Post by @stefano@mastodon.bsd.cafe
Ok, looks like this is the week of funny experiences.
Customer: "I had an AI check our server and it says the SSH port is open and that's not very secure."
Me: "Yes, you asked us to open it so you could access the server via SFTP (actually, you wanted FTP, but we discussed it a bit and found this compromise). Don't worry, it's only accessible from your IP and you land in a dedicated FreeBSD jail. From there, you can only access the 'exchange' directory on your server, where you can upload and download files without affecting the application."
(NB: I had suggested a VPN, but they declined because it was too complicated.)
Customer: "Yes, but maybe it's still insecure. Can't we close it?"
Me: "No, unless you want to lose access to that directory."
Customer: "Ok, thanks."
One hour later:
Customer: "Hi, I think we've found a solution. We've just created an app (!!!) with AI that lets us access the files anyway, but more securely than SSH (!!!). Can we install that and close SSH? Oh, and not in the dedicated jail, but directly in the application's jail, because it needs access to the application's files."
Me: "Frankly, I trust SSH in a dedicated jail, restricted by the firewall, a lot more. I don't think this is a good idea."
Customer: "Ok, thanks."
Half an hour later:
Customer: "Ok, now it's secure. I had another AI check it and it found some security issues, but it fixed them all. Can you install it and disable SSH?"
Me: "I strongly advise against it. I can see problems coming."
Customer: "Ok, thanks."
One hour later, my phone rings.
Their internal IT guy (who has access to the machine, which, after all, belongs to them) had given the AI the login credentials to go ahead with the operation.
Except the AI had managed to lock itself out via the firewall, without even starting the app. And now they couldn't get back in.
Fortunately, I had my own access, via VPN, to a separate jail that the AI hadn't touched (or even considered).
Customer: "SORRYSORRYSORRYSORRYSORRY! From now on, we do things your way."
Well, at least it ended well.
PS: The customer knows I'm sharing this story and agreed to it.
@stefano I can only imagine.
« May I share this user experience within our network on the fediverse in order to improve our response accuracy to customers and people around the world ? »
Customer is heard typing and mumbling "Is it good to share what you just did to my remote machine ?"
AI says "Most definitely ! A user experience as good as this one can only improve global security ! Do you want to know more about cybersecurity ?"
Customer: « Most definitely ! »
And a toot was posted.
@eidolies 😆
The truth is: the customer said "now go and publish this on your Cafe".
"Hey, I'm quite sure many others will read it"
He, smiling: "Sure, we deserve it".
And I'm sure he's reading the entire thread, as I sent the link 😉
@stefano@bsd.cafe ooh! In that case... Hello Stefano's customer!
We all here consider Stefano one of the nicest and most trust worthy people on the internet!
He's worth listening to, that is for certain!