安全与隐私serverfault.com
如何把我们那位“白痴”安全审计员想要的信息给他
How do I give our security auditor the information he wants? (2011)
2011 — 2016，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
这是 ServerFault 上一个广为流传的提问：运维人员被 PCI 安全审计员要求提供明文密码、SSH 私钥和六个月日志，甚至被要求伪造历史记录，于是发帖问如何满足这些要求。问题本身暴露出合规审计与基本安全常识的冲突；评论区普遍认为审计员的要求荒谬且危险，也有人怀疑这是钓鱼或自编的骗局。
为什么经久不衰：它把“外行合规要求逼着技术人员做反安全操作”的荒诞场景浓缩成经典案例，至今仍能引起运维和开发者的共鸣。
HN 评论精选
PCI 审计行业充斥无能者，荒谬要求可能拖垮企业。
伯明翰？我想我认识这家伙——我们有个客户在那边，和他们的 PCI 审计员打了三年仗，对方无能到危险的地步。他们坚持我们应该能解密 PAN（信用卡号）；我们仍未照办，因为我们刻意不存储卡号，只做传输。这不是钓鱼骗局，这差不多是英国当下的常态——你试试让一个 32 岁的“小孩”公司董事，去面对一个 55 岁、似乎从没用过电脑、以为 network 是航海术语的“安全工程师”，在客户面前打资历牌。可悲的是，过去 18 个月里我看到两家零售商听信这类胡说八道而不是真正懂行的人，把自己硬生生拖垮。一家半年花了约 800 万英镑在 PCI 审计员身上，然后破产，还怪我们平台提供商——我们可是有 PA-DSS 和 ISO 认证。审计员也怪我们，然后关门搬去西班牙。PCI 专家成了新一代 SEO 专家。
madaxe_again查看英文原文
Birmingham? I think I know this guy - we have a client based there and are three years into a war with their PCI auditor, who are dangerously incompetent. They were adamant that we should be able to decrypt PANs (credit card numbers) - we still haven't complied, as we quite deliberately don't store them and just transit them. It's not a phishing scam, this is pretty much state of the art in the UK - and try being a 32 year old "kid" company director while the 55 year old "security engineer" who seems to have never used a computer and thinks a network is a maritime term plays the "seniority" card in front of a client of the same generation. The sad thing is I've seen two retailers drive themselves hard into the ground over the last eighteen months by listening to this variety of chumbly wotsit rather then someone who actually knows what the hell they're talking about. One spent about £8M on their PCI auditor over six months, then went bust, blaming us, the platform provider - who are PA-DSS and ISO certified. The auditor blamed us too, then folded up shop and moved to Spain. PCI experts are the new SEO experts.
Unix 密码本就不可能提供明文，索要明文等于制造安全泄露。
好吧，如果审计员想玩比大小的把戏：我从 1982 年就开始用 Unix（Bell Labs 第 7 版，既然你问了），我怀疑我经验比他多。Unix 及 Linux 等衍生/类似系统一直是一向加密存储密码。我完全不知道他指望系统管理员如何提供明文密码列表——除非把 passwd 工具换成会偷偷保存加密前版本的 hacked 版本，或让员工把明文密码邮件发给被他纠缠的可怜人。无论哪种都是大规模安全泄露。单向加密的全部意义就是原始明文密码不会留下持久痕迹。这家伙审计安全的方式让人想起西班牙宗教裁判所审计巫术：做也死，不做也死。他的公司最好换一个有脑子的支付服务商和称职审计员。
jonsg查看英文原文
Well, if the auditor wants to play willy-measuring tactics: I've been using Unix since 1982 (Bell Labs Version 7, since you asked), and I rather suspect that I've more experience than he has. UNIX and derived/lookalike systems like Linux have _always_ stored passwords one-way encrypted. I have precisely no idea how he expects the sysadmin to provide a list of plaintext passwords, short of replacing the passwd utility with a hacked one that stores the pre-crypt version somewhere for retrieval, or asking staff to email their plaintext passwords to the poor sap he's badgering. Either way, a massive security breach. The whole point of one-way encryption is that there is no persistent trace left of the original plaintext password. This guy's way of auditing security recalls the Spanish Inquisition's way of auditing witchcraft. Damned if you do; damned if you don't. His company's far better off using a payments provider with a clue - and a competent auditor.
索要账号密码应被当作钓鱼行为并举报。
也许该告诉审计员：如果他坚持以安全审计为名索要用户账号和密码，你将别无选择，只能向 FBI 或 MI5 举报他，怀疑他是钓鱼骗局操作者，可能已经用类似手段坑过以前的客户。
sfifs查看英文原文
Hmmm... perhaps the auditor should be informed that if he persists in requesting for user account and passwords in the guise of a security audit, you will have no choice but to report him to the FBI or MI5 as a suspected phishing scam operator who may have already compromised prior clients in similarly.
原帖可能是借审计之名套取攻击方法的社会工程/骗局。
这是社会工程案例，不是安全审计员对发帖人，而是发帖人对读者。发帖人想知道如何轻松收集公钥和私钥 SSH 密钥，并伪造六个月的入站流量。根本没有审计员。也许发帖人正在写一本破解系统的书？谁知道。但这闻起来像骗局。
blackboxxx查看英文原文
This is a case of social engineering, not of a security auditor, but of the poster. The poster wants to know an easy way to collect public and private SSH keys and fake 6 months of inbound traffic. There is no auditor. Maybe the poster is writing a book on cracking systems? Who knows. But it smells like a hoax.
历次讨论
同类还值得读
非法素数
Illegal prime
维基百科条目，介绍“非法素数”：某些素数之所以被称为“非法”，是因为它们经特定编码后，恰好对应一段被法律禁止传播的数据——最著名的是 DVD 解密程序 DeCSS 的代码，有人把…
安全与隐私上首页 5 次 · 2010–2021en.wikipedia.org编辑精选关于 /dev/urandom 的常见误区
Myths about /dev/urandom
（Thomas Hühn 撰写，2014 年首发并持续更新）逐条反驳关于 /dev/urandom 的常见误解：它与 /dev/random 使用的是同一个 CSPRNG，一旦完…
安全与隐私上首页 5 次 · 2014–20202uo.de编辑精选AES 高级加密标准火柴人图解
A Stick Figure Guide to the Advanced Encryption Standard (AES)
一篇用火柴人漫画形式讲解 AES（高级加密标准）算法的经典科普文章。
安全与隐私上首页 5 次 · 2009–2022moserware.com编辑精选指纹是用户名，不是密码
Fingerprints are Usernames, not Passwords
作者（eCryptfs 维护者、Ubuntu 安全工程师）认为指纹等生物特征是公开、不可更改的标识，应视作用户名而非密码，不能当作秘密凭据用于认证。
安全与隐私上首页 4 次 · 2013–2017blog.dustinkirkland.comHTTPS 连接的最初几毫秒（2009）
The First Few Milliseconds of an HTTPS Connection (2009)
逐毫秒拆解一次 HTTPS 连接建立时发生了什么，重点讲 TLS 握手、证书验证、RSA 签名与密钥协商等机制，面向不熟悉该领域的读者。
安全与隐私上首页 4 次 · 2009–2020moserware.com编辑精选