1

If a small number of physical servers are used to run an OS and reverse proxy purely in RAM and have no storage, and they are rebooted/re-initiated in relay every X minutes - so that changes to the system while in RAM are wiped - does this provide a real security benefit over more standard always on servers?

Improve this question
1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop ♦
    Aug 9, 2016 at 7:42

1 Answer 1

Reset to default
1

The specific proposed approach of rebooting full server instances every n minutes would in practice be far too operationally expensive and fragile to entertain in a production environment, but the ideas of:

  • automatically refreshing one's plant on a regular basis
  • disallowing durable writes on edge services (except perhaps for logging)

are good ones for security and other reasons and are common threads in DevOps practices going back decades.

Most recently, container technologies now embody these and related practices:

  • containers are quick to "boot" and can be efficiently used for applications whose lifespans are measured in high tens of seconds to low numbers of minutes
  • containers are immutable after creation, so file system writes are not durably retained
  • containers provide additional sandbox capabilities for constraining application access to sensitive resources
  • platform dependencies used in containers can be inspected and new container templates cut when needed, an improvement over the fragile practice of deploying patches

Take a look at Docker, "cattle vs pets" and "immutable infrastructure" to learn more.

Improve this answer
4
  • Thank you, this is helpful. Why do you think it would be too expensive for production? These instances would solely operate as reverse proxies.
    – Jonno
    Aug 8, 2016 at 20:12
  • Two aspects to start: traffic management and instance management. Traffic management- these machines have IP addresses, something has to know to send packets to them when they are up, and not send packets when they are down. Or, something has to move the IPs when they are going down and move again when they are coming up. When they are to go down, if they are busy serving traffic then that traffic has to be drained. When they are coming up, their ability to serve traffic has to be verified. All of this machinery is expensive.
    – Jonah Benton
    Aug 8, 2016 at 20:46
  • Instance management- if lifetimes are managed in minutes, a full reboot of a server class machine takes a non-trivial fraction of that time, which means right off the bat you are paying a significant operational tax not having those machines in service.
    – Jonah Benton
    Aug 8, 2016 at 20:47
  • Thanks. I planned to use a virtual ip to move traffic and to have enough instances to allow graceful shut downs. I see your point, perhaps I would need to increase the lifetime.
    – Jonno
    Aug 8, 2016 at 20:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .