3 ms·
> has network access to the salt masters port, which should never occur You seem to prescribe to the "hard shell soft gooey center" network security philosophy
by mike_d 7y ago
> has network access to the salt masters port, which should never occur
You seem to prescribe to the "hard shell soft gooey center" network security philosophy. Should people expose an Oracle server to the internet? Absolutely not. Does moving it behind a firewall change the fact that every mildly skilled exploit developer is sitting on an Oracle 0day? Absolutely not.
People have legitimate reasons for exposing Salt to the internet. I do. It's how I bootstrap random VMs and bare metal from the internet. But in my case the attack was mitigated by the fact that Salt cascades changes in a bunch of other systems and re-masters minions to a host only reachable over a tunnel. I blew away the internet master, restored from a backup, and patched.
> the ones that were compromised by this issue have deeper security issues to deal with
Or it was just another Monday. When you become sufficiently large you deal with incidents on a daily basis. Kudos to the people who publicly postmortem and talk about what went well and what didn't.
(For the record, I've already been working for a few months on a move to Ansible for non-security reasons)
- hajhatten 7y agoYou piqued my interest, what made you move? I personally haven't touched Saltstack in years, but was super happy with it when I did.
- mike_d 7y agoTwice I encountered breaking changes between versions that required manually upgrading minions. I also got the overall feeling Salt was built by developers, Ansible by sysadmins - and I fit into the latter bucket.
- Conan_Kudo 7y agoAnsible (originally known as "Fedora Unified Network Controller" or "func") was made for solving the problems automating Fedora Infrastructure. Puppet did not make Fedora Infrastructure administrators happy. So func was designed around solving their problems, and expanded its scope as people found it useful. Then it was renamed to Ansible, the developers left Red Hat to create AnsibleWorks, and the rest is history! So yes, it was made for sysadmins. :)
- empath75 7y ago> People have legitimate reasons for exposing Salt to the internet. I do. It's how I bootstrap random VMs and bare metal from the internet. I question that that is a legitimate reason to expose it to the internet. Defense in depth is a thing and putting the keys to the kingdom at layer 0 doesn’t seem wise even if a vpn or bastion doesn’t offer perfect protection.
- mike_d 7y agoRead the sentence after the ones you quoted. The internet connected salt master is used to provision accepted hosts in to the tunneled (VPN) network where the real master lives.
- mixedCase 7y ago> It's how I bootstrap random VMs and bare metal from the internet. What's stopping you from bootstrapping a bastion server through a simpler script and then bootstrapping with Salt from there?
- mike_d 7y agoThat is exactly what the internet connected Salt master does. It bootstraps enough control that I can get the tunnels and keys properly configured, and the other 95% takes place once it is switched to a protected Salt master.