Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
| elearning:workbooks:docker3:drf06 [2023/12/27 07:51] – removed admin | elearning:workbooks:docker3:drf06 [2024/02/21 13:40] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| + | ~~PDF: | ||
| + | Version : **2024.01** | ||
| + | |||
| + | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| + | |||
| + | ======DOF607 - Gestion de la Sécurité de Docker====== | ||
| + | |||
| + | =====Contenu du Module===== | ||
| + | |||
| + | * **DOF607 - Gestion de la Sécurité de Docker** | ||
| + | * Contenu du Module | ||
| + | * LAB #1 - Utilisation des Docker Secrets | ||
| + | * LAB #2 - Création d'un Utilisateur de Confiance pour Contrôler le Daemon Docker | ||
| + | * LAB #3 - Le Script docker-bench-security.sh | ||
| + | * LAB #4 - Sécurisation de la Configuration de l' | ||
| + | * LAB #5 - Sécurisation de la Configuration du daemon Docker | ||
| + | * 5.1 - Le Fichier / | ||
| + | * LAB #6 - Sécurisation des Images et les Fichiers de Construction | ||
| + | * LAB #7 - Sécurisation du Container Runtime | ||
| + | * LAB #8 - Sécurisation des Images avec Docker Content Trust | ||
| + | * 8.1 - DOCKER_CONTENT_TRUST | ||
| + | * 8.2 - DCT et la commande docker pull | ||
| + | * L' | ||
| + | * 8.3 - DCT et la commande docker push | ||
| + | * 8.4 - DCT et la commande docker build | ||
| + | * Créer un deuxième Repositry | ||
| + | * Supprimer une Signature | ||
| + | * LAB #9 - Sécurisation du Socket du Daemon Docker | ||
| + | * 9.1 - Création du Certificat de l' | ||
| + | * 9.2 - Création du Certificat du Serveur Hôte du Daemon Docker | ||
| + | * 9.3 - Création du Certificat du Client | ||
| + | * 9.4 - Démarrage du Daemon Docker avec une Invocation Directe | ||
| + | * 9.5 - Configuration du Client | ||
| + | |||
| + | =====LAB #1 - Utilisation des Docker Secrets===== | ||
| + | |||
| + | Les secrets Docker sont une façon sécurisée de stocker des informations sensibles telles les noms d' | ||
| + | |||
| + | Considérez l' | ||
| + | |||
| + | < | ||
| + | version: ' | ||
| + | |||
| + | services: | ||
| + | |||
| + | db: | ||
| + | image: postgres | ||
| + | environment: | ||
| + | POSTGRES_USER: | ||
| + | POSTGRES_PASSWORD: | ||
| + | POSTGRES_DB: | ||
| + | |||
| + | adminer: | ||
| + | image: adminer | ||
| + | ports: | ||
| + | - 8080:8080 | ||
| + | </ | ||
| + | |||
| + | On peut constater dans ce fichier la présence des informations sensibles en non-sécurisées : | ||
| + | |||
| + | * POSTGRES_USER | ||
| + | * POSTGRES_PASSWORD | ||
| + | * POSTGRES_DB | ||
| + | |||
| + | Afin de sécuriser ces informations, | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | </ | ||
| + | |||
| + | Créez ensuite un Docker Secret appelé **pg_user** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | root@manager: | ||
| + | lpk8eq80qvfiqw7z1686fmj5t | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Notez l' | ||
| + | </ | ||
| + | |||
| + | Pour visualiser la liste des secrets, utilisez la commande docker secrets **ls** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | ID NAME DRIVER | ||
| + | lpk8eq80qvfiqw7z1686fmj5t | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Notez que la colonne **DRIVER** est vide. Ceci indique que le gestion des secrets est accomplie par Docker lui-même au lieu d' | ||
| + | </ | ||
| + | |||
| + | Créez maintenant les secrets **pg_password** et **pg_database** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | h9tsfbfwz6o0sd35roklwpopi | ||
| + | root@manager: | ||
| + | 5lx4zydpfocwgpdto0yy1jod9 | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Notez qu'un secret Docker est immuable. | ||
| + | </ | ||
| + | |||
| + | Vérifiez la prise en compte de vos commandes : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | ID NAME DRIVER | ||
| + | 5lx4zydpfocwgpdto0yy1jod9 | ||
| + | h9tsfbfwz6o0sd35roklwpopi | ||
| + | lpk8eq80qvfiqw7z1686fmj5t | ||
| + | </ | ||
| + | |||
| + | Pour obtenir de l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | [ | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }, | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | } | ||
| + | ] | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : On peut constater dans la sortie de cette commande la valeur **CreatedAt** qui correspond à la date de création du secret ainsi que **UpdatedAt** qui correspond à la date de modification du secret. | ||
| + | </ | ||
| + | |||
| + | L' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | ID: 5lx4zydpfocwgpdto0yy1jod9 | ||
| + | Name: pg_database | ||
| + | Driver: | ||
| + | Created at: 2021-04-15 03: | ||
| + | Updated at: 2021-04-15 03: | ||
| + | </ | ||
| + | |||
| + | Créez maintenant le fichier compose **postgres-secrets.yaml** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | root@manager: | ||
| + | version: ' | ||
| + | |||
| + | services: | ||
| + | |||
| + | db: | ||
| + | image: postgres | ||
| + | restart: always | ||
| + | environment: | ||
| + | POSTGRES_USER_FILE: | ||
| + | POSTGRES_PASSWORD_FILE: | ||
| + | POSTGRES_DB_FILE: | ||
| + | secrets: | ||
| + | - pg_password | ||
| + | - pg_user | ||
| + | - pg_database | ||
| + | |||
| + | adminer: | ||
| + | image: adminer | ||
| + | ports: | ||
| + | - 8080:8080 | ||
| + | |||
| + | secrets: | ||
| + | pg_user: | ||
| + | external: true | ||
| + | pg_password: | ||
| + | external: true | ||
| + | pg_database: | ||
| + | external: true | ||
| + | </ | ||
| + | |||
| + | Notez que dans ce fichier les trois variables **POSTGRES_USER**, | ||
| + | |||
| + | Deuxièmement la section suivantes spécifie les noms des secrets à utiliser avec le service : | ||
| + | |||
| + | < | ||
| + | secrets: | ||
| + | - pg_password | ||
| + | - pg_user | ||
| + | - pg_database | ||
| + | </ | ||
| + | |||
| + | La dernière section spécifie que les secrets sont **externes** : | ||
| + | |||
| + | < | ||
| + | secrets: | ||
| + | pg_user: | ||
| + | external: true | ||
| + | pg_password: | ||
| + | external: true | ||
| + | pg_database: | ||
| + | external: true | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Le terme **externe** indique que les secrets ne seront pas stockés dans l' | ||
| + | </ | ||
| + | |||
| + | Déployez maintenant le service en utilisant la commande **docker stack** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Ignoring unsupported options: restart | ||
| + | |||
| + | Creating network postgres_default | ||
| + | Creating service postgres_db | ||
| + | Creating service postgres_adminer | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Notez a présence de l' | ||
| + | </ | ||
| + | |||
| + | Connectez-vous maintenant à Apache Guacamole et ouvrez un navigateur web dans la machine virtuelle. Naviguez ensuite à l' | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Validez le formulaire et vérifiez que les secrets ont été pris en compte : | ||
| + | |||
| + | {{ : | ||
| + | |||
| + | Dernièrement, | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | NAME SERVICES | ||
| + | postgres | ||
| + | root@manager: | ||
| + | Removing service postgres_adminer | ||
| + | Removing service postgres_db | ||
| + | Removing network postgres_default | ||
| + | </ | ||
| + | |||
| + | =====LAB #2 - Création d'un Utilisateur de Confiance pour Contrôler le Daemon Docker===== | ||
| + | |||
| + | Au contraire des solutions classiques de gestion de machines virtuelles où l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | docker: | ||
| + | root@manager: | ||
| + | root@manager: | ||
| + | déconnexion | ||
| + | trainee@manager: | ||
| + | Got permission denied while trying to connect to the Docker daemon socket at unix:/// | ||
| + | trainee@manager: | ||
| + | trainee@manager: | ||
| + | CONTAINER ID IMAGE | ||
| + | d02c6115724c | ||
| + | trainee@manager: | ||
| + | alpine1 | ||
| + | trainee@manager: | ||
| + | a214e2df0499c97e8da25a6c9ea751ac75344c9bcd7d238f8cb8d5c777510ab9 | ||
| + | trainee@manager: | ||
| + | CONTAINER ID IMAGE | ||
| + | a214e2df0499 | ||
| + | </ | ||
| + | |||
| + | =====LAB #3 - Le Script docker-bench-security.sh===== | ||
| + | |||
| + | Le **Center for Internet Security (CIS)** est une organisation indépendante à but non-lucratif qui publie des best practices dans de nombreux domaines de l' | ||
| + | |||
| + | Le guide est divisé en plusieurs sections : | ||
| + | |||
| + | * La configuration de l' | ||
| + | * La configuration du daemon Docker, | ||
| + | * Les fichiers de configuration du daemon Docker, | ||
| + | * Les images ainsi que les fichiers servant à la construction des images, | ||
| + | * Le container runtime, | ||
| + | * Les opérations sécuritaires relatives à Docker, | ||
| + | * La configuration de Docker Swarm. | ||
| + | |||
| + | Ce guide est à utiliser avec le script **Docker Benchmark Security**. | ||
| + | |||
| + | Clonez le script **docker-bench-security.sh** en utilisant **git** : | ||
| + | |||
| + | < | ||
| + | trainee@manager: | ||
| + | Password: fenestros | ||
| + | |||
| + | root@manager: | ||
| + | Cloning in ' | ||
| + | remote: Enumerating objects: 18, done. | ||
| + | remote: Counting objects: 100% (18/18), done. | ||
| + | remote: Compressing objects: 100% (16/16), done. | ||
| + | remote: Total 1921 (delta 5), reused 6 (delta 2), pack-reused 1903 | ||
| + | Receiving objects: 100% (1921/ | ||
| + | Delta resolution: 100% (1339/ | ||
| + | </ | ||
| + | |||
| + | Exécutez maintenant le script **Docker Benchmark Security** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | |||
| + | root@manager: | ||
| + | # -------------------------------------------------------------------------------------------- | ||
| + | # Docker Bench for Security v1.6.0 | ||
| + | # | ||
| + | # Docker, Inc. (c) 2015-2023 | ||
| + | # | ||
| + | # Checks for dozens of common best-practices around deploying Docker containers in production. | ||
| + | # Based on the CIS Docker Benchmark 1.6.0. | ||
| + | # -------------------------------------------------------------------------------------------- | ||
| + | |||
| + | Initializing 2023-12-17T14: | ||
| + | |||
| + | |||
| + | Section A - Check results | ||
| + | |||
| + | [INFO] 1 - Host Configuration | ||
| + | [INFO] 1.1 - Linux Hosts Specific Configuration | ||
| + | [WARN] 1.1.1 - Ensure a separate partition for containers has been created (Automated) | ||
| + | [INFO] 1.1.2 - Ensure only trusted users are allowed to control Docker daemon (Automated) | ||
| + | [INFO] | ||
| + | [WARN] 1.1.3 - Ensure auditing is configured for the Docker daemon (Automated) | ||
| + | [WARN] 1.1.4 - Ensure auditing is configured for Docker files and directories -/ | ||
| + | [WARN] 1.1.5 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.1.6 - Ensure auditing is configured for Docker files and directories - /etc/docker (Automated) | ||
| + | [WARN] 1.1.7 - Ensure auditing is configured for Docker files and directories - docker.service (Automated) | ||
| + | [INFO] 1.1.8 - Ensure auditing is configured for Docker files and directories - containerd.sock (Automated) | ||
| + | [INFO] | ||
| + | [WARN] 1.1.9 - Ensure auditing is configured for Docker files and directories - docker.socket (Automated) | ||
| + | [WARN] 1.1.10 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] 1.1.11 - Ensure auditing is configured for Dockerfiles and directories - / | ||
| + | [INFO] | ||
| + | [WARN] 1.1.12 - 1.1.12 Ensure auditing is configured for Dockerfiles and directories - / | ||
| + | [INFO] 1.1.13 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] | ||
| + | [WARN] 1.1.14 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.1.15 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] 1.1.16 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] | ||
| + | [INFO] 1.1.17 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] | ||
| + | [WARN] 1.1.18 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] 1.2 - General Configuration | ||
| + | [NOTE] 1.2.1 - Ensure the container host has been Hardened (Manual) | ||
| + | [PASS] 1.2.2 - Ensure that the version of Docker is up to date (Manual) | ||
| + | [INFO] | ||
| + | |||
| + | [INFO] 2 - Docker daemon configuration | ||
| + | [NOTE] 2.1 - Run the Docker daemon as a non-root user, if possible (Manual) | ||
| + | [WARN] 2.2 - Ensure network traffic is restricted between containers on the default bridge (Scored) | ||
| + | [PASS] 2.3 - Ensure the logging level is set to ' | ||
| + | [PASS] 2.4 - Ensure Docker is allowed to make changes to iptables (Scored) | ||
| + | [PASS] 2.5 - Ensure insecure registries are not used (Scored) | ||
| + | [PASS] 2.6 - Ensure aufs storage driver is not used (Scored) | ||
| + | [INFO] 2.7 - Ensure TLS authentication for Docker daemon is configured (Scored) | ||
| + | [INFO] | ||
| + | [INFO] 2.8 - Ensure the default ulimit is configured appropriately (Manual) | ||
| + | [INFO] | ||
| + | [WARN] 2.9 - Enable user namespace support (Scored) | ||
| + | [PASS] 2.10 - Ensure the default cgroup usage has been confirmed (Scored) | ||
| + | [PASS] 2.11 - Ensure base device size is not changed until needed (Scored) | ||
| + | [WARN] 2.12 - Ensure that authorization for Docker client commands is enabled (Scored) | ||
| + | [WARN] 2.13 - Ensure centralized and remote logging is configured (Scored) | ||
| + | [WARN] 2.14 - Ensure containers are restricted from acquiring new privileges (Scored) | ||
| + | [WARN] 2.15 - Ensure live restore is enabled (Scored) | ||
| + | [WARN] 2.16 - Ensure Userland Proxy is Disabled (Scored) | ||
| + | [PASS] 2.17 - Ensure that a daemon-wide custom seccomp profile is applied if appropriate (Manual) | ||
| + | [PASS] 2.18 - Ensure that experimental features are not implemented in production (Scored) | ||
| + | |||
| + | [INFO] 3 - Docker daemon configuration files | ||
| + | [PASS] 3.1 - Ensure that the docker.service file ownership is set to root:root (Automated) | ||
| + | [PASS] 3.2 - Ensure that docker.service file permissions are appropriately set (Automated) | ||
| + | [PASS] 3.3 - Ensure that docker.socket file ownership is set to root:root (Automated) | ||
| + | [PASS] 3.4 - Ensure that docker.socket file permissions are set to 644 or more restrictive (Automated) | ||
| + | [PASS] 3.5 - Ensure that the /etc/docker directory ownership is set to root:root (Automated) | ||
| + | [PASS] 3.6 - Ensure that /etc/docker directory permissions are set to 755 or more restrictively (Automated) | ||
| + | [INFO] 3.7 - Ensure that registry certificate file ownership is set to root:root (Automated) | ||
| + | [INFO] | ||
| + | [INFO] 3.8 - Ensure that registry certificate file permissions are set to 444 or more restrictively (Automated) | ||
| + | [INFO] | ||
| + | [INFO] 3.9 - Ensure that TLS CA certificate file ownership is set to root:root (Automated) | ||
| + | [INFO] | ||
| + | [INFO] 3.10 - Ensure that TLS CA certificate file permissions are set to 444 or more restrictively (Automated) | ||
| + | [INFO] | ||
| + | [INFO] 3.11 - Ensure that Docker server certificate file ownership is set to root:root (Automated) | ||
| + | [INFO] | ||
| + | [INFO] 3.12 - Ensure that the Docker server certificate file permissions are set to 444 or more restrictively (Automated) | ||
| + | [INFO] | ||
| + | [INFO] 3.13 - Ensure that the Docker server certificate key file ownership is set to root:root (Automated) | ||
| + | [INFO] | ||
| + | [INFO] 3.14 - Ensure that the Docker server certificate key file permissions are set to 400 (Automated) | ||
| + | [INFO] | ||
| + | [PASS] 3.15 - Ensure that the Docker socket file ownership is set to root:docker (Automated) | ||
| + | [PASS] 3.16 - Ensure that the Docker socket file permissions are set to 660 or more restrictively (Automated) | ||
| + | [INFO] 3.17 - Ensure that the daemon.json file ownership is set to root:root (Automated) | ||
| + | [INFO] | ||
| + | [INFO] 3.18 - Ensure that daemon.json file permissions are set to 644 or more restrictive (Automated) | ||
| + | [INFO] | ||
| + | [PASS] 3.19 - Ensure that the / | ||
| + | [PASS] 3.20 - Ensure that the / | ||
| + | [INFO] 3.21 - Ensure that the / | ||
| + | [INFO] | ||
| + | [INFO] 3.22 - Ensure that the / | ||
| + | [INFO] | ||
| + | [PASS] 3.23 - Ensure that the Containerd socket file ownership is set to root:root (Automated) | ||
| + | [PASS] 3.24 - Ensure that the Containerd socket file permissions are set to 660 or more restrictively (Automated) | ||
| + | |||
| + | [INFO] 4 - Container Images and Build File | ||
| + | [INFO] 4.1 - Ensure that a user for the container has been created (Automated) | ||
| + | [INFO] | ||
| + | [NOTE] 4.2 - Ensure that containers use only trusted base images (Manual) | ||
| + | [NOTE] 4.3 - Ensure that unnecessary packages are not installed in the container (Manual) | ||
| + | [NOTE] 4.4 - Ensure images are scanned and rebuilt to include security patches (Manual) | ||
| + | [WARN] 4.5 - Ensure Content trust for Docker is Enabled (Automated) | ||
| + | [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images (Automated) | ||
| + | [WARN] | ||
| + | [WARN] | ||
| + | [WARN] | ||
| + | [WARN] | ||
| + | [PASS] 4.7 - Ensure update instructions are not used alone in the Dockerfile (Manual) | ||
| + | [NOTE] 4.8 - Ensure setuid and setgid permissions are removed (Manual) | ||
| + | [PASS] 4.9 - Ensure that COPY is used instead of ADD in Dockerfiles (Manual) | ||
| + | [NOTE] 4.10 - Ensure secrets are not stored in Dockerfiles (Manual) | ||
| + | [NOTE] 4.11 - Ensure only verified packages are installed (Manual) | ||
| + | [NOTE] 4.12 - Ensure all signed artifacts are validated (Manual) | ||
| + | |||
| + | [INFO] 5 - Container Runtime | ||
| + | [INFO] | ||
| + | |||
| + | [INFO] 6 - Docker Security Operations | ||
| + | [INFO] 6.1 - Ensure that image sprawl is avoided (Manual) | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] 6.2 - Ensure that container sprawl is avoided (Manual) | ||
| + | [INFO] | ||
| + | |||
| + | [INFO] 7 - Docker Swarm Configuration | ||
| + | [WARN] 7.1 - Ensure swarm mode is not Enabled, if not needed (Automated) | ||
