Hacker News new | past | comments | ask | show | jobs | submit | linuxsec's comments login

Objectives of this series of articles:

- Save up to 90% disk space based on VRR (Variable Replication factor and Retention) estimations by playing with replication, retention and custom classification. Differentiate important from redundant information and apply different policies to them.

- Log useful information for once, that you will be able to filter, query, plot and alert on. We are covering parameters, structured arguments, and how to avoid grok to parse them.

- Save tons of OPS time by using the right tools to empower DEVs to be responsible of their logs. Let's avoid bothering our heroes with each change in a log line. Minimizing OPS time is paramount.


I see what you're doing here.. and I like this: https://looking4q.blogspot.com/2019/01/level-up-logs-and-elk...


yeah!


Looking for details..


haven't contacted the author but he describes his supposed route. I'm trying to replicate his results and there is indeed a possible integer overflow condition but I'd be doubtful of reports of successful exploitation with systems linked with a newer version of glibc w/ heap consistency checking, stackguard &/| aslr.

http://lxr.evanmiller.org/http/source/core/ngx_log.h#L120 contains a few functions (2, 5 I've found so far) that write data in a (at a quick glance) safe fashion, I guess you might be able to give someone wierd logfiles.

I've been over every file that referenced by ngx_http_request_t http://lxr.evanmiller.org/http/ident?i=ngx_http_request_t looking for buffers, directly or indirectly using a value derived from a ngx_http_request->count (not -> main -> count), and although the bug condition he describes is possibly real, I'd love to see an RCE proof of concept from the author.


MM, I'm not sure if this is real or not... Need more info


Nice post dudes!


"Apache is awesome, but I run nginx on my own EC2 micro instance. It's less hassle."

...enough said!


Nginx rulez... end of story!


Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: