Différences
Ci-dessous, les différences entre deux révisions de la page.
| Prochaine révision | Révision précédente | ||
| elearning:workbooks:debian:11:sec:l110 [2025/12/02 13:25] – créée admin | elearning:workbooks:debian:11:sec:l110 [2025/12/04 15:41] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| ~~PDF: | ~~PDF: | ||
| - | Version : **2061.01** | + | Version : **2026.01** |
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======LDF410 - Gestion | + | ======LDF410 - Validation |
| =====Contenu du Module===== | =====Contenu du Module===== | ||
| - | * **LDF410 - Gestion | + | * **LDF410 - Validation |
| * Contenu du Module | * Contenu du Module | ||
| - | * LAB #1 - Création d'un Utilisateur de Confiance pour Contrôler le Daemon Docker | + | * Rappel du Programme |
| - | * LAB #2 - Le Script docker-bench-security.sh | + | * Évaluation |
| - | * LAB #3 - Sécurisation | + | * Validation |
| - | * 3.1 - [WARN] 1.2.1 - Ensure a separate partition for containers has been created | + | |
| - | * 3.2 - [WARN] 1.2.3 - Ensure auditing is configured for the Docker daemon | + | |
| - | * LAB #4 - Sécurisation | + | |
| - | * 4.1 - [WARN] 2.1 - Ensure network traffic is restricted between containers on the default bridge | + | |
| - | * 4.2 - [WARN] 2.8 - Enable user namespace support | + | |
| - | * 4.3 - [WARN] 2.11 - Ensure that authorization for Docker client commands is enabled | + | |
| - | * 4.4 - [WARN] 2.12 - Ensure centralized and remote logging is configured | + | |
| - | * 4.5 - [WARN] 2.14 - Ensure Userland Proxy is Disabled | + | |
| - | * 4.6 - [WARN] 2.17 - Ensure containers are restricted from acquiring new privileges | + | |
| - | * 4.7 - Le Fichier / | + | |
| - | * LAB #5 - Sécurisation | + | |
| - | * 5.1 - [WARN] 4.1 - Ensure a user for the container has been created | + | |
| - | * 5.2 - [WARN] 4.5 - Ensure Content trust for Docker is Enabled | + | |
| - | * 5.3 - [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images | + | |
| - | * LAB #6 - Sécurisation du Container Runtime | + | |
| - | * 6.1 - [WARN] 5.1 - Ensure AppArmor Profile is Enabled | + | |
| - | * 6.2 - [WARN] 5.2 - Ensure SELinux security options are set, if applicable | + | |
| - | * 6.3 - [WARN] 5.10 - Ensure memory usage for container is limited | + | |
| - | * 6.4 - [WARN] 5.11 - Ensure CPU priority is set appropriately on the container | + | |
| - | * 6.5 - [WARN] 5.12 - Ensure the container' | + | |
| - | * 6.6 - [WARN] 5.14 - Ensure ' | + | |
| - | * 6.7 - [WARN] 5.25 - Ensure the container is restricted from acquiring additional privileges | + | |
| - | * 6.8 - [WARN] 5.26 - Ensure container health is checked at runtime | + | |
| - | * 6.9 - [WARN] 5.28 - Ensure PIDs cgroup limit is used | + | |
| - | * LAB #7 - Sécurisation des Images avec Docker Content Trust | + | |
| - | * 7.1 - DOCKER_CONTENT_TRUST | + | |
| - | * 7.2 - DCT et la commande docker pull | + | |
| - | * L' | + | |
| - | * 7.3 - DCT et la commande docker push | + | |
| - | * 7.4 - DCT et la commande docker build | + | |
| - | * Créer un deuxième Repositry | + | |
| - | * Supprimer une Signature | + | |
| - | =====LAB #1 - Création d'un Utilisateur | + | =====Rappel du Programme |
| - | Au contraire des solutions classiques de gestion de machines virtuelles où l' | + | |
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | * Programme de la Formation | ||
| - | < | + | * **LDF401 - Gestion des Droits** |
| - | root@debian9: | + | * Présentation |
| - | docker: | + | * Préparation |
| - | root@debian9: | + | * LAB #1 - Les Droits Unix Simples |
| - | root@debian9: | + | * 1.1 - La Modification des Droits |
| - | déconnexion | + | * La Commande chmod |
| - | trainee@manager: | + | * Mode Symbolique |
| - | Got permission denied while trying to connect to the Docker daemon socket at unix:/// | + | * Mode Octal |
| - | trainee@manager: | + | * La Commande umask |
| - | trainee@manager: | + | * 1.2 - Modifier le propriétaire ou le groupe |
| - | CONTAINER ID IMAGE | + | |
| - | d02c6115724c | + | |
| - | trainee@manager: | + | * LAB #2 - Les Droits Unix Étendus |
| - | alpine1 | + | * 2.1 - SUID/SGID bit |
| - | trainee@manager: | + | * 2.2 - Inheritance Flag |
| - | a214e2df0499c97e8da25a6c9ea751ac75344c9bcd7d238f8cb8d5c777510ab9 | + | * 2.3 - Sticky bit |
| - | trainee@manager: | + | * LAB #3 - Les Droits Unix Avancés |
| - | CONTAINER ID IMAGE | + | * 3.1 - Les ACL |
| - | a214e2df0499 | + | * 3.2 - Les Attributs Étendus |
| - | </ | + | |
| - | =====LAB #2 - Le Script docker-bench-security.sh===== | + | * **LDF402 - Netfilter et Firewalld** |
| + | * Les Problématiques | ||
| + | * L'IP Spoofing | ||
| + | * Déni de Service (DoS) | ||
| + | * SYN Flooding | ||
| + | * Flood | ||
| + | * La Contre-Mesure | ||
| + | * LAB #1 - La Configuration de firewalld | ||
| + | * 1.1 - La Configuration de Base de firewalld | ||
| + | * 1.2 - La Commande firewall-cmd | ||
| + | * 1.3 - La Configuration Avancée de firewalld | ||
| + | * 1.4 - Le mode Panic de firewalld | ||
| - | Le **Center for Internet Security (CIS)** est une organisation indépendante à but non-lucratif qui publie | + | * **LDF403 - Authentification** |
| + | * Le Problématique | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | * / | ||
| + | * Les Contre-Mesures | ||
| + | * LAB #1 - Renforcer la sécurité | ||
| + | * LAB #2 - PAM | ||
| + | * 2.1 - Configuration des modules | ||
| + | * 2.2 - Utiliser des Mots de Passe Complexes | ||
| + | * LAB #3 - Mise en place du Système | ||
| + | * 3.1 - Installation | ||
| + | * 3.2 - Configuration | ||
| + | * Le répertoire | ||
| + | * Le fichier fail2ban.conf | ||
| + | * Le répertoire / | ||
| + | * Le répertoire | ||
| + | * 3.3 - Commandes | ||
| + | * Activer et Démarrer le Serveur | ||
| + | * Utiliser la Commande Fail2Ban-server | ||
| + | * Ajouter un Prison | ||
| - | Le guide est divisé | + | * **LDF404 - Système de Fichiers** |
| + | * La sécurisation des systèmes de fichiers | ||
| + | * Le Fichier / | ||
| + | * Comprendre le fichier / | ||
| + | * Options de Montage | ||
| + | * Systèmes de Fichiers Chiffrés | ||
| + | * LAB #1 - Créer un Système de Fichiers Chiffré avec encryptfs | ||
| + | * LAB #2 - Créer un Système de Fichiers Chiffré avec LUKS | ||
| + | * 2.1 - Présentation | ||
| + | * 2.2 - Mise en Place | ||
| + | * 2.3 - Le fichier / | ||
| + | * 2.4 - Ajouter une deuxième Passphrase | ||
| + | * 2.5 - Supprimer une Passphrase | ||
| + | * 2.6 - Supprimer LUKS | ||
| + | * LAB #3 - Mise en place du File Integrity Checker Afick | ||
| + | * 3.1 - Présentation | ||
| + | * 3.2 - Installation | ||
| + | * 3.3 - Configuration | ||
| + | * La Section Directives | ||
| + | * La Section Alias | ||
| + | * La Section File | ||
| + | * 3.4 - Utilisation | ||
| + | * 3.5 - Automatiser Afick | ||
| + | * Root Kits | ||
| + | * Le Problématique | ||
| + | * Contre-Mesures | ||
| + | * LAB #4 - Mise en place de rkhunter | ||
| + | * 4.1 - Installation | ||
| + | * 4.2 - Utilisation | ||
| + | * 4.3 - Configuration | ||
| + | * LAB #5 - Mise en place de chkrootkit | ||
| + | * 5.1 - Installation | ||
| + | * 5.2 - Utilisation | ||
| + | * 5.3 - Configuration | ||
| - | * La configuration de l' | + | * **LDF405 - System Hardening** |
| - | * La configuration | + | * Contenu |
| - | * Les fichiers | + | * System Hardening Manuel |
| - | * Les images ainsi que les fichiers | + | * Les compilateurs |
| - | * Le container runtime, | + | * Les paquets |
| - | * Les opérations sécuritaires relatives | + | * Les démons et services |
| - | * La configuration | + | |
| + | * Les fichiers | ||
| + | * Interdire les connexions de root via le réseau | ||
| + | * Limiter le delai d’inactivité d'une session shell | ||
| + | * Renforcer la sécurité d' | ||
| + | * Les Distributions SysVInit | ||
| + | * Les Distributions Upstart | ||
| + | * Renforcer la sécurité du Noyau | ||
| + | * La commande sysctl | ||
| + | * LAB #1 - System Hardening | ||
| + | * 1.1 - Présentation | ||
| + | * 1.2 - Installation | ||
| + | * 1.3 - Utilisation | ||
| + | * LAB #2 - Mise en Place d'un Chroot pour isoler un utilisateur/ | ||
| + | * LAB #3 - Mise en place d' | ||
| + | * 3.1 - Présentation | ||
| + | * 3.2 - Définitions | ||
| + | * Les Profils d' | ||
| + | * Les Etats ou Modes d' | ||
| + | * 3.3 - Installation | ||
| + | * Installation des Paquets | ||
| + | * Modification de GRUB | ||
| + | * Vérification de l' | ||
| + | * LAB #4 - Travailler avec AppArmor | ||
| + | * 4.1 - Consulter | ||
| + | * La Commande aa-status | ||
| + | * 4.2 - Passer le Mode d'un Profil de Complain | ||
| + | * La Commande aa-complain | ||
| + | * 4.3 - Passer le Mode d'un Profil d' | ||
| + | * La Commande aa-enforce | ||
| + | * 4.4 - Désactiver et Réactiver tous les Profils | ||
| + | * 4.5 - Créer un Profil | ||
| + | * La Commande aa-genprof | ||
| + | * La Commande aa-logprof | ||
| + | * 4.6 - Supprimer un Profil | ||
| + | * La Commande apparmor_parser | ||
| + | * La Commande aa-remove-unknown | ||
| + | * LAB #5 - Mise en place de SELinux pour sécuriser le serveur | ||
| + | * 5.1 - Présentation | ||
| + | * 5.2 - Définitions | ||
| + | * Security Context | ||
| + | * Domains et Types | ||
| + | * Roles | ||
| + | * Politiques de Sécurité | ||
| + | * Langage de Politiques | ||
| + | * allow | ||
| + | * type | ||
| + | * type_transition | ||
| + | * Décisions de SELinux | ||
| + | * Décisions d' | ||
| + | * Décisions de Transition | ||
| + | * 5.3 - Commandes SELinux | ||
| + | * 5.4 - Les Etats de SELinux | ||
| + | * 5.5 - Booléens | ||
| + | * LAB #6 - Travailler avec SELinux | ||
| + | * 6.1 - Copier et Déplacer des Fichiers | ||
| + | * 6.2 - Vérifier les SC des Processus | ||
| + | * 6.3 - Visualiser la SC d'un Utilisateur | ||
| + | * 6.4 - Vérifier la SC d'un fichier | ||
| + | * 6.5 - Troubleshooting SELinux | ||
| + | * La commande chcon | ||
| + | * La commande restorecon | ||
| + | * 6.6 - Le fichier / | ||
| + | * 6.7 - La commande semanage | ||
| + | * 6.8 - La commande audit2allow | ||
| - | Ce guide est à utiliser avec le script | + | |
| + | * Le Problématique | ||
| + | * Préparation | ||
| + | * Les Outils | ||
| + | * LAB #1 - Netwox | ||
| + | * 1.1 - Installation | ||
| + | * 1.2 - Utilisation | ||
| + | * 1.3 - Avertissement important | ||
| + | * LAB #2 - Greenbone Vulnerability Management (GVM) | ||
| + | * 2.1 - Présentation | ||
| + | * 2.2 - Préparation | ||
| + | * 2.3 - Installation | ||
| + | * 2.4 - Configuration | ||
| + | * 2.5 - Utilisation | ||
| + | * 2.6 - Analyse des Résultats | ||
| - | Clonez le script | + | |
| + | * Contenu du Module | ||
| + | * Le Problématique | ||
| + | * LAB #1 - Utilisation de nmap et de netcat | ||
| + | * 1.1 - nmap | ||
| + | | ||
| + | | ||
| + | * Fichiers de Configuration | ||
| + | * Scripts | ||
| + | * 1.2 - netcat | ||
| + | * Utilisation | ||
| + | * Les Contre-Mesures | ||
| + | * LAB #2 - Mise en place du Système de Détection d' | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | * 3.1 - Installation | ||
| + | * 3.2 - Configuration | ||
| + | * 3.3 - Utilisation | ||
| - | < | + | * **LDF408 |
| - | trainee@manager: | + | * Le Problématique |
| - | Mot de passe : fenestros | + | * LAB #1 - Utilisation de tcpdump |
| - | root@debian9: | + | * 1.1 - Utilisation |
| - | Clonage dans 'docker-bench-security'... | + | * L' |
| - | remote: Enumerating objects: 18, done. | + | * L'option |
| - | remote: Counting objects: 100% (18/18), done. | + | * L' |
| - | remote: Compressing objects: 100% (16/16), done. | + | * L'option -w |
| - | remote: Total 1921 (delta 5), reused 6 (delta 2), pack-reused 1903 | + | * L' |
| - | Réception d'objets: 100% (1921/ | + | * 1.2 - Filtrage à l' |
| - | Résolution des deltas: 100% (1339/ | + | * Les Contre-Mesures |
| - | </ | + | * Introduction à la cryptologie |
| + | * Définitions | ||
| + | * Algorithmes à clé secrète | ||
| + | * Le Chiffrement Symétrique | ||
| + | * Algorithmes à clef publique | ||
| + | * Le Chiffrement Asymétrique | ||
| + | * La Clef de Session | ||
| + | * Fonctions de Hachage | ||
| + | * Signature Numérique | ||
| + | * PKI | ||
| + | * Certificats X509 | ||
| + | * LAB #2 - Utilisation de GnuPG | ||
| + | * 2.1 - Présentation | ||
| + | * 2.2 - Installation | ||
| + | * 2.3 - Utilisation | ||
| + | * Signer un message | ||
| + | * Chiffrer un message | ||
| + | * LAB #3 - Mise en place de SSH et SCP | ||
| + | * 3.1 - Introduction | ||
| + | * SSH-1 | ||
| + | * SSH-2 | ||
| + | * L'authentification par mot de passe | ||
| + | * L' | ||
| + | * 3.2 - Configuration du Serveur | ||
| + | * 3.3 - Utilisation | ||
| + | * 3.4 - Mise en place des clefs | ||
| + | * 3.5 - Tunnels SSH | ||
| + | * 3.6 - SCP | ||
| + | * Introduction | ||
| + | * Utilisation | ||
| + | * LAB #4 - Mise en place d'un VPN avec OpenVPN | ||
| + | * Présentation | ||
| + | * Configuration commune au client et au serveur | ||
| + | * Configuration du client | ||
| + | * Configuration du serveur | ||
| + | * Tests | ||
| + | * Du client vers le serveur | ||
| + | * Du serveur vers le client | ||
| - | Exécutez maintenant | + | * **LDF409 - Gestion de la Sécurité de Docker** |
| + | * Contenu du Module | ||
| + | * Présentation de Docker | ||
| + | * LAB #1 - Travailler avec Docker | ||
| + | * 1.1 - Installer docker | ||
| + | * 1.2 - Démarrer un Conteneur | ||
| + | * 1.3 - Consulter la Liste des Conteneurs et Images | ||
| + | * 1.4 - Rechercher une Image dans un Dépôt | ||
| + | * 1.5 - Supprimer un Conteneur d'une Image | ||
| + | * 1.6 - Créer une Image à partir d'un Conteneur Modifié | ||
| + | * 1.7 - Supprimer une Image | ||
| + | * 1.8 - Créer un Conteneur avec un Nom Spécifique | ||
| + | * 1.9 - Exécuter une Commande dans un Conteneur | ||
| + | * 1.10 - Injecter des Variables d' | ||
| + | * 1.11 - Modifier | ||
| + | | ||
| + | | ||
| + | * 1.14 - Accéder aux Services d'un Conteneur de l' | ||
| + | * 1.15 - Arrêter et Démarrer un Conteneur | ||
| + | * 1.16 - Utiliser des Signaux avec un Conteneur | ||
| + | * 1.17 - Forcer la Suppression d'un Conteneur en cours d' | ||
| + | * 1.18 - Utilisation Simple d'un Volume | ||
| + | * 1.19 - Télécharger une image sans créer un conteneur | ||
| + | * 1.20 - S' | ||
| + | * 1.21 - Installer un logiciel dans le conteneur | ||
| + | * 1.22 - Utilisation de la commande docker commit | ||
| + | * 1.23 - Se connecter au serveur du conteneur de l' | ||
| + | * LAB #2 - Création d'un Utilisateur de Confiance pour Contrôler le Daemon | ||
| + | * LAB #3 - Le Script docker-bench-security.sh | ||
| + | * LAB #4 - Sécurisation de la Configuration de l' | ||
| + | * 4.1 - [WARN] 1.2.1 - Ensure a separate partition for containers has been created | ||
