On Thursday 26 April 2007 01:51:56 pm Duane Winner wrote:
> I am looking for any sort of insight, experience from anybody who uses VPS
> technology to substitute for managing their own infrastructure and servers
> for business apps.
>
> We are looking at different options to unload some of the burden of
> supporting a network and server infrastructure that is composed of 50+
> FreeBSD servers.
>
> The concept of VPS technology has been put on the table, along with co-lo
> and dedicated server options. Web hosting is right out of the question.
I've had a VPS with JohnCompanies for quite some time and have been very happy
with it. A client of mine also hosts dedicated/managed servers with them with
good results.
> Requirements:
>
> 1. We need to have servers take over the role of the 30+ web servers,
> which run apache and mzscheme webapps. These web servers to talk to 2+
> postgresql databases on seperate servers.
>
> 2. The data on the pgsql databases is of a sensitive nature, so it needs
> to be secured in part by keeping these servers on a separate network
> segment, accessible only by the web servers, using stunnel encryption.
You may want to consider running the webservers as VPS'es and the database
servers on dedicated hardware (your own or managed). That would make it easy
to directly control the network environment on the database side, at least.
> 3. All servers should have some form of firewall protection, either
> locally (software) or on the network. Preferably network.
>
> 4. If using VPS, the FreeBSD image should look and feel just as if we
> installed it ourselves from scratch, starting off barebones and installing
> only the apps and services we need.
That's what JC gives you.
> 5. Web server disk space needs to be 10GB. Can scale back to 5GB if ports
> are kept off the server and compiled offline then synced up.
>
> 6. One of our database servers is utilizing 33GB of disk space at the
> moment, so we would need at least 50GB per server.
Another reason to not go VPS for the DB servers.
> Findings:
>
> I have found about 4-5 providers who offer FreeBSD VSP's. I've evaluated
> 2: JohnCompanies and Verio.
>
> 1. JohnCompanies' VPS image was nearly exactly what I'm looking for --
> started off barebones, and I had to do the rest. Just like in my server
> room. But disk space was abysmal $29/month for 2GB or $69/month for 8GB.
I do think the default disk space offered with their packages is pretty low,
but you can get as much more as you want/need for an extra $2/GB/mo. I would
recommend contacting them directly (sales@), they are helpful and have a
clue.
> 2. Verios turned me off right away between high-pressure sales tactics and
> an evaluation that saw a base image loaded with crap like it was a Linux or
> worse, a Windows box: NAS audio server, mp3 player, a default Apache 2.2
> install (who said I want 2.2?), that wasn't a port, but built-in shared
> app! PHP, Xridiculous.
Thanks for the warning...
> 3. Nobody seems to include any sort of firewall protection -- just throw
> the server out in the public DMZ, and then there is no option to protect
> database servers on a private subnet. Not even ipfw is included. Verios
> told me that their FreeBSD images cannot firewall, but their Linux images
> can, and then tried to pressure me into just converting to Linux. Sorry,
> they're off the list now.
Again from my experience with JC.. I don't know if or how well individual
VPS'es are firewalled from each other, but you can specify your own firewall
rules to be run on the firewall between the VPS server host(s) and the rest
of the universe. If you were to put your databases on dedicated managed
servers I'm sure you could get them on their own segment, and you could run
whatever firewall you choose locally.
> Summary:
>
> I really don't think VPS technology can scale to our requirements or meet
> the specs we need, in resources or security. Their are other in my group
> who wanted to investigate VPS technology because of the notion that it is
> more secure. For instance, there is the concept that because it is
> "virtual", and more hidden, it would be more difficult for an employee at
> our provider to get at the data, whereas if we colocated, they could just
> pull a hard drive and get at the data. Personally, I think it would be
> easier to hi-jack a VMware session or image that it would be to get through
> security, and into a locked cabinet at a colo facility and reboot into
> single user mode or yank out a disk in a RAID array to get to the data.
JC has their own segment/cage/whatever at their datacenter with their own
personnel onsite 24x7. I do know that JC tech's can access the complete
filesystem of any VPS at any time without any downtime, impact or evidence on
the VPS itself. This is handy for e.g. backup/restore purposes but could be
viewed as a security concern. On a dedicated server, you would notice
downtime (disks yanked or reboot
