Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Alpine Linux Docker images have NULL for root password

cve.mitre.org

Post reply on HN
Print view View original

171–180 of 203 posts

Re: Alpine Linux Docker images have NULL for root password

#171

Post by zaarn »

arghwhat wrote: post #169
zaarn wrote: post #162

Earlier quoted context omitted.

Alpine comes with no suid binaries in Docker to my knowledge (it's expected you run your stuff as root inside the container unless there is a reason not to)

Just for the uninitiated: suid binaries are binaries with a special flag set that will make it run with root privileges regardless of who started it. sudo is an example of something that would use suid . When a user runs sudo , the binary actually runs with root privileges from the get-go, checks if the user is OK, then executes the command you specified. However, use of sudo or other suid binaries is entirely pointl…

Well in theory someone could escalate their privileges to the exact same ones they already have! THAT'S TERRIBLE!

Re: Alpine Linux Docker images have NULL for root password

#172

Post by spacenick88 »

johnisgood wrote: post #170
akvadrako wrote: post #6

Is this a risk out of the box? $ docker run -it -u guest alpine / $ su su: must be suid to work properly / $ login login: must be suid to work properly / $ find / -perm /4000 -print find: /root: Permission denied find: /proc/tty/driver: Permission denied / $

Docker is a risk "out of the box". It requires root to run the daemon, and to use it you either need sudo or belong to the docker group which is equivalent to root access. On their website they claim docker is "quite secure" if you "run your processes as non-privileged users inside the container", but I do not see how this would be the case given that breakouts happen all the time, AND again, it requires root to run,…

Docker also has support for user namespaces which makes it so that the root inside the container is e.g. nobody outside. In general I'd say docker (with user namespaces) is quite a bit more secure than running as a normal user without containers when it comes to escaping the container/the app being breached. However this is very distinct from the fact that it basically ignores all multi user aspects of Unix when it comes to using the docker command. So while the application inside is more secure, using docker is insecure. Now in the typical deployment scenario the latter doesn't really matter since an admin deploys and the developer only creates the image locally.

Re: Alpine Linux Docker images have NULL for root password

#173

Post by spacenick88 »

nurettin wrote: post #154
yegle wrote: post #19

Earlier quoted context omitted.

For anyone who want a small image but with glibc, https://github.com/GoogleContainerTools/distroless is a good choice, especially if you are writing in static linked language e.g. Go and Rust.

I don't quite get it. If you've somehow statically compiled all your dependencies, shouldn't that just run without a container? Perhaps the point is not to enable program execution, but to make use of the benefits that may come with container orchestration.

Well at the very least running in a container gives you filesystem and network and PID space isolation, optionally also user namespace isolation.

Re: Alpine Linux Docker images have NULL for root password

#174

Post by kamane »

deathanatos wrote: post #93
LukeShu wrote: post #88

Earlier quoted context omitted.

Going through alpine:3.1 to alpine:3.9, then alpine:edge, I see that the following versions have the problem: 3.3, 3.4, 3.5, and 3.8.

3.8 looks fine? » docker run --rm -ti alpine:3.8 sh -c 'cat /etc/shadow | grep root' root:!::0::::: The others you mention though, I agree, they look less than fine. Also, has anyone reported this to the official Alpine repository? (since the Talos disclosure seems to be confused; it says official but has URLs to the Glider Labs version?) Edit: Ah, so here's the relevant GitHub issue for official Alpine Linux docker:…

What should be done to prevent NULL password then? Like just setting a custom strong password for root user in alpine container Dockerfile ? If yes, could you share the recipe how to correctly do it?

Re: Alpine Linux Docker images have NULL for root password

#175

Post by growse »

res0nat0r wrote: post #142
__jal wrote: post #109

Earlier quoted context omitted.

If you trust Amazon to know your risk profile better than your security people, you have a management problem of some sort.

I trust myself who setup our infrastructure vs. the security guys who's automatic response to everything is deny all everywhere, encrypt everything everywhere (at rest encryption isn't enough, what can you do to get the db to work on the data encrypted internally 100% of the time?), and enable 2 factor on everything (the github gui has 2fa enabled, why aren't push/pull requests using 2fa?). I think may main point is…

Sounds like you need better security people.

