search

ibm-cloud-docs / monitoring

Documentation repository for monitoring
1 stars 11 forks source link

`curl | sudo bash` in examples #6

Closed inahga closed 3 years ago

inahga commented 3 years ago

We noticed in these docs that it's suggested to use the curl | sudo bash pattern to install the sysdig agent.

The exact command:

curl -sL https://ibm.biz/install-sysdig-agent | sudo bash -s -- --access_key ACCESS_KEY --collector COLLECTOR_ENDPOINT --collector_port 6443 --secure false --tags TAG_DATA --additional_conf 'sysdig_capture_enabled: false'

This pattern is risky since it's executing an arbitrary shell script as root on the target machine, so its use should be discouraged. This pattern was the vector for the recent codecov attacks. This script seems especially risky since it's on an AWS S3 bucket, which I assume is totally out of IBM control.

I noticed the script does install an apt repository, so I suggest those sections to be rewritten to suggest installing the sysdig apt repository and writing a configuration file.

lopezdsr commented 3 years ago

Thank you very much for your feedback. We will review.