Post by @stefano@mastodon.bsd.cafe

Ok, looks like this is the week of funny experiences.

Customer: "I had an AI check our server and it says the SSH port is open and that's not very secure."

Me: "Yes, you asked us to open it so you could access the server via SFTP (actually, you wanted FTP, but we discussed it a bit and found this compromise). Don't worry, it's only accessible from your IP and you land in a dedicated FreeBSD jail. From there, you can only access the 'exchange' directory on your server, where you can upload and download files without affecting the application."

(NB: I had suggested a VPN, but they declined because it was too complicated.)

Customer: "Yes, but maybe it's still insecure. Can't we close it?"

Me: "No, unless you want to lose access to that directory."

Customer: "Ok, thanks."

One hour later:

Customer: "Hi, I think we've found a solution. We've just created an app (!!!) with AI that lets us access the files anyway, but more securely than SSH (!!!). Can we install that and close SSH? Oh, and not in the dedicated jail, but directly in the application's jail, because it needs access to the application's files."

Me: "Frankly, I trust SSH in a dedicated jail, restricted by the firewall, a lot more. I don't think this is a good idea."

Customer: "Ok, thanks."

Half an hour later:

Customer: "Ok, now it's secure. I had another AI check it and it found some security issues, but it fixed them all. Can you install it and disable SSH?"

Me: "I strongly advise against it. I can see problems coming."

Customer: "Ok, thanks."

One hour later, my phone rings.

Their internal IT guy (who has access to the machine, which, after all, belongs to them) had given the AI the login credentials to go ahead with the operation.

Except the AI had managed to lock itself out via the firewall, without even starting the app. And now they couldn't get back in.

Fortunately, I had my own access, via VPN, to a separate jail that the AI hadn't touched (or even considered).

Customer: "SORRYSORRYSORRYSORRYSORRY! From now on, we do things your way."

Well, at least it ended well.

PS: The customer knows I'm sharing this story and agreed to it.

#IT #SysAdmin

@stefano Oooohhhh man, don't get me started. That's the kind of crap that pisses me of to no end! ​

We've been doing these things for years and have years of expertise to know what's secure and what's not. Trust us when we tell you that something like SSH is secure, especially when it's already been hardened and tested in specific cases like this.

Your customer might be reading this, but I have no qualm in stating how disrespectful that is to you and the expertise you have which has been tested, especially proven in that talk you gave at EuroBSDcon about those 142 servers.

Maybe they should take the time this Friday to watch it, so as not to doubt you again.

https://events.eurobsdcon.org/2026/talk/KAEQA8/