3 ms·
Surprised to read this from a security guy. 1) discard time-tested crypto implementation 2) write your own. 3) run it as root so it can read sensors 4) feel
by hosay123 14y ago
Surprised to read this from a security guy.
1) discard time-tested crypto implementation
2) write your own.
3) run it as root so it can read sensors
4) feel safer
Everything aside, most of these colo machines are set to netboot in order to implement their rescue system. Never poked around, but wouldn't be surprised those DHCP requests hit other machines on the segment. OVH seem to be more sensible than most when it comes to network configuration, but I wouldn't be surprised this happens in other places (the difference between a $50 Ethernet switch and a $5000 Ethernet switch right there)
Edit: since some don't seem to understand the basics of security, or perhaps out of an ill-placed sense of loyalty: running a web server + CGI combo as root on an Ethernet segment exposed to other colo customers, in place of a 20 year old service designed for exactly this scenario, when its sole user already has hardware access (and reboot + netboot access) to the machine is fucking stupid. I'm making no argument here, just calling out terrible advice for what it is.
- tptacek 14y ago?!
- hosay123 14y agoWhich bit didn't you understand?
- tptacek 14y agoEvery single one of your numbered points. 1) discard REMOTE SHELL solely for OS statistics 2) write your own TINY WEB APPLICATION SERVED BY NGINX/APACHE 3) run it as SOME USER THAT can read STATISTICS DATA 4) BE safer
- hosay123 14y ago1. > One way would be to publish a HTTP/JSON API for fetching a specific set of stats from a server > given an authorization key 2. > provide a reference implementation, and allow customers to build their own if they're not comfortable with that. Implies 3: entire point of the implementation is to read sensors, which requires root, or further messing with the security properties of the base system (e.g. sudo), and expecting users to do this correctly. So basically what you're advocating is to encourage users to run custom HTTP servers as root. Edit: and I see you edited your comment, and now advocating running nginx as root.
- tptacek 14y agoI have no idea what you're talking about or who you think you're arguing with but it isn't me. Especially amusing that whoever would say these crazy things you're saying would still be better off than giving remote root SSH away for stats collection. Sheesh.
- hosay123 14y agoIt's OK, we all give bad advice sometimes. You clearly just advocated replacing SSH with a custom HTTP server that effectively always requires root, and furthermore to advocate users mess with this root-running code. I don't understand why you can't see this.
- nknight 14y agoHe did none of those things. None of the code he suggested requires root. Some hardware information collection may require root (though darn little of it in Linux, at least), but that's entirely independent of the question of how to expose it to the provider.
- tptacek 14y agoHey, 'nknight, you appear to be hellbanned (starting 3 posts back). It seems to happen randomly to some people; you should just ping 'pg about it. Edit Don't blame you. The hellbanning system Does Not Seem To Work.
- nknight 14y agoYeah, thanks, but I knew almost as soon as it happened months ago (I only browsed HN logged in on one device), just thought I'd see if it'd been reversed. Apparently not. I'm not going to go begging to the man responsible for this degrading method of community management. I'll be better off continuing to not spending the time posting on HN anyway.
- phillijw 14y agoI got hellbanned a few years ago and it's pretty lonely out here. I sent an email to PG and was basically told to f-off