News: 1633941130

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

Config cockup leaves Reg reader reaching for the phone

(2021/10/11)


Who, Me? Facebook went down and Twitch flashed its privates last week thanks to alleged config cockups. However, who among us has not suffered the stomach-dropping fear that follows the ill-advised submission of a seemingly innocuous command?

Welcome back to [1]Who, Me? , The Reg 's weekly column that recounts personal tales of catastrophe.

Memories of today's story, courtesy of "Kildare", was triggered, in his words, by "the recent period of world peace brought about by Facebook's absence."

[2]

It was the early 2000s, and Kildare was the network manager of a large London hospital. He and his team were working through a network upgrade: "Frankly," he said, "it was so bad that almost anything that was done would count as an upgrade!"

[3]

[4]

The routers were being changed out, and a Cabletron box had replaced one of the big boys. An SSR 8600 to be precise.

This was before [5]Cabletron was hacked to pieces . Of the kit, Kildare observed: "These things were a bit of a brute, but were a major step forward from the old Retix device (Max 6 X 10Mb interfaces and it used RIP2 – ah those were the days!)."

[6]

The SSR differed from Cisco hardware in a number of ways. Perhaps the most important was how configuration worked. "When changes were applied to the command line they were applied directly," explained Kildare, "rather than being held in a buffer and applied with a second command."

"Now," he added, "I expect frequent readers of this column will at this point think 'What could possibly go wrong?'"

It was not so much "what", though. More "when".

[7]

And the "when" arrived with the inevitability of a Lego brick to the soft foot of a careless parent.

"All the changes had resulted in a section of config no longer being required," said Kildare. "Line numbers were created when the config was displayed, so a command along the lines of delete 225 – 235 would do the job."

Easy, right?

Not quite.

"Unfortunately – (big word that) that's not quite what I typed: what I actually typed was delete 225 – 135."

[8]Things that are not PogChamp: Amazon's Twitch has its source code, streamer payout data leaked

[9]Facebook rendered spineless by buggy audit code that missed catastrophic network config error

[10]Cloud load balancer snafu leads to 3D printer user printing on a stranger's kit

[11]See that last line in the access list? Yeah, that means you don't have an access list

Kildare stared aghast at the screen, fervently hoping the router would spot the mistake.

It did not.

What it did was wipe all the lines between the numbers he'd typed. Numbers that, alas, included the config to permit connection to his PC.

Did we mention that the suddenly very, very lonely router was located a mile away?

Fortunately for Kildare, this was in the era before IP telephones ruled the roost and he was able to place a call to a colleague local to the stricken device.

He hurriedly dispensed instructions on how to recover the borked device and the day was saved. "But I did," he told us, "learn to re-read everything I ever typed VERY carefully before hitting the enter key."

This hack's moment of arse-swooping horror involved carelessly highlighting an UPDATE SQL statement and missing the WHERE clause before hitting Ctrl-e. How about you? Share your own bit of Facebook-esque silliness with an email to [12]Who, Me? ®

Get our [13]Tech Resources



[1] https://www.theregister.com/Tag/who-me

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/columnists&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YWQLafGnhCNYpDtpn9qI-AAAAAA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/columnists&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YWQLafGnhCNYpDtpn9qI-AAAAAA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/columnists&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YWQLafGnhCNYpDtpn9qI-AAAAAA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://www.theregister.com/2000/02/14/cabletron_shares_jump_as_company/

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/columnists&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YWQLafGnhCNYpDtpn9qI-AAAAAA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/columnists&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YWQLafGnhCNYpDtpn9qI-AAAAAA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[8] https://www.theregister.com/2021/10/06/twitch_data_leak/

[9] https://www.theregister.com/2021/10/06/facebook_outage_explained_in_detail/

[10] https://www.theregister.com/2021/08/20/3d_printer_spaghetti_detectives_cloud_config/

[11] https://www.theregister.com/2021/08/13/on_call/

[12] mailto:whome@theregister.com

[13] https://whitepapers.theregister.com/



Cisco commands are live too

tip pc

The SSR differed from Cisco hardware in a number of ways. Perhaps the most important was how configuration worked. "When changes were applied to the command line they were applied directly," explained Kildare, "rather than being held in a buffer and applied with a second command."

Cisco commands go live once entered.

A good routine is build your config in a text editor

Then save the running config on the device and a copy on your pc

Then reload in [x minutes]

Then paste your commands

If you make a mistake and lock yourself out then it’ll reboot and get you back to where you where before you started.

An out of band network (dial up, mobile or xdsl) is invaluable when working on remote systems.

We all (ok most of us) learn from our squeaky moments!!

Re: Cisco commands are live too

Anonymous Coward

Yep - Cisco IOS, CatOS etc were all live for configuration.

Perhaps the author has only used IOS XR on Cisco devices which like JunOS is entered and the committed later giving you a chance to check things before you do.

Forgetting to use commit confirmed on JunOS or IOS XR can still lead to the same embarrassment with locked out devices etc. With the added trick that one OS you put the delay before reverting in seconds the other in minutes, commit confirmed 300 - what do you mean it will revert in 3 hours!

Memories of an issue with a commit on JunOS and the ensuing BGP chaos are probably one for my own Who Me (no this didn't relate to Facebook).

Sun kit

Roger Kynaston

newfs /dev/c1t0d0s4

But I actually typed

newfs /dev/c0t0d0s4

Cue the /usr slice disappearing and the server keeling over in slow motion.

Of course, I was being a twit with dividing the os into so may partitions when it didn't need it as well but I thought I was being clever.

Me too...

GlenP

This hack's moment of arse-swooping horror involved carelessly highlighting an UPDATE SQL statement and missing the WHERE clause before hitting Ctrl-e.

Been there, done that, recovered database from backup and crafted a new update statement.

And that is why we almost never, ever, use UPDATE on the production databases.

Re: Me too...

LDS

Transactions are your friends.... and never use autocommit.... and always wait a little to type commit - verify everything is as expected.

Re: Me too...

dr john

Missing the WHERE clause - me too...

Every member of a club could no longer access their online accounts. Apart from Anne whose new data had replace everyone else's login data....

After the first few had reported the same problem, I had to search through LOTS of old emails from every member to get their correct details back in place. Not a five minute job. And i hadn't activated the database backup option on the web server. Did that very quickly afterwards.

Re: Me too...

Dave Pickles

ISTR Informix wouldn't allow UPDATE or DELETE without a WHERE clause. Never saw it happen but I can imagine muscle-memory adding WHERE 1=1...

HkraM

I'm waiting for the "Who, Me?" from the tech at a certain now-dead ISP in Finchley who tried to reinitialise the offline RAID array on the mail server, but entered the command on the live RAID array instead.

Jay 2

I needed to update the SSH config on many boxes (in the days before ansible) so a quick bit of command line fun and it was all done (change config file, restart sshd for effect). Then I realised I coudn't SSH into any of the servers. Turns out I'd made a typo! I was then punished for this, my myself, with having to go onto the remote console of each server (which thankfully all worked, some iDRAC/iLO can be a bit flakey) and sort out the problem.

Lessons of the day being don't be so blase about such changes, double check the config, and test on one box first!

Similar to the article I've also been messing about with iptables before and managed to lock myself out of a server via SSH. Again, to the console for fixing.

Majority, n.:
That quality that distinguishes a crime from a law.