Interview with CEO of rsync.net: “no firewalls and no routers” • Hacker News Board

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#231

Post by function_seven » Fri, Mar 19, 2021, 1:23 AM UTC

technion wrote: post #229

navaati wrote: post #102

Earlier quoted context omitted.

It’s hilarious that the first "vulnerability" in the example report[0] linked in this page is basically "SSH is accessible". Well… Duh ! [0] https://www.rsync.net/resources/regulatory/PCI_usw-s005_repo... EDIT: It’s marked as "PASS" though, so it’s all fine, just funny.

I did a job where I was given access to a server in the form of a set of credentials for an HPE iLO, which was accessible over the Internet. From there, we could use the remote console to logon as root. HPE iLO doesn't support MFA or any form of public key authentication, and its security history is much worse than SSH. It requires several ports open and the old version they had required Java plugins on desktops and…

I don't know... I mean, maybe the security posture is to annoy the hackers into giving up?

("This thing requires a Java applet and is slow as hell. Screw it, let's just pwn the bank across the street")

I'll call it Security by Inconvenience.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#232

Post by lmm » Fri, Mar 19, 2021, 1:24 AM UTC

globular-toast wrote: post #168

tfsh wrote: post #159

Meta: I really dislike the style of console.dev, the article is shunted to the left and leaves the rest of the screen real estate to be taken up by an - albeit pretty - but unnecessary piece of digital artwork. This - https://ibb.co/nzbFxjW - is what the article looks like on my ultrawide which made for very uncomfortable viewing

What would you prefer? Having an entire paragraph of text on a single line? Your monitor is the wrong shape.

Yes, I want an entire paragraph on a single line. If I wanted the content to be narrower then I'd make my browser narrower.

http://motherfuckingwebsite.com/ looks great on an ultrawide. It's pathetic that so many websites don't.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#233

Post by superkuh » Fri, Mar 19, 2021, 1:33 AM UTC

tfsh wrote: post #159

Meta: I really dislike the style of console.dev, the article is shunted to the left and leaves the rest of the screen real estate to be taken up by an - albeit pretty - but unnecessary piece of digital artwork. This - https://ibb.co/nzbFxjW - is what the article looks like on my ultrawide which made for very uncomfortable viewing

I had to disable CSS entirely to get the text readable.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#234

Post by abrookewood » Fri, Mar 19, 2021, 1:42 AM UTC

bigiain wrote: post #195

touisteur wrote: post #184

Earlier quoted context omitted.

What is the threat model there? What if the system can't be upgraded for reasons? What if your service/gateway is just behind the 'network choke' (who said you had to have only one?). Are you paying to upgrade everyone and their perfectly working mainframes or java 8 apps to TLS 1.3? How do your intruders come in? They have to break the appliance? How's the chance you have better tuned/setup your TLS terminator or FW…

The threat model is that any foothold an attacker gets behind you TLS terminator potentially allows then to snoop plaintext traffic - which likely includes login creds and auth tokens for all those mainframes and java 8 apps. (Note, I do exactly this a bit myself - terminate TLS at Elastic Load Balancers - and I feel a little dirty about it ever4y time I'm reminded... I sometimes wonder if I spend more time ensuring…

You don't have to forward traffic onto HTTP - ELBs & ALBs will happily forward traffic to HTTPS endpoints. That gives you an encrypted backend, but still allows you to manage the certificates & TLS policies in one spot. The backend servers can happily run on self-signed certs and the load balancer won't care.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#235

Post by derekp7 » Fri, Mar 19, 2021, 1:42 AM UTC

rsync wrote: post #38

frammie wrote: post #21

Really well done interview, some real interesting bits in there. One part concerned me though, in the interview, it mentions "we own (and have built) all of our own platform." and it fails to mention a few critically important key parts of a storage platform, first being encryption. How are personal files being handled? Is encryption being used? Are you able to access this data using a shared key? As well as continge…

"How are personal files being handled? Is encryption being used? Are you able to access this data using a shared key?" We give you an empty UNIX filesystem. So, if you push up files over rsync or sftp, they will sit here unencrypted. However , there are now excellent "tools like rsync that encrypt the remote result with a key rsync.net never sees" - chief among them being 'borg'[1]. Other options include duplicity an…

Since I've had a handful of users ask about cloud storage for Snebu, Would you be interested in adding Snebu as a supported protocol? It should be similar to how you currently support Borg. For Snebu, the client runs find and tar, sending results via ssh to the snebu binary on the remote host. And more recently client-side public key encryption support has been added via a client-side filter called "tarcrypt". Ideally, a customer would use Snebu to back up to a local device on their network (for example a Raspberry Pi with a large USB drive attached), and then use Snebu's efficient replication to send deltas to the cloud-hosted server. Client files are stored individually (deduplicated) on the Snebu server, and metadata is in an SQLite DB (advantages over Borg is more open standards for the data storage and public-key encryption, disadvantage is file-level instead of block-level deduplication and a project that isn't as widely used).

