Root Access

Journeyman Geek

12:00 AM

@qasdfdsaq you're on SU not SF ;p

Bob

Screw l2arc.

(I'm running ZFS itself off SSDs...)

Journeyman Geek

@Bob apparently dosen't matter

bwDraco

The Z5 Premium does pull some tricks to tame the power consumption (limiting resolution to 1080p during ordinary tasks), but 2160p panels are power hogs.

qasdfdsaq

@JourneymanGeek I'm on SF too y'know

Journeyman Geek

ugh. I'm having one of those days when I wish I had a small lathe.

Bob

12:01 AM

1 GB/TB?

Journeyman Geek

off the top of my head

I may be wrong

Bob

I've got some 16 GB of RAM dedicated to the ARC ... for 600 GB of usable storage.

qasdfdsaq

@Bob That's a rough ballpark figure

You can get a better estimate from calculating record sizes

(About 320 bytes per record "in core" but bear in mind ZoL suffers from horrendous memory fragmentation)

bwDraco

2160p also demands an insane amount of framebuffer.

Journeyman Geek

as you might have noticed. I live dangerously with my OSes and safe with my filesystems

qasdfdsaq

12:02 AM

@Bob Well you'll be fine

I've got 16GB of RAM dedicated to the ARC for 96TB of usable storage >_>

Journeyman Geek

@allquixotic @Bob is a room owner tho. He can read ^

allquixotic

lxd probably isn't airtight but I trust the crafty fox

Journeyman Geek

(and sneakily he'll know that)

qasdfdsaq

Eh, all my boxes sudo without a password. Most of them are configured to use SSH agent authentication instead of passwords.

allquixotic

@Bob :(

Journeyman Geek

12:04 AM

@allquixotic I was playing with it on keres.

Its pretty nice

allquixotic

@qasdfdsaq same here, 100% of my server boxen are ssh pubkey only

password based authentication is dumb ;p

Journeyman Geek

>_>

holds up a sign saying - I was a bad dog and had password based auth on a VPS

allquixotic

I have dedup off because of the ridiculous CPU and RAM it'd take up

qasdfdsaq

@allquixotic Oh I have local password based login if I need it, but I usually use keys for both login and sudo pam

allquixotic

but my compression is lz4

bwDraco

12:07 AM

Me too. Nobody's going to break a 4096-bit RSA key.

qasdfdsaq

I adopted pam ssh agent mainly from work where we had a "no passwords" policy

Michael Frank

@bwDraco Not with a computer! Maybe with a wrench though.

3

qasdfdsaq

And plain unauthenticated sudo was also dumb

allquixotic

# zpool get all
NAME  PROPERTY                    VALUE                       SOURCE
tank  size                        1.81T                       -
tank  capacity                    25%                         -
tank  altroot                     -                           default
tank  health                      ONLINE                      -
tank  guid                        don't look at my guid :(          default
tank  version                     -                           default
tank  bootfs                      tank/root                   local

Bob

@qasdfdsaq I actually log in as root on most of my servers -_-

pubkey, though. of course.

bwDraco

12:09 AM

Yep. There's no getting around side-channel attacks even if your auth is secure...

allquixotic

@Bob ~~such bad practice!~~ oh yea, I do that too

qasdfdsaq

@Bob Same.

Password auth isn't really that bad if you have secure, complex passwords

Bob

I just don't see why it's supposedly such a big risk.

allquixotic

damn, too bad I don't have cavil on a subvolume or I could just zfs snapshot before you started working

bwDraco

Me too as well. I saw no convincing reason to lock down SSH access to root. The thing that matters is that you're not using password auth.

qasdfdsaq

12:09 AM

(Also good luck with SSH key auth if you have to recover a server from bare metal...)

allquixotic

that would have been so damn sexy

Bob

@allquixotic lol. My VMs are running ext4 on ZVOLs :\

allquixotic

i really need to put my VMs on subvolumes

not doing filesystem on filesystem, that's ugly

qasdfdsaq

Zvols?

@Bob Root SSH and password SSH are both considered "risky" mainly due to dumb people putting in bad passwords that are easily brute forced.

Bob

@allquixotic I can't easily avoid it.

Might look into booting off 9p though.

@qasdfdsaq I usually have password auth off.

Wait. No. I haven't set that in a while... whoops.

qasdfdsaq

12:12 AM

I keep it on, because 80% of the time I've not got my SSH keys on me.

allquixotic

explain 9p to me again? I feel like you already did maybe 2 or 3 times

qasdfdsaq

Also my main access method is Windows RDP...

Bob

Meh. Most of my servers only have root and ssh to root via password is disabled by default.

@allquixotic 9p is a filesystem/protocol thing ripped from plan 9

allquixotic

fricken Plan 9 thingy

eww... why are you using that @_@

Bob

9p virtio is just a way of exposing a host folder to the guest

allquixotic

12:12 AM

oh ok

Bob

seems fairly performant

qasdfdsaq

On the other hand there's also plenty of dumb people who store SSH keys insecurely and unencrypted

Bob

booting from 9p might let me keep a tiny boot partition on ext4 and everything else on zfs proper

@qasdfdsaq depends on the level of security you need

but security is full of those kinds of tradeoffs

qasdfdsaq

When I first started my last job, I inherited an environment where everyone's SSH key was in the authorized_keys list for root, and each machine's root key was in the authorized_keys list for root on every other machine.

Bob

I tend not to encrypt my keys on my local machine

Mostly because if an attacker got that level of access to my machine I'm right fucked anyway.

Though I've been looking at slipping them into keepass ... no easy way to do that

qasdfdsaq

12:16 AM

Putty agent ftw.

I encrypt all my keys unless the machine it's on has full-disk encryption already.

And even then some of my keys are double encrypted.

Sure it'd be bad if they compromised my desktop PC, but that doesn't have to lead to compromise of all my servers, laptops, etc. if I left root keys lying around

Bob

oh, it wouldn't give them access to my other local machines

qasdfdsaq

But it would give them access to allquixotic's server

Bob

nope, cause I don't save that connection

qasdfdsaq

But if they get the key it doesn't really matter, they can connect from anywhere

Bob

the chance of someone getting the key and just happening to try it on allq's server is almost nonexistent

qasdfdsaq

12:19 AM

Depends if it's a targeted attack and if they read this chat :-P

Bob

@qasdfdsaq Eh. They can catch the unencrypted key in memory while it's in use.

allquixotic

wow, the Z5 Premium actually looks like a good smartphone; the 810 would be a sidegrade from the Note 4, but I assume they are optimizing the heck out of the GPU to run on 4K, and it has microSD, and the same RAM... I just wish it weren't still a 28nm soc

Bob

They can enter commands into the KiTTY window when I leave it open.

allquixotic

maybe the successor to the Z5 Premium might pull me away from AAPL if bluetooth isn't an issue

qasdfdsaq

Sony's got very good software optimisations for battery life and performance as well.

Bob

12:20 AM

Key-theft really would be the last of my worries if I was under targeted attack and they actually got on my machine.

@allquixotic I'm waiting to see the LG G5 :P

Though I want an european (unlocked) model :\

qasdfdsaq

Even on phones with the same CPU as my same-gen Samsung phone, my Sony ends up with 2x the battery life with a smaller battery and snappier performance to boot

Bob

S7 miiiight entice me back to Samsung

allquixotic

I'm waiting to see if the Note 6 has a better fingerprint sensor and microSD and at least 128GB of built-in NAND

Bob

but I actually really like the feel of the G4 in my hand

allquixotic

if yes, I might return to sam

Bob

12:21 AM

that curved screen and back :D

qasdfdsaq

Rumours are the S7 is either waterproof or has an SD slot. both of which were dealbreakers that caused me to return my S6. So it may tempt me too

The S6 already has a much improved fingerprint sensor.

allquixotic

the Note6 will just be an S7 with a pen, and I want that

the pen would be a legitimate, physical device I don't have access to now on the iphone

qasdfdsaq

Does the Note series still exist? I thought they renamed it to S6 Edge+ and dropped the pen

Bob

My only gripe with LG is the locked bootloader. Well, that and the hardware failures but that hasn't hit me yet.

allquixotic

@qasdfdsaq the Note5 is current

qasdfdsaq

12:23 AM

Oh it's so new it's not even on sale in the UK yet

Bob

Otherwise... smooth UI, miles ahead of TouchWiz.

qasdfdsaq

knowyourmobile.com/samsung/samsung-galaxy-note-5/23081/…

Bob

And very fast/frequent updates.

qasdfdsaq

That's like, 5 months behind the usual Note release cycle :-/

Bob

They actually patch (serious) security vulns maybe a week or two behind AOSP.

qasdfdsaq

12:24 AM

> However, in a weird twist of events, it now appears as if Samsung is going to do the exact opposite in 2016 — release the Galaxy Note 6 in the UK, but not the Galaxy S7 EDGE+.

And the reason? Simple: sales of the Galaxy S6 EDGE+ were rubbish and likely no way near what the Galaxy Note 5’s would have been had it launched in the UK last year.

oldmud0

1:26 AM

@JourneymanGeek How to i fahrenhiet

crap, didn't mean to wake you out of your slumber

Journeyman Geek

@oldmud0 no clue.

naw. I was awake and minecrafting

oldmud0

oh

the demographic for minecraft has shifted from 22 to 8

not sure how you can survive online these days, without going into servers decked out with mods

Journeyman Geek

Oh, I play single player

oldmud0

wow, I am amazed, somebody who still plays singleplayer

bwDraco

1:57 AM

For some reason, I am not getting stable Internet speeds. I suspect network contention at the local node...

Never mind. It appears the ISP is throttling YouTube...

However, why is my phone reporting unusually slow speeds during speed testing?

oldmud0

@bwDraco If your ISP throttles YouTube, you might want to contact FCC about that.

From my understanding, throttling of any kind is ILLEGAL, severely punishable, and shameful dispray.

bwDraco

2:15 AM

Okay. Streaming a game from my server over VNC works normally, fully saturating the local Internet connection. What the heck is wrong, TWC?

Okay. Appears to be contention at the peering point.

It'll probably clear up later.

This is not a local node issue. I am getting full speeds with normal downloads and with VNC.

These are peak hours, so I suspect the peering point is congested.

Again, this is not a local Internet connection issue.

oldmud0

2:40 AM

twc = trashy wired connection

Journeyman Geek

3:17 AM

Headphone repairs seem to have worked

Nothing new has fallen off in a few days

Canadian Luke

3:35 AM

Hey guys, got a security related question

allquixotic

k

Canadian Luke

Need to share multiple MS Access databases as securely as possible. My thoughts on the setup:

1. Hosted server in Canada in a data center. It runs a VM with an encrypted LVM partition (encrypted data at rest)
2. No passwords to SSH, only SSH keys
3. User is given an OpenVPN file, with the three keys/certificates the user needs, and instructions to use OpenVPN. Each client certificate is different, and can be revoked eaasily
4. After the user logs in to OpenVPN, they can connect to a SAMBA share with a username and password, and gain access only to the database they're allowed.

Am I missing anything important?

allquixotic

@CanadianLuke do you need to allow multiple users to access any single database simultaneously?

Journeyman Geek

@CanadianLuke You might need to add a AV exception for the samba share.

Canadian Luke

Yes, but the Access database already allows for that. The data center only offers Linux hosting, otherwise I'd try for a Windows server wtih MS SQL

AV exception... Anti virus exception? Why? I expect them to not put viruses in there

Journeyman Geek

3:46 AM

1

Q: tuning windows 7 to centos linux smb over a long distance VPN connection

I'll try to fill in as I can, but here's the basics We have a VPN (I believe running openvpn) between a site in singapore to a main site in london, with the main site.Its a purely ipv4network. We have a windows 7 box (in sg) which we use to retrieve a file from a centos 6.5 server running smbd...

MSSE is alright.

Canadian Luke

Wow! OK

I was testing it last week with AVG Internet Security (Business) 2016, and it worked great for me, as one user

... Over wireless

The latency is <100ms from even the slow Internet I have at the organization I'm planning this for

Journeyman Geek

Canadian Luke

So, think I've mitigated enough risks that it's worthwhile? I feel I have

allquixotic

4:13 AM

@CanadianLuke Be very, very careful. I am pretty sure Access can be exploited at the filesystem level to bypass any security restrictions you may have on the database, like making users sign in or typing a password. Encrypting the database with Access's crypto may help, but I think that requires you to put in a password that's shared among all users, after which it's decrypted.

If the database has only one access level, and anyone who can access the file is more than welcome to effectively be able to flip arbitrary bits within the file (and such access would be authorized), then go ahead and proceed.

I don't think Access has the technical capability to enforce separate permission levels or roles within a single database in a way that can't be easily exploited, even with its symmetrical encryption enabled.

Canadian Luke

@allquixotic I understand that write permissions on the Access file means anyone with write permissions can do as they please. There will be nightly backups taken off site as well

allquixotic

@CanadianLuke Then that should be fine. I guess if your intent is to have 3 different databases (presumably, with different sets of data or different levels of access), then that's pretty secure the way you designed the separate OpenVPN client certificates for access to the samba shares.

