6 ms·

>>> If you're here, chances are you're already compromised. WTF does that mean? Our salt implementation is on an entirely private network, so why would I be mo

>>> If you're here, chances are you're already compromised. WTF does that mean? Our salt implementation is on an entirely private network, so why would I be more likely than not to be compromised already? ---- Edit: Re-downvotes -- This is a sincere question. Is there some evidence that the majority of salt implementations are compromised, or some mechanism by which this hits private networks? Or is that line just for dramatic effect?

jkingsman 6y ago
With you on this one... a coworker put it well "[this tone is] at a 9, it needs to be at a 3".
busterarm 6y ago
99% of companies I've encountered running SaltStack are masterless anyway.
- saltyguy22 6y ago
  Depends on their use case. IMO, Salts best feature is probably running with the Master / Minion setup because it connects out to the master. Masterless is handy for using in conjunction with Vagrant, Packer, or another provisioning tool not so much for managing a the lifecycle of a server / OS.
  - busterarm 6y ago
    I'm not clueless. I know this. This doesn't detract at all from what I said. In production, an outsized number of companies are using SaltStack a certain way. The reason is because of the way we all evaluate business risk. I could have said that out of all of the companies I've worked with using Salt that have compliance requirements, 100% of them are using it Masterless, but then some smart-ass would have piped up with a "not me" comment.
    - Ascetik 6y ago
      not me :D
    - kapilvt 6y ago
      How would you compare it to ansible in that usage model? I don't do much config mgmt these days, so curious for a master(less) mindset, whats the comparison for salt vs. ansible?
      - busterarm 6y ago
        Ansible gets a ton more use. Its push model is highly favored in IT organizations. Salt's event/reactor system has tricks Ansible can't do.
    - rexarex 6y ago
      Not me
- devonkim 6y ago
  Salt is a bit of a rarity among ops people but the funny thing is my experience is the opposite of yours - 66%+ of companies I see with Salt run in master/minion mode. I prefer it over Ansible when my ssh settings are super awkward (MFA, multiple bastions, etc) to integrate into an Ansible inventory file. One place with 900+ hosts and 300+ random IP ranges with tons of (badly written) compliance I spent about 3 weeks trying to get an inventory file hacked up and I gave up and deployed Salt within a day for the basic stuff I needed to do for basic running of shell commands from a single point of control.
  - busterarm 6y ago
    Most of the places I've seen it are banks. Oddly. Your use case makes absolute perfect sense though -- nice!
twic 6y ago
I assumed that the problem was that if a master is accessible on your intranet, it could be hit with some sort of XSS attack from browsers inside the firewall. But apparently there are 6000 people just straight up exposing their masters to the internet: https://gbhackers.com/saltstack-salt/ https://gbhackers.com/saltstack-salt/
- NikolaeVarius 6y ago
  > This whole "don't have your salt master exposed to the internet" thing has me annoyed. The whole point of salt is to manage boxes all over the place. I manage around 500 machines. Most of them are behind the firewalls of incompetent admins who have spent hours in the past trying to set up port forwards when salt-minion crashed so I could access the box again. I'm about to test binding salt-master to localhost and salt-minion to localhost and then setting up spiped to wrap the traffic... Some companies need better DevOps apparently
  - dijit 6y ago
    Nitpick: this is purely an operations/sysadmin problem. The DevOps grouping doesn't apply too much, Operations-minded staff should be focusing on keeping things locked down. Unless, you know, you're not hiring those people and instead are hoping that developers take the Ops burden. ;)
    - deleted 6y ago
      [deleted]
    - dijit 6y ago
      People downvoting: I guess I hit a nerve, but could you explain why? Development and Operations are different disciplines and the idea was to remove silos, not make one person responsible for both.
- Spivak 6y ago
  But that's like half the point of SaltStack. It's supposed be secure enough to run on the public internet to manage road-warrior endpoints. "I found this site called Alexa that lists a bunch of companies that just straight up expose their web servers to the internet. Crazy." And I have some bad news about how many companies are exposing their VPN servers to the internet too.
TheDong 6y ago
>>>> If you're here, chances are you're already compromised. > WTF does that mean? The website assumes that if you dropped by or googled the vulnerability, it's because you had saltstack exposed to the public internet. You don't have to react so harshly to that turn of phrase.
- alexandercrohde 6y ago
  My main impression was that this site was blurring the line between professional "Bulletin" and scare-mongering. > Even if you didn't notice any unexpected symptoms, please: nuke and restart. If I were writing this, I'd probably write something like "On May x, a remote-code-execution in (all versions?) public salt-masters (not minions?), was unveiled. Shortly thereafter, actual exploitation in the wild is being used. If your salt installation uses a salt-master, and it's internet-reachable, it may already be compromised, along with much your infrastructure. Section 2 is how to see if you are infected, and Section 3 is how to remove the infection."
  - TheDong 6y ago
    > Section 2 is how to see if you are infected and Section 3 is how to remove the infection That's much worse. That implies there is a reliable way to detect and remove the infection. That's not the case. This website included some known attacks and such. There's a high chance that there were attacks of this vulnerability with additional payloads. There's no way to know if you were hit with a rootkit that persists itself in the bootloader or other parts of your system. There's no way to know if you were infected or not. The only way to be sure is to nuke the machine, as they said. Security advice should always err on the right side for a naive reader.