If you are interested, I would be more then happy to have an extended discussion with you going over implementation options, and updating the client side script to make it work better with your service. (https://www.snebu.com, https://github.com/derekp7/snebu, and the tarcrypt extensions to tar are described at https://www.snebu.com/tarcrypt.html).

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#236

Post by acdha » Fri, Mar 19, 2021, 1:48 AM UTC

blabitty wrote: post #211

bigiain wrote: post #195

Earlier quoted context omitted.

The threat model is that any foothold an attacker gets behind you TLS terminator potentially allows then to snoop plaintext traffic - which likely includes login creds and auth tokens for all those mainframes and java 8 apps. (Note, I do exactly this a bit myself - terminate TLS at Elastic Load Balancers - and I feel a little dirty about it ever4y time I'm reminded... I sometimes wonder if I spend more time ensuring…

Take a look at AWS nitro instances they give you "free" ipsec type network encryption with some caveats I forget.

The main caveat is that it only applies between Nitro instances: not AWS services like load balancer or databases, which would be one of the areas where it’d be most useful for anyone with legacy apps.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#237

Post by batch12 » Fri, Mar 19, 2021, 1:54 AM UTC

stavros wrote: post #197

high_byte wrote: post #101

Earlier quoted context omitted.

> Our platform only answers on port 22 with OpenSSH. I do security and I title this "Most secured platform in the world."

Oh yeah? Well I run one where no ports are open. In fact, I haven't even connected it to the network.

I'll raise you-- I have one that I keep powered off...

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#238

Post by StavrosK » Fri, Mar 19, 2021, 1:57 AM UTC

batch12 wrote: post #237

stavros wrote: post #197

Earlier quoted context omitted.

Oh yeah? Well I run one where no ports are open. In fact, I haven't even connected it to the network.

I'll raise you-- I have one that I keep powered off...

I can top that: I don't have one.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#239

Post by klodolph » Fri, Mar 19, 2021, 2:09 AM UTC

hertzrat wrote: post #212

dsr_ wrote: post #180

Earlier quoted context omitted.

"Steve, did you open a port? We only use SSH. What's going on?"

Oversights happen https://thenewstack.io/junior-dev-deleted-production-databas...

Yes, people make mistakes. That doesn’t mean you need a firewall.

In order for someone to accidentally delete a production database like in the linked article, many people have to make mistakes.

> The firewall is still helpful in case they hire a new person who opens a port and forgets to close it one day

Let’s talk about this scenario a bit.

What does it mean for someone to “open a port”? Really, what it means is that someone is running a program on the machine which listens to a port. But, why should anybody be running services on production machines manually, except in an emergency?

Normally, any changes you make to production machines go through some kind of configuration management system. You can’t just SSH into one of the prod servers. It doesn’t matter if you are an intern or if you’re the CTO. You don’t have the credentials. Nobody does.

Instead, if you want to run a service on a production machine, you have to make that change in source control, send the change to somebody else for review and approval, and once it is approved, submit it. Your configuration management system then pushes this change out to production systems according to the script.

Of course, not everyone works this way. Not everyone can work that way. But many companies do have tight controls over the production environment and the decision to forego a firewall isn’t unreasonable.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#240

Post by rtpg » Fri, Mar 19, 2021, 2:10 AM UTC

ac29 wrote: post #201

okl wrote: post #185

Earlier quoted context omitted.

> [...] but complexity that would hurt security? Higher complexity = larger attack surface. For example, if they used a firewall with one of Cisco's infamous backdoors. https://www.zdnet.com/article/cisco-removed-its-seventh-back...

Isnt a firewall largely a defense in depth thing? If everything is working perfectly and the firewall gets compromised, then yes, you'd just be listening to port 22 with SSH anyways, so it wouldn't really matter. But if something went wrong on the system behind the firewall (configuration mistake, software defect, malware, hacking) but the firewall itself was still secure, it would limit the damage that could be done…

I generally agree with the sentiment, but it's not strictly right.

For example you have your main machines set up securely, and requests go through the firewall. Of course a compromised firewall doesn't make it easier to compromise the main machines. But because your users are going through the firewall, _they_ might now become vulnerable to some classes of redirection attacks.

Even in a scenario where you're using the firewall as a passthrough, you're still looking at a scenario where (For example) your DNS entries are now pointing to a machine you have less control after. It might not mean that now HTTPS doesn't work anymore, but that (combined with some other mistake) might be enough.

One potential class of vulnerability might be related to recent git client issues: the software your client is using might have an issue that would be a security issue when connecting to an untrusted source. You wouldn't try to get a keylogger on your clients' machines, and the software is always pointing at your own domain etc etc. But the firewall vulnerabilities have opened up that angle of attack!

It's definitely a balancing act, and dependent on how much you trust each layer of your stack.