Ramblings of a Unix Geek

I've been doing this for a long time... I ramble!

When MFA isn't necessarily strong

Every day we hear of yet another data breach. One common reason is because of password compromise. The problem may be because of successfully phishing; it may be due to password re-use; it may be due to brute force attacks; it may just be weak passwords. So it is now considered best practice to use some form of Multi Factor Authentication. To quickly summarise, MFA is 2-or-more of the following factors:

Adding some smarts to a dumb aircon

I have a Friedrich aircon. It’s of the old school. The only intelligent part of it is “eco” mode (turn off the fan when the temperature is cold enough) and a simple timer (“turn on in 9 hours time”). It’s this timer that annoys me; you have to set it every day. A number of days I would go to work, forgetting to set it, and come home to a house in the mid-90F.

Extending automation to the garage

My garage door is controlled my a Lynx 455 Plus garage opener This is a pretty traditional opener; a door-bell type button inside the garage to open/close the door and a remote control for wireless access. I wanted to see if I could make this smart-enabled. Now the control side is simple enough; just put a relay in parallel to the button. If the relay closes then the opener will think the button has been pressed.

Slowly making my home smart

This post isn’t in my normal theme. I’m gonna describe how I made my home smart. Well, semi-smart. Over the past couple of years I’ve slowly been making my house lights be smart. In many places I’ve used Hue White Bulbs. They’re frequently on sale and can be got for around $10/bulb, which isn’t bad. With the hub they can be controlled by Alexa, or locally by using the API exposed on the hub.

Emulating a Philips Hue light

Over the past couple of years I’ve been building out an Alexa skill for my media center. So now I can say things like “Alexa, tell media to play music”. That will turn my receiver on, switch it to the Mac input, and start iTunes playing. Similarly “Alexa, tell media to switch to TiVo”, “Alexa tell media to pause”. The backend code running on the Mac asks the receiver what input is selected (TiVo, Mac, BluRay…) and if on the Mac it works out what application has focus (iTunes, DVD Player, Kodi, …) so when a command such as “pause” is received then it knows how to send the appropriate action.

Career advice

I get email… What are your thoughts about making a career out of specialising in Unix? It seems like you’ve done quite well… Interesting question… Realise that I started doing this 30 years ago. At that time there was no Windows (Windows 1.0 was around the corner). We had DOS. Networking was mostly serial based; if you were (un)lucky you might have had Banyon Vines or Novell or some other proprietary network stack.

When Development is Production

It’s an article of faith that the development process starts in the part of the network set aside for development work. Then the code may go to the QA area for QA testing, UAT area for UAT, production area for production. That statement almost looks like a truism; development work is done in DEV. So a corporate network may be divided along dev/uat/prod lines, with firewalls between them so that development code can’t impact production services.

Privilege Escalation in Unix

In a well controlled environment you typically do not want people logging into servers with privileged access (absent of additional external processes, such as a keystroke logged session manager). If you have 5 SAs all logging in as root then how can you audit activity and determine if it was Tom, Dick or Harry that rebooted the server? Similarly you don’t want DBAs directly logging in as oracle; how do you know who dropped the production table?

What I did on my weekend

Every so often I get asked to do something that’s not related to my employer, or is stuff that results from my activities for my employer. Frequently this is some form of informal consulting/discussion. There was the cloud expo presentation. I’ve been on a couple of “Customer Advisory Boards” because of my container opinions (I have opinions; sometimes people want to listen to them). This time I was asked to look at a mobile email configuration.

DevOps and Separation of Duties

Reducing the number of personnel with access to the production environment and cardholder data minimizes risk and helps ensure that access is limited to those individuals with a business need to know. The intent of this requirement is to separate development and test functions from production functions. For example, a developer may use an administrator-level account with elevated privileges in the development environment, and have a separate account with user-level access to the production environment.