| + | * 4.2 - [WARN] 1.2.3 - Ensure auditing is configured for the Docker daemon | ||
| + | * LAB #5 - Sécurisation de la Configuration du daemon Docker | ||
| + | * 5.1 - [WARN] 2.1 - Ensure network traffic is restricted between containers on the default bridge | ||
| + | * 5.2 - [WARN] 2.8 - Enable user namespace support | ||
| + | * 5.3 - [WARN] 2.11 - Ensure that authorization for Docker client commands is enabled | ||
| + | * 5.4 - [WARN] 2.12 - Ensure centralized and remote logging is configured | ||
| + | * 5.5 - [WARN] 2.14 - Ensure Userland Proxy is Disabled | ||
| + | * 5.6 - [WARN] 2.17 - Ensure containers are restricted from acquiring new privileges | ||
| + | * 5.7 - Le Fichier / | ||
| + | * LAB #6 - Sécurisation des Images et les Fichiers de Construction | ||
| + | * 6.1 - [WARN] 4.1 - Ensure a user for the container has been created | ||
| + | * 6.2 - [WARN] 4.5 - Ensure Content trust for Docker is Enabled | ||
| + | * 6.3 - [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images | ||
| + | * LAB #7 - Sécurisation du Container Runtime | ||
| + | * 7.1 - [WARN] 5.1 - Ensure AppArmor Profile is Enabled | ||
| + | * 7.2 - [WARN] 5.2 - Ensure SELinux security options are set, if applicable | ||
| + | * 7.3 - [WARN] 5.10 - Ensure memory usage for container is limited | ||
| + | * 7.4 - [WARN] 5.11 - Ensure CPU priority is set appropriately on the container | ||
| + | * 7.5 - [WARN] 5.12 - Ensure the container' | ||
| + | * 7.6 - [WARN] 5.14 - Ensure ' | ||
| + | * 7.7 - [WARN] 5.25 - Ensure the container is restricted from acquiring additional privileges | ||
| + | * 7.8 - [WARN] 5.26 - Ensure container health is checked at runtime | ||
| + | * 7.9 - [WARN] 5.28 - Ensure PIDs cgroup limit is used | ||
| + | * LAB #8 - Sécurisation des Images avec Docker Content Trust | ||
| + | * 8.1 - DOCKER_CONTENT_TRUST | ||
| + | * 8.2 - DCT et la commande docker pull | ||
| + | * L' | ||
| + | * 8.3 - DCT et la commande docker push | ||
| + | * 8.4 - DCT et la commande docker build | ||
| + | | ||
| + | | ||
| - | < | + | * **LDF410 |
| - | root@debian9: | + | * Rappel du Programme de la Formation |
| - | root@debian9: | + | * Évaluation de la Formation |
| - | # ------------------------------------------------------------------------------ | + | * Validation des acquis |
| - | # Docker Bench for Security v1.3.5 | + | |
| - | # | + | |
| - | # Docker, Inc. (c) 2015- | + | |
| - | # | + | |
| - | # Checks for dozens of common best-practices around deploying Docker containers in production. | + | |
| - | # Inspired by the CIS Docker Benchmark v1.2.0. | + | |
| - | # ------------------------------------------------------------------------------ | + | |
| - | Initializing vendredi 8 novembre 2019, 12:12:03 (UTC+0100) | + | =====Évaluation de la Formation===== |
| + | Afin de valider votre formation, veuillez compléter l’Évaluation de la Formation ainsi que la Validation des Acquis. | ||
| - | [INFO] 1 - Host Configuration | + | ----- |
| + | Copyright © 2025 Hugh Norris - Document non-contractuel. Le programme peut être modifié sans préavis. | ||
| - | [INFO] 1.1 - General Configuration | ||
| - | [NOTE] 1.1.1 - Ensure the container host has been Hardened | ||
| - | [INFO] 1.1.2 - Ensure Docker is up to date | ||
| - | [INFO] | ||
| - | [INFO] | ||
| - | |||
| - | [INFO] 1.2 - Linux Hosts Specific Configuration | ||
| - | [WARN] 1.2.1 - Ensure a separate partition for containers has been created | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | Ce script sert à automatiser le contrôle des points précédemment cités et produit un rapport contenant des annotations : | ||
| - | |||
