Gregory's Server@aral how is it theatre? For example when I have to expose ssh to the internet I usually use port 2022 because at least that's one more layer of security, in case someone gets user access to the system and are able to crash the ssh service they can't start their own service that harvests passwords because it was on a privileged port.
|
7 comments
paillp
@aral @stemid I mean, there's just plenty of solutions. From what I read in your article you have found one through modifying a kernel parameter. Which means that the mechanism is implemented. It's just not enabled by default. I see lots of workarounds to your problem and Linux in itself doesn't prevent one from achieving the behavior you're looking for.
Stefan Midjich ꙮ҄
@aral ok I read the post but all I can say is that I deploy services of all sorts of languages and frameworks for a living and I never have to give them any higher privileges. Because in production there is always a proxy in front of the service, and in dev they can use nonstandard ports. So I still see no reason to allow services to use privileged ports in my view. But we all have different perspectives. 
Aral Balkan
@stemid This is my use case: https://ar.al/2020/08/07/what-is-the-small-web/ We need to set up your own Facebook on your own server in under a minute with no technical knowledge required on your part. And democratise development while we’re at it as much as possible. So no front controller/proxy, etc., setups. Think lightweight server with in-process database. But, beyond use cases, again, it provides no real security unless you’re administering a System/360.
hkc (Carbonated)
@stemid "oh no, someone already got access to our system and starts collecting its data, I'm sure it's not too late to stop everything!"
Stefan Midjich ꙮ҄
@hatkidchan it's absolutely not too late. System access does not mean access to sensitive data. That is precisely why Linux has things like multiple users accounts, file permissions, promiscuous mode networking, and of course more advanced MAC systems like selinux. So no the battle is absolutely not lost just because someone has access to a system. |
@stemid Please see the linked page (and the articles linked to that) :)