You might want to run 3 separate samba servers just to be sure a privilege escalation vulnerability in Samba itself doesn't bite you.

Canadian Luke

I see it as kinda multi-factored... A key (something they have) and a password (something they know)

It's not using real users, Samba 4 allows for virtual users

So they can't elevate to root

... Unless I've been lied to...

allquixotic

As long as the underlying assumption of "has write access to file == they can make arbitrary changes to the data" is not violating any data integrity concerns in your business process, it should be good.

@CanadianLuke I'm not talking about elevating to root. I'm talking about the ability for one Samba user to impersonate another Samba user, or to obtain incorrectly wide permissions to the filesystem. Root has nothing to do with it.

That could be a vulnerability that might happen entirely within the Samba code, independent of anything to do with the filesystem or Linux.

In fact I'm pretty sure such vulns have been CVEs in the past against Samba.

Canadian Luke

The guy who wrote it is an effing idiot when it comes to security, but he doesn't want the databases hosted online... Yet he posts them in an encrypted .ZIP file with a 3 digit (not character, DIGIT) password on a public facing web server

allquixotic

4:19 AM

@CanadianLuke The system you're laying out is much more secure than that...

Canadian Luke

I agree. That's why I'm selling the idea like that

I'm going to test with our local database in my city first, starting in March. If it works great until Summer (and my users are going to offer feedback on the instructions I provide), then I'm going to recommend the rest of the province moves to this system

That is my goal

allquixotic

@CanadianLuke It's a very interesting merger of bog standard Linux sysadmin FOSS tools and proprietary Windows-only "novice business user" "brogrammer" tools. I've never heard of something like this being used in production. That said, it may just work.

Canadian Luke

They're essentially membership databases, with Supply information and Training information, along with their personal information

allquixotic

Especially considering you're taking nightly backups...

Canadian Luke

I love rbackup :)

allquixotic

4:22 AM

Hopefully the files don't become too large, because certain paranoid virus scanning utilities might insist on downloading every last bit of the file before allowing it to "pass", so that could take a long time over a WAN connection.

Might significantly delay the startup of the database.

Canadian Luke

The databases are around 10MB zipped... Expanded, I think our database was around 36 MB

And a delay for convenience is something I can live with

allquixotic

I wonder if you'd save any additional space by compacting the database.

Canadian Luke

It's a volunteer organization, and many are still running Windows XP... I'm slowly getting them access to legal licenses for non-profits for Windows 7

Could, but wouldn't that make it slower when operating on it?

Bob

Uhm. Am I the only one with alarm bells going off in my head from what looks like quite a convoluted mess? -_-

Though I suppose it's not that unusual, considering it involves Access.

Just sounds like you're trying to barricade the front door while missing a side wall.

On a completely unrelated note... @allquixotic time to dig into Cavil's brains :P

(i.e. I'm gonna try to rewrite the runner with webdriver.io)

Canadian Luke

@Bob Got other advice? I'm looking for input, so if you think this is crazy, PLEASE let me know now

You know, while it's still not as big of an issue

Bob

4:34 AM

That's not very reassuring.

@CanadianLuke Uhm. That's part of the problem. Short of getting the hell away from Access, I can't really think of anything :P

I suppose finding a way to properly host a jet instance.

but I don't know what kind of forms nightmare you have going in access

Canadian Luke

I do the fixing, as the original author has decided he's released the final version...

If they get more money, we can look at getting an actual MS SQL server instance going. Else, I'm waiting on another tech dude I know who does lots of programming to make something web-based

jokerdino

Hey, is Visual Studio free? I want to try some C# programming.

Bob

@jokerdino VS Community is free for individuals.

jokerdino

How nice of you clippy.

Bob

It's effectively the same as VS Pro IIRC

Canadian Luke

4:38 AM

Just lacking team features

jokerdino

Does it support VBasic 6?

Bob

Also, feel free to ask if you have any questions - I wouldn't mind some C# questions for once :P

@jokerdino No. Just no.

VB6 is long deprecated. It's dead, Jim.

It won't even run on Win7.

Canadian Luke

VB.Net is vastly different from VB6

Bob

VB.NET is syntactically similar. But, seriously, go C# if you can.

VB.NET is a second-class citizen nowadays.

jokerdino

@Bob Why do they teach me that stuff in college, man.

Bob

4:40 AM

It technically has access to (almost?) as much as C#, but it's nowhere near as popular and it's far less powerful syntactically. It's a lot more verbose for common operations, for starters.

jokerdino

I had some fun with Visual Basic. If C# or .NET is anything like that, I think I would like it.

Bob

@jokerdino Eh, you'd have to try to find out.

Also depends how you learn. e.g. I learn by having a project to work on, diving into the deep end as it were.

Lots of people prefer to learn by structured courses.

Each method has its own advantages.

jokerdino

I most definitely don't have patience to go through a course.

Bob

lol, ya.

jokerdino

I guess I would try to create some semblance of a project for my own amusement.

Bob

4:47 AM

but the problem with starting with a project is, well, finding or thinking of a project

jokerdino

What project are you working on?

Bob

Also depends if you want to learn to just throw shit together, or want a deeper understanding of how everything works together.

@jokerdino These days? Not so much. Basically no personal projects.

Apart from work, I've been patching Firefox -_-

(or at least trying to)

Journeyman Geek

and randomly throwing together things ;p

Bob

Oh. Yes. That :P

jokerdino

@Bob since I am not really interested in a developer job, I would want to get some hold of the things I am doing.

Bob

4:49 AM

(see JMG's recent questions)

@jokerdino So you want to go with the deeper understanding?

jokerdino

@JourneymanGeek What ya doing ?

@Bob Clearly.

Bob

That's always good! But you have to want to go research when you want to know something :P

jokerdino

I only hope the documentation is good. I have had enough with Gtk toolkit.

Bob

@jokerdino Oh. MSDN documentation is generally excellent.

Also, VS itself tends to expose the docs pretty well.

Journeyman Geek

@jokerdino oh, I was rebuilding my home server. @Bob threw together the a plugin for growl for windows that works with the native notifier for windows 10

Bob

4:52 AM

I started with C#. Still probably my favourite language, though I do miss some features found in other languages.

When doing things in Java, I'm constantly disappointed by just how hard it is to browse javadocs :\

jokerdino

I started with Java and stopped programming soon after.

Bob

And frustrated.

@jokerdino LOL

jokerdino

I fell in love with programming after I learned python.

Bob

JavaScript actually tends to be fairly well documented too (MDN...) but some of the web APIs are ... lacking.

@jokerdino In terms of verbosity, C# approaches Java.

But there's lots of nifty syntax shortcuts that make it much easier, IMO.

jokerdino

It's not that I hated Java, I just didn't understand what is programming when I first started. It only made sense after I picked up python.

HackToHell

4:54 AM

python is awesome <3

jokerdino

I'll let you know what I feel about C# once this 8 hour update is over. O_O

Bob

o.O

@jokerdino Anyway - try to think of something you want to make :P

I'd recommend starting with something console-mode.

jokerdino

Taking forever to download Community 2015.

Bob

Yea, it's pretty giant :\

jokerdino

Fortunately, my super fast 125 kbps broadband line is on point today.

HackToHell

4:56 AM

125 kbps ?

jokerdino

pretty impressive, yeah?

@Bob definitely something only I will be using :P

HackToHell

Mind boggling fast

Atom's font and display sucks compared to sublime text 3

Journeyman Geek

sublime text is basically the high water mark of text editors IMO

HackToHell

lol, someone did what I have been attempting to do for a while now with whatsapp on facebook

defaultnamehere.tumblr.com/post/139351766005/…

Bob

Meh. continues using vscode

Journeyman Geek

5:01 AM

;p

HackToHell

This is a good time to try that too

haven't updated in ages

HackToHell

5:16 AM

has anyone worked with react.js?

Bob

eww

HackToHell

at react ? ;p

Bob

6:23 AM

!!info

HackToHell

!!dead?

Journeyman Geek

7:03 AM

ee ain't dead, ee's pining for the fjords

bwDraco

7:20 AM

@JourneymanGeek chat.stackexchange.com/…

Gotta go.

Journeyman Geek

@bwDraco dead parrot sketch ;p

Bob

8:32 AM

in JavaScript on Stack Overflow Chat, 15 hours ago, by Florian Margaine

@user2249907 java is to javascript what a ham is to a hamster

in JavaScript on Stack Overflow Chat, 18 hours ago, by rlemon

I used to have a drinking problem, then I got a raise and it no longer was a problem.

heh.

Nebulas do not tend to appear next to planets - true, I suppose, in much the same way that you don't often find a continent inside your house. :-) — Harry Johnston 23 hours ago

Transcript for