| + | [PASS] 7.2 - Ensure that the minimum number of manager nodes have been created in a swarm (Automated) (Swarm mode not enabled) | ||
| + | [PASS] 7.3 - Ensure that swarm services are bound to a specific host interface (Automated) (Swarm mode not enabled) | ||
| + | [PASS] 7.4 - Ensure that all Docker swarm overlay networks are encrypted (Automated) | ||
| + | [PASS] 7.5 - Ensure that Docker' | ||
| + | [PASS] 7.6 - Ensure that swarm manager is run in auto-lock mode (Automated) (Swarm mode not enabled) | ||
| + | [PASS] 7.7 - Ensure that the swarm manager auto-lock key is rotated periodically (Manual) (Swarm mode not enabled) | ||
| + | [PASS] 7.8 - Ensure that node certificates are rotated as appropriate (Manual) (Swarm mode not enabled) | ||
| + | [PASS] 7.9 - Ensure that CA certificates are rotated as appropriate (Manual) (Swarm mode not enabled) | ||
| + | [PASS] 7.10 - Ensure that management plane traffic is separated from data plane traffic (Manual) (Swarm mode not enabled) | ||
| + | |||
| + | |||
| + | Section C - Score | ||
| + | |||
| + | [INFO] Checks: 86 | ||
| + | [INFO] Score: 1 | ||
| + | </ | ||
| + | |||
| + | Ce script sert à automatiser le contrôle des points précédemment cités et produit un rapport contenant des annotations : | ||
| + | |||
| + | * **[PASS]** : Concerne les points qui n'ont pas besoin d' | ||
| + | * **[WARN]** : Concerne les points qui **doivent** être modifiés, | ||
| + | * **[INFO]** : Concerne les points qui doivent être passés en revue selon les besoins de votre configuration, | ||
| + | * **[NOTE]** : Vous informe d'un **best practice**. | ||
| + | |||
| + | =====LAB #4 - Sécurisation de la Configuration de l' | ||
| + | |||
| + | Lors de l' | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | [INFO] 1 - Host Configuration | ||
| + | [INFO] 1.1 - Linux Hosts Specific Configuration | ||
| + | [WARN] 1.1.1 - Ensure a separate partition for containers has been created (Automated) | ||
| + | [INFO] 1.1.2 - Ensure only trusted users are allowed to control Docker daemon (Automated) | ||
| + | [INFO] | ||
| + | [WARN] 1.1.3 - Ensure auditing is configured for the Docker daemon (Automated) | ||
| + | [WARN] 1.1.4 - Ensure auditing is configured for Docker files and directories -/ | ||
| + | [WARN] 1.1.5 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.1.6 - Ensure auditing is configured for Docker files and directories - /etc/docker (Automated) | ||
| + | [WARN] 1.1.7 - Ensure auditing is configured for Docker files and directories - docker.service (Automated) | ||
| + | [INFO] 1.1.8 - Ensure auditing is configured for Docker files and directories - containerd.sock (Automated) | ||
| + | [INFO] | ||
| + | [WARN] 1.1.9 - Ensure auditing is configured for Docker files and directories - docker.socket (Automated) | ||
| + | [WARN] 1.1.10 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] 1.1.11 - Ensure auditing is configured for Dockerfiles and directories - / | ||
| + | [INFO] | ||
| + | [WARN] 1.1.12 - 1.1.12 Ensure auditing is configured for Dockerfiles and directories - / | ||
| + | [INFO] 1.1.13 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] | ||
| + | [WARN] 1.1.14 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.1.15 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] 1.1.16 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] | ||
| + | [INFO] 1.1.17 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] | ||
| + | [WARN] 1.1.18 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [INFO] 1.2 - General Configuration | ||
| + | [NOTE] 1.2.1 - Ensure the container host has been Hardened (Manual) | ||
| + | [PASS] 1.2.2 - Ensure that the version of Docker is up to date (Manual) | ||
| + | [INFO] | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Les problèmes de sécurité qu'il convient à résoudre sont indiqués par les annotations **[WARN]**. | ||
| + | |||
| + | ====[WARN] 1.1.1 - Ensure a separate partition for containers has been created (Automated)==== | ||
| + | |||
| + | Par défaut, tous les fichiers de Docker sont stockés dans le répertoire **/ | ||
| + | |||
| + | ====[WARN] 1.1.3 - Ensure auditing is configured for the Docker daemon (Automated)==== | ||
| + | |||
| + | < | ||
| + | [WARN] 1.1.4 - Ensure auditing is configured for Docker files and directories -/ | ||
| + | [WARN] 1.1.5 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.1.6 - Ensure auditing is configured for Docker files and directories - /etc/docker (Automated) | ||
| + | [WARN] 1.1.7 - Ensure auditing is configured for Docker files and directories - docker.service (Automated) | ||
| + | [WARN] 1.1.9 - Ensure auditing is configured for Docker files and directories - docker.socket (Automated) | ||
| + | [WARN] 1.1.10 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.1.12 - Ensure auditing is configured for Dockerfiles and directories - / | ||
| + | [WARN] 1.1.14 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.1.15 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [WARN] 1.1.18 - Ensure auditing is configured for Docker files and directories - / | ||
| + | </ | ||
| + | |||
| + | Ces avertissements sont présents parce que **auditd** n'est pas installé et parce qu'il n'y a pas de règles spécifiques au daemon Docker et ses répertoires et fichiers associés. | ||
| + | |||
| + | Editez le fichier **/ | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | |||
| + | root@manager: | ||
| + | deb http:// | ||
| + | deb-src http:// | ||
| + | deb http:// | ||
| + | deb-src http:// | ||
| + | deb [arch=amd64] https:// | ||
| + | </ | ||
| + | |||
| + | Exécutez la commande **apt-update** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Ign:1 http:// | ||
| + | Atteint:2 http:// | ||
| + | Atteint:3 http:// | ||
| + | Réception de:4 https:// | ||
| + | 44,8 ko réceptionnés en 0s (107 ko/s) | ||
| + | Lecture des listes de paquets... Fait | ||
| + | Construction de l' | ||
| + | Lecture des informations d' | ||
| + | 254 packages can be upgraded. Run 'apt list --upgradable' | ||
| + | </ | ||
| + | |||
| + | Pour installer auditd, utilisez **apt-get** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | </ | ||
| + | |||
| + | Modifiez ensuite le fichier **/ | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | |||
| + | root@manager: | ||
| + | ## First rule - delete all | ||
| + | -D | ||
| + | |||
| + | ## Increase the buffers to survive stress events. | ||
| + | ## Make this bigger for busy systems | ||
| + | -b 8192 | ||
| + | |||
| + | ## This determine how long to wait in burst of events | ||
| + | --backlog_wait_time 0 | ||
| + | |||
| + | ## Set failure mode to syslog | ||
| + | -f 1 | ||
| + | |||
| + | ##Docker | ||
| + | -w / | ||
| + | -w / | ||
| + | -w /etc/docker -p wa | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : L' | ||
| + | </ | ||
| + | |||
| + | Re-démarrez ensuite auditd : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | </ | ||
| + | |||
| + | Vérifiez ensuite la prise en charge des règles : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | ## This file is automatically generated from / | ||
| + | -D | ||
| + | -b 8192 | ||
| + | -f 1 | ||
| + | --backlog_wait_time 0 | ||
| + | -w / | ||
| + | -w / | ||
| + | -w /etc/docker -p wa | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | -w / | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** - Pour plus d' | ||
| + | </ | ||
| + | |||
| + | Ré-exécutez le script **Docker Benchmark Security** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | ... | ||
| + | [PASS] 1.1.4 - Ensure auditing is configured for Docker files and directories -/ | ||
| + | [PASS] 1.1.5 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [PASS] 1.1.6 - Ensure auditing is configured for Docker files and directories - /etc/docker (Automated) | ||
| + | [PASS] 1.1.7 - Ensure auditing is configured for Docker files and directories - docker.service (Automated) | ||
| + | [PASS] 1.1.9 - Ensure auditing is configured for Docker files and directories - docker.socket (Automated) | ||
| + | [PASS] 1.1.10 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [PASS] 1.1.12 - Ensure auditing is configured for Dockerfiles and directories - / | ||
| + | [PASS] 1.1.14 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [PASS] 1.1.15 - Ensure auditing is configured for Docker files and directories - / | ||
| + | [PASS] 1.1.18 - Ensure auditing is configured for Docker files and directories - / | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | =====LAB #5 - Sécurisation de la Configuration du daemon Docker===== | ||
| + | |||
| + | Exécutez de nouveau le script **docker-bench-security.sh**. Vous devez obtenir un résultat similaire à ceci en ce qui concerne la sécurité de la configuration du daemon Docker : | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | [INFO] 2 - Docker daemon configuration | ||
| + | [NOTE] 2.1 - Run the Docker daemon as a non-root user, if possible (Manual) | ||
