4 ms·

Which bit didn't you understand?

tptacek 14y ago
Every single one of your numbered points. 1) discard REMOTE SHELL solely for OS statistics 2) write your own TINY WEB APPLICATION SERVED BY NGINX/APACHE 3) run it as SOME USER THAT can read STATISTICS DATA 4) BE safer
- hosay123 14y ago
  1. > One way would be to publish a HTTP/JSON API for fetching a specific set of stats from a server > given an authorization key 2. > provide a reference implementation, and allow customers to build their own if they're not comfortable with that. Implies 3: entire point of the implementation is to read sensors, which requires root, or further messing with the security properties of the base system (e.g. sudo), and expecting users to do this correctly. So basically what you're advocating is to encourage users to run custom HTTP servers as root. Edit: and I see you edited your comment, and now advocating running nginx as root.
  - tptacek 14y ago
    I have no idea what you're talking about or who you think you're arguing with but it isn't me. Especially amusing that whoever would say these crazy things you're saying would still be better off than giving remote root SSH away for stats collection. Sheesh.
    - hosay123 14y ago
      It's OK, we all give bad advice sometimes. You clearly just advocated replacing SSH with a custom HTTP server that effectively always requires root, and furthermore to advocate users mess with this root-running code. I don't understand why you can't see this.
      - nknight 14y ago
        He did none of those things. None of the code he suggested requires root. Some hardware information collection may require root (though darn little of it in Linux, at least), but that's entirely independent of the question of how to expose it to the provider.
      - tptacek 14y ago
        Hey, 'nknight, you appear to be hellbanned (starting 3 posts back). It seems to happen randomly to some people; you should just ping 'pg about it. Edit Don't blame you. The hellbanning system Does Not Seem To Work.
        nknight 14y ago
        Yeah, thanks, but I knew almost as soon as it happened months ago (I only browsed HN logged in on one device), just thought I'd see if it'd been reversed. Apparently not. I'm not going to go begging to the man responsible for this degrading method of community management. I'll be better off continuing to not spending the time posting on HN anyway.
        phillijw 14y ago
        I got hellbanned a few years ago and it's pretty lonely out here. I sent an email to PG and was basically told to f-off
        vertis 14y ago
        I don't understand, from briefly looking at nknight's previous comments, I can't see a reason for that kind of punishment.
      - kaens 14y ago
        I'm not sure if you're aware or not, but you can fine-grain permissions to anything on the box however you like. There's even built-in documentation.
  - WayneDB 14y ago
    I do agree with your larger point that building your own here is undesirable, however the web server wouldn't have to have root by using IPC or other kinds of tricks. In any case, wouldn't it be even more secure if the server just pushed stats outwards (syslog anyone?) instead of needing to accept any kind of commands via SSH/HTTP/S or otherwise?
    - tptacek 14y ago
      I am at a total loss for how any of this would require root access. I'm not sure any component of the system online or offline would need root; I'm absolutely certain the web app wouldn't. You don't need IPC tricks. I'd be less comfortable with the contraption that pushes stats out from the hosts. I don't agree that it would be more secure. Virtually any system you could imagine to solve this probably would almost by mathematical necessity be more secure than giving out a root SSH login, which is the funny thing about this thread.
      - dllthomas 14y ago
        Mathematically, giving root login to person X is never more secure against person X than any other interaction with person X. I think the idea was regarding other people. With SSH, what you are exposing to those who lack the key is SSH, which is well hardened. If you set up a web service naively and run it as root, you have a weaker surface more exposed in exchange for more security against a mostly trusted party (who already has physical access). Of course, I'm not sure what kind of statistics can't be gathered by anyone but root; even if there are some (and there probably are in some configurations), I don't see why they couldn't be polled by root in a cronjob and dumped in a log file that's readable by a (specific, if you care) non-root user and fetched over SSH by that non-root user, &c. So, on the whole, I agree that there's no reason to give out root; but it's not a crazy notion that there are things worse than giving root to person A, with respect to your security against person B.
        tptacek 14y ago
        Accidentally revealing server stats because of a bug handling a trivial authentication token is less of a big deal than giving a third party root shell access to your server, is my point.

Every single one of your numbered points. 1) discard REMOTE SHELL solely for OS statistics 2) write your own TINY WEB APPLICATION SERVED BY NGINX/APACHE 3) run it as SOME USER THAT can read STATISTICS DATA 4) BE safer

hosay123 14y ago
1. > One way would be to publish a HTTP/JSON API for fetching a specific set of stats from a server > given an authorization key 2. > provide a reference implementation, and allow customers to build their own if they're not comfortable with that. Implies 3: entire point of the implementation is to read sensors, which requires root, or further messing with the security properties of the base system (e.g. sudo), and expecting users to do this correctly. So basically what you're advocating is to encourage users to run custom HTTP servers as root. Edit: and I see you edited your comment, and now advocating running nginx as root.
- tptacek 14y ago
  I have no idea what you're talking about or who you think you're arguing with but it isn't me. Especially amusing that whoever would say these crazy things you're saying would still be better off than giving remote root SSH away for stats collection. Sheesh.
  - hosay123 14y ago
    It's OK, we all give bad advice sometimes. You clearly just advocated replacing SSH with a custom HTTP server that effectively always requires root, and furthermore to advocate users mess with this root-running code. I don't understand why you can't see this.
    - nknight 14y ago
      He did none of those things. None of the code he suggested requires root. Some hardware information collection may require root (though darn little of it in Linux, at least), but that's entirely independent of the question of how to expose it to the provider.
    - tptacek 14y ago
      Hey, 'nknight, you appear to be hellbanned (starting 3 posts back). It seems to happen randomly to some people; you should just ping 'pg about it. Edit Don't blame you. The hellbanning system Does Not Seem To Work.
      - nknight 14y ago
        Yeah, thanks, but I knew almost as soon as it happened months ago (I only browsed HN logged in on one device), just thought I'd see if it'd been reversed. Apparently not. I'm not going to go begging to the man responsible for this degrading method of community management. I'll be better off continuing to not spending the time posting on HN anyway.
      - phillijw 14y ago
        I got hellbanned a few years ago and it's pretty lonely out here. I sent an email to PG and was basically told to f-off
      - vertis 14y ago
        I don't understand, from briefly looking at nknight's previous comments, I can't see a reason for that kind of punishment.
    - kaens 14y ago
      I'm not sure if you're aware or not, but you can fine-grain permissions to anything on the box however you like. There's even built-in documentation.
- WayneDB 14y ago
  I do agree with your larger point that building your own here is undesirable, however the web server wouldn't have to have root by using IPC or other kinds of tricks. In any case, wouldn't it be even more secure if the server just pushed stats outwards (syslog anyone?) instead of needing to accept any kind of commands via SSH/HTTP/S or otherwise?
  - tptacek 14y ago
    I am at a total loss for how any of this would require root access. I'm not sure any component of the system online or offline would need root; I'm absolutely certain the web app wouldn't. You don't need IPC tricks. I'd be less comfortable with the contraption that pushes stats out from the hosts. I don't agree that it would be more secure. Virtually any system you could imagine to solve this probably would almost by mathematical necessity be more secure than giving out a root SSH login, which is the funny thing about this thread.
    - dllthomas 14y ago
      Mathematically, giving root login to person X is never more secure against person X than any other interaction with person X. I think the idea was regarding other people. With SSH, what you are exposing to those who lack the key is SSH, which is well hardened. If you set up a web service naively and run it as root, you have a weaker surface more exposed in exchange for more security against a mostly trusted party (who already has physical access). Of course, I'm not sure what kind of statistics can't be gathered by anyone but root; even if there are some (and there probably are in some configurations), I don't see why they couldn't be polled by root in a cronjob and dumped in a log file that's readable by a (specific, if you care) non-root user and fetched over SSH by that non-root user, &c. So, on the whole, I agree that there's no reason to give out root; but it's not a crazy notion that there are things worse than giving root to person A, with respect to your security against person B.
      - tptacek 14y ago
        Accidentally revealing server stats because of a bug handling a trivial authentication token is less of a big deal than giving a third party root shell access to your server, is my point.