we add a small meeting with new GSoC student skelly37 with outsidecontext
2022-05-30 15006, 2022
zas
we discussed a bit about Picard dev priorities for upcoming 2.9 & 3.0
2022-05-30 15047, 2022
zas
I also deployed a workaround for an annoying warning about SSD failure on trille (according to Hetzner the problem isn't real, and the net seems to confirm that)
plus usual upgrades, supervision, user support, minor issues handling. fin. atj?
2022-05-30 15034, 2022
atj
hi
2022-05-30 15009, 2022
atj
last week I made some changes to our smartmontools and netplan ansible roles. the first was to resolve the issue zas mentioned just now and the second was prep work for moving the spark cluster to ansible.
2022-05-30 15053, 2022
zas
atj: thanks for your work on ansible, much appreciated
2022-05-30 15006, 2022
atj
I had a look at the spark cluster configuration, and created a WIP PR for our ansible playbook
2022-05-30 15032, 2022
atj
we've been focused on physical servers up until this point, so including VMs requires some reorganisation
2022-05-30 15026, 2022
atj
hopefully I'll find some more time to work on that this week so we can get the jackson VMs into ansible ASAP
2022-05-30 15018, 2022
mayhem
those are bare metal, not VMs.
2022-05-30 15021, 2022
mayhem
not sure it matters.
2022-05-30 15039, 2022
atj
heh, are they?
2022-05-30 15045, 2022
mayhem
yep
2022-05-30 15002, 2022
zas
yes, but different group, SOLR cloud is on VMs though
2022-05-30 15006, 2022
mayhem
the server auction type, if I am not mistaken. (read: cheap)
2022-05-30 15026, 2022
alastairp
that being said, if you want to practise with VMs then I can help to work on brainzbot and sentry VMs
2022-05-30 15043, 2022
zas
alastairp: this will come at some point ;)
2022-05-30 15054, 2022
atj
sorry, ignore my mention of VMs then :) however they have VLAN interfaces which is the primary difference
2022-05-30 15058, 2022
alastairp
yes, not pressuring, just offering some servers if necessary :)
2022-05-30 15005, 2022
odnes_ joined the channel
2022-05-30 15032, 2022
mayhem
sorry, we're a bunch of pedants
2022-05-30 15043, 2022
atj
I'm glad you pointed it out
2022-05-30 15047, 2022
odnes has quit
2022-05-30 15052, 2022
atj
I think I got confused between SOLR and Spark
2022-05-30 15008, 2022
yvanzo
the correct writing is Solr
2022-05-30 15021, 2022
atj
thanks yvanzo :)
2022-05-30 15041, 2022
CatQuest
mbssssssss
2022-05-30 15054, 2022
zas
lol :)
2022-05-30 15001, 2022
yvanzo
I’m just following the team :)
2022-05-30 15018, 2022
alastairp
solR, it's a mid-2010s social network
2022-05-30 15046, 2022
atj
that's about it I think, FYI I'll be AFK on Thursday and Friday, as we have been bestowed with an extra bank holiday thanks to our archaic system of government involving strange woman lying in ponds distributing swords
2022-05-30 15056, 2022
CatQuest
mfw i realise "mid 2010s" is like a decade ago
2022-05-30 15020, 2022
CatQuest
king arthur day is a thing?
2022-05-30 15028, 2022
atj
who else is up?
2022-05-30 15031, 2022
monkey
+1 for Python reference
2022-05-30 15052, 2022
CatQuest
listen buddy, no watery tart has ever given me a sword!
2022-05-30 15017, 2022
atj
we may well see the violence inherent in the system
2022-05-30 15037, 2022
reosarevok
I thought only covid parties were inherent in the system
2022-05-30 15041, 2022
yvanzo
atj: nobody else, just your chapter about securing MeB infra
2022-05-30 15047, 2022
CatQuest
i prefer corvid parties
2022-05-30 15052, 2022
CatQuest
they're a murder!
2022-05-30 15000, 2022
reosarevok groans
2022-05-30 15012, 2022
CatQuest
Success!
2022-05-30 15030, 2022
atj
is that the name for a group of crows?
2022-05-30 15047, 2022
CatQuest
thatsthejoke.png
2022-05-30 15057, 2022
CatQuest
yes :D
2022-05-30 15059, 2022
alastairp
shall we move on?
