2

I have a question about my Server Fault post: Unauthorised access to Heroku server -- how to trace attacker

I have a Heroku server for which I have been essentially responsible for the professional management (e.g. I do not pay Heroku as yet, though I intend to once the app hits production and my client begins to pass business earnings on to me, rather than paying me normal freelance web developer rates), and have found that on the unpaid plan I am basically responsible for solving any problems (I have not had one yet that the tech support team have been able to solve but I haven't).

As such, given the client is paying me and I am functionally managing the server as part of a paid agreement, it would seem to me that the question is absolutely on topic. However, it has been suggested that people with Heroku server licenses are considered users unless they are the Heroku staff themselves.

This seems a little confusing to me as I have performed what I would term server maintenance in the past on my Heroku server.

In this regard, could people suggest a particular definition of "managing information technology systems" in a similar manner to the way in which this post:

http://meta.serverfault.com/questions/9073/what-delineates-a-business-environment

sought to define "business environment"?

2
  • 9
    You should be careful with your terminology. You don't have "a server" you have a managed service, provided by Heroku, wherein your application can be deployed and executed. Likewise, you haven't been "managing your server". You've been managing your application, as deployed on Heroku's server. Yes, you have access to run a very restricted set of operations on the systems that are running your application, but that should not be conflated with actually managing the server.
    – EEAA Mod
    Commented Apr 2, 2017 at 17:40
  • 5
    ...all that to say there's nothing wrong at all with using services like Heroku. Not at all. I've been a sysadmin for 15 years, and even I use Heroku from time to time. I bring up the terminology thing because words are important, both to help yourself get your head around things, but even more importantly to help your customers understand what the situation is, and to be able to explain better to others how your application is being hosted, for instance as you did in your original question.
    – EEAA Mod
    Commented Apr 2, 2017 at 17:40

2 Answers 2

Reset to default
1

People administering computers professionally, as part of their job.

I think these definitions only roughly describe the site concept. For example, somebody working as professional system administrator by a non-profit, non-governmental organization still qualifies the site topic, although it doesn't pass the strictly interpreted "business environment" criteria.

But, for example, a non-technical leader of an IT department of a big company still "manages IT systems in a business environment", despite that his focus of interest and the site topic are probably distinct.

But these are rare exceptions. If we see the idea, the vision of the site, the definition is to me okay.

You can find more proper definitions in the site tour, and on this meta site.

In concrete cases, the vote of the 3k+ users decides about the questions, they are following mainly the idealistic description with different levels of strictness.

In your specific case, if I find your question in the review queue, I had voted either to "leave open" or to close as "unclear", but not to close as offtopic.

If the site closes the question, it also means that you are free to reask it anywhere on the SE network. The forbidden cross-site dupes obviously doesn't apply in this case. In your case I would suggest the security SE (http://security.stackexchange.com), but be more clear - what you wrote from your, currently deleted post, is not enough for me for a categoric opinion.

8

While more powerful, Heroku is not very different from some web hoster where you upload files and run them in hosters environment. You have no administrative control about the underlying system (e.g. you couldn't restart the application server your code is running on). Having this kind of administrative control is a longstanding requirement for questions on Serverfault and from this point of view, you are not administering something on Heroku, but just use it.

7
  • 1
    I can access the console and can run commands remotely, including viewing server logs. I can also install and build applications remotely on the Heroku server and even install third-party applications. What additional functionality would define administrative control (which I am assuming you are using as a direct substitutable for "managing information technology systems")?
    – Angular4 Kiddie
    Commented Apr 2, 2017 at 17:14
  • 4
    On a shared web hosting, I can read log files, add software packages, upload files remotely. But, like with Heroku, I can't restart the web server or even the whole system. That's the level of access we are talking about.
    – Sven Mod
    Commented Apr 2, 2017 at 17:18
  • So managing information technology systems is defined by being able to restart a server? I'm sure that's not what you mean, but could you try to give a more holistic definition that covers at least a realistic proportion of what would be expected as per the regulation definition?
    – Angular4 Kiddie
    Commented Apr 2, 2017 at 17:20
  • 5
    Yes, essentially that's what I mean, albeit taken it to the extreme. Are you root? Good. If not, the question is off-topic. You are not root on Heroku, I guarantee you that.
    – Sven Mod
    Commented Apr 2, 2017 at 17:22
  • 7
    @RailsKiddie Could you, for instance, install auditd and configure it as needed to catch and research something like this? No. Could you run a packet capture on the server? No. You have very limited access to the server that's running your application, and thus, again, are a user of the system. Bear in mind that similar questions from users of Google App Engine, Parse (RIP), etc are also asked and closed on a fairly frequent basis. We're not just picking on you here.
    – EEAA Mod
    Commented Apr 2, 2017 at 17:22
  • Thanks EEAA. That comment actually contains a lot of information that is pertinent to my original question. Sven, could you edit your original answer to note that at the very least users thought to be managing an information technology system should have root access? This seems to me a useful clarification of the original definition.
    – Angular4 Kiddie
    Commented Apr 2, 2017 at 17:24
  • 3
    Don't get hung up on the restarting thing. It's just a benchmark of sorts to determine if one is truly managing the system in question or is merely using it.
    – EEAA Mod
    Commented Apr 2, 2017 at 17:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .