russjones
Joined 13 years ago
Karma
199
Submissions
45
Member since
Jul 26
Recent submissions
Comment · 1 year ago
Comment · 1 year ago
Teleport (YC S15) | Backend and Fullstack Engineers | US, Toronto, London, Remote OK | https://goteleport.com
Do you enjoy building security and deployment tools for other engineers? Join us to hack on https://github.com/gravitational/teleport. Most of our code is Go, we have very little technical debt, our codebase is clean and small.
If you are a backend or fullstack engineer, we expect you to be comfortable with the following:
* Go for backend and Go+TypeScript for fullstack engineers.
* Linux, networking, and security.
* Scalability and/or security experience for systems software is welcome.
We offer:
* Competitive salary and equity.
* 401k with company match.
* Excellent health insurance.
What to expect once you apply:
* You will join a 30 minute intro call and we will walk you through compensation, the interview process, and requirements.
* You join a private Slack channel and submit a coding challenge in Go (backend) or Go+TypeScript (fullstack) depending on the position using Github.Comment · 6 years ago
You only need a browser if you are using SSO. If you are using local accounts it's all done in the CLI.
Comment · 6 years ago
Hi scarygliders,
That's a good question and valid skepticism. The UI serves two purposes.
The first is to manage your cluster. For example, you may want to change a users role (to change what servers they can access) or play back a session recording to see what a user did within a session. You can do all of these things from the CLI, but sometimes you don't want to remember the exact command and flags, that's where the UI comes in.
The second is to have access to servers from an environment that either does not have robust SSH support, doesn't allow you to install software, or maybe an environment (temporary) into which you don't want to install software. For example, when the UI was first written Windows did not have great support for SSH certificates, but the UI would allow Windows users to access Teleport clusters.
Lastly, the UI is completely optional, in addition even the CLI tool is (almost) optional. Once you've fetched your certificate, you can use your OpenSSH client as normal. In-fact a lot of people use Teleport this way.
Disclaimer: I work at Gravitational.
Comment · 6 years ago
We're trying to raise structured behavioral information about what is happening in a session to the cluster administrator.
That means we don't just provide information about what's executing, but also what files are being opened and TCP connections being established. Other avenues of expansion you may see this feature venture into: how were files changed, support for other protocols, support for other events (bind, listen, accept).
However we are not claiming this approach is not subvertable, but we do want to raise the bar for attackers and make it easier for cluster administrators to understand what is happening within their system.
Comment · 6 years ago
Thank you Abe! The kind comments are appreciated!
So far we have gotten positive feedback. While this feature does not protect against root doing something malicious, it does allow admins to capture what root was doing up until they did something malicious and link that information to an identity (if using SSO).
Along with this feature we rolled out a Workflow API [1] that can be used to request role elevation. Once you add in session termination (which we are aiming for in the next release), you will have a powerful set of features that will allow you to start users out with limited access to your cluster with the ability to request more privileges and potentially automatically termination your session (and user) if you're found to be doing some malicious.
Comment · 6 years ago
Understandable confusion, I've seen it referred to both ways. We decided to go with BPF for this blog post since that appears to be the official abbreviation.
From "BPF Performance Tools" by Brendan Gregg:
"Extended BPF is often abbreviated as eBPF, but the official abbreviation is still BPF, without the "e," so throughout this book I use BPF to refer to extended BPF. The kernel contains only one execution engine, BPF (extended BPF), which runs both extended BPF and "classic" BPF programs."
Comment · 6 years ago
Author of the post here, happy to answer any questions.
Comment · 7 years ago
Noted.
Comment · 7 years ago
I ran an eBPF program called opensnoop [1] to capture what files were opened during login to a system and then re-launching bash. Looks like both are read during initial login but only .bashrc for non-login shells. Output is below.
24435 bash 3 0 /etc/profile
24435 bash 3 0 /etc/profile.d/
24435 bash 3 0 /etc/profile.d/256term.sh
24435 bash 3 0 /etc/profile.d/colorgrep.sh
24435 bash 3 0 /etc/profile.d/colorls.sh
24435 bash 3 0 /etc/profile.d/lang.sh
24435 bash 3 0 /etc/profile.d/less.sh
24435 bash 3 0 /etc/profile.d/which2.sh
24435 bash 3 0 /etc/profile.d/sh.local
24435 bash 3 0 /home/centos/.bash_profile
24435 bash 3 0 /home/centos/.bashrc
24435 bash 3 0 /etc/bashrc
24736 bash 3 0 /home/centos/.bashrc
24736 bash 3 0 /etc/bashrc
24736 bash 3 0 /etc/profile.d/
24736 bash 3 0 /etc/profile.d/256term.sh
24736 bash 3 0 /etc/profile.d/colorgrep.sh
24736 bash 3 0 /etc/profile.d/colorls.sh
24736 bash 3 0 /etc/profile.d/lang.sh
24736 bash 3 0 /etc/profile.d/less.sh
24736 bash 3 0 /etc/profile.d/which2.sh
Comment · 7 years ago
Maybe I did not provide the best example, but the point I was driving at is that the restrictions here are at the application level and not at the system level.
If you take the approach you are taking, similar to ForceCommand, you have to make sure none of the commands in your PATH allow code execution. For example git, vim, less, awk, and find, all of which I use on a daily basis, can all be used to re-launch a restriction free bash.
Once you remove all the commands you have to, how much of a shell do you have left?
Do you enjoy building security and deployment tools for other engineers? Join us to hack on https://github.com/gravitational/teleport. Most of our code is Go, we have very little technical debt, our codebase is clean and small.
If you are a backend or fullstack engineer, we expect you to be comfortable with the following:
We're looking for senior engineers to join the Teleport team. Teleport is a company started by engineers to build products for engineers. We are a stable and growing company.We offer:
Apply: https://jobs.lever.co/teleportWhat to expect once you apply: