←back to thread

466 points CoolCold | 2 comments | | HN request time: 0.53s | source
Show context
airocker ◴[] No.40215819[source]
I have seldom come across unix multiuser environments getting used anymore for servers. Its generally just one user on one physical machine now a days. I understand run0's promise is still useful but i would really like to see the whole unix permission system simplified for just one user who has sudo access.
replies(17): >>40215898 #>>40216049 #>>40216052 #>>40216221 #>>40216591 #>>40216746 #>>40216794 #>>40216847 #>>40217413 #>>40217462 #>>40218411 #>>40219644 #>>40219888 #>>40220264 #>>40221109 #>>40223012 #>>40225619 #
berkes ◴[] No.40216746[source]
I always still split up "sysadmin" from "deploy".

Ephemeral setups (amongst which k8s) remove that need but introduce a big load of other stuff.

Having a VPS that is managed by sysadmins (users with sudo rights, authed with keys) and on which partly overlapping "deploy" users can write to small parts and maybe do a passwordless "sudo sysctl restart fooapp" but only that, is a nice and simple setup.

I manage at least seven of these. And nothing in me even considers porting this to my k8s infra.

Edit: The reason for this setup is simple and twofold: deploy is safe and clear: deployers can be confident that whatever crap they pull, the server will churn on, data will be safe, recovery is possible. And all devs/ops having their own keys and accts gives a trail, logs and makes it very easy to remove that contractor after she did her work.

replies(2): >>40217436 #>>40219921 #
theteapot ◴[] No.40217436[source]
I think you mean systemctl.
replies(1): >>40218207 #
8372049 ◴[] No.40218207[source]
He probably meant sysadmin as in the account with sudo access.
replies(1): >>40219349 #
1. BenjiWiebe ◴[] No.40219349[source]
s/sysctl/systemctl/
replies(1): >>40220304 #
2. berkes ◴[] No.40220304[source]
Correct. Typed it on mobile.