Security in the cloud, KISS

The idea of keeping things simple when it comes to server security is not at all radical and cloud servers provide the ability to reach the not so lofty goal of keeping your servers simple and secure without breaking the bank.

The theory is simple: The smaller the number of processes you have running on your box the less there is to go wrong, or attack. This is one area where Windows based servers are immediately at a disadvantage over a *ix server, but I digress.

When I was pretending to be a hosting provider a few years ago I ran colocated discrete servers. They weren’t cheap to own or run, not by a long shot. That cost was a huge enemy of the KISS security concept.

In the process of trying to squeeze every last cent of value from the boxes I overloaded them with every obscure daemon and process I could think of. Subsequently the configuration of the servers became complex and difficult to manage, while applying patches became a cause of sleepless nights and caffeine abuse.

With the cost to deliver a virtual server in the cents per hour and the ability to build a new server in a matter of minutes the barrier to building complex applications with a robust security architecture is all but vanished.

The mySQL server behind this blog site is a base install of Debian Lenny with mySQL, nullmailer, knockd and an iptables firewall script. That’s it. Simple to build, simple to configure, simple to backup and simple to manage. KISS.

A little bit of searching around on hardening up a linux box and you’ll quickly find information on changing default settings for sshd and iptables rulesets which you can combine with small targeted cloud servers to reduce the sleepless nights.

I can’t help with the coffee addiction though, I’m still trying to kick that habit myself!

Working on a cloud

This blog is now coming to you from a cloud. A rackspace cloud server that is. Two of them in fact, the front end server running the CMS, and the back-end MySQL server.

The concept of cloud computing really isn’t all that new, but if you’re all at sea when it comes to clouds you might want to toodle over to Wikipedia and read about it there.

“This is the pointy end of the geek scale where crontabs are complex and the preferred editors have two letter names.”
The service I’m using is probably better described as cloud provisioning, in that I’ve got two virtual servers living somewhere in the bowels of the Rackspace data centre. I don’t have to care about memory sizing, disk space, network infrastructure, or anything else for that matter, I’m just renting some resources out of the cloud.

I picked how much memory and disk space I wanted in a few clicks then before the kettle had time to boil the server was on line and ready for configuration. If this service was available back when I was running a hosting business I’d probably still be running a hosting business, although I’d also be stark raving bonkers.

At this point I should say that I’m talking about virtual Linux servers here, not cloud hosting or full service shared hosting. This is the pointy end of the geek scale where crontabs are complex and the preferred editors have two letter names.

I’ve moved the blog onto the fluffy stuff to get a feeling for the service before I shift my work-in-progress link shrinker into the cloud as well. What I want to achieve with the is simply not possible on a shared platform, as I want to build a tiered application which can scale quickly.

The traditional way of achieving this goal would be to slap your gold card down on the counter of a hosting company and then proceed to the bank to arrange a second mortgage on your house. Virtualised ‘cloud’ server services such as rackspace cloud, Amazon EC2 or gogrid lets you do the same things for a fraction of the cost and with amazing flexibility.

note: I’m not affiliated with Rackspace, I just think they provide a nifty service. 🙂

Saturday’s Sunset

I don’t know about where you live, but here the sun sets pretty much every day. Granted it sometimes does so behind a veil of grey or in the total absence of cloud it just disappears without the slightest hint of pomp and ceremony.

We are blessed, however, here in Canterbury with a reasonable number of stunning sunsets, along with the one at the beginning of the day. What’s the name of that one? Sunlift? Sunclimb? Not sure. I’m not really a morning person, but I’m sure you know what I’m on about.

I’m a sucker for a good sunset as much as the next bloke, although in truth it’s the cloud scape I’m after when I venture off into the setting sun. The way our house faces the first indication I get of a good sunset is the red glow out to the east towards Banks Peninsula.

If I see the landscape getting that surreal golden look about it I’ll grab the camera and do a 5 minute photo recon of the back yard and check out what mother nature has thrown on. This is what I got on Saturday night when the wind had calmed itself from a furious day, and the number one daughter asked “Why is the sky a funny colour?”.

I blasted off some initial cloud-shots and chimped the RGB histogram on the camera to see what sort of light range I’d be competing with. Things were still a fraction too bright on the horizon for my liking, but the clouds looked great.

As the sun drops lower the light shears across the cloud base, creating the textures and effects that define and paint the sky. The closer it gets to the horizon the less contrast there is in the light and the more modelling you get of the clouds.

It’s a bit like playing chicken with mother nature. The sky changes quickly, shifting hues of red, orange and blue right, shards of light spreading further outwards as the sun gets under the base of the lowest clouds. If you wait too long the show is over, packed up it’s bags and moved on to another time zone.

This shows the problem with the light, even though this is two different exposures from one raw file, with a bit of doding on the shadows thrown in for good measure, I was still struggling to get enough detail in the shed and grass to be compelling, and the hot-spot from the sun is still too large and distracting for my liking.

After playing chicken for about 5 minutes things were looking about right. I couldn’t decide what exactly to take the photo of, so I opted for a sweeping 270 degree panorama shot vertically to get enough of the sky in the frame.

The shed is just off to the left of this, I decided it was too ‘heavy’ to leave in the frame, while the gate and fence balanced out the bright spot where the sun was sneaking out of site quite nicely.

Again this image is created from two raw conversions of each image, 16 in total without the shed on the right. The sky is as-shot, and the exposure for below the horizon was bumped up 2 stops and then blended in the GIMP before assembling the panorama.

There are two things that make a panorama successful, apart from the obvious need for something interesting to take a photo of. Exposure and overlap of images. The software for creating panoramas has come ahead by leaps and bounds over the last few years, but there’s no substitute for good source images.

If you take a set of mediocre images and try to stick them together you’re going to get an equally mediocre result. I’m a great fan of digital photography but many people seem to focused on the digital bit, and ignore the photography.

Setting exposure for a panorama is more problematic than a single-frame photo as you are potentially covering a far wider dynamic range. In this case I shot some frames of the brightest spot, adjusting the exposure until an acceptably small patch was showing the blinking over-exposure highlight. I then used AE-lock to fix the exposure for all 10 frames.

Using AE lock fixes the exposure and means that the tone-blending part of the panorama process is so much easier for the software to sort out. I use Hugin on Linux, but all of the current tools are very similar in function. They don’t cope well if you’ve got a two stop difference in exposure between frames, and you get bands of light and dark areas in the finished image.

Along the lines of keeping the job simple for the computer is having the images overlap in a sensible way, and having plenty of overlap to work with. On the left is one of the images from the panorama, full frame.

Keeping the horizon through the middle of the frame makes the job of stitching the images far easier, and having at least 1/3rd of the frame as overlap ensures the software will have enough points to create a seamless version of what you saw.

Yahoo plus Bing, Strange Bedfellows

The news that Bing is set to become the search engine behind Yahoo is quite old now. The ten year deal between number two and three in the battle for search dominance was cut back in July this year.

There’s nothing too strange about Microsoft and Yahoo doing business together on the face of it, this came a bit of a year after a failed attempt by the Seattle software hawkers to buy out Yahoo lock stock and flickr pages for a cool $44.6 Billion in change.

What is strange is the positioning of Bing search results in the Yahoo pages.

Existing Yahoo search users have made a conscious effort to not use Live! Search and it’s successor in mediocre search result delivery, Bing. How are they going to react to Steve Ballmer sneaking back into their lives in 2010 when the deal is set to become reality?

Looking at this through my rather rose coloured glasses the bulk of Bing faithful is probably made up of three groups who can clearly be defined. Zealots who also lusted after attendance at Windows 7 Launch parties, ignorant users who don’t know how to change their default search provider, and interior decorators who are drawn to the elegant interface but secretly wish they could search for mis-spelt words but don’t change for fear of affecting the Feng shui of their office.

What portion of Yahoo users do you think changed their default search provider in their shiny IE8 install because they simply didn’t want to use something provided by Microsoft? While Microsoft know the power of bundling in making Bing the default for Windows 7 and IE8, they also know all to well that a portion of their customers resent them simply because they are a near monopoly supplier in their market.

So, will Bing and Yahoo joining forces and realise conversion of their 8% and 20% chunks of the search market into 28%, or will it carve up Yahoo’s 20% for Google, Cuil, Ask, and all the other players out there.

Interesting times.