Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Alpine Linux Docker images have NULL for root password

cve.mitre.org

Post reply on HN
Print view View original

181–190 of 203 posts

Re: Alpine Linux Docker images have NULL for root password

#181

Post by jacques_chester »

alanwreath wrote: post #65
sofaofthedamned wrote: post #52

Earlier quoted context omitted.

Unless you're behind a load balancer which terminates TLS and the traffic you deal with is purely http.

I wonder if this would be important with service mesh and mutual tls...

Service meshes make in-cluster mTLS a more-or-less automatic feature, which is worth having. Some will terminate TLS at ingress and convert to mTLS internally. The argument above is that you shouldn't do this and should instead plumb that ingressing TLS traffic all the way to the container.

The downside of plumbing directly to the container is that you lose many of the routing features of a service mesh. If it can't inspect the traffic, it can't do layer 7 routing. It can only route and shape at layer 4.

Re: Alpine Linux Docker images have NULL for root password

#182

Post by raesene9 »

johnisgood wrote: post #170
akvadrako wrote: post #6

Is this a risk out of the box? $ docker run -it -u guest alpine / $ su su: must be suid to work properly / $ login login: must be suid to work properly / $ find / -perm /4000 -print find: /root: Permission denied find: /proc/tty/driver: Permission denied / $

Docker is a risk "out of the box". It requires root to run the daemon, and to use it you either need sudo or belong to the docker group which is equivalent to root access. On their website they claim docker is "quite secure" if you "run your processes as non-privileged users inside the container", but I do not see how this would be the case given that breakouts happen all the time, AND again, it requires root to run,…

If you are running as a non-privileged user inside a container, which breakouts do you think can be used to escalate privileges to the hosting machine?

All a container is, is a linux process with added security constraints. So, if you're talking about an escalation from an unprivileged process inside a container, you need a standard Linux privesc attack (nothing to do with Docker) and you also need to bypass the isolation mechanisms on that process (namespaces, capabilities, seccomp filter, SELinux/AppArmor)

Re: Alpine Linux Docker images have NULL for root password

#183

Post by raesene9 »

scandinavian wrote: post #128
lallysingh wrote: post #5

Note the conditional: "systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the `root` user" So if you're not using a container running ssh/etc, it doesn't affect you. Serious question: what's the use of PAM in a docker image that's vulnerable here?

For sshd you would have to set PermitEmptyPasswords to yes for it to matter, right?

and also PermitRootLogin, AFAIK

Re: Alpine Linux Docker images have NULL for root password

#184

Post by dserodio »

crehn wrote: post #145
mark242 wrote: post #67

Earlier quoted context omitted.

Please don't do this anymore. End-to-end encryption is extremely easy to set up and maintain. P2PE will absolutely lull you into a false sense of security.

What's an extremely easy solution to set up and maintain automated certificate signing and provisioning?

CloudFlare's cfssl: http://blog.cloudflare.com/introducing-cfssl

Re: Alpine Linux Docker images have NULL for root password

#185

Post by Fnoord »

akvadrako wrote: post #6

Is this a risk out of the box? $ docker run -it -u guest alpine / $ su su: must be suid to work properly / $ login login: must be suid to work properly / $ find / -perm /4000 -print find: /root: Permission denied find: /proc/tty/driver: Permission denied / $

According to the CVSS score its a huge risk. FTA:

> 9.8 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

(Leaving my opinion out of this.)

Re: Alpine Linux Docker images have NULL for root password

#187

Post by javagram »

arghwhat wrote: post #169
zaarn wrote: post #162

Earlier quoted context omitted.

Alpine comes with no suid binaries in Docker to my knowledge (it's expected you run your stuff as root inside the container unless there is a reason not to)

Just for the uninitiated: suid binaries are binaries with a special flag set that will make it run with root privileges regardless of who started it. sudo is an example of something that would use suid . When a user runs sudo , the binary actually runs with root privileges from the get-go, checks if the user is OK, then executes the command you specified. However, use of sudo or other suid binaries is entirely pointl…

> There being no password also does not matter, as you are by default already running everything as root. Who cares if root can become root?

Best practice would have you switch to a non root user before running whatever it is inside the container. Although if you haven’t added any suid binaries by accident then there’s no way to go back.

E.g. the node alpine image adds a “node:node” user and group for the process to run as instead of root. https://github.com/nodejs/docker-node/blob/master/10/alpine/...

Re: Alpine Linux Docker images have NULL for root password

#188

Post by jpwgarrison »

stephenr wrote: post #155
snarfy wrote: post #26

Earlier quoted context omitted.

For statically linked binaries, why wouldn't you use the SCRATCH (0 kb) 'image'?

If your binary is static, why do you need a container at all?

So you can justify using k8s and shine up your resume!

Re: Alpine Linux Docker images have NULL for root password

#189

Post by [deleted] »

johnisgood wrote: post #170
akvadrako wrote: post #6

Is this a risk out of the box? $ docker run -it -u guest alpine / $ su su: must be suid to work properly / $ login login: must be suid to work properly / $ find / -perm /4000 -print find: /root: Permission denied find: /proc/tty/driver: Permission denied / $

Docker is a risk "out of the box". It requires root to run the daemon, and to use it you either need sudo or belong to the docker group which is equivalent to root access. On their website they claim docker is "quite secure" if you "run your processes as non-privileged users inside the container", but I do not see how this would be the case given that breakouts happen all the time, AND again, it requires root to run,…

[deleted]

Re: Alpine Linux Docker images have NULL for root password

#190

Post by stephenr »

jpwgarrison wrote: post #188
stephenr wrote: post #155

Earlier quoted context omitted.

If your binary is static, why do you need a container at all?

So you can justify using k8s and shine up your resume!

It’s the new 3x SQLServer + 2x IIS + 2x SharePoint cluster to serve an intranet for 100 staff when a single would be more than sufficient.
Post reply on HN