4 ms·

I have my whole system running like a livecd using overlayfs, it's great. It's a real peace of mind knowing nothing will persist. No logs or information is stor

I have my whole system running like a livecd using overlayfs, it's great. It's a real peace of mind knowing nothing will persist. No logs or information is stored without your knowledge, any configuration mistakes will solve themselves on reboot, it also enforces the separation between your data and the system install.

snorkel 5y ago
Nice. Reminds me of longtime security tactic for web servers of shipping logs and mounting the entire file system as read-only so that intruders have no means of installing their root kit.
- im3w1l 5y ago
  If you have root, what prevents you from remounting as read-write? That seems like an advantage for the actual live-cd over the "like a live-cd". It's physically read only.
  - dgfitz 5y ago
    One could argue it’s fairly hard to use an exploit to get root on a ro fs. One could also argue that protecting a system from an attacker with root privileges is a futile effort.
    - im3w1l 5y ago
      That's a good point, I was responding to the "install rootkit"-part implying they do have root and want persistence, but yeah it does protect against other things.
  - invokestatic 5y ago
    I believe this was to mitigate certain PHP code execution and file upload exploits. It used to be fairly commonplace that file upload code was buggy, allowing you to upload arbitrary files into the web root. So people would upload “PHP shells”, which are backdoor scripts, somewhere on the web root and then navigate to that URL to execute the shell. I think this technique still remains common to escalate getting admin on a WordPress blog to taking over the host.
    - ljm 5y ago
      A lot of the PHP specific issues came from poor input validation and setting the uploaded file permissions to 0777. This was of course in those days before StackOverflow where you’d copy code snippets from old blogs or forum posts, same as all those snippets containing SQL injection vulnerabilities.

snorkel 5y ago

Nice. Reminds me of longtime security tactic for web servers of shipping logs and mounting the entire file system as read-only so that intruders have no means of installing their root kit.

im3w1l 5y ago
If you have root, what prevents you from remounting as read-write? That seems like an advantage for the actual live-cd over the "like a live-cd". It's physically read only.
- dgfitz 5y ago
  One could argue it’s fairly hard to use an exploit to get root on a ro fs. One could also argue that protecting a system from an attacker with root privileges is a futile effort.
  - im3w1l 5y ago
    That's a good point, I was responding to the "install rootkit"-part implying they do have root and want persistence, but yeah it does protect against other things.
- invokestatic 5y ago
  I believe this was to mitigate certain PHP code execution and file upload exploits. It used to be fairly commonplace that file upload code was buggy, allowing you to upload arbitrary files into the web root. So people would upload “PHP shells”, which are backdoor scripts, somewhere on the web root and then navigate to that URL to execute the shell. I think this technique still remains common to escalate getting admin on a WordPress blog to taking over the host.
  - ljm 5y ago
    A lot of the PHP specific issues came from poor input validation and setting the uploaded file permissions to 0777. This was of course in those days before StackOverflow where you’d copy code snippets from old blogs or forum posts, same as all those snippets containing SQL injection vulnerabilities.