Hi,
so as I said in the meeting earlier toda^w yesterday, we (or rather Jason) did copy the prod instance to a staging instance on https://fedoramagstg.wpengine.com/
However, it seems we can't add a vhost for that instance, which is less than ideal, as I need now to change the name everywhere.
So, while doing so, I also had a few questions:
- as staging tend to be forgotten, would it be ok to password protect the website so it can be safely protected from worm until we need it ?
If so, where should it be stored, the goal being just to avoid automated scanning (so I was think some easy passwords in the doc, since the goal is just to prevent potential automated attacks) ?
- how up to date do we want it to be regarding posts, etc ? (I think we can't do a regular automated sync easily, so if that's needed, I will have to find some way to automate that)
- do we want to have it plugged to the prod instance of FAS or the staging one ? (for now, that's the staging one)
Off the top of my head...
On Thu, Sep 5, 2019 at 7:43 AM Michael Scherer mscherer@redhat.com wrote:
Hi,
so as I said in the meeting earlier toda^w yesterday, we (or rather Jason) did copy the prod instance to a staging instance on https://fedoramagstg.wpengine.com/
However, it seems we can't add a vhost for that instance, which is less than ideal, as I need now to change the name everywhere.
So, while doing so, I also had a few questions:
- as staging tend to be forgotten, would it be ok to password protect
the website so it can be safely protected from worm until we need it ?
Yes.
If so, where should it be stored, the goal being just to avoid automated scanning (so I was think some easy passwords in the doc, since the goal is just to prevent potential automated attacks) ?
Not sure what you mean here -- you mean put the passwords in a doc somewhere?
- how up to date do we want it to be regarding posts, etc ?
(I think we can't do a regular automated sync easily, so if that's needed, I will have to find some way to automate that)
Doesn't need to be sync'd all the time. If the current content is needed we can always ask.
- do we want to have it plugged to the prod instance of FAS or the
staging one ? (for now, that's the staging one)
Staging seems right to me.
Le jeudi 05 septembre 2019 à 08:09 -0400, Paul Frields a écrit :
Off the top of my head...
On Thu, Sep 5, 2019 at 7:43 AM Michael Scherer mscherer@redhat.com wrote:
Hi,
so as I said in the meeting earlier toda^w yesterday, we (or rather Jason) did copy the prod instance to a staging instance on https://fedoramagstg.wpengine.com/
However, it seems we can't add a vhost for that instance, which is less than ideal, as I need now to change the name everywhere.
So, while doing so, I also had a few questions:
- as staging tend to be forgotten, would it be ok to password
protect the website so it can be safely protected from worm until we need it ?
Yes.
If so, where should it be stored, the goal being just to avoid automated scanning (so I was think some easy passwords in the doc, since the goal is just to prevent potential automated attacks) ?
Not sure what you mean here -- you mean put the passwords in a doc somewhere?
Yup, I know that best practice is to encrypt etc, but there is a administrative cost in doing so if there is no infra to store such passwords safely, so I would just propose to add that in the public documentation, and say "the staging instance is protected from automated scanner with "foo"/"password"".
That's slightly less worst than having it directly exposed, but I am not sure there is anything interesting in the first place. The posts are public, there will be no web exposure (or any win in SEO or malware distribution) after a compromise (due to password protection).
Worst case in case of compromise is that someone would just get a few emails, and I am not sure they can't be already harvested somewhere else in FAS anyway.
- how up to date do we want it to be regarding posts, etc ?
(I think we can't do a regular automated sync easily, so if that's needed, I will have to find some way to automate that)
Doesn't need to be sync'd all the time. If the current content is needed we can always ask.
- do we want to have it plugged to the prod instance of FAS or the
staging one ? (for now, that's the staging one)
Staging seems right to me.
Ok, we need to keep that in mind if we sync again, this will be erased/forgotten.
I will take care of that next week.
On Fri, Sep 6, 2019 at 7:58 AM Michael Scherer mscherer@redhat.com wrote:
Le jeudi 05 septembre 2019 à 08:09 -0400, Paul Frields a écrit :
Off the top of my head...
On Thu, Sep 5, 2019 at 7:43 AM Michael Scherer mscherer@redhat.com wrote:
If so, where should it be stored, the goal being just to avoid automated scanning (so I was think some easy passwords in the doc, since the goal is just to prevent potential automated attacks) ?
Not sure what you mean here -- you mean put the passwords in a doc somewhere?
Yup, I know that best practice is to encrypt etc, but there is a administrative cost in doing so if there is no infra to store such passwords safely, so I would just propose to add that in the public documentation, and say "the staging instance is protected from automated scanner with "foo"/"password"".