| - | * **[PASS]** : Concerne les points qui n'ont pas besoin d' | ||
| - | * **[WARN]** : Concerne les points qui **doivent** être modifiés, | ||
| - | * **[INFO]** : Concerne les points qui doivent être passés en revue selon les besoins de votre configuration, | ||
| - | * **[NOTE]** : Vous informe d'un **best practice**. | ||
| - | |||
| - | =====LAB #3 - Sécurisation de la Configuration de l' | ||
| - | |||
| - | Lors de l' | ||
| - | |||
| - | < | ||
| - | ... | ||
| - | [INFO] 1 - Host Configuration | ||
| - | |||
| - | [INFO] 1.1 - General Configuration | ||
| - | [NOTE] 1.1.1 - Ensure the container host has been Hardened | ||
| - | [INFO] 1.1.2 - Ensure Docker is up to date | ||
| - | [INFO] | ||
| - | [INFO] | ||
| - | |||
| - | [INFO] 1.2 - Linux Hosts Specific Configuration | ||
| - | [WARN] 1.2.1 - Ensure a separate partition for containers has been created | ||
| - | [INFO] 1.2.2 - Ensure only trusted users are allowed to control Docker daemon | ||
| - | [INFO] | ||
| - | [WARN] 1.2.3 - Ensure auditing is configured for the Docker daemon | ||
| - | [WARN] 1.2.4 - Ensure auditing is configured for Docker files and directories - / | ||
| - | [WARN] 1.2.5 - Ensure auditing is configured for Docker files and directories - /etc/docker | ||
| - | [WARN] 1.2.6 - Ensure auditing is configured for Docker files and directories - docker.service | ||
| - | [WARN] 1.2.7 - Ensure auditing is configured for Docker files and directories - docker.socket | ||
| - | [WARN] 1.2.8 - Ensure auditing is configured for Docker files and directories - / | ||
| - | [INFO] 1.2.9 - Ensure auditing is configured for Docker files and directories - / | ||
| - | [INFO] | ||
| - | [INFO] 1.2.10 | ||
| - | [INFO] | ||
| - | [WARN] 1.2.11 | ||
| - | [INFO] 1.2.12 | ||
| - | [INFO] | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | Les problèmes de sécurité qu'il convient à résoudre sont indiqués par les annotations **[WARN]**. | ||
| - | |||
| - | ====3.1 - [WARN] 1.2.1 - Ensure a separate partition for containers has been created==== | ||
| - | |||
| - | Par défaut, tous les fichiers de Docker sont stockés dans le répertoire **/ | ||
| - | |||
| - | ====3.2 - [WARN] 1.2.3 - Ensure auditing is configured for the Docker daemon==== | ||
| - | |||
| - | < | ||
| - | [WARN] 1.2.4 - Ensure auditing is configured for Docker files and directories - / | ||
| - | [WARN] 1.2.5 - Ensure auditing is configured for Docker files and directories - /etc/docker | ||
| - | [WARN] 1.2.6 - Ensure auditing is configured for Docker files and directories - docker.service | ||
| - | [WARN] 1.2.7 - Ensure auditing is configured for Docker files and directories - docker.socket | ||
| - | [WARN] 1.2.8 - Ensure auditing is configured for Docker files and directories - / | ||
| - | [WARN] 1.2.11 | ||
| - | </ | ||
| - | |||
| - | Ces avertissements sont présents parce que **auditd** n'est pas installé et parce qu'il n'y a pas de règles spécifiques au daemon Docker et ses répertoires et fichiers associés. | ||
| - | |||
| - | Pour installer auditd, utilisez **apt-get** : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | </ | ||
| - | |||
| - | Modifiez ensuite le fichier **/ | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | ## First rule - delete all | ||
| - | -D | ||
| - | |||
| - | ## Increase the buffers to survive stress events. | ||
| - | ## Make this bigger for busy systems | ||
| - | -b 8192 | ||
| - | |||
| - | ## This determine how long to wait in burst of events | ||
| - | --backlog_wait_time 0 | ||
| - | |||
| - | ## Set failure mode to syslog | ||
| - | -f 1 | ||
| - | |||
| - | ##Docker | ||
| - | -w / | ||
| - | -w / | ||
