Containers and Security: Seccomp


When working with potentially dangerous, unverified, or simply raw software, developers often use sandboxes. These are special environments that isolate or restrict programs and code from accessing data outside the environment. Sandboxes limit the software’s network access, OS interactions, and information from IO devices.

Lately, people have been turning more and more towards containers for launching unverified and non-secure software. Read more

Mining Cryptocurrency: An Updated Glance


Way back in 2013, we wrote an article on Habrahabr (Russian) about Bitcoin mining. The main idea was that there was little profit in mining due to the difficulty of the algorithms. Things haven’t changed much up to now, and the market has been overtaken by mining behemoths from China, who operate mining farms the size of aircraft hangars.

In this article, we’d like to retract our statement and say that, for the time being, mining can be and is in fact profitable. Read more

Managing the VPC with ansible-selvpc-modules


As we’ve mentioned in previous articles, the Selectel Virtual Private Cloud is built on the OpenStack platform.

A lot of our clients are already used to using Ansible, a configuration management system that lets you automate routine tasks. Among its other advantages, Ansible already has a wealth of ready-made modules available, including those for automating processes with OpenStack components (list of modules). Read more

Auditing System Events in Linux


Original publication date: September 22, 2015.

The audit subsystem is used to raise the level of security in Linux systems. Although it doesn’t offer additional security per se, it’s used to retrieve detailed information on system events. This provides detailed information on system violations, which can be used to implement additional targeted security measures. We’ll be taking a deeper look at the audit subsystem in this article. Read more

Security Monitoring with Sysdig Falco

In May 2016, the developers of Sysdig released Falco, a tool for detecting anomalous system behavior.

Falco consists of two main components: the sysdig_probe kernel module (which Sysdig also runs on) and the daemon for writing the information it collects to the disk.

Falco tracks applications according to user-defined rules, and if any anomalies are detected, it writes the information to a standard output, syslog, or user-defined file. in their blog, the developers jokingly call Falco “…a hybrid of snort, ossec and strace,” and position it as a simple IDS that puts almost no additional load on the system.

Read more