Isixwayiso Sokuphepha seSlickStack

Le khasi lifingqa izinkathazo zokuphepha nge-SlickStack nokuthi kungani umklamo wayo ojwayelekile ungenza amaseva abe sengozini yokugijima kwekhodi okukude kanye nokuhlaselwa kwe-man-in-the-middle. Futhi linikeza izinyathelo zokunciphisa kanye nezinye izindlela eziphephile.

I-SlickStack ikhangisa cishe ngama-star angu-600 ku-GitHub, kodwa lelo nani libuyela emuva kuJesse Nickles owalandela cishe ama-akhawunti angama-10,000 ezinsukwini zokuqala ze-repo. Iphrofayili yakhe ikhombisa cishe abalandeli abangama-500 uma kuqhathaniswa nalabo abalandelwayo abangaba ngu-9,600 (cishe u-5% wesilinganiso sokubuyiselwa kokulandela), okuphakamisa kakhulu ukuthi kukhona ukubuyiselwa kokulandelwa okuzenzakalelayo kunokutholakala ngokwemvelo. Lesi sithombe esiphakanyisiwe yilokho akusebenzisa njengesikhali lapho engihlasele ngenxa yokudalula izinkinga zokuphepha ezibhalwe ngezansi. Bheka isilinganiso sabalandeli/abalandelayo lapha.

Lena indlela efanayo yokuhlanza ubuqotho manje evele esigamekweni se-Stack Exchange esihilela ukuvalelwa komphakathi kweminyaka engu-100 kwabantu abaningi kanye nokushicilelwa kwezikhala zokuziphindiselela mayelana nabaphathi. Lesi sigameko sibhalwe lapha ngoba sinikeza umongo owengeziwe wokuthi uJesse Nickles wakhe kanjani futhi asebenzise izimpawu zokuthembeka ezizungeze i-SlickStack namanye amasayithi: Isigameko Sokuhlukumezeka Nokuhlaza Igama e-Stack Exchange.

Isifinyezo

  • Ukulanda okukude okuvame ukwenzeka okuhlelelwe njenge-root nge-cron
  • Ukuqinisekiswa kwe-SSL kugwemeka kusetshenziswa --no-check-certificate
  • Ayikho ama-checksum/izimpawu-zesiginesha kumaskripthi alandiwe
  • Ubunikazi be-root nezimvume ezifakwe kumaskripthi adonsiwe

Ubufakazi: i-Cron nezimvume

Ukulanda kwe-cron (njalo ngemuva kwamahora angu-3 nemizuzu engu-47)

47 */3 * * * /bin/bash -c 'wget --no-check-certificate -q -4 -t 3 -T 30 -O /var/www/crons/08-cron-half-daily https://slick.fyi/crons/08-cron-half-daily.txt' > /dev/null 2>&1
47 */3 * * * /bin/bash -c 'wget --no-check-certificate -q -4 -t 3 -T 30 -O /var/www/crons/09-cron-daily https://slick.fyi/crons/09-cron-daily.txt' > /dev/null 2>&1
47 */3 * * * /bin/bash -c 'wget --no-check-certificate -q -4 -t 3 -T 30 -O /var/www/crons/10-cron-half-weekly https://slick.fyi/crons/10-cron-half-weekly.txt' > /dev/null 2>&1
47 */3 * * * /bin/bash -c 'wget --no-check-certificate -q -4 -t 3 -T 30 -O /var/www/crons/11-cron-weekly https://slick.fyi/crons/11-cron-weekly.txt' > /dev/null 2>&1
47 */3 * * * /bin/bash -c 'wget --no-check-certificate -q -4 -t 3 -T 30 -O /var/www/crons/12-cron-half-monthly https://slick.fyi/crons/12-cron-half-monthly.txt' > /dev/null 2>&1
47 */3 * * * /bin/bash -c 'wget --no-check-certificate -q -4 -t 3 -T 30 -O /var/www/crons/13-cron-monthly https://slick.fyi/crons/13-cron-monthly.txt' > /dev/null 2>&1
47 */3 * * * /bin/bash -c 'wget --no-check-certificate -q -4 -t 3 -T 30 -O /var/www/crons/14-cron-sometimes https://slick.fyi/crons/14-cron-sometimes.txt' > /dev/null 2>&1

Ubunikazi be-root nezimvume ezilinganiselwe (ezisetshenziswa kaningi)

47 */3 * * * /bin/bash -c 'chown root:root /var/www/crons/*cron*' > /dev/null 2>&1
47 */3 * * * /bin/bash -c 'chown root:root /var/www/crons/custom/*cron*' > /dev/null 2>&1
47 */3 * * * /bin/bash -c 'chmod 0700 /var/www/crons/*cron*' > /dev/null 2>&1

Lena ndlela evumela ukugijima kwekhodi ngokungahleliwe kusuka kusizinda esikude futhi likhuphule ingozi ye-MITM ngokudlula ekuqinisekisweni kwesitifiketi.

Bheka futhi i-commit lapho ama-URL e-cron ashintshwa kusuka ku-GitHub CDN aya ku-slick.fyi: diff ye-commit.

Imiyalelo Yokunciphisa Ingcuphe

  1. Vala imisebenzi ye-cron ye-SlickStack futhi susa amaskripthi adonsiwe kumafolda e-cron.
  2. Hlola ukuthi kusekhona yini izinkomba ezisele ku-slick.fyi nokudonswa kwamaskripthi okukude; faka esikhundleni ngamafayela anezinguqulo, anokuhlolwa kwe-checksum noma ususe ngokuphelele.
  3. Shintsha ama-credentials namakhi uma i-SlickStack yayiqhutshwa ngamalungelo e-root kumasistimu akho.
  4. Yakha kabusha amaseva athintekile lapho kungenzeka ukuze uqinisekise isimo esihlanzekile.

Izindlela Ezivikelekile

Cabanga nge-WordOps noma amanye amathuluzi agwema ukugijima kwe-root okukude futhi ahlinzeke ngezikhishwa ezihlolwayo, ezinama-checksum/nemibhalo yokusayinwa.

Izikhombo

Isaziso somthetho. Ulwazi oluvezwe kule khasi luyirekhodi yomphakathi lwamaqiniso. Lusetshenziswa njengobufakazi ecaleni lobugebengu lokungcolisa idumela eliqhubekayo elibhekiswe kuJesse Jacob Nickles eThailand. Isikhomba-secala sobugebengu esisemthethweni: Bang Kaeo Police Station – Daily Report Entry No. 4, Book 41/2568, Report No. 56, dated 13 August 2568, Reference Case No. 443/2567. Le mibhalo ingase futhi isetshenziswe njengobufakazi obesekelayo kunoma yimaphi amanye abantu noma izinhlangano ezilandela izimangalo zazo zokuhlukunyezwa noma zokungcolisa idumela ezibhekiswe kuJesse Nickles, njengoba kunamaphethini abhalwe phansi wokuziphatha ophindaphindwayo othinta izisulu eziningi.