4 ms·

It's really not. You also wouldn't expose your database just because it's password-protected? I bet all these public servers have a firewall running to protec

It's really not. You also wouldn't expose your database just because it's password-protected? I bet all these public servers have a firewall running to protect other services. Shouldn't be hard to include the saltstack port(s) and whitelist the relevant IP addresses. Also,the main difference with your example is that the clients that connect to webservers and vpns are either not known in advance or don't have static IP addresses.

saltyguy22 6y ago
You can't really compare Salt to a password protected database. SSH is probably a better comparison as both use public key crypto and plenty of servers are exposed on the internet via it. Its just that salt hasn't been audited as heavily as OpenSSH or other implementations of SSH so its risky exposing Salt to the internet, but I can see why some admins might do that.
Spivak 6y ago
Anyone who's putting their Salt master on the internet is having to deal with clients without fixed addresses. And it's not uncommon to have to deal with clients that aren't known advance which is when autosign scripts are used. Sans the current CVE this is otherwise a service that is safe to expose to adversarial networks.
- tilolebo 6y ago
  From Algolia's outage retrospective: What we did so far: We’ve secured the impacted SaltStack service by updating it and adding additional IP filtering, allowing only our servers to connect to it. So clearly unrestricted access wasn't a necessity. I understand it's a pain, I've been running a 1000+ server stack with puppet on a public network and relied on iptables to secure it. But I'd rather cope with the daily iptable rules update than having to fight a 0-day exploit...
lmm 6y ago
I would (and do) expose my database to the internet, because it's properly secured (client certificates rather than just passwords). I don't run firewalls. If a service doesn't need to be exposed, the port isn't open. Means no worrying about who has access to the wifi (because that's outside the security boundary) and no mucking about with VPNs when accessing remotely.
- tilolebo 6y ago
  >because it's properly secured That's what these Saltstack users thought too until this week.
  - lmm 6y ago
    People are saying they used a hand-rolled crypto stack rather than something standard like TLS? That should have been a massive red flag.

saltyguy22 6y ago

You can't really compare Salt to a password protected database. SSH is probably a better comparison as both use public key crypto and plenty of servers are exposed on the internet via it. Its just that salt hasn't been audited as heavily as OpenSSH or other implementations of SSH so its risky exposing Salt to the internet, but I can see why some admins might do that.

Spivak 6y ago

Anyone who's putting their Salt master on the internet is having to deal with clients without fixed addresses. And it's not uncommon to have to deal with clients that aren't known advance which is when autosign scripts are used. Sans the current CVE this is otherwise a service that is safe to expose to adversarial networks.

tilolebo 6y ago
From Algolia's outage retrospective: What we did so far: We’ve secured the impacted SaltStack service by updating it and adding additional IP filtering, allowing only our servers to connect to it. So clearly unrestricted access wasn't a necessity. I understand it's a pain, I've been running a 1000+ server stack with puppet on a public network and relied on iptables to secure it. But I'd rather cope with the daily iptable rules update than having to fight a 0-day exploit...

lmm 6y ago

I would (and do) expose my database to the internet, because it's properly secured (client certificates rather than just passwords). I don't run firewalls. If a service doesn't need to be exposed, the port isn't open. Means no worrying about who has access to the wifi (because that's outside the security boundary) and no mucking about with VPNs when accessing remotely.

tilolebo 6y ago
>because it's properly secured That's what these Saltstack users thought too until this week.
- lmm 6y ago
  People are saying they used a hand-rolled crypto stack rather than something standard like TLS? That should have been a massive red flag.