz mark...can't remember exactly), GeForce 2, about 386 MB of memory, and two hard drives coming in at 40 GB and 8 GB. I've been planning on selling the thing off simply because it runs really hot and it's really loud. The extra case fan I installed in it a few years back sounds like an airplane getting ready to take off.

If I run a dedicated box in my apartment, I want it to be small, use very little power, and be extremely quiet. Hence the Mac Mini and Zino HD options I was considering.

In terms of off-site backup: I've got 2 GB of off-site backup storage with Mozy simply for files that I deem essential and cannot lose. That's the extent of my off-site backup right now.

Quote:

---

Originally Posted by DavidP

I found these options going along that road that seem reasonably priced:

SliceHost

---

I have a 256 slice that I use for version control and test websites. Linode might have a slightly more bang for the buck package, but I decided not to switch given that I found Slicehost's admin interface and support to be very good.

Well we use a laptop with a broken lid for our webserver (WordPress and Apache on Debian) (http://jbcobb.net)since w/o a display the laptop is awkward, we use one of these as our mail server (and can act as a torrent/file host):
Excito | Small and silent server for a pair of very low-power solutions.

For file, remote processing, etc just another old box running Debian. For video/audio serving we have three 2 TB NAS servers (all low-power):
US Robotics USR8700 NAS Server ( USR8700 ) - Network Storage - U.S. Robotics Storage

These have been running 24/7 for four or more years and have never messed up. They come with a nice web interface but run Redhat under the hood I think. Quiet, reliable. Time to buy more...

David;
One thing I would like to add is this: home servers and networks are a highly-unique and personal thing; what is right for one person is horribly wrong for the next. Pick what you need, not what someone tells you to do. Some folks solve problems by throwing hardware at them; others figure out creative (although usually more work-intensive) solutions using existing hardware. For example instead of the dedicated NAS shells I use I could have (and used to) run FreeNAS on a scrap box. Power requirements are what lead me to this solution. Also I want more direct control over my website and other servers/services so I run it in-house which makes me happy. I don't want to depend on anyone else other than to give me my basic static IP.

Measure twice, cut once, so to speak.

Thanks for the options you linked me to, jeffcobb.

The Excito looks like a nice option that rivals both the Mac Mini and the Zino HD. Although its processor seems less powerful, it has more disk space. It worries me that it doesn't have wireless, though, as I will need my solution (if I decide to go this route) to be able to connect to the internet wirelessly as it will not have direct wired access to the router. I know I can get some small USB devices to handle this though.

I keep looking for reviews by people who have tried setting up the Zino HD as a server running Linux, but I can't find much.

In terms of using an old laptop, I've also thought about that. My current laptop computer (my primary machine) may or may not be replaced soon (I'm thinking about getting a new laptop), and if I do so, I could always set up my current laptop to be a server of sorts.

Anyways, thanks for the info! Still mulling over the options...

Quote:

---

Originally Posted by jeffcobb

I want more direct control over my website and other servers/services so I run it in-house which makes me happy. I don't want to depend on anyone else other than to give me my basic static IP.

---

That's why I like the "unmanaged" option: you get a slice with your choice of OS installed and ssh running so you can log in. After that, you can do whatever you want (such as configure and run a web server); the provider may maintain a local repository (for linux) or you can download software packs from elsewhere. There's no admin panel, you don't have to (in fact, can't) ask anyone to do anything, no one else touches your system. It's also half the price (and way less than paying for a static IP at home).

MK27, where do I find this unmanaged option of which you speak? The baseline for SliceHost is $20, and you implied through your post that you can get something cheaper than this if you go "unmanaged".

Are you talking about the service offered by SliceHost, or a different company?

I've been using these people since last summer:

Xen Hosting by VPS Village


That is the "unmanaged VPS" branch of groknet, which when I signed up it was all together and clearly delineated, which now it does not clearly refer to the fact. I did look at slicehost and can't remember whether they do or not, and it's not clear on their site either. But googling "unmanaged VPS" turned up a few other names.

