3 ms·
A couple years back I installed Vault nodes on three Linode servers. Now, Vault's documentation specifies very clearly that the servers in your Vault deploymen
by mewse 5y ago
A couple years back I installed Vault nodes on three Linode servers. Now, Vault's documentation specifies very clearly that the servers in your Vault deployment need to be talking to each other across a private network and their ports absolutely mustn't be accessible to the public internet.
At that time (this may have changed in the interim; I'm not using Linode nearly as much these days), Linode didn't offer private LANs between groups of servers. They did offer private IP addresses, but they had only a single LAN that was shared by every machine in each data center. But I figured; hey, that'd probably be good enough -- Those private IPs weren't publicly accessible, after all!
Anyhow, long story short, less than twelve hours later all three machines were furiously mining bitcoin.
Lesson learned: when software says that you need a private network, you need a private network.
- iotku 5y ago>Linode didn't offer private LANs between groups of servers. They did offer private IP addresses, but they had only a single LAN that was shared by every machine in each data center. >Lesson learned: when software says that you need a private network, you need a private network. Hah yeah, I imagine a properly secured (famous last words) VPN setup is kinda necessary when dealing with stuff like that. Having your secrets in one place (especially remotely accessible) is a very attractive target and you don't want to find out there's a 0day (or general misconfiguration) on your management system the hard way. I'd like to think that I could make something like that work, but it's certainly more than setup and forget about it.