Live data from Hacker News

Posting successful SSH logins to Slack

sandrinodimattia.net

61–70 of 71 posts

Re: Posting successful SSH logins to Slack

#61
post #55
post #41

Earlier quoted context omitted.

Some file systems support append-only permissions, although I've never used them. I wonder if that would work with bash's history file?

No, since you can just turn it off or prepend all your commands with a space to hide them.

You can remove ignorespace from HISTCONTROL for the latter, and for the former, can't you just remove chattr's execute permission for that user?

Re: Posting successful SSH logins to Slack

#62

Earlier quoted context omitted.

What would you use instead?

IRC on a server I control, or some slack clone with on-premise hosting. Call me paranoid, but I'm paranoid.

I still don't understand why everyone is so excited about slack, it really doesn't offer that much more than IRC.

Re: Posting successful SSH logins to Slack

#63
post #61
post #55

Earlier quoted context omitted.

No, since you can just turn it off or prepend all your commands with a space to hide them.

You can remove ignorespace from HISTCONTROL for the latter, and for the former, can't you just remove chattr's execute permission for that user?

The user can point $HISTFILE elsewhere (e.g., /dev/null), `unset` it, use another shell, ...

Re: Posting successful SSH logins to Slack

#64
post #14
post #9

Is Slack really the right place for security-critical notifications?

Not in my book. Slack seems to be really cool but since it's not self-hosted and owned by a US entity, I'll stay clear.

We just discovered that some developers at my workplace use their domain user account credentials for Slack as well. My manager was not happy.

Re: Posting successful SSH logins to Slack

#65
post #4

Excellent. I've been thinking about having a SSHD keylogger post to slack (or some other log). It's crazy that sshd doesn't have this functionality built-in. It's so important to know what your admins are executing on your machines. Aside from the fact that they might have been compromised, it's just good to know what sort of general administration is being done.

Surprised at how many people didn't read parent's post as satire...

The author didn't walk it back when challenged.

Re: Posting successful SSH logins to Slack

#66
post #61

Earlier quoted context omitted.

You can remove ignorespace from HISTCONTROL for the latter, and for the former, can't you just remove chattr's execute permission for that user?

The user can point $HISTFILE elsewhere (e.g., /dev/null), `unset` it, use another shell, ...

It looks like you could lock down the environment variables with rbash http://unix.stackexchange.com/questions/66627/is-there-anywa...

But that's getting into no-man's land I guess

Re: Posting successful SSH logins to Slack

#67

Earlier quoted context omitted.

IRC on a server I control, or some slack clone with on-premise hosting. Call me paranoid, but I'm paranoid.

I still don't understand why everyone is so excited about slack, it really doesn't offer that much more than IRC.

It offers marketing and support, that's about it.

Nobody is selling IRC.

Re: Posting successful SSH logins to Slack

#68

Earlier quoted context omitted.

IRC on a server I control, or some slack clone with on-premise hosting. Call me paranoid, but I'm paranoid.

I still don't understand why everyone is so excited about slack, it really doesn't offer that much more than IRC.

I use IRC, but come on. It offers a lot more than IRC right out of the box.

* File uploads

* Embedding portions of links (tweets, images)

* A very good search

* Multi-line posts

* Code-formatting, including multi-line posts, and also snippets.

* A mobile client that alerts you when someone mentions you.

* Scroll-back history when you sign on at any time.

* Syncing between multiple clients.

Yes, you could create a bot or modify an irc server to do this, and then find or write a client that will do all that stuff, and an irc bouncer can fill in for a lot of this.

But Slack does it out of the box. Zero extra work needed.

I like IRC, but if you claim that Slack doesn't offer anything more than IRC, you're either delusional or using an incredibly broad definition of IRC.

Re: Posting successful SSH logins to Slack

#69
post #67

Earlier quoted context omitted.

I still don't understand why everyone is so excited about slack, it really doesn't offer that much more than IRC.

It offers marketing and support, that's about it. Nobody is selling IRC.

cough www.grove.io would like a word with you ;-)

Re: Posting successful SSH logins to Slack

#70
post #69
post #67

Earlier quoted context omitted.

It offers marketing and support, that's about it. Nobody is selling IRC.

cough www.grove.io would like a word with you ;-)

Looks cool, but

>We're sorry but Grove isn't currently accepting new customers right now.

I guess with that pricing structure they don't need to.

Post reply on HN