I run a dedicated chat server on this with a control client connected here whenever I'm online. The control client pings the server every five seconds, so I have a pretty good idea of whether it is running nicely a lot of the time (if the server slows way down, the ping will fail and I find out). In the past six months, there was one weekend when everything was out (and we got an apology and explanation). Occasionally (once or twice a month) I'll notice it becomes erratic for an hour or so. I know nothing about hypervisors, so it could be that someone else on that box is getting away with some expensive processing periodically -- since I'm only paying $11/month,* it doesn't bother me enough to complain. Someone in Asia once complained the connection time was slow, they are eastern seaboard I believe. Other than that, they seem pretty great to me, a competent sys admin type person answers the phone 24/7, friendly, etc.

If you're comfy with the command line and console apps, it's just like home. I logged in, installed mc as a file browser, and was off to the races.

*128 mb RAM, 8 gb storage. Right now I'm using less than half the storage (the initial OS, which is enough for a web server, is about 2 gb) and haven't once had any memory use issues -- altho I also never get more than 5-10 simultaneous connections. It does occupy (almost) the entire 128mb most of the time. I think I have apache set to run 4 instances of 25 threads or something, plus mod_perl (which is usually considered memory intensive; the reason I got into the VPS was because normal hosts will not provide mod_perl unless you pay more). I believe it could deal with a fair bit more traffic as is but have not tested that.

BTW one thing about using an old laptop as a webserver:
1. You have hands-on access to the HW if needed.
2. The battery in it means built-in UPS ^__^
3. If you like to experiment like I do you can change the SW/OS on it all you like w/o asking someone to do it.

Quote:

---

Originally Posted by davidp

...to connect to the internet wirelessly as it will not have direct wired access to the router. I know I can get some small USB devices to handle this though.

---

Careful, they get pretty damn hot.

My server is 1.0GHz and micro-ATX board. It's plenty for what I do, and it eats almost no power :). I use it for backups, web server, svn server, schedule downloads so I can get them off-peak and a distributed compiler (distcc). It runs a tiny fan on the CPU, meaning the only other fan is the PSU. The only thing I want is a bit more horse-power to record live-tv, or run a headless virtual machine.

Code:

---

zac@mercury:~ $ uname -mpi
i686 VIA Nehemiah CentaurHauls
zac@mercury:~ $ cat /proc/cpuinfo
processor        : 0
vendor_id        : CentaurHauls
cpu family        : 6
model                : 9
model name        : VIA Nehemiah
stepping        : 8
cpu MHz                : 1002.121
cache size        : 64 KB
...
zac@mercury:~ $ uptime
 14:26:08 up 206 days, 2:21,  4 users,  load average: 0.17, 0.30, 0.13

---

I would say, try build a micro-ATX server (most CPUs are soldered on). That way you've got most of the components, the case from the AMD, hard-drives, perhaps even memory.

And beware of making SSH visible to the world, the amount of attacks I get even running a non-standard port is bizarre.

Quote:

---

Originally Posted by zacs7

Careful, they get pretty damn hot.


And beware of making SSH visible to the world, the amount of attacks I get even running a non-standard port is bizarre.

---

Agreed and seconded. I only make SSH available on an as-needed basis and then its with an intense password on a non-standard port.

I left a standard SSH port open for a while when I first moved here and one day was watching the slow lazy zombie attack in real-time....that I was being attacked did not bother me as much as the fact that it was a distributed, *coordinated* attack...I saw one hit come in from (say) illinois...then a few minutes later another come in from the UK using a password one character off from the previous...then a minute later one from alaska...same thing...checked my logs and it had been going on for a while. Moving to a non-standard port stopped it immediately and it has not repeated but in a "belt and suspenders" moment, I also set it up to only be open to the world when I command it to from this side of the FW. Also the password looks like the VIN number from my car...its NOT but it looks like it...IOW no dictionary attack will work which is what they were using before...

Miscreants...

And that is another thing: build the network that is right for you and more importantly make sure you feel comfortable about securing it....

Quote:

---

Originally Posted by zacs7

Code:

---

zac@mercury:~ $ uptime
 14:26:08 up 206 days, 2:21,  4 users,  load average: 0.17, 0.30, 0.13

---

---

That's pretty impressive!

Quote:

---

using a password one character off from the previous

---

I thought passwords would be encrypted.

