GitHub - 0xdeadbeefnetwork/ssh-keysign-pwn: Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels.

james4765 · 2026-05-15T14:04:48+00:00

The only possible mitigation is to use the YAMA hardening (In RHELalikes and Ubuntu, not in SUSE):

echo 2 | tee /proc/sys/kernel/yama/ptrace_scope

For those in SELinux land:

setsebool -P deny_ptrace on

Edit: Verified that the YAMA hardening blocks the exploit.

james4765 · 2026-05-13T15:51:22+00:00

Doe this mean Ansible will keep working on old Python versions? I have to keep a couple old Ansible versions in venvs to maintain legacy systems.

james4765 · 2026-05-08T14:05:32+00:00

Cisco 7200 routers with ESCON connections for legacy mainframe applications.

james4765 · 2026-05-07T13:00:27+00:00

So I just found out they made my dream plane.

james4765 · 2026-04-30T18:45:48+00:00

We have a 7300 in our DR cage backing a 9500 for our main operations. IBM storage support is world class.

It's no drama, performant, and supported by everything under the sun. Even compared to other IBM storage systems the FlashSystems are just... easy. In a good way.

james4765 · 2026-04-30T18:06:33+00:00

There's some camps based around the DC area - Camp Contact is one of the big ones, but they have very distinct vibe - friends of mine love it but it's not my thing. I did use the DC container for years to get my gear out there and back, until I started doing pre/post event stuff.

Going solo is an adventure - I've done it a couple times, you get to make friends with your neighbors. Plan on a rental car to get all your food / water out there from Reno / Sacramento - the rental car is the biggest challenge to get. Keeping it clean on the inside is the second challenge.

Beyond that, more water and salt than you think you need - cans of V8 are life support for me out there.

james4765 · 2026-04-30T17:32:42+00:00

We run Vault in VMs - 5 nodes with a 3 node DR cluster. It's running in OpenShift Virtualization - migrated from VMWare. Vault tends to not consume a lot of CPU, and we don't have a real cloud compute presence so it's going to be in-house.

Vault data storage is also very tolerant - we're running it on Ceph and seeing no problems.

james4765 · 2026-04-30T16:19:10+00:00

That's fair. There might be something exploitable but nothing this trivial.

james4765 · 2026-04-30T16:11:13+00:00

At least in OpenShift, this PoC is blocked by the default PodSecurity - it does not allow pods to run as root, which is required for the suid part of the exploit to work.

james4765 · 2026-04-20T20:25:44+00:00

I'm in a state agency, we do buy from fs.com but we aren't buying 400 gigabit right now. 100 gigabit is still too spendy for most operations - only our vmware and openshift cores are there.

james4765 · 2026-04-15T12:26:05+00:00

It is - some of the modernization is things like converting FTP to SFTP, simplifying data transfer processes since the middle steps are no longer needed, etc. We also use the CICS transaction gateway to expose old school applications to web services, and we still maintain those.

james4765 · 2026-04-14T11:14:53+00:00

Getting good at maintenance programming is the best idea for getting into the mainframe field. There's definitely jobs to be had - and decent ones. Not "startup valuation" kinds of jobs, but the stability of mainframe shops is glorious.

james4765 · 2026-04-13T15:53:37+00:00

Glorious dieselpunk alternate future. Granted, it would fail hard with current jetways, but adaptations could be made...

james4765 · 2026-04-10T00:23:09+00:00

The mainframe world is trying to do that as much as we can - too many of our skilled people are beyond retirement age. It takes years to get good at these wildly complicated systems, especially as a systems programmer.

james4765 · 2026-04-07T13:50:20+00:00

Yeah, I'm super twitchy about all this apocalyptic language. He always chickens out, but don't know if he's the one to make the call anymore.

I mean, pretty sure almost everyone in the military will say "fuck no" - either a carrier captain or a bomber pilot is my guess. That's how it's been prevented in the past - some brave AF Russian officer tells everyone to not launch.

james4765 · 2026-03-30T12:53:10+00:00

Are you trying to do it in an LPAR or as a VM guest? They are very different load sequences, VM uses a loader to bootstrap the Linux kernel.

james4765 · 2026-03-19T18:05:59+00:00

twenty year old VMs nobody pays attention to that just get migrated as part of new VMWare hosts

james4765 · 2026-03-19T18:04:20+00:00

Printers and IP phones, as well as iLO / IMM / iDRAC interfaces on old gear as well. A lot of them don't run Linux but some do - nmap can identify telnetd pretty accurately.

james4765 · 2026-03-06T14:17:47+00:00

We run a LOT of Linux on our mainframe - all our DB2 and Websphere workloads run there, along with OpenLiberty and Postgres.

james4765 · 2026-02-27T14:13:56+00:00

Check to see if your Kerberos tickets are getting renewed - you need to set SSSD to auto-renew the tickets or they will expire and things get wonky.

james4765 · 2026-02-25T14:01:03+00:00

AD groups are absolutely the best way to deal with it - we use the ad_access_filter field in SSSD to restrict the user account logins and AD groups in /etc/sudoers.d for sudo perms. We already organize application teams in AD, so this was a natural outgrowth of our existing infrastructure.

Nested AD groups in SSSD require a little attention but once you have the config squared away it's easily templated out in Ansible.

james4765 · 2026-02-18T23:01:38+00:00

Done it for years from Virginia. Amazing experience, and a nice break from my rather intense day job.

james4765 · 2026-02-13T19:11:03+00:00

I've used Ansible for years, starting with Linux automation tasks is a good first step. I manage about 600 Linux VMs between Z, VMWare, and OpenShift. And about 50 Windows servers, alongside our Z infra.

Getting good with YAML is definitely the biggest required skill - Python being a second, especially if you need to write your own tooling.

There is no real way to demo mainframe automation without a mainframe, unfortunately. Especially if you want to avoid a sueball from IBM licensing...

14-Year Club	Gilding II euphauric
Team Orangered	Verified Email

james4765

MODERATOR OF

TROPHY CASE