2

I just finished setting up a server to run a python pyramid application, and while I did not find any guidance on the Internet that helped me, I feel like I could contribute one myself.

I'm considering posting all of the commands that I used, in order, on my blog (with passwords removed, of course).

However, this will result in me sharing my directory structure, deployment script, user list, IP tables config, and other things which occur to me could be advantageous to a hacker.

It's obvious that it's better for me not to share this information, but I'm not convinced that I have a realistic idea of the security risks involved. What are the security risks and how serious are they?

  • Can you omit or alter portions of it that include sensitive information? Basically do you have to show all of those items in their entirety? – John Conde Sep 4 '14 at 20:02
  • 1
    Yes- security is a huge issue. Far more than you realize! You can make your examples anonymous of course. Most file paths are the same from server to server and install to install with some variations for some operating systems such as RedHat. Most configuration files are nearly the same or fairly common. Just remove all site specific stuff using example.com and username and password as an example. – closetnoc Sep 4 '14 at 20:30
  • @JohnConde I guess I'm just looking for some help deciding what is sensitive information and what isn't. I know you shouldn't post passwords, and I sense some queasiness over usernames. But I'm not so sure about, say, directory structure and deployment script or the UNIX username that I use, or my firewall config, etc. – Jeremy T Sep 4 '14 at 22:03
  • 1
    As long as you make sure to remove passwords, usernames. IP addresses and host names from your code, you should be okay. – Jonathan Sep 4 '14 at 23:21
  • 2
    @w3d Well, here it is. This is the first time I've done this, so there are definitely errors: jeremytunnell.com/posts/… – Jeremy T Sep 5 '14 at 16:00