Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I hacked our development machines using a rooted rpm, we only had access to the sudo rpm command so I decided to deploy our rails app using capistrano. to work around the sudo rpm only access I decided to add some install scripts to the rpm because these run as root. This allowed me to re-configure sshd making it possible to do a local capistrano deploy. I was smart about it by reverting the ssh changes back after the deploy completed - bash has a kind of ensure that allows you to roll things back like a transaction. The cool thing about the whole thing was that our ops team was on the ball and detected the changes to the sshd configuration even though I restored them. Mind you this was all in a staging development environment. The issue was just how immature it was of me to go this far to cap deploy instead of rpm install our rails app. For me, I looked at it then like a good learning experience in hacking rpms and in security. When you run sudo rpm -Uhv package.rpm - you better trust package.rpm it can execute any shell scripts it wants as root. Also, in the future I would walk away from a company like this much sooner. I enjoyed everyone there I worked with and would work with any of them again, but just would not want to work in such a stress filled environment for so long again.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: