Or "how leaving the keys in the lock when you are not a home is a bad idea"
Pwning your web server the easy way or why exposing –/.ssh/ is a bad idea
51–60 of 60 posts
Re: Pwning your web server the easy way or why exposing –/.ssh/ is a bad idea
#52TL;DR: Antipattern: pointing web server config to any files based in /home.
Not just that. Even if you don't make that mistake, having servers ssh into other hosts and leaving keys on them for this purpose means if one machine is compromised, others can be too. And they can use known_hosts to discover which ones.
ssh -A is a thing. A risky thing, but so much better than keeping private keys on server.
Re: Pwning your web server the easy way or why exposing –/.ssh/ is a bad idea
#53Earlier quoted context omitted.
Unverifiable working theory (I didn't live through the 80s myself): I think computer systems were always terrible (I think our brains were only ever able to properly/ completely grok the old 8- and 16-bit microcomputers and early game consoles), but because early networks and computer systems were built almost entirely on a combination of naivete and lack of awareness on the part of the large corporations, the sysadm…
I especially agree with your last note. Again, I’m young, but it seems to me that the shortcomings of humans have a largely homogenous distribution through time and space.
It's wrong on nigh-on every point in its descriptions both of the 1980s and of today, however.
Re: Pwning your web server the easy way or why exposing –/.ssh/ is a bad idea
#54Earlier quoted context omitted.
I would disagree: The problem is developers (and users in general, but their lack of formal training is an excuse) being comfortable using interfaces and abstractions they don't fully understand. Note that the result of this might sound like it makes the idea of a professional system administrator invalid but that's not true: I think the better SAs of the past had a thorough understanding of what their tools did and…
I am agreeing with what you wrote, though. Or at least I am trying to. I have seen numerous times the results of that, where for instance, a developer creating a tool decides that his interpretation of a bad requirement is satisfied in a poor way. Or a sysadmin deciding that a default configuration is good enough because he did `mv conf.example to conf`, and it works. I guess what I am trying to say is that the learn…
I submit that you are heavily romanticizing the past. (-:
Re: Pwning your web server the easy way or why exposing –/.ssh/ is a bad idea
#55This is what I have learned in many years of work: people who know systems should be let to handle those systems. This is what happens when a developer is left to do the work that a system administrator should be trained to do - not all are -. For a developer, in most cases, "just works" is the end goal, when referring to systems. Not "how it works", and what are the implications of making it work like this. This rea…
Sys admins are dead. I have GKE now via a reliable Terraform module. None of my production instances can be logged onto.
But if you run your containers on GKE you are a sysadmin. The system might not be a traditional UNIXy one, but there are still elements you need to take care of that aren't just application development:
Do your containers have security vulnerabilities? How do you keep track of them?
How do they communicate? What's your blast radius if something is compromised?
Who has access to your container management plane?
Have you correctly sized your system?
Is it resilient to failures?
What about your data? Is it backed up? Have you tested the backups? Do you have volumes that can fill up? I/O limits?
All those are sysadmin things that will never go away.
Re: Pwning your web server the easy way or why exposing –/.ssh/ is a bad idea
#56Earlier quoted context omitted.
I especially agree with your last note. Again, I’m young, but it seems to me that the shortcomings of humans have a largely homogenous distribution through time and space.
It's wrong on nigh-on every point in its descriptions both of the 1980s and of today, however.
This feedback is much appreciated. Thanks.
I was born in 1991 so a lot of my understanding/worldview of this era is synthesized from hopefully-representative anecdata. Also, learning difficulties (gross oversimplification, and not realizing I'm misinterpreting something incorrectly) add extra spin to some of my earlier models that I also have to correct for (and in some cases notice in the first place).
Haha, how wrong am I? "You're sorta heading in the right direction, if you squint right, but missing 99% of nuance/context"? Or "the turnoff for the correct forest was 50 miles back"? :)
If you have any suggestions for good references I could absorb that will (misinterpretation notwithstanding) present a decent capture of the nuance of 40 years ago, I'd love to hear it.
Re: Pwning your web server the easy way or why exposing –/.ssh/ is a bad idea
#57Earlier quoted context omitted.
I would disagree: The problem is developers (and users in general, but their lack of formal training is an excuse) being comfortable using interfaces and abstractions they don't fully understand. Note that the result of this might sound like it makes the idea of a professional system administrator invalid but that's not true: I think the better SAs of the past had a thorough understanding of what their tools did and…
I am agreeing with what you wrote, though. Or at least I am trying to. I have seen numerous times the results of that, where for instance, a developer creating a tool decides that his interpretation of a bad requirement is satisfied in a poor way. Or a sysadmin deciding that a default configuration is good enough because he did `mv conf.example to conf`, and it works. I guess what I am trying to say is that the learn…
Mumble mumble The Great Worm mumble mumble.
In other words, I don't think that was a time that actually happened: we just remember the good parts and perhaps a few spectacularly bad parts, but never the mediocre hacks that always make up the remaining 90% of everything.
Re: Pwning your web server the easy way or why exposing –/.ssh/ is a bad idea
#58Earlier quoted context omitted.
It's wrong on nigh-on every point in its descriptions both of the 1980s and of today, however.
This feedback is much appreciated. Thanks. I was born in 1991 so a lot of my understanding/worldview of this era is synthesized from hopefully-representative anecdata. Also, learning difficulties (gross oversimplification, and not realizing I'm misinterpreting something incorrectly) add extra spin to some of my earlier models that I also have to correct for (and in some cases notice in the first place). Haha, how wro…
I think it's mostly because the Jargon File, BOFH stories, and similar lore only pick the interesting parts...and let's face it, parts that make the sysop narrator look good (as opposed to the "suit" antagonists).
Of course it is described as The Golden Age, because that's how all the stories of any golden age are curated.
Re: Pwning your web server the easy way or why exposing –/.ssh/ is a bad idea
#59Exposing a private key to the world is a security problem? No kidding?
As long as you keep the public part private, there is no issue ;)
From what I see on StackExchange [0] that's probably untrue.
Re: Pwning your web server the easy way or why exposing –/.ssh/ is a bad idea
#60Earlier quoted context omitted.
> being comfortable using interfaces and abstractions they don't fully understand. I don't think it was an interface or abstraction that got the user in trouble here, they were using a pair of systems in ways that were fine on their own, but combined led to an emergent vulnerability that they didn't even know to consider. It may be sheer pedantry but I really do see this as a unique "systems" issue, and this type of…
I think it is an abstraction: the one underlying both of those components that combined to create the vulnerability. The abstractions provided by the OS compose in very surprising and hard to predict ways for humans. This is why newer systems don’t use the same abstractions (JavaScript and browser APIs), or else sandbox them much more thoroughly (iOS). Those newer tools have newer problems, of course, but I think a l…
I’m not sure I agree with this, there’s a point where you start infantilizing users and make it difficult or impossible for them to do useful things with their computers. iOS is still like this (although they may be headed in the right direction) and I’m fairly certain the web absolutely is.
I will say apple absolutely got the built in ssh client in iOS13 right.