• 0 Posts
  • 1.06K Comments
Joined 2 years ago
cake
Cake day: July 2nd, 2023

help-circle






  • foggy@lemmy.worldtoSelfhosted@lemmy.worldAutograding tool
    link
    fedilink
    English
    arrow-up
    3
    ·
    edit-2
    3 days ago

    I mean just for the love of God don’t spin up something on your company’s infrastructure that accepts file uploads.

    Just don’t.

    If you’re reading this and going “well, it’s just internal,” or “well, it doesn’t do much it just accepts this exact file type.” My god. Ask your CISA. And if they’re okay with it, cool. That’s on them.

    Unless your whole business is transferring files, don’t. And even then… Don’t.

    And if you’re still confused, the answer is to use another company’s infrastructure for this. Use Azure. Use AWS. Use Google cloud or even g suites. Don’t accept that liability. Let the trillionaires do it.





  • foggy@lemmy.worldtoSelfhosted@lemmy.worldAutograding tool
    link
    fedilink
    English
    arrow-up
    16
    arrow-down
    2
    ·
    edit-2
    4 days ago

    Why give your students a way to get RCE on your institutions servers through anything less than perfect file upload implementation.

    For a .tar? I wish you the best…

    Instead of that, simplify.

    Use unique salts for each assignment per student.

    Align hashes with those salts to check the outcome for each students assignment.

    Literally have them send you a CTF style sha256 string.

    Do it step by step where each step doesn’t depend on the next, grade as a percentage of flags accurately procured.








  • For getting your stuff available over the internet, y I recommend a secure tunnel with wire guard between your vps and servers running the services.

    Make your vps an authentication portal using stuff like Authelia and Fail2ban.

    If you’re really needing out, get ELK stood up for free and get agents on your containers/services to keep visibility into any potential… Anything