Re: Alpine Linux Docker images have NULL for root password

#176

Post by bloak »

akvadrako wrote: post #6

Is this a risk out of the box? $ docker run -it -u guest alpine / $ su su: must be suid to work properly / $ login login: must be suid to work properly / $ find / -perm /4000 -print find: /root: Permission denied find: /proc/tty/driver: Permission denied / $

It's just about possible for someone to accidentally do something like this, on "host":

  # docker run -it -p 2222:22/tcp alpine
  / # apk add openssh-server
  / # for t in ecdsa ed25519 rsa ; do ssh-keygen -t $t -C root -P '' -f /etc/ssh/ssh_host_${t}_key ; done
  / # echo PermitRootLogin yes >> /etc/ssh/sshd_config
  / # echo PermitEmptyPasswords yes >> /etc/ssh/sshd_config
  / # /usr/sbin/sshd
Then, on another machine:

  ssh -p 2222 root@host

Re: Alpine Linux Docker images have NULL for root password

#177

Post by jacques_chester »

ShinTakuya wrote: post #151
jacques_chester wrote: post #133

Earlier quoted context omitted.

This is the part most people don't realise. They see Alpine at 5Mb and Ubuntu at 80Mb. They mentally multiply, without realising that each of these will be pulled once for each image built on top of them. For a large cluster it's a wash. You might as well use Ubuntu, Centos -- anything where there are people working fulltime to fix CVEs quickly.

As far as I'm aware you'd have to load that 80mb into memory for each docker container you run so that can add up if you want to run a bunch of containers on a cheap host with 1GB of RAM. I do agree that people prematurely optimise and mainly incorrectly consider disk space but I think there's a decent use case for tiny images.

Not quite. The 80Mb represents the uncompressed on-disk size. Those bits can appear in memory in two main ways. It can be executable, in which case large parts will be shared (remember, containers are not like VMs). Or it can in the FS cache, in which case bits will be evicted as necessary to make room for executables.

There's a case for tiny images, but it's in severely-constrained environments. Otherwise folks are fetishising the wrong thing based on a misunderstanding of how container images and runtimes work.

Re: Alpine Linux Docker images have NULL for root password

#178

Post by onlydeadheroes »

GordonS wrote: post #167
sprydevl wrote: post #153

Earlier quoted context omitted.

If you want small images, why not use a tool like https://github.com/docker-slim/docker-slim Then it doesn’t matter which distro you favor?

Wow, I've never heard of this before - I'm looking forward to seeing how much this shrinks my images!

Search for "awesome-docker" and make sure you have some free time. :)

Re: Alpine Linux Docker images have NULL for root password

#179

Post by jacques_chester »

solatic wrote: post #77
mark242 wrote: post #67

Earlier quoted context omitted.

Please don't do this anymore. End-to-end encryption is extremely easy to set up and maintain. P2PE will absolutely lull you into a false sense of security.

Last time I checked, mTLS incurred significant performance penalties and required significant soak testing to ensure that performance would be acceptable for a given application. If you're a small company, you have much lower hanging fruit to chase.

In my understanding there's additional overhead at handshake, but after that the performance is basically identical. The client certificate mostly acts to identify the client to the server, but otherwise the business of picking session keys etc is the same. At this point TLS overhead is close to free.

I think the start of this thread was a plea not to terminate HTTPS at the edge, but instead to plumb it all the way to the serving container. That's unlikely to be mTLS in any case.

Re: Alpine Linux Docker images have NULL for root password

#180

Post by captn3m0 »

kamane wrote: post #174
deathanatos wrote: post #93

Earlier quoted context omitted.

3.8 looks fine? » docker run --rm -ti alpine:3.8 sh -c 'cat /etc/shadow | grep root' root:!::0::::: The others you mention though, I agree, they look less than fine. Also, has anyone reported this to the official Alpine repository? (since the Talos disclosure seems to be confused; it says official but has URLs to the Glider Labs version?) Edit: Ah, so here's the relevant GitHub issue for official Alpine Linux docker:…

What should be done to prevent NULL password then? Like just setting a custom strong password for root user in alpine container Dockerfile ? If yes, could you share the recipe how to correctly do it?

Update your base images
Post reply on HN