3 ms·

Kss, being compromised by a script kiddie is bad. But I am puzzled: a running process like redis is supposed to run in a chroot, and /tmp is supposed to always

Kss, being compromised by a script kiddie is bad. But I am puzzled: a running process like redis is supposed to run in a chroot, and /tmp is supposed to always be mounted with no exec, the chroot and process should have been runned with seteuid/guid redis... I normally have backend technologies confined in a jails with pf authorizing only inbound & outbound traffic on the legitimate interface+port, and you need no ssh access in a jail. Looks to me there is a cascade of sysadmins wrong practice. Devops and modern "full stack devs" seems to have lost their basics.

jlgaddis 11y ago
I wear a "sysadmin" hat (among many others) but not a "dev" hat. Every sysadmin I know who's worth their paycheck does the things you've mentioned above (and others), every time. Perhaps this is what happens when you take a "dev" with no real sysadmin experience and make him/her responsible for these machines? It's like giving my neighbor's kid with a small dirt bike the key to my Harley and sending him out on the highway -- bad things are bound to happen. It reminds me of the common solution that many "amateur sysadmins" have when they encounter SELinux issues: turning it off. :/
- SFjulie1 11y ago
  Selinux is crap. To complex to configure, and poorly configured by default. process poorly packaged crash and nothing in the logs. You disable it, see there was a warning about a poor permission and shout at selinux for making you lose days worth of works by poorly logging. Btw, I am a dev. But I have to sometimes go in production see servers because I need to help production sysadmins troubleshoot the weirdness of todays mis-performing easy to use solutions (selinux, systemd, rsyslogd, packaging). When you have to recompile centos or debian packages to have them support vanilla features and you are a dev, it is boring.

jlgaddis 11y ago

I wear a "sysadmin" hat (among many others) but not a "dev" hat. Every sysadmin I know who's worth their paycheck does the things you've mentioned above (and others), every time. Perhaps this is what happens when you take a "dev" with no real sysadmin experience and make him/her responsible for these machines? It's like giving my neighbor's kid with a small dirt bike the key to my Harley and sending him out on the highway -- bad things are bound to happen. It reminds me of the common solution that many "amateur sysadmins" have when they encounter SELinux issues: turning it off. :/

SFjulie1 11y ago
Selinux is crap. To complex to configure, and poorly configured by default. process poorly packaged crash and nothing in the logs. You disable it, see there was a warning about a poor permission and shout at selinux for making you lose days worth of works by poorly logging. Btw, I am a dev. But I have to sometimes go in production see servers because I need to help production sysadmins troubleshoot the weirdness of todays mis-performing easy to use solutions (selinux, systemd, rsyslogd, packaging). When you have to recompile centos or debian packages to have them support vanilla features and you are a dev, it is boring.