Alpine Linux Docker images have NULL for root password • Hacker News Board

Re: Alpine Linux Docker images have NULL for root password

#121

Post by hobofan » Wed, May 08, 2019, 10:17 PM UTC

catern wrote: post #61

yegle wrote: post #37

Earlier quoted context omitted.

Why is that a bad thing? Binaries are binaries, whether you copied from a deb package or completely built from source code (assuming reproducible build, which Debian supports), they are the same.

It's absolutely not a bad thing, indeed I think it's a good thing to use binaries from Debian. I just think the name of the project is strongly misleading. "distroless" is built from the Debian distribution, not something new made from scratch.

Not sure how widespread that view is, but that's never the association I would have made.

"Xless" is just a different way of saying "without X". "fearless" = "without fear"; "serverless" = "without a server" (yes, I know, not really); so "distroless" = "(comes) without a distribution"

So in my opinon the name correctly suggests that it's "just the package" and comes "without a distro", and not "was built without the help of a distribution".

Re: Alpine Linux Docker images have NULL for root password

#122

Post by the8472 » Wed, May 08, 2019, 10:21 PM UTC

lstodd wrote: post #116

y04nn wrote: post #106

Earlier quoted context omitted.

With remote debugging?

remote debugging is a shell

not necessarily. e.g. java runtimes can expose debugging ports when needed that operate on a custom protocol.

or you can just build gdb into the container and run the process under gdb, then attach to the tty.

or you can debug from the host system where the container's pid namespace is a descendant of the root namespace and the other namespaces can be accessed via /proc or unshare.

Re: Alpine Linux Docker images have NULL for root password

#123

Post by code_duck » Wed, May 08, 2019, 10:25 PM UTC

akvadrako wrote: post #6

Is this a risk out of the box? $ docker run -it -u guest alpine / $ su su: must be suid to work properly / $ login login: must be suid to work properly / $ find / -perm /4000 -print find: /root: Permission denied find: /proc/tty/driver: Permission denied / $

On every distro in the past, i’d do sudo passwd. Always worked. No idea about Alpine.

Re: Alpine Linux Docker images have NULL for root password

#124

Post by username223 » Wed, May 08, 2019, 10:30 PM UTC

Nelson69 wrote: post #85

whatshisface wrote: post #28

Earlier quoted context omitted.

Why is musl slower?

I don't want to disparage any project or guess the motivation but there have been some undercurrents of anti-GPL sentiment at times and anti-complexity. Folks have sort of backed it up by posting some links to things that aren't as you might think. GLIBC in particular looks nothing like how you might imagine it. You can look at strlen in the K&R book and it's beautiful, like a textbook: int strlen(char s[]) { int i;…

This reminds me of a classic blog post:

    http://ridiculousfish.com/blog/posts/old-age-and-treachery.html

All of those old Unix programs aren't fast by being simple and clean on the inside. Old age and treachery...

Re: Alpine Linux Docker images have NULL for root password

#125

Post by smolder » Wed, May 08, 2019, 10:39 PM UTC

disiplus wrote: post #105

res0nat0r wrote: post #96

Earlier quoted context omitted.

Everyone seems to think E2E encryption is needed everywhere (I know because the security guys at work think it is needed everywhere, even for everything inside a VPC), but even AWS here is advertising the fact that you don't need to do this: https://aws.amazon.com/blogs/aws/new-tls-termination-for-net... >Today we are simplifying the process of building secure web applications by giving you the ability to make use of…

but without tls amazon can "decrypt" your traffic and see whats inside. its one thing to have a backdoor inside a server that they rent to you that would have to be actively exploited and another to passively clone the traffic and analyze it in the name of making the service better.

Why do they have to actively exploit hardware/vms that they own? Isn't it pretty trivial for a hypervisor to "passively clone" data right out of the memory of the VM? Or to use management interfaces/custom peripherals to exfiltrate data if it were bare metal? AWS is kind of a black box to me but it seems hopeless to try to protect data from people that physically control the systems.

Re: Alpine Linux Docker images have NULL for root password

#126

Post by matthewbauer » Wed, May 08, 2019, 10:39 PM UTC

code_duck wrote: post #123

akvadrako wrote: post #6

Is this a risk out of the box? $ docker run -it -u guest alpine / $ su su: must be suid to work properly / $ login login: must be suid to work properly / $ find / -perm /4000 -print find: /root: Permission denied find: /proc/tty/driver: Permission denied / $

On every distro in the past, i’d do sudo passwd. Always worked. No idea about Alpine.

But sudo access requires you to have logged in through a user in the wheel group. That at least is not a vulnerability.

Re: Alpine Linux Docker images have NULL for root password

#127

Post by matthewbauer » Wed, May 08, 2019, 10:41 PM UTC

jupp0r wrote: post #69

yegle wrote: post #39

Earlier quoted context omitted.

For almost any serious job running in production, you might need CA certificates and openssl.

With static linking your binary would contain openssl.

Not the certificates though, unless you do some special tricks. I think GP is probably thinking of kerberos/NSS, which has a plugin system that requires dynamic linking.

Re: Alpine Linux Docker images have NULL for root password

#128

Post by scandinavian » Wed, May 08, 2019, 10:44 PM UTC

lallysingh wrote: post #5

Note the conditional: "systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the `root` user" So if you're not using a container running ssh/etc, it doesn't affect you. Serious question: what's the use of PAM in a docker image that's vulnerable here?

For sshd you would have to set PermitEmptyPasswords to yes for it to matter, right?

Re: Alpine Linux Docker images have NULL for root password

#129

Post by ecnahc515 » Wed, May 08, 2019, 10:52 PM UTC

hssys wrote: post #34

snarfy wrote: post #26

Earlier quoted context omitted.

For statically linked binaries, why wouldn't you use the SCRATCH (0 kb) 'image'?

You might want at least a shell in the container for debugging?

You can use nsenter

Re: Alpine Linux Docker images have NULL for root password

#130

Post by justincormack » Wed, May 08, 2019, 10:52 PM UTC

akvadrako wrote: post #6

Is this a risk out of the box? $ docker run -it -u guest alpine / $ su su: must be suid to work properly / $ login login: must be suid to work properly / $ find / -perm /4000 -print find: /root: Permission denied find: /proc/tty/driver: Permission denied / $

No, it is not an issue, there are no suid binaries at all in the base install, so no way of changing user.

The link from the CVE says "Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container that utilize Linux PAM, or some other mechanism that uses the system shadow file as an authentication database, may accept a NULL password for the root user." - so the config would have to install PAM with suid binaries, and configure shadow passwords and not change the password. This is pretty unlikely overall.