| - | -w /etc/docker -p wa | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : L' | ||
| - | </ | ||
| - | |||
| - | Re-démarrez ensuite auditd : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | </ | ||
| - | |||
| - | Vérifiez ensuite la prise en charge des règles : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | ## This file is automatically generated from / | ||
| - | -D | ||
| - | -b 8192 | ||
| - | -f 1 | ||
| - | --backlog_wait_time 0 | ||
| - | -w / | ||
| - | -w / | ||
| - | -w /etc/docker -p wa | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | -w / | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** - Pour plus d' | ||
| - | </ | ||
| - | |||
| - | Ré-exécutez le script **Docker Benchmark Security** : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | ... | ||
| - | [PASS] 1.2.4 - Ensure auditing is configured for Docker files and directories - / | ||
| - | [PASS] 1.2.5 - Ensure auditing is configured for Docker files and directories - /etc/docker | ||
| - | [PASS] 1.2.6 - Ensure auditing is configured for Docker files and directories - docker.service | ||
| - | [PASS] 1.2.7 - Ensure auditing is configured for Docker files and directories - docker.socket | ||
| - | [PASS] 1.2.8 - Ensure auditing is configured for Docker files and directories - / | ||
| - | ... | ||
| - | [PASS] 1.2.11 | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | =====LAB #4 - Sécurisation de la Configuration du daemon Docker===== | ||
| - | |||
| - | Exécutez de nouveau le script **docker-bench-security.sh**. Vous devez obtenir un résultat similaire à ceci en ce qui concerne la sécurité de la configuration du daemon Docker : | ||
| - | |||
| - | < | ||
| - | ... | ||
| - | [INFO] 2 - Docker daemon configuration | ||
| - | [WARN] 2.1 - Ensure network traffic is restricted between containers on the default bridge | ||
| - | [PASS] 2.2 - Ensure the logging level is set to ' | ||
| - | [PASS] 2.3 - Ensure Docker is allowed to make changes to iptables | ||
| - | [PASS] 2.4 - Ensure insecure registries are not used | ||
| - | [PASS] 2.5 - Ensure aufs storage driver is not used | ||
| - | [INFO] 2.6 - Ensure TLS authentication for Docker daemon is configured | ||
| - | [INFO] | ||
| - | [INFO] 2.7 - Ensure the default ulimit is configured appropriately | ||
| - | [INFO] | ||
| - | [WARN] 2.8 - Enable user namespace support | ||
| - | [PASS] 2.9 - Ensure the default cgroup usage has been confirmed | ||
| - | [PASS] 2.10 - Ensure base device size is not changed until needed | ||
| - | [WARN] 2.11 - Ensure that authorization for Docker client commands is enabled | ||
| - | [WARN] 2.12 - Ensure centralized and remote logging is configured | ||
| - | [PASS] 2.13 - Ensure live restore is Enabled (Incompatible with swarm mode) | ||
| - | [WARN] 2.14 - Ensure Userland Proxy is Disabled | ||
| - | [PASS] 2.15 - Ensure that a daemon-wide custom seccomp profile is applied if appropriate | ||
| - | [PASS] 2.16 - Ensure that experimental features are not implemented in production | ||
| - | [WARN] 2.17 - Ensure containers are restricted from acquiring new privileges | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | Les problèmes de sécurité qu'il convient à résoudre sont indiqués par les annotations **[WARN]**. | ||
| - | |||
| - | ====4.1 - [WARN] 2.1 - Ensure network traffic is restricted between containers on the default bridge==== | ||
| - | |||
| - | Par défaut Docker permet un trafic réseau sans restrictions entre des conteneurs sur le même hôte. Il est cependant possible de modifier la configuration par défaut. Pour empêcher ceci, il faut fixer la valeur de **icc** à **false**. De cette façon, docker crée des conteneurs qui peuvent communiquer entre eux **uniquement** s'il existe un lien. | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====4.2 - [WARN] 2.8 - Enable user namespace support==== | ||
