A few of us at my company have root access on production servers. We are looking for a good way to make it exceedingly clear when we have ssh'd in.
A few ideas we have had are:
- Bright red prompt
- Answer a riddle before getting a shell
- Type a random word before getting a shell
What are some techniques you guys use to differentiate production systems?
The red prompt is a good idea, which I also use.
Another trick is to put a large ASCII-art warning in the
/etc/motd
file.Having something like this greet you when you log in should get your attention:
You could generate such a warning on this website or you could use the
figlet
command.Like Nicholas Smith suggested in the comments, you could spice things up with some dragons or other animals using the
cowsay
command.Instead of using the /etc/motd file, you could also call
cowsay
orfiglet
in the.profile
file.Not quite the same thing, but this web site recommends having your developers wear a pink sombrero when making changes to production systems. You could probably have a similar rule for sshing into them.
The biggest I've used is a discrete naming-scheme where prod-systems are named obviously different than test/dev instances. This makes the "Username@Hostname: " style prompt visibly different. And by obvious I mean more than just different words, different formats too:
example: PRD-WEB001 vs DEVEL-BOB-WEB001
This has several things going for it:
And best of all, it doesn't require special terminal-configs for production just to avoid Oops errors.
In my experience, you want something that is a constant reminder of where you are. Login-methods like riddles are good for about 10 seconds, until you forget which window is which. All it takes is to do an
ls
in the wrong directory to scroll the ominous login-banner out of view, bury the terminal window under a browser window while googling something, alt-tab back to the wrong window and mayhem ensues. Best to have some constant visual cue like a significantly different command-prompt.One thing you need to keep in mind is that this needs to be a persistent reminder, not just an indicator at login time. Very often, someone will have several shells running at the same time in different tabs and move between them. Some will be dev, some production. So when you are running a command, you need to have an indicator at that point. So having a special prompt is the best method, in my experience, with a modified title/tab bar being a nice complement to this for finding the right window/tab easily.
So I'd recommend having a colored prompt (red being the obvious choice) and all caps for the hostname, with similar behavior for the user (privileged vs. non-privileged) as your prompt. Some examples:
Usually something like
in your shell startup file. This one is for the blue. Replace the
44
with41
fir red, and42
for green. Other colors and wild patterns available too.These are my suggestions:
1) Make sure most commands (rm, chown, chmod, /etc/init.d/* ) on the Production environment require sudo access
2) Use PS1/PS2 to indicate that the user is in a Prod server
This will show the command prompt as
3) If Using Putty/SSH clients, You can always set up unique Background color/profile to make the Production servers stand-out.
Just consider that your second and third ideas help during the initial connection but are of no value when you have multiple terminals open and move from one to another. sysadmin1138's idea of using naming is good when it can be applied but there are plenty of cases where it cannot be.
The only thing I've found to be really worthwhile is a coloured prompt. I like green for dev/testing, red for production and blue for machines in the DMZ. That way, even if I have two machines with the same name (in different networks), such as when preparing a replacement machine, I can still easily tell which one I'm on.
The red/special command prompt is good. Another thing might be a quicker auto-logout on those machines using the TMOUT variable. If you have opened many windows the production ones will go away faster.
This should lead to a different behaviour:
Working on a production machine with a plain root account is never ever a good idea.
Have an account with full sudo permissions. Does not allow saving sudo session. Prohibit sudo su. Use separate password for it ( not one you have for your dev machine ). Probably tweak sudo to notify about production identity of the shell before executing the command ( via alias ).
It will make accidental mistakes quite a hard ones. And red prompt never hurts.
I went with the red prompt idea, and found it fairly tedious to find working code for
.bashrc
.So here's my version, ready to be included in
.bashrc
- https://github.com/RichVel/nicer-bash-prompt. It's completely driven by hostname, so as long as you have a suitable pattern to production hostnames (sayxyprod01
,xyprod02
, etc) it will work well, and you can use the same.bashrc
in all environments.It looks like this:
This creates a nicer bash prompt including red prompt on production hosts - also shows you the current git branch, and last 2 directories in $PWD. It takes care to avoid messing up the prompt display when doing Ctrl/R (reverse searching) in bash.
Also includes an optional feature to sync your bash history across all terminal windows, along the lines of this answer. This is nice but not everyone wants it, so it's disabled by default.
Though I don't know what your IT setup is like, one solution that might be effective would be to have a special room that you have to go to to SSH into production servers as root. If you have a datacenter this could be the server room itself, but having a separate physical location from which 'normal' work is not done would quite effectively serve as a constant reminder that you're accessing production machines.