Alpine Linux Docker images have NULL for root password • Hacker News Board

Re: Alpine Linux Docker images have NULL for root password

#141

Post by CameronNemo » Wed, May 08, 2019, 11:57 PM UTC

whatshisface wrote: post #28

hnthrow0693 wrote: post #11

I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.

Why is musl slower?

* musl prioritizes thread safety and static linking over performance * most software is written and optimized against glibc, not musl

Re: Alpine Linux Docker images have NULL for root password

#142

Post by res0nat0r » Wed, May 08, 2019, 11:58 PM UTC

__jal wrote: post #109

res0nat0r wrote: post #96

Earlier quoted context omitted.

Everyone seems to think E2E encryption is needed everywhere (I know because the security guys at work think it is needed everywhere, even for everything inside a VPC), but even AWS here is advertising the fact that you don't need to do this: https://aws.amazon.com/blogs/aws/new-tls-termination-for-net... >Today we are simplifying the process of building secure web applications by giving you the ability to make use of…

If you trust Amazon to know your risk profile better than your security people, you have a management problem of some sort.

I trust myself who setup our infrastructure vs. the security guys who's automatic response to everything is deny all everywhere, encrypt everything everywhere (at rest encryption isn't enough, what can you do to get the db to work on the data encrypted internally 100% of the time?), and enable 2 factor on everything (the github gui has 2fa enabled, why aren't push/pull requests using 2fa?).

I think may main point is that kneejerk reactions to satisfy a security list checkbox are just as useless as a default "encrypt everything everywhere" stance must be better.

Re: Alpine Linux Docker images have NULL for root password

#143

Post by yegle » Thu, May 09, 2019, 12:04 AM UTC

matthewbauer wrote: post #127

jupp0r wrote: post #69

Earlier quoted context omitted.

With static linking your binary would contain openssl.

Not the certificates though, unless you do some special tricks. I think GP is probably thinking of kerberos/NSS, which has a plugin system that requires dynamic linking.

There are two basic flavors of distroless image, one is base, the other one is static.

The `static` image is very bare minimal and only contains things like nsswitch.conf and ca certificates. This is the recommended base image for statically linked languages.

There's also a `base` image that I usually use as the base image of C programs, e.g. stunnel/unbound DNS. In those cases, I usually use Debian Stretch as build environment (distroless uses binary from Debian stable, so ABI is compatible), build a dynamically linked binary, then copy the result binary along with all dynamic object files to a distroless base image.

So when I talk about openssl in the image, I was referring to the `base` flavor. If you are happy with the provided openssl version, the openssl in the base image is indeed useful.

Re: Alpine Linux Docker images have NULL for root password

#144

Post by indigodaddy » Thu, May 09, 2019, 1:03 AM UTC

If your box gets rooted because of this then you already had glaring security issues.

Re: Alpine Linux Docker images have NULL for root password

#145

Post by crehn » Thu, May 09, 2019, 1:26 AM UTC

mark242 wrote: post #67

sofaofthedamned wrote: post #52

Earlier quoted context omitted.

Unless you're behind a load balancer which terminates TLS and the traffic you deal with is purely http.

Please don't do this anymore. End-to-end encryption is extremely easy to set up and maintain. P2PE will absolutely lull you into a false sense of security.

What's an extremely easy solution to set up and maintain automated certificate signing and provisioning?

Re: Alpine Linux Docker images have NULL for root password

#146

Post by fao_ » Thu, May 09, 2019, 1:26 AM UTC

disiplus wrote: post #105

res0nat0r wrote: post #96

Earlier quoted context omitted.

Everyone seems to think E2E encryption is needed everywhere (I know because the security guys at work think it is needed everywhere, even for everything inside a VPC), but even AWS here is advertising the fact that you don't need to do this: https://aws.amazon.com/blogs/aws/new-tls-termination-for-net... >Today we are simplifying the process of building secure web applications by giving you the ability to make use of…

but without tls amazon can "decrypt" your traffic and see whats inside. its one thing to have a backdoor inside a server that they rent to you that would have to be actively exploited and another to passively clone the traffic and analyze it in the name of making the service better.

If you believe that amazon are potentially an adversary, but you still want to host it on their servers, there is essentially nothing you can do to stop them getting at your data. At some point, to process the data, you have to do that unencrypted. That is an unpluggable achilles heel.

Re: Alpine Linux Docker images have NULL for root password

#147

Post by antod » Thu, May 09, 2019, 1:49 AM UTC

lallysingh wrote: post #5

Note the conditional: "systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the `root` user" So if you're not using a container running ssh/etc, it doesn't affect you. Serious question: what's the use of PAM in a docker image that's vulnerable here?

I also note they could run head on /etc/shadow without sudo

> docker run -it alpine:3.$i head -n 1 /etc/shadow

The container process itself is running as the locally namespaced root account anyway.

From my possibly incorrect interpretation... unless you are trying to build containers like VMs with multiple users and init etc, this null root password issue seems irrelevant.

Re: Alpine Linux Docker images have NULL for root password

#148

Post by peterwwillis » Thu, May 09, 2019, 2:05 AM UTC

sofaofthedamned wrote: post #55

peterwwillis wrote: post #24

Earlier quoted context omitted.

It's not a few megabytes, it's a few hundred to a thousand megabytes saved, on average. Multiplied by a thousand containers, and much larger layers on build servers, plus bandwidth, it makes a difference. Worst case for slower processes, things take longer. Worst case for more disk use, things start crashing. For general cases, the former is preferable.

No, it's not. With samepage merging it's nothing, let alone docker only loading the image once.

I'm not talking about image waste, I'm talking a single box with a half dozen different base image versions and a slew of extra packages thrown in. Every app built against glibc is going to get bigger, and not all Ubuntu packages are built with small size in mind. Compare these systems with Ubuntu vs Alpine base images and the average size for an Ubuntu ecosystem is substantially larger.

Re: Alpine Linux Docker images have NULL for root password

#149

Post by sleepybrett » Thu, May 09, 2019, 2:37 AM UTC

akvadrako wrote: post #97

sofaofthedamned wrote: post #23

Earlier quoted context omitted.

I've no idea why you wouldn't use Ubuntu which is only around 40mb, has a sane package manager and a standard glibc.

Ubuntu is 40MB but if you add a few packages with tons of dependencies it can quickly reach 800MB. Alpine has much more reasonable dependency trees.

And a shitty library at the heart that makes everything suck just a bit more.

Re: Alpine Linux Docker images have NULL for root password

#150

Post by ShinTakuya » Thu, May 09, 2019, 2:45 AM UTC

TheDong wrote: post #136

code_duck wrote: post #131

Earlier quoted context omitted.

OK. In my experience it worked with any user account. I would install, create an account, and immediately use sudo to change the root password.

The first user account is considered an administrator account on most distros by default, so it has sudo privileges. If you can do what you said with a non-wheel/sudo account, that would be a serious vulnerability.

Alternatively, it's possible the distro added the first user account to wheel also. I believe I've seen that in the past.