Tinystatus: A tiny status page generated by a Python script

Post by nicoburns » Thu, Sep 05, 2024, 2:44 PM UTC

vocram wrote: post #25

Can this be run as a AWS Lamba instance?

Post by jpitz » Thu, Sep 05, 2024, 3:09 PM UTC

remram wrote: post #30

selcuka wrote: post #6

Earlier quoted context omitted.

The idea is the values in .env files can be configured via environment variables, while checks.yaml is for things that can be hard coded. In this case it's a bit moot because the yaml file works like a database, but when you deploy this using, say, Docker or k8s, you can use a different method to configure environment variables and skip .env files.

Why can't I change the port of my database server via an environment variable? This would be required for e.g. Nomad support. If this is a goal, why is it a goal for only half the configuration?

Post by runjake » Thu, Sep 05, 2024, 3:23 PM UTC

lormayna wrote: post #34

The usage of ping require that to run as root. And this can open a big security issue as the paramater host of the function "check_ping" can be used for a root command injection. I know that this is not going to be exposed on Internet, but I think it should be fixed in any case. I am at work, but I can open a PR fixing it later.

    % ls -l /usr/bin/ping
    -rwxr-xr-x 1 root root 89768 Apr  8 09:00 /usr/bin/ping
    
    % getcap /usr/bin/ping
    /usr/bin/ping cap_net_raw=ep

    ~
    % whoami
    jake
    
    ~
    % id
    uid=1000(jake) gid=1000(jake) groups=1000(jake),4(adm),24(cdrom)
    
    % ping -c 3 8.8.8.8
    PING 8.8.8.8 (8.8.8.8): 56 data bytes
    64 bytes from 8.8.8.8: icmp_seq=0 ttl=117 time=9.195 ms
    64 bytes from 8.8.8.8: icmp_seq=1 ttl=117 time=8.837 ms
    64 bytes from 8.8.8.8: icmp_seq=2 ttl=117 time=10.998 ms
    
    --- 8.8.8.8 ping statistics ---
    3 packets transmitted, 3 packets received, 0.0% packet loss
    round-trip min/avg/max/stddev = 8.837/9.677/10.998/0.946 ms

Post by pphysch » Thu, Sep 05, 2024, 3:36 PM UTC

thelastparadise wrote: post #22

There is no reason to take on the added cost of Python for this.

Post by runjake » Thu, Sep 05, 2024, 4:12 PM UTC

trulyrandom wrote: post #38

runjake wrote: post #35

Earlier quoted context omitted.

It doesn't need to be fixed. There isn't an issue here. Depending on the OS, ping is either set setuid[1] as root, or more commonly these days, ping is granted a "capability"[2], such as CAP_NET_RAW on Linux. macOS does things a little different[3]. This allows non-root users to run stuff like ping without granting them full root access. You do not need to, nor should you, run the script as root. % ls -l /usr/bin/pin…

On Linux, "net.ipv4.ping_group_range" is typically used to allow unprivileged users to do ICMP echo requests. Setting the setuid bit or granting a capability are both very old ways of doing this.

    $ sudo sysctl -a | grep net.ipv4.ping
    net.ipv4.ping_group_range = 1 0

    ping_group_range (two integers; default: see below; since Linux 2.6.39)
    Range of the group IDs (minimum and maximum group IDs,
    inclusive) that are allowed to create ICMP Echo sockets.
    >>The default is "1 0", which means no group is allowed to
    create ICMP Echo sockets.