Quote:

---

cyberfish@servhost:~$ cat /proc/cpuinfo
processor : 0
vendor_id : GenuineIntel
cpu family : 15
model : 3
model name : Intel(R) Celeron(R) CPU 2.40GHz
stepping : 4
cpu MHz : 2392.035
cache size : 256 KB
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 5
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe constant_tsc up pebs bts pni dtes64 monitor ds_cpl cid xtpr
bogomips : 4784.07
clflush size : 64
power management:

cyberfish@servhost:~$ uptime
20:35:54 up 144 days, 35 min, 1 user, load average: 0.00, 0.03, 0.01

---

I took it down 144 days ago because I went somewhere for summer vacation and took the server (it's in a virtual machine) with me. Before that it has been running for at least 2 years.

Apache, Postfix, SMBD in a virtual machine with snapshot backup. Host has RAID-5.

Just upgraded from P3 to Celeron a few years ago.

Quote:

---

Originally Posted by MK27

That's pretty impressive!

---

From my little bubba server (mail):

Code:

---

jeffc@bubba:~$ uptime
 21:27:54 up 222 days,  7:58,  1 user,  load average: 0.13, 0.05, 0.01
jeffc@bubba:~$

---

That was when we moved house ;)

Quote:

---

Originally Posted by DavidP

The baseline for SliceHost is $20, and you implied through your post that you can get something cheaper than this if you go "unmanaged".

---

Slicehost is unmanaged, but it has good documentation and support.

Quote:

---

Originally Posted by MK27

I've been using these people since last summer:

Xen Hosting by VPS Village


That is the "unmanaged VPS" branch of groknet, which when I signed up it was all together and clearly delineated, which now it does not clearly refer to the fact.

---

I do not know about the current state of affairs, but back when I had an account with them, GrokThis had very good support. However, if I remember correctly, I did not choose VPS Village in the end because I felt Slicehost's admin console and documentation was better. (Though in retrospect the documentation is actually more widely applicable than just Slicehost, so somewhat ironically this should not have been a factor.)

Quote:

---

Originally Posted by jeffcobb

3. If you like to experiment like I do you can change the SW/OS on it all you like w/o asking someone to do it.

---

This should be true of any VPS as well, though your choice of OS may or may not be limited. But I guess that having physical access to the hardware is a nice feeling :)

Quote:

---

Originally Posted by jeffcobb

I only make SSH available on an as-needed basis and then its with an intense password on a non-standard port.

---

Why not disable password authentication? Alternatively, use a sudoer account, disable root login via SSH, and install denyhosts.

Quote:

---

Originally Posted by zacs7

And beware of making SSH visible to the world, the amount of attacks I get even running a non-standard port is bizarre.

---

Quote:

---

Originally Posted by jeffcobb

Agreed and seconded. I only make SSH available on an as-needed basis and then its with an intense password on a non-standard port.

---

This is excessively paranoid. I started work last year on a dedicated server for a "medium profile" public figure. We use ssh there; I had some security concerns because of some work I was doing and wanted to discuss this with one of the other staff, who's a C++ programmer for NASA. These had nothing to do with ssh , but in any case, he said there'd been no successful, noticeable break-ins on the site in a decade.

@zacs7: what counts as "an attack" here? some bot scanning ports? They're irritating, but I do not think they are actually attempting anything malicious beyond surveying.

If you did want to get a really cheap computer, I have three of the Atom based processors. The whole system only cost me $140 each (that's with a 200GB HD and 2GB memory). Here is a list of these.

Quote:

---

This is excessively paranoid.

---

My thoughts as well. I used to administer some servers running Mac OS X, on which we had SSH running non-stop on the standard port.

What about using public/private key authentication in addition to a password?

Quote:

---

Originally Posted by DavidP

My thoughts as well. I used to administer some servers running Mac OS X, on which we had SSH running non-stop on the standard port.

What about using public/private key authentication in addition to a password?

---

I haven't studied ssh much, I thought it always used a key (which is to say, it's all "ssh keys" on the servers I've worked on).

I guess you can just use a password. Adding a key sure seems like a way harder thing to crack.

Quote:

---

Originally Posted by DavidP

I used to administer some servers running Mac OS X, on which we had SSH running non-stop on the standard port.

