Peak security
-
Yes, I also used to run an "on premise" server - in my kitchen, not 500km away. I sometimes might need to admin it remotely, but never critical setup work.
And the meme makes it sound like they have to drive there specifically to fix it, like nobody is actually living nearby.wrote on last edited by [email protected]I mean it's a pretty realistic scenario. I happened to be the unlikely remote hands for the company I work for just a few weeks ago.
Company: an industrial cleaning company with about 1500 AD users and about 8000 employees, historically had 2 corporate offices, currently has three as it's transitioning one corporate office across the country
Server and mistake in question: old admin who's no longer with the company setup the ESXI 6.0 cluster in the server room at the office without documenting the root password to access it. This cluster happens to host the companies critical services including AD so being unable to access the host has been blocking the office migration. Old admin had also not fixed the ESXI backups which have been broken for over 3 years so no backups to restore from. Also the out of band access to the servers was never correctly setup
I happening to be close to this office and having IT experience was poked to go in and with physical access to modify the shadow file and set the root password to be blank. Had I not been available they would have had to fly someone in from the office 2000 miles away or hire a very expensive local contractor to come in after hours to do the same thing
-
They should have a remote console like Dell RAC or HP iLO
Could be they were configuring the actual network firewall and got a couple of rules out of order so they blocked all of their out of band access
-
^This^ ^is^ ^a^ ^joke,^ ^I^ ^didn't^ ^really^ ^lock^ ^myself^ ^out^
Almost the same thing happened to me. I accidentally fucked up the internet connection in my home while in Japan, and I had to video call my mom to have her fix it. It was a pain for both of us, but thankfully it went rather smoothly. Thank you mom!
-
Does it actually happen to people? All servers I worked with both had a back door (or two), and someone at the data centre (during work hours at least) you could contact in an emergency.
wrote on last edited by [email protected]iptables default DENY and flush the rules. Done by at least two people I know (then me) at the same company. Led to them moving the servers in-house and virtualizing some services to connect to the hypervisor. It does happen though.
-
deaths
deaths nuths
-
^This^ ^is^ ^a^ ^joke,^ ^I^ ^didn't^ ^really^ ^lock^ ^myself^ ^out^
Before you make a change, do this in a screen-session:
sleep 300 && iptables-restore old_fw_rules.bak
-
It's easy to write, easy to build, produces lightweight and fast executables, and the type system is great. Why not rust?
Rust does not have an ABI. Everything is linked into the executables. I would not call them lightweight.
-
I'd rather plug in a screen with VGA than deal with HPE iLO 4
Sounds like an issue draling with .NET or JRC console.
Are you on the nosz up to date firmware? -
Would misusing the
ddcommand be considered a hardware failure?Yes. Everything is a hardware failure because where does the software run? That's right, on hardware. So software bug = hardware failure.
-
^This^ ^is^ ^a^ ^joke,^ ^I^ ^didn't^ ^really^ ^lock^ ^myself^ ^out^
This is the NetAdmin's problem. And he's got 3 ways to get into the datacenter, so he goddamn well better have an answer that doesn't involve airfare. Worst case, he's gotta use remote hands, but that would be embarrassing, and I'd not let him forget it. Nobody forgives me when I screw up a server cluster, so he gets no latitude when he takes a datacenter offline.
-
Since that happens to the best of us, I envision writing a wrapper script around {n,}pfctl that asks for confirmation upon detecting that you're logged in via ssh through a specific port AND detecting that the new rules would block that port.
VMware does this with its virtual networking. If a change takes it offline, it automatically rolls it back. It can be frustrating at times, but mostly its saved my ass.
-
I'd rather plug in a screen with VGA than deal with HPE iLO 4
I keep a Windows 2008 w Java 6 VM on ice for administering old Java console shit like that.
The VM is unsafe as hell. Completely virgin unpatched. The only protection is that I don't give it a gateway or dns, and I shut it down when its not in use.
And it works. Old Java shit can still be used. -
They should have a remote console like Dell RAC or HP iLO
I hate it when my boss says that. Or he will call it "D-RAC". Annoys the hell out of me.
It's iDRAC.
Yes, there are components that are called RAC, but the Dell out of band management system is called iDRAC.
... but that's not as dumb as when he calls the SuperMicro system "iLO". That's IPMI. We don't even own any HPE. I've no idea why he's stuck on iLO. -
Rust does not have an ABI. Everything is linked into the executables. I would not call them lightweight.
Oh, so it's inconvenient for GPL-circumventers, too? That just sounds better and better.
-
Sounds like an issue draling with .NET or JRC console.
Are you on the nosz up to date firmware?I remember there being the option of using HTML or a Java applet, I chose the former
-
I'd rather plug in a screen with VGA than deal with HPE iLO 4
wrote on last edited by [email protected]Networking noob here; what, pray tell, is HPE iLO4... or do I want to even know?
Edit: Never mind. Found it. HP... shudders
-
Rust does not have an ABI. Everything is linked into the executables. I would not call them lightweight.
wrote on last edited by [email protected]A standard Docker container with a NodeJS/PHP/Python app is usually around 200-300 MB (yes really), the OpenJDK JVM is around a hundred MB, but a fully statically compiled rust binary that doesn't even depend on libc is just a couple MB and can be deployed as a tiny distroless Docker container.
It's a lot heavier than your 8kb C++ executable but it's nothing compared to what is required to deploy anything else.
-
I remember there being the option of using HTML or a Java applet, I chose the former
If you have the HTML5 option you should be on a pretty recent firmware.
Interesting that you'd prefer going (literally) analog connection rather than over the IPMI.
-
Before you make a change, do this in a screen-session:
sleep 300 && iptables-restore old_fw_rules.bak
permission denied
fuuuu
-
^This^ ^is^ ^a^ ^joke,^ ^I^ ^didn't^ ^really^ ^lock^ ^myself^ ^out^
Rescue mode with networking, mount drive, make changes and reboot.