2022-05-30 15001, 2022
atj
I was just checking I understood it
2022-05-30 15005, 2022
atj
yep
2022-05-30 15006, 2022
CatQuest
absolutely
2022-05-30 15022, 2022
reosarevok
Freso: time to move on? :)
2022-05-30 15026, 2022
alastairp
if we understand correctly, that's it for reviews
2022-05-30 15040, 2022
Freso
reosarevok: Probably. :)
2022-05-30 15043, 2022
alastairp
next up, part 5 of the trilogy on securing infrastructure
2022-05-30 15053, 2022
yvanzo
atj: we were at “Reducing docker container capabilities” which you mostly wrote (IIRC)
2022-05-30 15056, 2022
CatQuest
part 5, the trillening
2022-05-30 15013, 2022
yvanzo
actually should be part 4 again, last time we just stated that the author was missing.
2022-05-30 15023, 2022
atj
yes, sorry about that
2022-05-30 15026, 2022
CatQuest
part 5: part 4,5
2022-05-30 15056, 2022
CatQuest watches the entire chat go apeshit at their norwegian desimals
2022-05-30 15057, 2022
yvanzo
Don't worry, we didn’t think about looking at it in advance either.
2022-05-30 15053, 2022
atj
so, the main thrust of my thoughts on this topic are summarised by the Docker docs: "Docker containers are, by default, quite secure; especially if you run your processes as non-privileged users inside the container."
2022-05-30 15009, 2022
atj
"quite" doing a bit of work there
2022-05-30 15012, 2022
akshaaatt gets reminded of AoT anime which has `seasons` for the final season
2022-05-30 15037, 2022
atj
my understanding is that pretty much everything in docker is running as root at present
2022-05-30 15045, 2022
alastairp
atj: so I think we agreed that we should focus on moving to non-root
2022-05-30 15055, 2022
yvanzo
Changing the users inside the container is definitely something that can be done at project-level, a TODO item has already been added.
2022-05-30 15055, 2022
alastairp
some services are root, others use non-privileged users
2022-05-30 15015, 2022
atj
if reducing that is feasible, then I think it would be a win from a security perspectivre
2022-05-30 15019, 2022
atj
*perspective
2022-05-30 15022, 2022
alastairp
what are your thoughts on capabilities and rootless?
2022-05-30 15024, 2022
CatQuest
hmm iirc "quite" menas diff in AE and BE ?
2022-05-30 15044, 2022
monkey
Quite.
2022-05-30 15000, 2022
atj
capabilities are good, but complex as they can often make things fail in odd ways
2022-05-30 15004, 2022
yvanzo
atj: The last point (6min left) is about permissions to run docker commands.
2022-05-30 15040, 2022
atj
alastairp: rootless is probably more hassle than it's worth I think, but I need to investigate further
2022-05-30 15020, 2022
atj
yvanzo: I'm not sure how we can feasibly reduce that attack surface but am open to suggestions
2022-05-30 15036, 2022
atj
giving users docker access is akin to granting root, as we know
2022-05-30 15046, 2022
atj
and everyone who has docker access has sudo anyway
2022-05-30 15021, 2022
yvanzo
I don’t know if removing sudo users from docker group would make a difference?
2022-05-30 15053, 2022
atj
somewhat, but I think most people probably need both?
2022-05-30 15002, 2022
yvanzo
IIRC it can make a difference in some context, which is both are supported by some Docker Compose projects.
2022-05-30 15014, 2022
odnes_ has quit
2022-05-30 15015, 2022
atj
personally I think we should try to focus on use of non-root users as much as possible, and examine the feasibility of reducing capabilities
trying to move to fine grained user permissions is likely to cause sysadmin headaches
2022-05-30 15054, 2022
atj
and frustrated users
2022-05-30 15018, 2022
yvanzo
Would generalizing the use of DOCKER_CMD removes this need for docker group?
2022-05-30 15027, 2022
Etua joined the channel
2022-05-30 15029, 2022
alastairp
I think that moving to non-root users is a pretty straightforward step that we can do, and so we should focus on that first
2022-05-30 15006, 2022
alastairp
yvanzo: maybe for scripts, but for general interaction on servers - running one-off commands etc I'm used to running without sudo
2022-05-30 15009, 2022
atj
yvanzo: standardise one or the other, personally I'd probably avoid sudo, but not sure on other peoples thoughts
2022-05-30 15012, 2022
yvanzo
I agree, not suggested to move to fine grained permissions right away, but to find a mid-term path to it.