---

I always do that. Although it is probably true that using a non-standard port makes you less of a target, I find it somewhat of an attempt at security through obscurity. I reason that as long as the accounts that can be accessed via SSH have good passwords (especially with denyhosts limiting the number of incorrect tries), or are restricted to key based authentication, it should be good enough.

Quote:

---

Originally Posted by DavidP

What about using public/private key authentication in addition to a password?

---

I do not think that that makes it any more secure than just using a password. In fact, it might arguably make it less secure, since there are two things to keep secret instead of one (i.e., the password and the private key, or the password and the password protecting the private key), yet either one is enough. But if you disable password authentication and just use key based authentication, then you still have only one thing to keep secret.

Quote:

---

Originally Posted by laserlight

Slicehost is unmanaged, but it has good documentation and support.

This should be true of any VPS as well, though your choice of OS may or may not be limited. But I guess that having physical access to the hardware is a nice feeling :)


Why not disable password authentication? Alternatively, use a sudoer account, disable root login via SSH, and install denyhosts.

---

Re: VPS vs using your own hardware: That may be....for a control freak having physical access to the HW is nice though. Just a personality quirk plus knowing I can up my hardware anytime I need at no additional cost (as long as the hardware is lying about the house) is nice too. However I know this is not for everyone and to an extent, while this has some practical advantages, my setup has also been a fun learning experience as well, knowing I can go from bare metal to working webserver. Same thing goes for my mail server.

Re: SSH. All good points and suggestions. As rarely as I need to do this (like once every other year) this crosses the pain threshold. I may still do this at some point but logging into the firewall and disabling the port forward rule takes seconds. Still not a good excuse for slothfulness but its the only one I have...

^__^

Jeff

Quote:

---

Originally Posted by DavidP

My thoughts as well. I used to administer some servers running Mac OS X, on which we had SSH running non-stop on the standard port.

What about using public/private key authentication in addition to a password?

---

The attacks are real. Here is one posting on the subject:

Slow brute force server security - distributed slow SSH brute-force attacks - slow vs fast brute force attacks run over days or weeks and are distributed from an IP net of hundreds of IPs

This is just one of many. It describes exactly what I was seeing. With your SSH on a standard port you are one password away from being owned. Setting a strong password here really doesn't seem paranoid.

Further, moving the ssh to a non-standard port stopped the attempts altogether...so if I have discouraged the zombies from even trying, is that considered overly paranoid?

Quote:

---

Originally Posted by jeffcobb

The attacks are real. Here is one posting on the subject:

Slow brute force server security - distributed slow SSH brute-force attacks - slow vs fast brute force attacks run over days or weeks and are distributed from an IP net of hundreds of IPs

---

That article, AFAICT, is exclusively about brute force attempts to crack passwords. I do not think a brute force attack on a key is very feasible (educated guess :p).

I'm pretty inexperienced here, but I am surprised to learn anybody uses ssh without keys. I thought the whole point of ssh was the public/private key system -- otherwise you might as well just use rlogin or something.

Quote:

---

Originally Posted by MK27

That article, AFAICT, is exclusively about brute force attempts to crack passwords. I do not think a brute force attack on a key is very feasible (educated guess :p).

I'm pretty inexperienced here, but I am surprised to learn anybody uses ssh without keys. I thought the whole point of ssh was the public/private key system -- otherwise you might as well just use rlogin or something.

---

First, if you use a dodgy/lame key (password) then its entirely possible it will get hacked and there are folks out there actively trying this. For every one of us "paranoids" out there, there are 50 knot-heads with a password like "sekrit". The hackers are not trying to get the careful ones, they are after the idiots. Darwin in action here.

As for the "keyless" systems there are keys and then there are keys. Two basic types of SSH keys are ones you type from the keyboard and the ones I think you are thinking of as "keyless" are the public/private keys set up so that if you issue a keyset to a remote user, they can log in simply by using their name b/c the computer is auto-supplying the stronger key. It is not meaning "leave your system wide open".

Quote:

---

Originally Posted by jeffcobb

Two basic types of SSH keys are ones you type from the keyboard and the ones I think you are thinking of as "keyless" are the public/private keys set up so that if you issue a keyset to a remote user, they can log in simply by using their name b/c the computer is auto-supplying the stronger key. It is not meaning "leave your system wide open".

