_jhqp

6 ms·

1.
by _jhqp 2y ago
> why the SQL API even allows injection vulnerability How would one implement this? "SQL APIs" use prepared statements. Meaning you have a string for SQL and some dynamic variables that inject into that string via $1, $2 etc. B
2.
by _jhqp 2y ago
Literally what PostgreSQL does. E.g. you can do manual selects from internal tables to see the same content as `\dt` command for example.
3.
by _jhqp 2y ago
Good point. Connecting to the Cluster is indeed actually a 4th layer. There you do need user with LOGIN, valid password & SSL.
4.
by _jhqp 2y ago
You can help out by posting answer / upvoting good answer.
5.
by _jhqp 2y ago
Then I would argue for trying to centrally ensure that all roles have INHERIT in your DBs. :thinking: Doing ALTER DEFAULT PRIVILEGES could be another future footgun of it's own.
6.
by _jhqp 2y ago
What do you mean exactly? If roles have INHERIT, then doing the following works, no? * Role A creates table * GRANT A TO B; * ROLE B can read from table just like A can. Also if Role A creates new table, Role B can read that too no?
7.
by _jhqp 2y ago
It's a bit confusing and legacy. All roles function like you would expect groups to function A role that is not allowed to login is a `group`. While the CREATE USER and CREATE GROUP commands still exist, they are simply aliases for CRE
8.
by _jhqp 2y ago
Everything in PostgreSQL is a role. It's just named such that when a ROLE allows `login` it's considered a user
9.
by _jhqp 2y ago
Here's your cookbook: https://stackoverflow.com/questions/78401179/how-do-postgres...
10.
by _jhqp 2y ago
I agree with the sentiment that IAM in PostgreSQL is complex. What makes it complex is that there are 3 layers of objects (Database, Schema, Tables) and also implicit grants given to DB object owners To be able to select from a table you ne
11.
by _jhqp 4y ago
> data is effectively modelled in a nosql style. What do you mean by this? Any references I could read?
12.
by _jhqp 5y ago
My take on this: https://akselallas.xyz/posts/russia-geopolitics/
13.
by _jhqp 5y ago
Thanks for the in-depth response!
14.
by _jhqp 5y ago
Incredible! :) What do you mean by hand-tuned Postgres & hand-tuned ZFS. What did you change and why?
15.
by _jhqp 5y ago
You are absolutely correct. I updated to not use GatewayPorts in v0.1.1 Thank you for the feedback! https://github.com/AkselAllas/airgapt/issues/1
16.
by _jhqp 5y ago
Though after looking into it more, it seems to me like bastions usually aren't used for reverse proxy / SOCKS like this. Usually bastions are just allowing one SSH server on your VPC/network and every SSH connection going thr
17.
by _jhqp 5y ago
Looks like :) https://github.com/ovh/the-bastion
18.
by _jhqp 5y ago
Good suggestion. Added it to the README as an optional addition.
19.
by _jhqp 5y ago
Agreed :) That's why I put it in "quotes" Can you propose an alternative / more accurate name?
20.
by _jhqp 5y ago
Exactly. These "trusted" machines still have security vulnerabilities that you would like to patch though :)
21.
by _jhqp 5y ago
I added MIT license now :)
22.
by _jhqp 5y ago
"Network access" as in outgoing requests to public web. e.g. you can't curl google.com I've used this code in CTF competitions and Blue Team exercises where some machines behind a VPN don't have outgoing network acc
23.
by _jhqp 5y ago
All comments & suggestions / code reviews are welcome!
24.
Show HN: Automatic proxy setup for SSH'able boxes that have no network access(github.com)
51 points by _jhqp 5y ago|32 comments