7 ms·

Enterprises will love this. There are so many legacy app flows kicked off via sftp/scp file drops. Being able to hook into those via lambda events on the associ

by koolba 8y ago

Enterprises will love this. There are so many legacy app flows kicked off via sftp/scp file drops. Being able to hook into those via lambda events on the associated S3 bucket will create a whole ecosystem of enterprise spaghetti for years to come.

mattdeboard 8y ago
Spaghetti as a service, delicious
- notyourwork 8y ago
  Welcome to the real world.
  - mattdeboard 8y ago
    plop
    - mattdeboard 8y ago
      (this was me plopping into the real world)
brazzledazzle 8y ago
The only downside is whitelisting but not on the SFTP server-side. Many enterprises restrict egress SFTP (usually for security reasons) so you need to provide IPs and they can’t frequently change because it can take enterprise network admins quite some time to deal with all of the bureaucracy and change control. That said, I wouldn’t be surprised if modern networking gear can handle CNAMEs but there’s no guarantee that they’re using modern gear or if they are that the questionable outsourced team even knows how to deal with the modern capabilities. This will certainly help a lot of use cases though.
- blincoln 8y ago
  It's less whether the gear is modern and more about the layer that it operates at. A network firewall doesn't see the DNS name that an internal system looked up in order to make an outbound connection. It just sees the source/destination IP/port. Processing a rule based on source/destination IP or CIDR and port is very fast, and all happens locally. Trying to make that device handle rules by IP address is pretty tricky. Does it do a reverse lookup on the destination IP? That may not give a result that's even remotely like what the client used, especially for cloud-hosted destinations. For a lot of applications (probably including this one), a proxy is a good approach, because DNS resolution can be delegated to the proxy, and therefore the proxy can easily apply DNS-based rules as well as IP/CIDR-based rules. However, proxies tend to make people unhappy because they generally require at least some configuration on the client side. Microsoft used to sell a product[1] that made this transparent for Windows clients[2], but obviously that doesn't help for most modern shops where a lot of the systems are Linux, MacOS, etc. [1] Internet Security and Acceleration Server ("ISA"), later renamed to Threat Management Gateway ("TMG"), now deprecated and approaching EOL. [2] It hooked into the network stack and rerouted requests based on a proxy routing rule table. Imagine a centrally-managed proxychains, but with the system configured to default to check the proxychains config file for every outbound TCP connection.
  - icebraining 8y ago
    I wonder if you could use the DNS resolution cache itself to do the reverse lookup. As long as the DNS cache lasted at least as long as the TTL, it should work.
  - brazzledazzle 8y ago
    Yeah I assumed something like Palo Alto’s or maybe ASA’s could do more since (I believe) they’re doing actual inspection but I’m only familiar with them in passing.
- LinuxBender 8y ago
  You can get a dedicated S3 gateway which has a static IP.
mrweasel 8y ago
>There are so many legacy app flows kicked off via sftp/scp file drops Yes,.... Legacy apps... because no one would choose SFTP for system that designed in 2017. Seriously this is great, so many solution rely on SFTP, but so many companies fail at managing the service. Having an SFTP service that just works and is secure (hopefully) will help a ton of compnies.

by koolba 8y ago

mattdeboard 8y ago

Spaghetti as a service, delicious

notyourwork 8y ago
Welcome to the real world.
- mattdeboard 8y ago
  plop
  - mattdeboard 8y ago
    (this was me plopping into the real world)

brazzledazzle 8y ago

The only downside is whitelisting but not on the SFTP server-side. Many enterprises restrict egress SFTP (usually for security reasons) so you need to provide IPs and they can’t frequently change because it can take enterprise network admins quite some time to deal with all of the bureaucracy and change control. That said, I wouldn’t be surprised if modern networking gear can handle CNAMEs but there’s no guarantee that they’re using modern gear or if they are that the questionable outsourced team even knows how to deal with the modern capabilities. This will certainly help a lot of use cases though.

blincoln 8y ago
It's less whether the gear is modern and more about the layer that it operates at. A network firewall doesn't see the DNS name that an internal system looked up in order to make an outbound connection. It just sees the source/destination IP/port. Processing a rule based on source/destination IP or CIDR and port is very fast, and all happens locally. Trying to make that device handle rules by IP address is pretty tricky. Does it do a reverse lookup on the destination IP? That may not give a result that's even remotely like what the client used, especially for cloud-hosted destinations. For a lot of applications (probably including this one), a proxy is a good approach, because DNS resolution can be delegated to the proxy, and therefore the proxy can easily apply DNS-based rules as well as IP/CIDR-based rules. However, proxies tend to make people unhappy because they generally require at least some configuration on the client side. Microsoft used to sell a product[1] that made this transparent for Windows clients[2], but obviously that doesn't help for most modern shops where a lot of the systems are Linux, MacOS, etc. [1] Internet Security and Acceleration Server ("ISA"), later renamed to Threat Management Gateway ("TMG"), now deprecated and approaching EOL. [2] It hooked into the network stack and rerouted requests based on a proxy routing rule table. Imagine a centrally-managed proxychains, but with the system configured to default to check the proxychains config file for every outbound TCP connection.
- icebraining 8y ago
  I wonder if you could use the DNS resolution cache itself to do the reverse lookup. As long as the DNS cache lasted at least as long as the TTL, it should work.
- brazzledazzle 8y ago
  Yeah I assumed something like Palo Alto’s or maybe ASA’s could do more since (I believe) they’re doing actual inspection but I’m only familiar with them in passing.
LinuxBender 8y ago
You can get a dedicated S3 gateway which has a static IP.

mrweasel 8y ago

>There are so many legacy app flows kicked off via sftp/scp file drops Yes,.... Legacy apps... because no one would choose SFTP for system that designed in 2017. Seriously this is great, so many solution rely on SFTP, but so many companies fail at managing the service. Having an SFTP service that just works and is secure (hopefully) will help a ton of compnies.