---

In ssh nomenclature, what you refer to as "keyless" are called keys, and they are clearly distinct from passwords. You cannot enter them on the keyboard. They are more than 1600 bytes. This is what I meant by "infeasible" by brute force. Isn't that 2^8^1600? Even if you made 4 attempts per second, I think this will take you more than a billion years...and you still won't be 1% done.

And since it is a "horseshoes and handgrenades" type game, brute force is the only option. Like I said, it was my understanding that this was the whole purpose of ssh and using it without them is akin to installing a laser perimeter alarm -- then never plugging it in.

This is probably why my man at NASA says no one has got in that way in 10 years (ie, the entire time). If brute force attacks are all you guys are worried about, I'm gonna say you're beyond paranoid -- you're totally insane ;)

Quote:

---

Originally Posted by MK27

In ssh nomenclature, what you refer to as "keyless" are called keys, and they are clearly distinct from passwords. You cannot enter them on the keyboard. They are more than 1600 bytes. This is what I meant by "infeasible" by brute force. Isn't that 2^8^1600? Even if you made 4 attempts per second, I think this will take you more than a billion years...and you still won't be 1% done.

And since it is a "horseshoes and handgrenades" type game, brute force is the only option. Like I said, it was my understanding that this was the whole purpose of ssh and using it without them is akin to installing a laser perimeter alarm -- then never plugging it in.

This is probably why my man at NASA says no one has got in that way in 10 years (ie, the entire time). If brute force attacks are all you guys are worried about, I'm gonna say you're beyond paranoid -- you're totally insane ;)

---

True enough; and I was generalizing. For password-based authentication however it makes nothing I said any the less valid. There is the old joke about "being paranoid doesn't mean they are not out to get you" but when I look at my server logs and find attempts to get in through everything from ssh to MS services from China, et al I can honestly say they ARE out to get you. I/we may seem paranoid to you; you seem naive to me, that's for sure. I cannot speak to your friend at NASA but if security was as simple as you would have us believe, I would wager far fewer machines would be hacked and set up as part of zombie nets...the thing with the above-mentioned attack is that while brute force, due to the nature of the relaxed timing it often falls below the radar of the typical IDS and therefore can go on for years w/o detection. To me, the attack that you cannot even see coming, lame or not is one of the most dangerous kinds...

Quote:

---

Originally Posted by jeffcobb

For password-based authentication however it makes nothing I said any the less valid. [...] the thing with the above-mentioned attack is that while brute force, due to the nature of the relaxed timing it often falls below the radar of the typical IDS and therefore can go on for years w/o detection. To me, the attack that you cannot even see coming, lame or not is one of the most dangerous kinds...

---

Yeah, but it sounds to me like this is just a product of pure ignorance, laziness, and or stupidity -- not using public/private keys. I'm not surprised at all that people get cracked that way. If you left your car parked downtown with the windows rolled down and the keys on the front seat, how many nights do you think would go by before there was a "startling security violation"?

Slow brute force attacks may be "insidious" and "undetectable", and maybe great if you are (patiently) phishing for access to someone's facebook page, but versus a 1600 byte key, who cares? They will still be plodding insidiously along when the sun burns out -- when the known universe collapses in upon itself. Etc.

Please. People. Use the keys. :p

Quote:

---

Originally Posted by MK27

you're totally insane ;)

---

Dude, don't lump the paranoid into my group (insanity doesn't run in my family -- it gallops), I'm not paranoid at all.



::what was that::

Quote:

---

Originally Posted by MK27

-- you're totally insane ;)

---

Well I initially had that reaction to your coding style but had the tact to keep it to myself. I take the "having a sense of security is insane" and file it in the stupid folder myself. To use your unlocked car analogy, I see my level of security as locking the car door and not leaving the laptop/iPhone in plain view. The unlocked car with the windows rolled down are those exposing completely unprotected services -- now *that* I consider insane...

Kennedy's excellent suggestion some posts ago, made me think also of netbooks. You could even "Take your server with you (tm)".

I honestly can't think of a use I could give these things that seem to be all the hype. But turning them into dedicated mobile servers really looks promising.

I'm pretty sure no one has mentioned this, but have you thought about using Opera Unite for this? It seems like it can fit all of your requirements.