jkingsman 6y ago

With you on this one... a coworker put it well "[this tone is] at a 9, it needs to be at a 3".

busterarm 6y ago

99% of companies I've encountered running SaltStack are masterless anyway.

saltyguy22 6y ago
Depends on their use case. IMO, Salts best feature is probably running with the Master / Minion setup because it connects out to the master. Masterless is handy for using in conjunction with Vagrant, Packer, or another provisioning tool not so much for managing a the lifecycle of a server / OS.
- busterarm 6y ago
  I'm not clueless. I know this. This doesn't detract at all from what I said. In production, an outsized number of companies are using SaltStack a certain way. The reason is because of the way we all evaluate business risk. I could have said that out of all of the companies I've worked with using Salt that have compliance requirements, 100% of them are using it Masterless, but then some smart-ass would have piped up with a "not me" comment.
  - Ascetik 6y ago
    not me :D
  - kapilvt 6y ago
    How would you compare it to ansible in that usage model? I don't do much config mgmt these days, so curious for a master(less) mindset, whats the comparison for salt vs. ansible?
    - busterarm 6y ago
      Ansible gets a ton more use. Its push model is highly favored in IT organizations. Salt's event/reactor system has tricks Ansible can't do.
  - rexarex 6y ago
    Not me
devonkim 6y ago
Salt is a bit of a rarity among ops people but the funny thing is my experience is the opposite of yours - 66%+ of companies I see with Salt run in master/minion mode. I prefer it over Ansible when my ssh settings are super awkward (MFA, multiple bastions, etc) to integrate into an Ansible inventory file. One place with 900+ hosts and 300+ random IP ranges with tons of (badly written) compliance I spent about 3 weeks trying to get an inventory file hacked up and I gave up and deployed Salt within a day for the basic stuff I needed to do for basic running of shell commands from a single point of control.
- busterarm 6y ago
  Most of the places I've seen it are banks. Oddly. Your use case makes absolute perfect sense though -- nice!

twic 6y ago

I assumed that the problem was that if a master is accessible on your intranet, it could be hit with some sort of XSS attack from browsers inside the firewall. But apparently there are 6000 people just straight up exposing their masters to the internet: https://gbhackers.com/saltstack-salt/ https://gbhackers.com/saltstack-salt/

NikolaeVarius 6y ago
> This whole "don't have your salt master exposed to the internet" thing has me annoyed. The whole point of salt is to manage boxes all over the place. I manage around 500 machines. Most of them are behind the firewalls of incompetent admins who have spent hours in the past trying to set up port forwards when salt-minion crashed so I could access the box again. I'm about to test binding salt-master to localhost and salt-minion to localhost and then setting up spiped to wrap the traffic... Some companies need better DevOps apparently
- dijit 6y ago
  Nitpick: this is purely an operations/sysadmin problem. The DevOps grouping doesn't apply too much, Operations-minded staff should be focusing on keeping things locked down. Unless, you know, you're not hiring those people and instead are hoping that developers take the Ops burden. ;)
  - deleted 6y ago
    [deleted]
  - dijit 6y ago
    People downvoting: I guess I hit a nerve, but could you explain why? Development and Operations are different disciplines and the idea was to remove silos, not make one person responsible for both.
Spivak 6y ago
But that's like half the point of SaltStack. It's supposed be secure enough to run on the public internet to manage road-warrior endpoints. "I found this site called Alexa that lists a bunch of companies that just straight up expose their web servers to the internet. Crazy." And I have some bad news about how many companies are exposing their VPN servers to the internet too.

TheDong 6y ago

>>>> If you're here, chances are you're already compromised. > WTF does that mean? The website assumes that if you dropped by or googled the vulnerability, it's because you had saltstack exposed to the public internet. You don't have to react so harshly to that turn of phrase.

alexandercrohde 6y ago
My main impression was that this site was blurring the line between professional "Bulletin" and scare-mongering. > Even if you didn't notice any unexpected symptoms, please: nuke and restart. If I were writing this, I'd probably write something like "On May x, a remote-code-execution in (all versions?) public salt-masters (not minions?), was unveiled. Shortly thereafter, actual exploitation in the wild is being used. If your salt installation uses a salt-master, and it's internet-reachable, it may already be compromised, along with much your infrastructure. Section 2 is how to see if you are infected, and Section 3 is how to remove the infection."
- TheDong 6y ago
  > Section 2 is how to see if you are infected and Section 3 is how to remove the infection That's much worse. That implies there is a reliable way to detect and remove the infection. That's not the case. This website included some known attacks and such. There's a high chance that there were attacks of this vulnerability with additional payloads. There's no way to know if you were hit with a rootkit that persists itself in the bootloader or other parts of your system. There's no way to know if you were infected or not. The only way to be sure is to nuke the machine, as they said. Security advice should always err on the right side for a naive reader.