| + | [WARN] 2.2 - Ensure network traffic is restricted between containers on the default bridge (Scored) | ||
| + | [PASS] 2.3 - Ensure the logging level is set to ' | ||
| + | [PASS] 2.4 - Ensure Docker is allowed to make changes to iptables (Scored) | ||
| + | [PASS] 2.5 - Ensure insecure registries are not used (Scored) | ||
| + | [PASS] 2.6 - Ensure aufs storage driver is not used (Scored) | ||
| + | [INFO] 2.7 - Ensure TLS authentication for Docker daemon is configured (Scored) | ||
| + | [INFO] | ||
| + | [INFO] 2.8 - Ensure the default ulimit is configured appropriately (Manual) | ||
| + | [INFO] | ||
| + | [WARN] 2.9 - Enable user namespace support (Scored) | ||
| + | [PASS] 2.10 - Ensure the default cgroup usage has been confirmed (Scored) | ||
| + | [PASS] 2.11 - Ensure base device size is not changed until needed (Scored) | ||
| + | [WARN] 2.12 - Ensure that authorization for Docker client commands is enabled (Scored) | ||
| + | [WARN] 2.13 - Ensure centralized and remote logging is configured (Scored) | ||
| + | [WARN] 2.14 - Ensure containers are restricted from acquiring new privileges (Scored) | ||
| + | [WARN] 2.15 - Ensure live restore is enabled (Scored) | ||
| + | [WARN] 2.16 - Ensure Userland Proxy is Disabled (Scored) | ||
| + | [PASS] 2.17 - Ensure that a daemon-wide custom seccomp profile is applied if appropriate (Manual) | ||
| + | [PASS] 2.18 - Ensure that experimental features are not implemented in production (Scored) | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Les problèmes de sécurité qu'il convient à résoudre sont indiqués par les annotations **[WARN]**. | ||
| + | |||
| + | ====[WARN] 2.2 - Ensure network traffic is restricted between containers on the default bridge (Scored)==== | ||
| + | |||
| + | Par défaut Docker permet un trafic réseau sans restrictions entre des conteneurs sur le même hôte. Il est cependant possible de modifier la configuration par défaut. Pour empêcher ceci, il faut fixer la valeur de **icc** à **false**. De cette façon, docker crée des conteneurs qui peuvent communiquer entre eux **uniquement** s'il existe un lien. | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====[WARN] 2.9 - Enable user namespace support (Scored)==== | ||
| + | |||
| + | Cet avertissement nous indique que l' | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====[WARN] 2.12 - Ensure that authorization for Docker client commands is enabled (Scored)==== | ||
| + | |||
| + | Par défaut, Docker permet un accès sans restrictions aux daemon Docker. Il est possible de restreindre l' | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====[WARN] 2.13 - Ensure centralized and remote logging is configured (Scored)==== | ||
| + | |||
| + | Cet avertissement indique que la configuration de rsyslog ne permet pas l' | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====[WARN] 2.14 - Ensure containers are restricted from acquiring new privileges (Scored)==== | ||
| + | |||
| + | Par défaut un conteneur peut obtenir une escalade de privilèges en utilisant les binaires setuid ou setgid. Pour interdire ceci il faut fixer la valeur de **no-new-privileges** à **true**. | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====[WARN] 2.15 - Ensure live restore is enabled (Scored)==== | ||
| + | |||
| + | L' | ||
| + | |||
| + | ====[WARN] 2.16 - Ensure Userland Proxy is Disabled (Scored)==== | ||
| + | |||
| + | Il existe deux méthodes pour qu'un conteneur puisse router vers l' | ||
| + | |||
| + | * le mode **Hairpin NAT**, | ||
| + | * **Userland Proxy**. | ||
| + | |||
| + | Il est préférable d' | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====5.1 - Le Fichier / | ||
| + | |||
| + | Créez le fichier **/ | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | |||
| + | root@manager: | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | Re-démarrez le service Docker : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | </ | ||
| + | |||
| + | Vérifiez la présence de l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | uid=116(dockremap) gid=121(dockremap) groupes=121(dockremap) | ||
| + | </ | ||
| + | |||
| + | Ré-exécutez le script **Docker Benchmark Security** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | ... | ||
| + | [PASS] 2.2 - Ensure network traffic is restricted between containers on the default bridge (Scored) | ||
| + | [PASS] 2.3 - Ensure the logging level is set to ' | ||
| + | [PASS] 2.4 - Ensure Docker is allowed to make changes to iptables (Scored) | ||
| + | [PASS] 2.5 - Ensure insecure registries are not used (Scored) | ||
| + | [PASS] 2.6 - Ensure aufs storage driver is not used (Scored) | ||
| + | [PASS] 2.9 - Enable user namespace support (Scored) | ||
| + | [PASS] 2.10 - Ensure the default cgroup usage has been confirmed (Scored) | ||
| + | [PASS] 2.11 - Ensure base device size is not changed until needed (Scored) | ||
| + | [PASS] 2.13 - Ensure centralized and remote logging is configured (Scored) | ||
| + | [PASS] 2.14 - Ensure containers are restricted from acquiring new privileges (Scored) | ||
| + | [PASS] 2.15 - Ensure live restore is enabled (Scored) | ||
| + | [PASS] 2.16 - Ensure Userland Proxy is Disabled (Scored) | ||
| + | [PASS] 2.17 - Ensure that a daemon-wide custom seccomp profile is applied if appropriate (Manual) | ||
| + | [PASS] 2.18 - Ensure that experimental features are not implemented in production (Scored) | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | =====LAB #6 - Sécurisation des Images et les Fichiers de Construction===== | ||
| + | |||
| + | Créez le conteneur mysql : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Lecture des listes de paquets... Fait | ||
| + | Construction de l' | ||
| + | Lecture des informations d' | ||
| + | Le paquet suivant a été installé automatiquement et n'est plus nécessaire : | ||
| + | libsasl2-modules | ||
| + | Veuillez utiliser « apt autoremove » pour le supprimer. | ||
| + | Les paquets suivants seront mis à jour : | ||
| + | docker-ce | ||
| + | 1 mis à jour, 0 nouvellement installés, 0 à enlever et 252 non mis à jour. | ||
| + | Il est nécessaire de prendre 22,7 Mo dans les archives. | ||
| + | Après cette opération, 497 ko d' | ||
| + | Réception de:1 https:// | ||
| + | 22,7 Mo réceptionnés en 0s (26,0 Mo/s) | ||
| + | Lecture des fichiers de modifications (« changelog »)... Terminé | ||
| + | (Lecture de la base de données... 112865 fichiers et répertoires déjà installés.) | ||
| + | Préparation du dépaquetage de .../ | ||
| + | Dépaquetage de docker-ce (5: | ||
| + | Paramétrage de docker-ce (5: | ||
| + | Traitement des actions différées (« triggers ») pour systemd (232-25+deb9u14) ... | ||
| + | |||
| + | root@manager: | ||
| + | Unable to find image ' | ||
| + | latest: Pulling from library/ | ||
| + | e9f2695d7e5b: | ||
| + | 80c6055edb33: | ||
| + | c646ab461d8b: | ||
| + | 012006c6a591: | ||
| + | 929d5fa34b95: | ||
| + | 17e0243877fa: | ||
| + | 1850b459cd2f: | ||
| + | 8dceaed53baf: | ||
| + | 197b834ea1cd: | ||
| + | 8df78c25b227: | ||
| + | Digest: sha256: | ||
| + | Status: Downloaded newer image for mysql: | ||
| + | e503dd98f88992ae6ed5ec4dcaa2e18982ade8ec74966869515a120763418f74 | ||
| + | |||
| + | root@manager: | ||
| + | CONTAINER ID IMAGE | ||
| + | e503dd98f889 | ||
| + | </ | ||
| + | |||
| + | Exécutez de nouveau le script **docker-bench-security.sh**. Vous devez obtenir un résultat similaire à ceci en ce qui concerne la sécurité des images et les fichiers de leur construction : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | ... | ||
| + | [INFO] 4 - Container Images and Build File | ||
| + | [WARN] 4.1 - Ensure that a user for the container has been created (Automated) | ||
| + | [WARN] | ||
| + | [NOTE] 4.2 - Ensure that containers use only trusted base images (Manual) | ||
| + | [NOTE] 4.3 - Ensure that unnecessary packages are not installed in the container (Manual) | ||
| + | [NOTE] 4.4 - Ensure images are scanned and rebuilt to include security patches (Manual) | ||
| + | [WARN] 4.5 - Ensure Content trust for Docker is Enabled (Automated) | ||
| + | [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images (Automated) | ||
| + | [WARN] | ||
| + | [PASS] 4.7 - Ensure update instructions are not used alone in the Dockerfile (Manual) | ||
| + | [NOTE] 4.8 - Ensure setuid and setgid permissions are removed (Manual) | ||
| + | [PASS] 4.9 - Ensure that COPY is used instead of ADD in Dockerfiles (Manual) | ||
| + | [NOTE] 4.10 - Ensure secrets are not stored in Dockerfiles (Manual) | ||
| + | [NOTE] 4.11 - Ensure only verified packages are installed (Manual) | ||
| + | [NOTE] 4.12 - Ensure all signed artifacts are validated (Manual) | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | ====[WARN] 4.1 - Ensure that a user for the container has been created (Automated)==== | ||
| + | |||
| + | Les processus dans le conteneur **mysql** tourne sous l'UID de root. Ceci est l' | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====[WARN] 4.5 - Ensure Content trust for Docker is Enabled (Automated)==== | ||
| + | |||
| + | Cette ligne indique que le support de Content trust n'a pas été activé. Content trust permet de s' | ||
| + | |||
| + | Pour activer le Content trust, il faut positionner la valeur de la variable **DOCKER_CONTENT_TRUST** à **1** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | DOCKER_CONTENT_TRUST=1 | ||
| + | |||
| + | root@manager: | ||
| + | </ | ||
| + | |||
| + | Re-démarrez la machine virtuelle **Manager** et démarrez le conteneur **mysql** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Connection to 10.0.2.62 closed by remote host. | ||
| + | Connection to 10.0.2.62 closed. | ||
| + | |||
| + | root@debian11: | ||
| + | trainee@10.0.2.62' | ||
| + | Linux manager.i2tch.loc 4.9.0-8-amd64 #1 SMP Debian 4.9.130-2 (2018-10-27) x86_64 | ||
| + | |||
| + | The programs included with the Debian GNU/Linux system are free software; | ||
| + | the exact distribution terms for each program are described in the | ||
| + | individual files in / | ||
| + | |||
| + | Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent | ||
| + | permitted by applicable law. | ||
| + | Last login: Sun Dec 17 18:39:07 2023 from 10.0.2.46 | ||
| + | |||
| + | trainee@manager: | ||
| + | Mot de passe : fenestros | ||
| + | |||
| + | root@manager: | ||
| + | |||
| + | root@manager: | ||
| + | |||
| + | root@manager: | ||
| + | mysql | ||
| + | </ | ||
| + | |||
| + | Exécutez de nouveau le script et notez le contenu de la section 4 : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | ... | ||
| + | [INFO] 4 - Container Images and Build File | ||
| + | [WARN] 4.1 - Ensure that a user for the container has been created (Automated) | ||
| + | [WARN] | ||
| + | [NOTE] 4.2 - Ensure that containers use only trusted base images (Manual) | ||
| + | [NOTE] 4.3 - Ensure that unnecessary packages are not installed in the container (Manual) | ||
| + | [NOTE] 4.4 - Ensure images are scanned and rebuilt to include security patches (Manual) | ||
| + | [PASS] 4.5 - Ensure Content trust for Docker is Enabled (Automated) | ||
| + | [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images (Automated) | ||
| + | [WARN] | ||
| + | [PASS] 4.7 - Ensure update instructions are not used alone in the Dockerfile (Manual) | ||
| + | [NOTE] 4.8 - Ensure setuid and setgid permissions are removed (Manual) | ||
| + | [PASS] 4.9 - Ensure that COPY is used instead of ADD in Dockerfiles (Manual) | ||
| + | [NOTE] 4.10 - Ensure secrets are not stored in Dockerfiles (Manual) | ||
| + | [NOTE] 4.11 - Ensure only verified packages are installed (Manual) | ||
| + | [NOTE] 4.12 - Ensure all signed artifacts are validated (Manual) | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====[WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images==== | ||
| + | |||
| + | Quand une image est construite il est possible d'y mettre un **HEALTHCHECK** dont le statut peut être vérifié par Docker afin de relancer le conteneur si nécessaire. | ||
| + | |||
| + | Pour mettre en place un HEALTHCHECK, | ||
| + | |||
| + | < | ||
| + | HEALTHCHECK --interval=20s --timeout=3s CMD curl -f http:// | ||
| + | </ | ||
| + | |||
| + | Ce test permet de vérifier que le conteneur peut atteindre l'URL indiqué tous les 20 secondes et produit une erreur au bout de 3 secondes. | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | =====LAB #7 - Sécurisation du Container Runtime===== | ||
| + | |||
| + | Exécutez de nouveau le script **docker-bench-security.sh**, | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | ... | ||
| + | [INFO] 5 - Container Runtime | ||
| + | [WARN] 5.1 - Ensure that, if applicable, an AppArmor Profile is enabled (Automated) | ||
| + | [WARN] | ||
| + | [WARN] 5.2 - Ensure that, if applicable, SELinux security options are set (Automated) | ||
| + | [WARN] | ||
| + | [PASS] 5.3 - Ensure that Linux kernel capabilities are restricted within containers (Automated) | ||
| + | [PASS] 5.4 - Ensure that privileged containers are not used (Automated) | ||
| + | [PASS] 5.5 - Ensure sensitive host system directories are not mounted on containers (Automated) | ||
| + | [PASS] 5.6 - Ensure sshd is not run within containers (Automated) | ||
| + | [PASS] 5.7 - Ensure privileged ports are not mapped within containers (Automated) | ||
| + | [PASS] 5.8 - Ensure that only needed ports are open on the container (Manual) | ||
| + | [PASS] 5.9 - Ensure that the host's network namespace is not shared (Automated) | ||
| + | [WARN] 5.10 - Ensure that the memory usage for containers is limited (Automated) | ||
| + | [WARN] | ||
| + | [WARN] 5.11 - Ensure that CPU priority is set appropriately on containers (Automated) | ||
| + | [WARN] | ||
| + | [WARN] 5.12 - Ensure that the container' | ||
| + | [WARN] | ||
| + | [PASS] 5.13 - Ensure that incoming container traffic is bound to a specific host interface (Automated) | ||
| + | [WARN] 5.14 - Ensure that the ' | ||
| + | [WARN] | ||
| + | [PASS] 5.15 - Ensure that the host's process namespace is not shared (Automated) | ||
| + | [PASS] 5.16 - Ensure that the host's IPC namespace is not shared (Automated) | ||
| + | [PASS] 5.17 - Ensure that host devices are not directly exposed to containers (Manual) | ||
| + | [INFO] 5.18 - Ensure that the default ulimit is overwritten at runtime if needed (Manual) | ||
| + | [INFO] | ||
| + | [PASS] 5.19 - Ensure mount propagation mode is not set to shared (Automated) | ||
| + | [PASS] 5.20 - Ensure that the host's UTS namespace is not shared (Automated) | ||
| + | [PASS] 5.21 - Ensure the default seccomp profile is not Disabled (Automated) | ||
| + | [NOTE] 5.22 - Ensure that docker exec commands are not used with the privileged option (Automated) | ||
| + | [NOTE] 5.23 - Ensure that docker exec commands are not used with the user=root option (Manual) | ||
| + | [PASS] 5.24 - Ensure that cgroup usage is confirmed (Automated) | ||
| + | [PASS] 5.25 - Ensure that the container is restricted from acquiring additional privileges (Automated) | ||
| + | [WARN] 5.26 - Ensure that container health is checked at runtime (Automated) | ||
| + | [WARN] | ||
| + | [INFO] 5.27 - Ensure that Docker commands always make use of the latest version of their image (Manual) | ||
| + | [WARN] 5.28 - Ensure that the PIDs cgroup limit is used (Automated) | ||
| + | [WARN] | ||
| + | [INFO] 5.29 - Ensure that Docker' | ||
| + | [INFO] | ||
| + | [PASS] 5.30 - Ensure that the host's user namespaces are not shared (Automated) | ||
| + | [PASS] 5.31 - Ensure that the Docker socket is not mounted inside any containers (Automated) | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Les problèmes de sécurité qu'il convient à résoudre sont indiqués par les annotations **[WARN]**. | ||
| + | |||
| + | ====[WARN] 5.1 - Ensure that, if applicable, an AppArmor Profile is enabled (Automated)==== | ||
| + | |||
| + | Cet avertissement est présent parce que le conteneur n' | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====[WARN] 5.2 - Ensure that, if applicable, SELinux security options are set (Automated)==== | ||
| + | |||
| + | Cet avertissement est présent parce que le conteneur n' | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====[WARN] 5.10 - Ensure that the memory usage for containers is limited (Automated)==== | ||
| + | |||
| + | Cet avertissement est du au fait que les conteneurs ont automatiquement accès à la totalité de la RAM de l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | b04b2a6f0dd93da21a8b7640afc319406e42868a141f90936dbcf52ab5bffb0d | ||
| + | root@manager: | ||
| + | CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS | ||
| + | b04b2a6f0dd9 | ||
| + | ^C | ||
| + | </ | ||
| + | |||
| + | Supprimez le conteneur et re-créez le avec une limite de mémoire : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Unable to find image ' | ||
| + | sha256: | ||
| + | 1f7ce2fa46ab: | ||
| + | 9b16c94bb686: | ||
| + | 9a59d19f9c5b: | ||
| + | 9ea27b074f71: | ||
| + | c6edf33e2524: | ||
| + | 84b1ff10387b: | ||
| + | 517357831967: | ||
| + | Digest: sha256: | ||
| + | Status: Downloaded newer image for nginx@sha256: | ||
| + | Tagging nginx@sha256: | ||
| + | e14d5112c2feb71e6f37252bcf99d03603d6b7a3e200bff0d55611a0e9a25e2b | ||
| + | |||
| + | root@manager: | ||
| + | CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS | ||
| + | e14d5112c2fe | ||
| + | e503dd98f889 | ||
| + | ^C | ||
| + | </ | ||
| + | |||
| + | Supprimez le conteneur et re-créez-le avec une limite de mémoire : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | CONTAINER ID IMAGE | ||
| + | e14d5112c2fe | ||
| + | e503dd98f889 | ||
| + | |||
| + | root@manager: | ||
| + | e14 | ||
| + | |||
| + | root@manager: | ||
| + | 38e91e096c83f7cbe78089617a4d70110bd273f53339f8fed8df2503d3cd65ca | ||
| + | |||
| + | root@manager: | ||
| + | CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS | ||
| + | 38e91e096c83 | ||
| + | e503dd98f889 | ||
| + | ^C | ||
| + | </ | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====[WARN] 5.11 - Ensure that CPU priority is set appropriately on containers (Automated)==== | ||
| + | |||
| + | Cet avertissement est du au fait que les conteneurs ont automatiquement accès à tous les CPU de l' | ||
| + | |||
| + | La valeur de cpu-shares est relative à la valeur par défaut de **1024**. Un valeur de 512 permet au conteneur d' | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====[WARN] 5.12 - Ensure that the container' | ||
| + | |||
| + | Afin de minimiser le risque de compromettre un conteneur par la présence de code malicieux, il est conseillé de démarrer les conteneurs en lecture seule, sauf pour les volumes qui nécessitent un accès en écriture/ | ||
| + | |||
| + | Créez le fichier **write_a_file** dans le conteneur **mysql** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | </ | ||
| + | |||
| + | La Commande **docker container diff** indique les différences apportées au conteneur par rapport à l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | C /run | ||
| + | C /run/mysqld | ||
| + | A / | ||
| + | A / | ||
| + | A / | ||
| + | A / | ||
| + | A / | ||
| + | A / | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Notez que la sortie indique les changements apportés au conteneur. | ||
| + | </ | ||
| + | |||
| + | Arrêtez et supprimez le conteneur : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | mysql | ||
| + | |||
| + | root@manager: | ||
| + | mysql | ||
| + | </ | ||
| + | |||
| + | Lancez un conteneur mysql en lecture seule : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | 711ab28bdfb41220c84246c1658bcde398681a78291bbbe7d3bbfd9bc317d41b | ||
| + | </ | ||
| + | |||
| + | Créez le fichier **write_a_file** dans le conteneur **mysql** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | touch: cannot touch '/ | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Notez l' | ||
| + | </ | ||
| + | |||
| + | Exécutez la commande **docker container diff** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | root@manager: | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Notez que la commande ne retourne aucune sortie. En effet le conteneur étant en lecture seule, aucun changement ne peut intervenir. | ||
| + | </ | ||
| + | |||
| + | ====[WARN] 5.14 - Ensure that the ' | ||
| + | |||
| + | Cet avertissement concerne la politique de re-démarrage du conteneur. La politique **on-failure[: | ||
| + | |||
| + | # docker container run -d --name mysql --read-only --restart on-failure: | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====[WARN] 5.26 - Ensure that container health is checked at runtime (Automated)==== | ||
| + | |||
| + | Voir l' | ||
| + | |||
| + | ====[WARN] 5.28 - Ensure that the PIDs cgroup limit is used (Automated)==== | ||
| + | |||
| + | Sans l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | </ | ||
| + | |||
| + | L' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Unable to find image ' | ||
| + | sha256: | ||
| + | a48641193673: | ||
| + | Digest: sha256: | ||
| + | Status: Downloaded newer image for ubuntu@sha256: | ||
| + | Tagging ubuntu@sha256: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | environment: | ||
| + | ^P^Q | ||
| + | </ | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | Supprimez maintenant tous les conteneurs déjà créées : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | db5ae43c3e55 | ||
| + | f3b2528fbac0 | ||
| + | 711ab28bdfb4 | ||
| + | |||
| + | root@manager: | ||
| + | CONTAINER ID IMAGE | ||
| + | </ | ||
| + | |||
| + | Re-créez le conteneur mysql en intégrant les points vus ci-dessus : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | f49d1ffdeae2e83435e8cc3a2e03fb2e0b33e5609d266e5a3403ff8859e5d122 | ||
| + | |||
| + | root@manager: | ||
| + | CONTAINER ID IMAGE | ||
| + | f49d1ffdeae2 | ||
| + | </ | ||
| + | |||
| + | Exécutez de nouveau le script **docker-bench-security.sh**, | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | ... | ||
| + | [PASS] 5.2 - Ensure that, if applicable, SELinux security options are set (Automated) | ||
| + | [PASS] 5.10 - Ensure that the memory usage for containers is limited (Automated) | ||
| + | [PASS] 5.11 - Ensure that CPU priority is set appropriately on containers (Automated) | ||
| + | [PASS] 5.12 - Ensure that the container' | ||
| + | [PASS] 5.14 - Ensure that the ' | ||
| + | [PASS] 5.28 - Ensure that the PIDs cgroup limit is used (Automated) | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | =====LAB #8 - Sécurisation des Images avec Docker Content Trust===== | ||
| + | |||
| + | **Docker Content Trust (DCT)** a été introduit avec Docker Engine 1.8 et Docker CS Engine 1.9.0. DCT permet la vérification de l' | ||
| + | |||
| + | DCT est utilisé par le **Docker Hub Registry** mais peut aussi être mis en place dans des Registry privés, notamment grâce à la mise en place du **[[https:// | ||
| + | |||
| + | DCT est basé sur l' | ||
| + | |||
| + | Pour plus d' | ||
| + | |||
| + | ====8.1 - DOCKER_CONTENT_TRUST==== | ||
| + | |||
| + | Pour utiliser **Docker Content Trust (DCT)**, il convient de vérifier que la valeur de la variable **DOCKER_CONTENT_TRUST** est **1** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | 1 | ||
| + | </ | ||
| + | |||
| + | Dans le cas contraire, il faut fixer la valeur de la variable à 1 : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | root@manager: | ||
| + | 1 | ||
| + | </ | ||
| + | |||
| + | ====8.2 - DCT et la commande docker pull==== | ||
| + | |||
| + | Afin d' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Login with your Docker ID to push and pull images from Docker Hub. If you don't have a Docker ID, head over to https:// | ||
| + | Username: < | ||
| + | Password: < | ||
| + | WARNING! Your password will be stored unencrypted in / | ||
| + | Configure a credential helper to remove this warning. See | ||
| + | https:// | ||
| + | |||
| + | Login Succeeded | ||
| + | </ | ||
| + | |||
| + | Pour constater l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Error: remote trust data does not exist for docker.io/ | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Notez l' | ||
| + | </ | ||
| + | |||
| + | Par contre, toutes les images de type **official** sont signées : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Using default tag: latest | ||
| + | Pull (1 of 1): centos: | ||
| + | sha256: | ||
| + | 729ec3a6ada3: | ||
| + | Digest: sha256: | ||
| + | Status: Downloaded newer image for centos@sha256: | ||
| + | Tagging centos@sha256: | ||
| + | docker.io/ | ||
| + | </ | ||
| + | |||
| + | Cette image est maintenant présente sur **manager.i2tch.loc** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | REPOSITORY | ||
| + | ubuntu | ||
| + | nginx | ||
| + | alpine | ||
| + | mysql | ||
| + | centos | ||
| + | </ | ||
| + | |||
| + | ===L' | ||
| + | |||
| + | Il est aussi possible d' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | unsigned: Pulling from i2tch/ | ||
| + | 10d70a43a9f9: | ||
| + | 4f4fb700ef54: | ||
| + | 8951e3a91277: | ||
| + | d1814ff35b8b: | ||
| + | ff2a2bbf6141: | ||
| + | b7205da5c3c9: | ||
| + | 458ea241cc75: | ||
| + | 74d1c0702786: | ||
| + | c66f3692932d: | ||
| + | 9224bd1b9757: | ||
| + | Digest: sha256: | ||
| + | Status: Downloaded newer image for i2tch/ | ||
| + | docker.io/ | ||
| + | |||
| + | root@manager: | ||
| + | REPOSITORY | ||
| + | ubuntu | ||
| + | nginx | ||
| + | alpine | ||
| + | mysql | ||
| + | centos | ||
| + | i2tch/ | ||
| + | |||
| + | root@manager: | ||
| + | Untagged: i2tch/ | ||
| + | Untagged: i2tch/ | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | Deleted: sha256: | ||
| + | </ | ||
| + | |||
| + | ====8.3 - DCT et la commande docker push==== | ||
| + | |||
| + | Pour envoyer l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | </ | ||
| + | |||
| + | L' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | REPOSITORY | ||
| + | ubuntu | ||
| + | nginx latest | ||
| + | < | ||
| + | alpine | ||
| + | mysql latest | ||
| + | centos | ||
| + | </ | ||
| + | |||
| + | Lors du push vers le registry privé, il faut créer des passphrases pour **deux** clefs : | ||
| + | |||
| + | * la **root** key aussi connue sous le nom **offline** key (ID 192fc7e), qui est uniquement demandée la **première** fois après la mise en place de DCT lors de la création d'un **repositry**, | ||
| + | * la **repository** key aussi connue sous le nom **tagging** key (ID 168c754), utilisée pour signer l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | The push refers to repository [docker.io/< | ||
| + | 77cae8ab23bf: | ||
| + | alpine: digest: sha256: | ||
| + | Signing and pushing trust metadata | ||
| + | You are about to create a new root signing key passphrase. This passphrase | ||
| + | will be used to protect the most sensitive key in your signing system. Please | ||
| + | choose a long, complex passphrase and be careful to keep the password and the | ||
| + | key file itself secure and backed up. It is highly recommended that you use a | ||
| + | password manager to generate the passphrase and keep it safe. There will be no | ||
| + | way to recover this key. You can find the key in your config directory. | ||
| + | Enter passphrase for new root key with ID 192fc7e: fenestros | ||
| + | Repeat passphrase for new root key with ID 192fc7e: fenestros | ||
| + | Enter passphrase for new repository key with ID 168c754: fenestros | ||
| + | Repeat passphrase for new repository key with ID 168c754: fenestros | ||
| + | Finished initializing " | ||
| + | Successfully signed docker.io/< | ||
| + | </ | ||
| + | |||
| + | Les clefs sont stockées dans le répertoire **~/ | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | total 8 | ||
| + | drwx------ 2 root root 4096 nov. 10 14:49 private | ||
| + | drwx------ 3 root root 4096 nov. 8 13:48 tuf | ||
| + | |||
| + | root@manager: | ||
| + | total 8 | ||
| + | -rw------- 1 root root 447 nov. 10 14:49 168c754ea8f36ce7fbcbe2299b6d91fc0f4d594c9ed9b86916687b618d8438ac.key | ||
| + | -rw------- 1 root root 416 nov. 10 14:49 192fc7ed9543ad4bceec58886ab1d605b7433c35f7462d7343d0780d8fddf1db.key | ||
| + | root@manager: | ||
| + | -----BEGIN ENCRYPTED PRIVATE KEY----- | ||
| + | gun: docker.io/ | ||
| + | role: targets | ||
| + | |||
| + | MIHuMEkGCSqGSIb3DQEFDTA8MBsGCSqGSIb3DQEFDDAOBAhm7HwR0y8FFAICCAAw | ||
| + | HQYJYIZIAWUDBAEqBBC729tU73wKHFQSbmZ1EVZaBIGgmGiFSs4lM5tElSGukl1B | ||
| + | HrELT9aFooFgW7oSXNLM8aFfF/ | ||
| + | 3m40g3MywHilW4rUcjoHVTTUXABGXUQ3f7h+nI15CXcZ11qRLyWbf2uywE9yYH9O | ||
| + | M7GLUcE+pTENJKfZAhRGBEL+LgXNfGI1aAVqaEbBDcDnKKf4Uj1Xu4oLJ7je8+nT | ||
| + | dg== | ||
| + | -----END ENCRYPTED PRIVATE KEY----- | ||
| + | |||
| + | root@manager: | ||
| + | -----BEGIN ENCRYPTED PRIVATE KEY----- | ||
| + | role: root | ||
| + | |||
| + | MIHuMEkGCSqGSIb3DQEFDTA8MBsGCSqGSIb3DQEFDDAOBAiAtCzEar3AhgICCAAw | ||
| + | HQYJYIZIAWUDBAEqBBAO7hHWVoqOo6xcETQQDXRdBIGgPUoLzTz07Ajx8K3D8+Vv | ||
| + | 2NUiflMYhH/ | ||
| + | V2BwSlXp7t1Cnqp/ | ||
| + | KREO8uEq3v7HcSBBqFm0+TU+92d7hVuDApPaj0lZYP+3f7H6AjUOqu6hUoK8Ck/ | ||
| + | Ig== | ||
| + | -----END ENCRYPTED PRIVATE KEY----- | ||
| + | </ | ||
| + | |||
| + | ====8.4 - DCT et la commande docker build==== | ||
| + | |||
| + | L' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | |||
| + | root@manager: | ||
| + | |||
| + | root@manager: | ||
| + | |||
| + | root@manager: | ||
| + | FROM docker/ | ||
| + | RUN echo | ||
| + | </ | ||
| + | |||
| + | Lors du build de l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Sending build context to Docker daemon | ||
| + | |||
| + | error during connect: Post http:// | ||
| + | </ | ||
| + | |||
| + | L' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Sending build context to Docker daemon | ||
| + | Step 1/2 : FROM docker/ | ||
| + | latest: Pulling from docker/ | ||
| + | Image docker.io/ | ||
| + | aac0c133338d: | ||
| + | a3ed95caeb02: | ||
| + | Digest: sha256: | ||
| + | Status: Downloaded newer image for docker/ | ||
| + | | ||
| + | Step 2/2 : RUN echo | ||
| + | | ||
| + | |||
| + | Removing intermediate container 694e79d3cd88 | ||
| + | | ||
| + | Successfully built 686e85ee76b8 | ||
| + | Successfully tagged < | ||
| + | </ | ||
| + | |||
| + | Lors du push de l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | The push refers to repository [docker.io/< | ||
| + | 5f70bf18a086: | ||
| + | c22f7bc058a9: | ||
| + | nottrusted: digest: sha256: | ||
| + | Signing and pushing trust metadata | ||
| + | Enter passphrase for repository key with ID 168c754: fenestros | ||
| + | Successfully signed docker.io/< | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Notez l' | ||
| + | </ | ||
| + | |||
| + | ===Créer un deuxième Repositry=== | ||
| + | |||
| + | Par contre en modifiant le tag de l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | |||
| + | root@manager: | ||
| + | REPOSITORY | ||
| + | < | ||
| + | < | ||
| + | ubuntu | ||
| + | nginx latest | ||
| + | < | ||
| + | alpine | ||
| + | mysql latest | ||
| + | centos | ||
| + | docker/ | ||
| + | |||
| + | root@manager: | ||
| + | The push refers to repository [docker.io/< | ||
| + | 5f70bf18a086: | ||
| + | c22f7bc058a9: | ||
| + | latest: digest: sha256: | ||
| + | Signing and pushing trust metadata | ||
| + | Enter passphrase for root key with ID 192fc7e: fenestros | ||
| + | Enter passphrase for new repository key with ID 7b13d02: fenestros | ||
| + | Repeat passphrase for new repository key with ID 7b13d02: fenestros | ||
| + | Finished initializing " | ||
| + | Successfully signed docker.io/< | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Notez la création d'une deuxième repositry key (ID 7b13d02 au lieu de ID 168c754) lors du push de l' | ||
| + | </ | ||
| + | |||
| + | La présence de cette deuxième repositry key (**7b13d02d74264624fb201e7ae13ae694286b9f761aa86adddefd0408c7234a58.key**) peut être constatée dans le répertoire **~/ | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | total 12 | ||
| + | -rw------- 1 root root 447 nov. 10 14:49 168c754ea8f36ce7fbcbe2299b6d91fc0f4d594c9ed9b86916687b618d8438ac.key | ||
| + | -rw------- 1 root root 416 nov. 10 14:49 192fc7ed9543ad4bceec58886ab1d605b7433c35f7462d7343d0780d8fddf1db.key | ||
| + | -rw------- 1 root root 451 nov. 10 17:37 7b13d02d74264624fb201e7ae13ae694286b9f761aa86adddefd0408c7234a58.key | ||
| + | </ | ||
| + | |||
| + | En inspectant les clefs des images créées, l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | [ | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | "Repo Admin" | ||
| + | ] | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| + | root@manager: | ||
| + | [ | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | "Repo Admin" | ||
| + | ] | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Notez que les clefs utilisées sont les mêmes pour les deux images. | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | [ | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | "Repo Admin" | ||
| + | ] | ||
| + | } | ||
| + | ], | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Notez que les clefs utilisées sont différentes. | ||
| + | </ | ||
| + | |||
| + | ===Supprimer une Signature=== | ||
| + | |||
| + | Dernièrement il est possible de supprimer la signature d'une image avec la commande **docker trust revoke** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Enter passphrase for repository key with ID 168c754: | ||
| + | Successfully deleted signature for < | ||
| + | root@manager: | ||
| + | [ | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | }, | ||
| + | { | ||
| + | " | ||
| + | " | ||
| + | { | ||
| + | " | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| + | } | ||
| + | ] | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 50%> | ||
| + | **Important** : Il existe un autre mécanisme de signatures cryptographiques qui permet de certifier le contenu des images mises à disposition sur une Registry. Appelé **Notary**, ce système a été développé par la communauté Docker et intègre une partie de la spécification de **[[https:// | ||
| + | </ | ||
| + | |||
| + | =====LAB #9 - Sécurisation du Socket du Daemon Docker===== | ||
| + | |||
| + | Par défaut le daemon Docker peut être contacté en utilisant un socket Unix local ce qui implique qu'il faut une connexion SSH vers l' | ||
| + | |||
| + | Pour pouvoir contacter de daemon Docker via le réseau d'une manière sécurisée il faut installer, configurer et activer le support TLS grâce aux options **tlsverify** et **tlscacert**. | ||
| + | |||
| + | La configuration implique que : | ||
| + | |||
| + | * pour le daemon Docker, seules les connections en provenance de clients authentifiés par un certificat signé par l' | ||
| + | * pour le client, il ne peut que connecter aux serveurs ayant un certificat signé par le CA du serveur. | ||
| + | |||
| + | La mise en place nécessite **openssl** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | ====9.1 - Création du Certificat de l' | ||
| + | |||
| + | Commencez par créer une clef privée **ca-key.pem** pour le CA : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Generating RSA private key, 4096 bit long modulus | ||
| + | ......................................................................................................................++++ | ||
| + | ...............................................................................................................................................................++++ | ||
| + | e is 65537 (0x010001) | ||
| + | Enter pass phrase for ca-key.pem: | ||
| + | Verifying - Enter pass phrase for ca-key.pem: | ||
| + | </ | ||
| + | |||
| + | Ensuite, créez le certificat **ca.pem** du CA : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Enter pass phrase for ca-key.pem: | ||
| + | You are about to be asked to enter information that will be incorporated | ||
| + | into your certificate request. | ||
| + | What you are about to enter is what is called a Distinguished Name or a DN. | ||
| + | There are quite a few fields but you can leave some blank | ||
| + | For some fields there will be a default value, | ||
| + | If you enter ' | ||
| + | ----- | ||
| + | Country Name (2 letter code) [AU]:GB | ||
| + | State or Province Name (full name) [Some-State]: | ||
| + | Locality Name (eg, city) []: | ||
| + | Organization Name (eg, company) [Internet Widgits Pty Ltd]:I2TCH LIMITED | ||
| + | Organizational Unit Name (eg, section) []:TRAINING | ||
| + | Common Name (e.g. server FQDN or YOUR name) []: | ||
| + | Email Address []: | ||
| + | </ | ||
| + | |||
| + | ====9.2 - Création du Certificat du Serveur Hôte du Daemon Docker==== | ||
| + | |||
| + | Les clefs du CA ayant été créées, créez une clef **server-key.pem** pour le serveur hôte du daemon Docker : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Generating RSA private key, 4096 bit long modulus | ||
| + | .................................................................................................................................++++ | ||
| + | ...........................++++ | ||
| + | e is 65537 (0x010001) | ||
| + | </ | ||
| + | |||
| + | Créez ensuite un **[[https:// | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | manager.i2tch.loc | ||
| + | root@manager: | ||
| + | </ | ||
| + | |||
| + | Une connexion TLS peut être effectuée en utilisant un FQDN ou une adresse IP. Pour cette raison, créez le fichier **extfile.cnf** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | </ | ||
| + | |||
| + | Fixez l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | </ | ||
| + | |||
| + | Vérifiez que votre fichier a été correctement créé : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | subjectAltName = DNS: | ||
| + | extendedKeyUsage = serverAuth | ||
| + | </ | ||
| + | |||
| + | Signez maintenant le CSR du serveur **server.csr** avec la clef privée du CA **ca-key.pem** afin de produire le certificat du serveur **server-cert.pem** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Signature ok | ||
| + | subject=CN = manager.i2tch.loc | ||
| + | Getting CA Private Key | ||
| + | Enter pass phrase for ca-key.pem: | ||
| + | </ | ||
| + | |||
| + | ====9.3 - Création du Certificat du Client==== | ||
| + | |||
| + | Créez ensuite la clef privée **key.pem** du client qui se connectera au daemon à partir du réseau : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Generating RSA private key, 4096 bit long modulus | ||
| + | ...................................................................................................................................++++ | ||
| + | ...............++++ | ||
| + | e is 65537 (0x010001) | ||
| + | </ | ||
| + | |||
| + | Modifiez l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | root@manager: | ||
| + | 127.0.0.1 localhost | ||
| + | 10.0.2.46 debian11.i2tch.loc debian11 | ||
| + | 10.0.2.45 myregistry.i2tch.loc | ||
| + | 10.0.2.62 manager.i2tch.loc manager | ||
| + | 10.0.2.63 worker1.i2tch.loc worker1 | ||
| + | 10.0.2.64 worker2.i2tch.loc worker2 | ||
| + | |||
| + | # The following lines are desirable for IPv6 capable hosts | ||
| + | ::1 | ||
| + | ff02::1 ip6-allnodes | ||
| + | ff02::2 ip6-allrouters | ||
| + | </ | ||
| + | |||
| + | Créez ensuite le CSR du client **client.csr** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | </ | ||
| + | |||
| + | Fixez l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | </ | ||
| + | |||
| + | Signez le CSR du client **client.csr** avec la clef privée du CA **ca-key.pem** afin de créer le certificat du client **cert.pem** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Signature ok | ||
| + | subject=CN = myregistry.i2tch.loc | ||
| + | Getting CA Private Key | ||
| + | Enter pass phrase for ca-key.pem: | ||
| + | </ | ||
| + | |||
| + | Vérifiez la présence des fichiers générés : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | total 60 | ||
| + | -rw------- 1 root root 3326 nov. 11 10:53 ca-key.pem | ||
| + | -rw-r--r-- 1 root root 2163 nov. 11 10:57 ca.pem | ||
| + | -rw-r--r-- 1 root root 17 nov. 11 11:15 ca.srl | ||
| + | -rw-r--r-- 1 root root 1907 nov. 11 11:15 cert.pem | ||
| + | -rw-r--r-- 1 root root 1594 nov. 11 11:12 client.csr | ||
| + | drwxr-xr-x 5 root root 4096 nov. 8 12:58 docker-bench-security | ||
| + | -rw-r--r-- 1 root root 1707 nov. 8 12:35 docker-stack.yml | ||
| + | -rw-r--r-- 1 root root 30 nov. 11 11:13 extfile-client.cnf | ||
| + | -rw-r--r-- 1 root root 95 nov. 11 11:06 extfile.cnf | ||
| + | -rw------- 1 root root 3243 nov. 11 11:10 key.pem | ||
| + | drwxr-xr-x 2 root root 4096 nov. 10 17:21 nottrusted | ||
| + | -rw-r--r-- 1 root root 1964 nov. 11 11:08 server-cert.pem | ||
| + | -rw-r--r-- 1 root root 1594 nov. 11 11:01 server.csr | ||
| + | -rw------- 1 root root 3243 nov. 11 10:59 server-key.pem | ||
| + | -rw-r--r-- 1 root root 882 oct. 27 15:46 stats | ||
| + | </ | ||
| + | |||
| + | Supprimez les fichiers ayant déjà été utilisés, à savoir les deux CSR et les deux fichiers des extensions : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | </ | ||
| + | |||
| + | Modifiez les permissions des clefs privées : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | le mode de ' | ||
| + | le mode de ' | ||
| + | le mode de ' | ||
| + | </ | ||
| + | |||
| + | Ainsi que les permissions des certificats : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | le mode de ' | ||
| + | le mode de ' | ||
| + | le mode de ' | ||
| + | </ | ||
| + | |||
| + | Arrêtez et supprimez le conteneur **mysql** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | mysql | ||
| + | root@manager: | ||
| + | mysql | ||
| + | </ | ||
| + | |||
| + | ====9.4 - Démarrage du Daemon Docker avec une Invocation Directe==== | ||
| + | |||
| + | Arrêtez et désactivez le service Docker : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | Warning: Stopping docker.service, | ||
| + | docker.socket | ||
| + | root@manager: | ||
| + | Synchronizing state of docker.service with SysV service script with / | ||
| + | Executing: / | ||
| + | </ | ||
| + | |||
| + | Lancez un invocation directe de **dockerd** afin que le daemon n' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | [1] 1868 | ||
| + | root@manager: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | WARN[2019-11-11T12: | ||
| + | WARN[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | INFO[2019-11-11T12: | ||
| + | [Entrée] | ||
| + | root@manager: | ||
| + | </ | ||
| + | |||
| + | Vérifiez que le processus tourne : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | root 1868 0.2 4.0 421876 82236 pts/0 Sl | ||
| + | root 1995 0.0 0.0 12780 964 pts/0 S+ | ||
| + | </ | ||
| + | |||
| + | Installez le paquet **net-tools** qui contient le binaire **netstat** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | </ | ||
| + | |||
| + | Vérifiez que le port **2376** est à l' | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | tcp6 | ||
| + | </ | ||
| + | |||
| + | ====9.5 - Configuration du Client==== | ||
| + | |||
| + | Transférez ensuite le certificat du CA ainsi que le certificat et la clef privée du client vers la VM **10.0.2.45** : | ||
| + | |||
| + | < | ||
| + | root@manager: | ||
| + | The authenticity of host ' | ||
| + | ECDSA key fingerprint is SHA256: | ||
| + | Are you sure you want to continue connecting (yes/no)? yes | ||
| + | Warning: Permanently added ' | ||
| + | trainee@10.0.2.45' | ||
| + | ca.pem | ||
| + | key.pem | ||
| + | cert.pem | ||
| + | </ | ||
| + | |||
| + | Lancez la commande **docker version** sur la VM **10.0.2.45** : | ||
| + | |||
| + | < | ||
| + | trainee@myregistry: | ||
| + | Client: Docker Engine - Community | ||
| + | | ||
| + | API version: | ||
| + | Go version: | ||
| + | Git commit: | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Server: Docker Engine - Community | ||
| + | | ||
| + | Version: | ||
| + | API version: | ||
| + | Go version: | ||
| + | Git commit: | ||
| + | Built: | ||
| + | OS/ | ||
| + | Experimental: | ||
| + | | ||
| + | Version: | ||
| + | GitCommit: | ||
| + | runc: | ||
| + | Version: | ||
| + | GitCommit: | ||
| + | | ||
| + | Version: | ||
| + | GitCommit: | ||
| + | </ | ||
| + | |||
| + | Afin de faciliter l' | ||
| + | |||
| + | < | ||
| + | trainee@myregistry: | ||
| + | mkdir: création du répertoire '/ | ||
| + | </ | ||
| + | |||
| + | Copiez ensuite les fichiers *.pem dans le répertoire **~/ | ||
| + | |||
| + | < | ||
| + | trainee@myregistry: | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | </ | ||
| + | |||
| + | Créez les deux variables **DOCKER_HOST** et **DOCKER_TLS_VERIFY** : | ||
| + | |||
| + | < | ||
| + | trainee@myregistry: | ||
| + | </ | ||
| + | |||
| + | Maintenant la connexion est sécurisée par défaut : | ||
| + | |||
| + | < | ||
| + | trainee@myregistry: | ||
| + | REPOSITORY | ||
| + | i2tch/ | ||
| + | i2tch/ | ||
| + | ubuntu | ||
| + | nginx | ||
| + | alpine | ||
| + | i2tch/ | ||
| + | mysql | ||
| + | centos | ||
| + | docker/ | ||
| + | </ | ||
| + | |||
| + | ----- | ||
| + | |||
| + | Copyright © 2024 Hugh Norris. | ||
