561–570 of 902 posts
Earlier quoted context omitted.
Curious why squid and not pf?
squid is a http(s) proxy and pf is a firewall. They do not do the same thing.
Relayd also does a bunch of similar things and is closely integrated with pf too..
Earlier quoted context omitted.
The important thing for me at least isn't he `-u apache` but rather knowing that `apache` exists as one of the installed services on this box. In the old ways, that was apparent because of the presence of the log file. Granted, this isn't the problem it used to be for us, however, it would come up because we'd have our services named things like `foo-ws` and knowing that `foo-ws` existed on a given box might be trick…
honestly that's such a niche problem to have that i dont think it's worth throwing the baby out with the bathwater. anyways you shouldn't be discovering installed services by logfile presence, it should be something like querying your package manager.
There should be a command like "journalctl --top" that would list all logging services with amount of logs, oldest and latest log times, and last few lines of each, to improve that experience. Maybe there is already a way to do something similar?
I have seldom come across unix multiuser environments getting used anymore for servers. Its generally just one user on one physical machine now a days. I understand run0's promise is still useful but i would really like to see the whole unix permission system simplified for just one user who has sudo access.
Earlier quoted context omitted.
> Even root might not be allowed as an ssh target if `PermitRootLogin` is set to `no`, which I do on all my systems. would something like PermitRootLogin=localhost punch an enormous hole in your intricate opsec?
I've set up tor on some machines to forward ssh as a hidden service for an easy to configure way to get past NAT before. That shows up as a login from localhost. (could be configured differently, with some extra work) There's so ways to configure access to a system, each with footguns I'm surely unaware of.
This is great! There was (is?) a program developed by some debian developers that did a similar thing way back, but I can't remember it. Anyone? [edit - https://www.chiark.greenend.org.uk/~ian/userv/ is probably what I'm thinking of]
I know of doas[1], but that appears to be an OpenBSD thing. Maybe Debian folks ported it? [1] https://wiki.archlinux.org/title/Doas
Earlier quoted context omitted.
Please say this is a joke
https://nlnet.nl/project/Gash/ It wouldn't be a bad idea. Also, Guile's JIT could be interesting there. Also, a shell with a live REPL instead of failing on errors can be pretty interesting.
I have seldom come across unix multiuser environments getting used anymore for servers. Its generally just one user on one physical machine now a days. I understand run0's promise is still useful but i would really like to see the whole unix permission system simplified for just one user who has sudo access.
Also, people noted HPC, and other still very relevant scenarios.
Earlier quoted context omitted.
I had to write an ssh client for an embedded system long ago. Looking at the design, I found it to be sort of messy. You could restrict commands ssh could invoke, but it didn't seem super secure. Also scp/sftp was not well designed. You basically had to give ssh access to your system to allow a file to be copied, and there were no real path restrictions. I personally thought ssh could be much more robust in what you…
Well, yes, rsync to replace scp. Sftp's also regarded a hack anyway imho. The write-only scp intrigues me. I guess it's not hard to write a program to do that. But, right, that's not easy with standard tools only. The Linux file system was also not designed for that (although it doesn't prohibit such software) I guess.
There's no 'the' Linux file system. There's plenty of file system to choose from.
And, in fact, it would be relatively easy to write a write-only filesystem with FUSE. (https://en.wikipedia.org/wiki/Filesystem_in_Userspace)
Earlier quoted context omitted.
Multi-user clusters are still quite common in HPC. And I think you're not going to see a switch away from multi-user systems anytime soon. Single user systems like laptops might be a good use-case, but even the laptop I'm using now has different accounts for me and my wife (and it's a Mac). When you have one OS that is used on devices from phones, to laptops, to servers, to HPC clusters, you're going to have this fri…
is it? most HPC (if GPU clusters count) are probably in industry and managed by containers
Yes. First, we use user level container systems like apptainer/singularity, and these containers run under the user itself.
This is also same for non academic HPC systems.
From schedulers to accounting, everything is done at user level, and we have many, many users.
It won’t change anytime soon.