What this server has with the tag: posts by people here, and posts from elsewhere that reached it. There's more of it on mastodon.social, social.taupehat.com, mastodon.bsd.cafe, floss.social.
Yet another reason to _always_ isolate your containers in VMs on a locked down bridge. Side-by-siding containers directly on the host with 'rootless' is not true isolation. Docker networks can also be a hot mess, and the given project's own firewalling can scribble/overstep that of host firewall.
If lacking the knowledge to isolate properly, just stick with one Docker project per VPS.
Thanks @themadhatter for the heads-up on this one. Woke up to it.
RE: https://m.ai6yr.org/@ai6yr/117533401914036933
And this, folks, is why every #sysadmin you know is absolutely hating life right now and actively reconsidering their career choices.
It was a real pleasure teaching the 6th edition of the Tunnel training.
Some exceptional displays of determination, focus and peer support. It came together beautifully in that last session with not just 'conservative' VPN configurations, of using a remote endpoint as a gateway to the www, but implementing real private LAN-like layers atop Internet infrastructure.
Congrats to the graduates!
Ok, looks like this is the week of funny experiences.
Customer: "I had an AI check our server and it says the SSH port is open and that's not very secure."
Me: "Yes, you asked us to open it so you could access the server via SFTP (actually, you wanted FTP, but we discussed it a bit and found this compromise). Don't worry, it's only accessible from your IP and you land in a dedicated FreeBSD jail. From there, you can only access the 'exchange' directory on your server, where you can upload and download files without affecting the application."
(NB: I had suggested a VPN, but they declined because it was too complicated.)
Customer: "Yes, but maybe it's still insecure. Can't we close it?"
Me: "No, unless you want to lose access to that directory."
Customer: "Ok, thanks."
One hour later:
Customer: "Hi, I think we've found a solution. We've just created an app (!!!) with AI that lets us access the files anyway, but more securely than SSH (!!!). Can we install that and close SSH? Oh, and not in the dedicated jail, but directly in the application's jail, because it needs access to the application's files."
Me: "Frankly, I trust SSH in a dedicated jail, restricted by the firewall, a lot more. I don't think this is a good idea."
Customer: "Ok, thanks."
Half an hour later:
Customer: "Ok, now it's secure. I had another AI check it and it found some security issues, but it fixed them all. Can you install it and disable SSH?"
Me: "I strongly advise against it. I can see problems coming."
Customer: "Ok, thanks."
One hour later, my phone rings.
Their internal IT guy (who has access to the machine, which, after all, belongs to them) had given the AI the login credentials to go ahead with the operation.
Except the AI had managed to lock itself out via the firewall, without even starting the app. And now they couldn't get back in.
Fortunately, I had my own access, via VPN, to a separate jail that the AI hadn't touched (or even considered).
Customer: "SORRYSORRYSORRYSORRYSORRY! From now on, we do things your way."
Well, at least it ended well.
PS: The customer knows I'm sharing this story and agreed to it.
I got a call from someone I don't know.
"Hi. We have a FreeBSD server. It's been working perfectly for years, but it hasn't been updated since then. We asked AI to update it, but now it won't boot anymore. It didn't even make a backup before starting. The AI keeps trying things, everything is down, and we've already spent over €500 in tokens. Can you help us?"
"Sure. €500, plus the time it'll take me to try to fix it. Assuming it can still be fixed and nothing important has been deleted."
"That much?"
Some silence.
"Well, I hope AI takes your job away!" And he hung up.
Believing that autopilot automatically makes you an invulnerable professional pilot will ruin far more people than job losses will.
I don't know if AI will take my job away, but it's already cost them €500 and, probably, their server.
Welcome to the GNOME Circle to Concessio!!
Concessio helps you understand and convert between UNIX permissions representations.
allheim has been updated.
