Mickael Scherer

One of the main issue with centralized internet services is the commercial exploitation of people private datas, and the relative lack of security of those data against states actors among others. Yet, being self hosted and using smaller provider do not automatically grant protection, and few people do have a concrete idea of what steps are needed to efficiently protect the privacy of others when hosting services, inspired by the policy of Mozilla, riseup and several others groups trying to do the right things

This talk will mostly speak of the steps required for respecting privacy, with a focus on privacy beyond "The NSA is trying to catch me", showing how even the best intentions do result in problem for some users, and how sysadmins and activists can set their systems to protect users without burdening them, and how things are most often more subtle than we think, in the context of hosting services.

Firewall, IDS, SELinux, ssh bastion, and others, the list of server side security measures is long. While servers can be reasonably secure nowadays, we always forget that there is always a way to enter by the desktop side. In this talk, we will explore various security measures to be used and deployed on a Linux desktop, and while it will be primarily focused on the Fedora distribution, lessons will be applicable to most Linux distributions and Unix systems.

In the system administration world, Ansible is a well know tool used to deploy and manage systems easily and seamlessly. However, few people know this can also be used by network engineer to manage manage all kind of switches and network equipement thanks to the flexibility of the agent-less design. This in turn open the doors of automation of the network layer without the disruption of a complete SDN solution, permitting to adopt modern best practices of management with small step, and starting the culture change required for embracing SDN.

The talk will quickly present Ansible, its principles, and how you can use it to manage a simple server. Then we will go deeper in the topic of network, the philosophy behind the network modules, their limitations, and how to use them.

Dockerfiles, while being the de factor standard for generating Docker containers, are also often seen as cumbersome to write and maintain due to the nature of Docker layering, subtle behaviour changes due to caches, and best practices who requires explicit actions to be applied. To improve this situation while keeping the innovation of Docker, the Ansible community came with the ansible-container project, a tool that permit to reuse the existing trove of Ansible roles to create, build and deploy containers in production with a single command.

This talk will present the project, explain the basics of ansible-container, show how to use it to build and deploy a complex multi-containers application.