You can avoid this issue through significant domain experience. Knowledge != smart. I find your assertions regarding assurance and networked computing disturbingly naive. If this 'fix' was simply altruism and a crying need it would be apparent to more of an audience than Google. This seems more like sheeps clothing and misdirection from Google - as usual.
Another product stream and company (and hype) I was never a fan of. Best thing they did was to rip off FreeBSD and the worst was break *nix compliant userspace + influence design UX and UI patterns for a new generation.
Seemed lackluster to me. Adding code in a literally defined data structure failed to complete anything.
with open() as f:
ll = [f.(no help from here on out)]
Who says the struct has no other value? An ADT is the only place this approach makes any sense and these are not typically comprised of two values/references alone.
A interface devised just to unwind information from
a two member struct is beyond 'cumbersome'.
I do exactly this. Granted I only have 50 chassis to deal with and can emergency boot to rescue via PXE. After 1st generation ILO and the enforced insecurity of vendor KVM options I saw the light.
Or someone can simply own your key holding device as you sip your beverage at the local hotspot or home wifi. Simpler to
go after the secret privileged client than the server.
So standardize on a non-standard port, document it and when you do have ssh probes assume it's targeted rather than just another l33t child running du-jour crack(x).
Moving to non-standard means more sophisticated discovery
and possibly a more sophisticated attempt.
You control what fail2ban does with said log data and what actually gets logged.
There are better ways than fail2ban of course but it's not the worst solution on the planet.
Interesting you bring this up.
Regardless of the provenance of packages and facility for installation you seem to be hinting that there should be a
method to install specific service/feature sets to a system
securely and without systems access.
I designed such a system which runs with appropriate permissions to a task, is modular, and accomplishes the provisioning via 'job' files submitted to a service
endpoint. A user could describe the software they want installed. The SA performs due diligence on vetting software
and designs a standard install module then generates a skeleton jobfile and provides it to the requesting user to fill in necessary details and submit. Wash , rinse, repeat.
Sure, especially when you VPN into a sacrificial subnet and need MFA to continue elsewhere into locked down application domains. OTOH I would leave ssh listening on a non-descript high port with MFA (key and OTP) enabled. No use worrying too much about that.
It's probably not safe to fork() from most frameworks threads (OpenMP) and is hard to make safe for complicated parallel processing. But if you control the flow of execution and minimize mutex and critical section(s) it can be done withal. Several examples of thread served queues performing user defined actions upon message receipt
to include fork() + exec() come to mind.
You cannot serve the whole internet without cloud scale resources anyway. So what does it matter if your
application is 10K/s less capable than an optimized
version? You pay for another instance. For 5k more time and energy yearly you save .026 an hour. Congrats.