11–20 of 60 posts
You really have to go out of your way to make the www-data user available through ssh, weird some do this.
The files in ~/.ssh are usually initialized with restrictive permissions, so how do they end up getting exposed? The only way I can think off-the-bat is that someone absent-mindedly commits them to their git dotfiles and ends up copying them over to another machine when they do a `git clone` command.
the author cites "allowing developers to connect to the host with the www-data user", and this is a very specific form of incompetence.
www-data is the name commonly used by debian and debian-based distros to run apache and other http servers. it's literally, just designed to run the executable, not to upload new version of webpages or anything.
there are countless ways to avoid this pitfall, the simplest that comes to my mind is creating another user for uploading stuff and adding such user to the www-data group.
at the end of the day... meh. people might start a campaign about how not to use the www-data or something else, but not-very-techy people will find another way to misuse a webserver.
This is what I have learned in many years of work: people who know systems should be let to handle those systems. This is what happens when a developer is left to do the work that a system administrator should be trained to do - not all are -. For a developer, in most cases, "just works" is the end goal, when referring to systems. Not "how it works", and what are the implications of making it work like this. This rea…
Use an entirely different user for file ownership.
TL;DR: Antipattern: pointing web server config to any files based in /home.
This is what I have learned in many years of work: people who know systems should be let to handle those systems. This is what happens when a developer is left to do the work that a system administrator should be trained to do - not all are -. For a developer, in most cases, "just works" is the end goal, when referring to systems. Not "how it works", and what are the implications of making it work like this. This rea…
Note that the result of this might sound like it makes the idea of a professional system administrator invalid but that's not true: I think the better SAs of the past had a thorough understanding of what their tools did and many of probably even modified them, this contrasts the current situation where people are poking things in PAS GUIs and accidentally running up huge bills.
# prevent access to any file/dir beginning with a dot
location ~ /\. { return 404; }
This is what I have learned in many years of work: people who know systems should be let to handle those systems. This is what happens when a developer is left to do the work that a system administrator should be trained to do - not all are -. For a developer, in most cases, "just works" is the end goal, when referring to systems. Not "how it works", and what are the implications of making it work like this. This rea…
Sys admins are dead. I have GKE now via a reliable Terraform module. None of my production instances can be logged onto.