3 ms·
But how? I've got prometheus running in its own, non-root account. That makes exploiting vulnerabilities nearly useless, unless you can find a way to get it to
by tgv 5y ago
But how? I've got prometheus running in its own, non-root account. That makes exploiting vulnerabilities nearly useless, unless you can find a way to get it to spawn a process which can sudo. It runs behind nginx, which has a simple name/pwd protection on it. That makes it very hard to exploit. And prometheus only runs on one server; the others run node_exporter, or publish app data.
What am I missing?
- zufallsheld 5y agoYou described multiple layers of security. Removing dependencies and stripping down code is the same: another layer of security.
- ori_b 5y ago> What am I missing? If I knew, it would have a CVE number. However, the less code you have, the fewer the places there are where you need to ask that question.