That's slightly less worst than having it directly exposed, but I am not sure there is anything interesting in the first place. The posts are public, there will be no web exposure (or any win in SEO or malware distribution) after a compromise (due to password protection).
Worst case in case of compromise is that someone would just get a few emails, and I am not sure they can't be already harvested somewhere else in FAS anyway.
Given the whole shebang is no longer on Fedora-run infrastructure, this sounds like an OK option to me.
- how up to date do we want it to be regarding posts, etc ?
(I think we can't do a regular automated sync easily, so if that's needed, I will have to find some way to automate that)
Doesn't need to be sync'd all the time. If the current content is needed we can always ask.
- do we want to have it plugged to the prod instance of FAS or the
staging one ? (for now, that's the staging one)
Staging seems right to me.
Ok, we need to keep that in mind if we sync again, this will be erased/forgotten.
I will take care of that next week.
Is there any risk to FAS if someone gains access to the staging server? My bet is not (only exposes an ability to federate ID) but if so, that would be one less thing to worry about. We could use production in that case.
Le vendredi 06 septembre 2019 à 08:15 -0400, Paul Frields a écrit :
On Fri, Sep 6, 2019 at 7:58 AM Michael Scherer mscherer@redhat.com wrote:
Le jeudi 05 septembre 2019 à 08:09 -0400, Paul Frields a écrit :
Off the top of my head...
On Thu, Sep 5, 2019 at 7:43 AM Michael Scherer < mscherer@redhat.com> wrote:
- how up to date do we want it to be regarding posts, etc ?
(I think we can't do a regular automated sync easily, so if that's needed, I will have to find some way to automate that)
Doesn't need to be sync'd all the time. If the current content is needed we can always ask.
- do we want to have it plugged to the prod instance of FAS or
the staging one ? (for now, that's the staging one)
Staging seems right to me.
Ok, we need to keep that in mind if we sync again, this will be erased/forgotten.
I will take care of that next week.
Is there any risk to FAS if someone gains access to the staging server? My bet is not (only exposes an ability to federate ID) but if so, that would be one less thing to worry about. We could use production in that case.
That is a good point, I would say "no" for openid, but I didn't look in details. I can't even find the git repo for the automated login plugin (who just insert a js script for that), so I will likely have to do touch to the code myself.
Worst possible attack I can think of would be if a cunning attacker simply replace the remote server in that plugin code, redirecting people for phising credentials on a fake FAS server. I do assume that most people wouldn't check the URL or anything.
But this is quite convoluted, nor something we can fix on wp side.
On Thu, Sep 5, 2019 at 4:44 AM Michael Scherer mscherer@redhat.com wrote:
Hi,
so as I said in the meeting earlier toda^w yesterday, we (or rather Jason) did copy the prod instance to a staging instance on https://fedoramagstg.wpengine.com/
However, it seems we can't add a vhost for that instance, which is less than ideal, as I need now to change the name everywhere.
So, while doing so, I also had a few questions:
- as staging tend to be forgotten, would it be ok to password protect
the website so it can be safely protected from worm until we need it ?
We could probably restrict access to people w/ accounts in the instance, they'd use their fas creds to access it.
If so, where should it be stored, the goal being just to avoid automated scanning (so I was think some easy passwords in the doc, since the goal is just to prevent potential automated attacks) ?
- how up to date do we want it to be regarding posts, etc ?
(I think we can't do a regular automated sync easily, so if that's needed, I will have to find some way to automate that)
- do we want to have it plugged to the prod instance of FAS or the
staging one ? (for now, that's the staging one)
-- Michael Scherer / He/Il/Er/Él Sysadmin, Community Infrastructure
Fedora Magazine mailing list -- magazine@lists.fedoraproject.org To unsubscribe send an email to magazine-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/magazine@lists.fedoraproject.o...
Le vendredi 06 septembre 2019 à 08:14 -0700, Jason Brooks a écrit :
On Thu, Sep 5, 2019 at 4:44 AM Michael Scherer mscherer@redhat.com wrote:
Hi,
so as I said in the meeting earlier toda^w yesterday, we (or rather Jason) did copy the prod instance to a staging instance on https://fedoramagstg.wpengine.com/
However, it seems we can't add a vhost for that instance, which is less than ideal, as I need now to change the name everywhere.
So, while doing so, I also had a few questions:
- as staging tend to be forgotten, would it be ok to password
protect the website so it can be safely protected from worm until we need it ?
We could probably restrict access to people w/ accounts in the instance, they'd use their fas creds to access it.
Mhh, that could be a good additional layer, yup, but then that's also one that would requires some fiddling with config, which may drift when we sync again.
magazine@lists.fedoraproject.org
-
Jason Brooks -
Michael Scherer -
Paul Frields