Quote:

---

Originally Posted by Mario F.

Kennedy's excellent suggestion some posts ago, made me think also of netbooks. You could even "Take your server with you (tm)".

I honestly can't think of a use I could give these things that seem to be all the hype. But turning them into dedicated mobile servers really looks promising.

---

Mario; I use mine for a ton of things: ebook reader, movie viewer, programming station, email/web, game machine and more. It is the portability of it that makes it worth it. These things (at least mine) are little larger than a book yet can hold so much more. In addition, your default OS, etc can be the productivity outlined above (I do all the above on the little 4G partition of the EEE 701) but if I need other uses for it (penetration testing, etc) I can just stick in a bootable USB key or SD card and the little computer takes on a whole different personality/use.

People complain about the screen size; I have no problem with it and its bigger than an iPhone, and the keyboard which is still bigger than an iPhone. It works for me. If you want to run Windows on it your experience will likely be worse. With a trimmed-down Linux though I can do a *lot* with mine...

If anything it would always be Linux since it would take more advantage of the limited resources. But being the owner of 2 laptops and not making the use of the net a typical netbook user is expected, I honestly don't see a need for one for myself. But this thread did make me wonder.

Quote:

---

Originally Posted by jeffcobb

Well I initially had that reaction to your coding style but had the tact to keep it to myself.

---

Sigh. Not every appreciates free thinkin'. You should see what's in the pipe.

Quote:

---

Originally Posted by Mario F.

If anything it would always be Linux since it would take more advantage of the limited resources. But being the owner of 2 laptops and not making the use of the net a typical netbook user is expected, I honestly don't see a need for one for myself. But this thread did make me wonder.

---

Mario you have touched upon one aspect of this conversation where the saying about "one mans meat is another mans poison" is so true. For some folks in some situation this would be as useful as a screen door on a submarine whereas in my case if was a life-line in my last job. I had to travel alot which made checking office mail, working on little ideas, reading documents, etc really easy with this form-factor of a laptop. Also because I commuted via train, carrying this little thing was easier that carrying a full laptop to work and back. So, *in my situation* this thing was just right. For others it may not be.

Quote:

---

Originally Posted by jeffcobb

Re: SSH. All good points and suggestions. As rarely as I need to do this (like once every other year) this crosses the pain threshold. I may still do this at some point but logging into the firewall and disabling the port forward rule takes seconds. Still not a good excuse for slothfulness but its the only one I have...

---

Slothfulness? Generating a key pair, uploading the public key, disabling password authentication and then reloading the SSH configuration may sound like hard work, but it is a one time thing. Once done, you no longer have to log onto the firewall and enable the rule when you need it. You just load the private key, maybe entering a passphrase if it is protected by one.

Quote:

---

Originally Posted by MK27

In ssh nomenclature, what you refer to as "keyless" are called keys, and they are clearly distinct from passwords. You cannot enter them on the keyboard. They are more than 1600 bytes. This is what I meant by "infeasible" by brute force. Isn't that 2^8^1600?

---

I do not think you can just look at the number of bytes, since that is related to how the private key is encoded to be stored as text, rather than its actual length. Nonetheless, it should still be far more infeasible to guess a private key than to guess a good password, unless you have a case like Debian's predictable random number generator security blunder that leads to weak keys.

Quote:

---

Originally Posted by MK27

Yeah, but it sounds to me like this is just a product of pure ignorance, laziness, and or stupidity -- not using public/private keys. I'm not surprised at all that people get cracked that way. If you left your car parked downtown with the windows rolled down and the keys on the front seat, how many nights do you think would go by before there was a "startling security violation"?

---

Bad analogy, since with good passwords, SSH access limited to a restricted set of users not including root, and denyhosts installed and running, brute force is also very unlikely to succeed.

Quote:

---

Originally Posted by laserlight

unless you have a case like Debian's predictable random number generator security blunder that leads to weak keys.

---

I learned of this sometime last year just by chance when I was moving from Ubuntu to ArchLinux. It never was clear to me what kind of inside knowledge should the attacker possess in order to take advantage of this vulnerability. It seems they would need to know other keys from the system, so this vulnerability was only serious for inside attackers. But would like a clarification.