2022-05-30 15017, 2022
alastairp
I'm sure it's a small thing to get used to, but...
2022-05-30 15010, 2022
atj
yvanzo: probably more like long term at this stage I think
2022-05-30 15021, 2022
yvanzo
alastairp: you can also set a shell alias.
2022-05-30 15035, 2022
Freso
Are we at a point where we can wrap up?
2022-05-30 15052, 2022
atj
we have 2 different attack surfaces: a) application vuln resulting in RCE and b) user account compromise
2022-05-30 15018, 2022
Freso
Or should we end general meeting and continue talk for involved and interested parties?
2022-05-30 15059, 2022
yvanzo
I’m good.
2022-05-30 15023, 2022
atj
we can end the general meeting, I'll try to look into docker capabilities more and if we can make a note to focus on moving to non-root users in containers when feasible
2022-05-30 15036, 2022
mayhem needs to go
2022-05-30 15043, 2022
Freso
Alright then.
2022-05-30 15002, 2022
Freso
Thank you all for your time! Take care, stay safe, drink water, wear your masks!
2022-05-30 15004, 2022
Freso
</BANG>
2022-05-30 15007, 2022
monkey
FWIW, I checked last week for BookBrainz images, they are running with a non-sudo user
2022-05-30 15012, 2022
akshaaatt
Thank you!
2022-05-30 15013, 2022
monkey
non-root*
2022-05-30 15024, 2022
atj
thanks monkey
2022-05-30 15027, 2022
alastairp
monkey: great!
2022-05-30 15032, 2022
alastairp
thanks everyone
2022-05-30 15050, 2022
alastairp
one thing that trips me up for non-root is one-off installations in a container
2022-05-30 15050, 2022
monkey
This is the default for node-based Docker images, which the BB ones are based on.
2022-05-30 15007, 2022
monkey gotta go too, byyeeeeee
2022-05-30 15007, 2022
alastairp
e.g. suddenly I need to apt instlal something extra
2022-05-30 15022, 2022
alastairp
or pip install for that matter (as we install packages to /usr/local)
2022-05-30 15042, 2022
alastairp
so having docker run start up as a regular user is really annoying
2022-05-30 15022, 2022
alastairp
could be worked around in development by using --user flag to docker run. not sure how many times it's come up that we need to install something in a `docker exec` on prod
yvanzo: my question about MB on wolf - I see that we have sir local dev enabled on the checkout, and a `sir` directory in musicbrainz home directory
2022-05-30 15009, 2022
alastairp
I don't know if we had live indexing (or solr at all) set up here
2022-05-30 15015, 2022
alastairp
one thing, which I will open a ticket for unless you point me to some documentation that I can read: step 5 says "If you were using the live search indexing, uninstall its triggers as follows", it'd be great to have a command to run to see if we are using live indexing (helpful for people who are maintaining a system that someone else set up)
2022-05-30 15038, 2022
yvanzo
alastairp: Is MB search needed on wolf instance?
2022-05-30 15052, 2022
yvanzo
(including MB Search API)
2022-05-30 15002, 2022
alastairp
I'm 80% sure no, but I'm not sure if anyone else is using it
2022-05-30 15058, 2022
yvanzo
I may have enabled it for the purpose of schema change test.
> We also support important phone services such as dial-up, fax, ISDN, ADSL, and bulletin boards. If you’d like to bring along your modem and fax machine the CuTEL wiki page has the details.
2022-05-30 15005, 2022
alastairp
so yes, they have fibre to a field in the middle of nowhere. but you _can_ dial in to get online if you want
mayhem: That ^ reminds me that I installed a development version of SIR for VolumIO mirror, they should just use the current SIR instead now, but they probably figured that out already.
2022-05-30 15026, 2022
yvanzo
alastairp: to answere your initial question: The command "admin/configure show" will mention "live-indexing-search" if it is still on.
2022-05-30 15043, 2022
alastairp
yvanzo: ah right, I understand. so if admin/configure was used to create an indexer service, then it's in use
2022-05-30 15018, 2022
alastairp
I was concentrating too much on setup-amqp-triggers script to install/uninstall triggers rather than looking for the running service
