#metabrainz

so also need to think about how/when these access can be useful/

yes, this is why an external log server is useful because the logs can't be erased (hopefully)

right erasing is one part. but with root access, one could login just as the postgres user and the db access logs won't show anything.

right

but keep in mind that anything is better than nothing - we're still going in the right direction

will need to consider this thoroughly during logging review.

indeed

yup agreed

if we start thinking about what to log, and where to log it to

perfect is the enemy of good etc

not running services as root would be good

makes sense

(which is next on the list)

onto next?

yep

3. Log possible incidents irrespective of whether we determined a breached happened or not, probably in syswiki or docs?

syswiki makes sense

so if we patch a vulnerability, i think it might be a good idea to log it somewhere. if we later detect something unusual, it'll help. also better to keep track of all of this stuff.

yes I think so

syswiki sounds good. MB team already uses it for a few purposes.

It’s better than nothing to start with.

I think it's a good place to start, if it turns out not to be suitable then we can re-evaluate

sounds good

do we have anything else on this topic?

not freom me

Well, there’s also only 1 minute left, so…

so docker capabilities next time (meeting after schema change probably) ?

sounds like it

going back to zas' question, I think we should be aiming for our security baseline to be at a level that deters an unsophisticated attacker (e.g. pop shell and install cryptominer)

makes sense

sophisticated attackers need reasons to target you, and I'm not sure that MeB has many of those

Good reminder. :)

Quick last minute final topic: Next meeting

next Monday there will be a MB database schema change.

so no meeting.

Next meeting in 14 days. :)

And with that, thank you all for your time! Stay safe out there!

</BANG>

thanks all!

thanks

Thanks everyone!

Thanks !

yvanzo: are you still available for a bit to check and merge stuff?

monkey: re the start time column in the docker container table, I found a jquery timeago plugin which works quite nicely, have a look

Yep, I know the one

Should work fine

Yep, just looked again, that's great. Does it play well with datatables?

yes, the sorting still works

and I set the title attribute, so the date shows when you hover over it

👍

I think that's all the boxes ticked

zas: I have a small ruby app mostly implemented which will periodically login to a configured list of servers and retrieve the docker stats, then write the output to a file for use with datatables

once it's ready for consumption, we should discuss how to secure it sufficiently

I think a dedicated user with a locked down sudo configuration is the best option, but would be interested in your thoughts

reosarevok: I’m still testing #2496 atm.

then we need to secure the web page too

Perfect, thanks

reosarevok: On #2434, the conversations look OK but your review is still requesting changes.

Checking

yvanzo: yeah, all seems good by now

Needs rebasing, but :)

CatQuest: I forgot I promised a pic!

our beautiful rescue boy <3

Do you have cats perchance? Just a hunch that you might :D

lucifer: ooooooh, proper sir tests

:D

yvanzo: hi! i just saw https://github.com/metabrainz/docker-server-con... . this is creating issues while trying to start a container on gaga. one is named listenbrainz-mbid-mapping and other is named listenbrainz-mbid-mapping-writer-prod, if second is running the script refuses to start the first one. probably docker filter check needs to be refined.

i'll revert docker-server-configs locally for now on gaga to start the container

mayhem: ^ in case you need to restart the mapping containers

aerozol: aaawww nice doggo

yea, I had cats, but sadly they all passed away (most of them where old, but the last one was only 2 years odl and it broke my heart. I haven't got another after this :s)

what i doggos name?

is*

give them headpats from me <3

He is Bean!

Awww so heart breaking. I'm sure when you've had time to heal another cat will slink their way into your heart

He got an ear scratch from you just now

reosarevok: off for the day, will continue on tomorrow

lucifer: right, opened a PR

Perfect, thanks :)