| - | |||
| - | Cet avertissement nous indique que l' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====4.3 - [WARN] 2.11 - Ensure that authorization for Docker client commands is enabled==== | ||
| - | |||
| - | Par défaut, Docker permet un accès sans restrictions aux daemon Docker. Il est possible de restreindre l' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====4.4 - [WARN] 2.12 - Ensure centralized and remote logging is configured==== | ||
| - | |||
| - | Cet avertissement indique que la configuration de rsyslog ne permet pas l' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====4.5 - [WARN] 2.14 - Ensure Userland Proxy is Disabled==== | ||
| - | |||
| - | Il existe deux méthodes pour qu'un conteneur puisse router vers l' | ||
| - | |||
| - | * le mode **Hairpin NAT**, | ||
| - | * **Userland Proxy**. | ||
| - | |||
| - | Il est préférable d' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====4.6 - [WARN] 2.17 - Ensure containers are restricted from acquiring new privileges==== | ||
| - | |||
| - | Par défaut un conteneur peut obtenir une escalade de privilèges en utilisant les binaires setuid ou setgid. Pour interdire ceci il faut fixer la valeur de **no-new-privileges** à **true**. | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====4.7 - Le Fichier / | ||
| - | |||
| - | Créez le fichier **/ | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | } | ||
| - | </ | ||
| - | |||
| - | Notez ici que **live-restore** est fixé à **true**. Ceci permet aux conteneurs de continuer à fonctionner même quand le daemon Docker ne fonctionne pas. Ceci est utile pendant la mise-à-jour de Docker. | ||
| - | |||
| - | Re-démarrez le service Docker : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | </ | ||
| - | |||
| - | Vérifiez la présence de l' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | uid=116(dockremap) gid=121(dockremap) groupes=121(dockremap) | ||
| - | </ | ||
| - | |||
| - | Ré-exécutez le script **Docker Benchmark Security** : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | ... | ||
| - | [PASS] 2.1 - Ensure network traffic is restricted between containers on the default bridge | ||
| - | ... | ||
| - | [PASS] 2.8 - Enable user namespace support | ||
| - | ... | ||
| - | [WARN] 2.11 - Ensure that authorization for Docker client commands is enabled | ||
| - | [PASS] 2.12 - Ensure centralized and remote logging is configured | ||
| - | ... | ||
| - | [PASS] 2.14 - Ensure Userland Proxy is Disabled | ||
| - | ... | ||
| - | [PASS] 2.17 - Ensure containers are restricted from acquiring new privileges | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | =====LAB #5 - Sécurisation des Images et les Fichiers de Construction===== | ||
| - | |||
| - | Créez le conteneur mysql : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | Unable to find image ' | ||
| - | latest: Pulling from library/ | ||
| - | 80369df48736: | ||
| - | e8f52315cb10: | ||
| - | cf2189b391fc: | ||
| - | cc98f645c682: | ||
| - | 27a27ac83f74: | ||
| - | fa1f04453414: | ||
| - | d45bf7d22d33: | ||
| - | 3dbac26e409c: | ||
| - | 9017140fb8c1: | ||
| - | b76dda2673ae: | ||
| - | bea9eb46d12a: | ||
| - | e1f050a38d0f: | ||
| - | Digest: sha256: | ||
| - | Status: Downloaded newer image for mysql: | ||
| - | 54606c03c52c5e3ec0328029d69b869d4b285fb433015576dedc8b8dd4ad0494 | ||
| - | root@debian9: | ||
| - | CONTAINER ID IMAGE | ||
| - | 54606c03c52c | ||
| - | </ | ||
| - | |||
| - | Exécutez de nouveau le script **docker-bench-security.sh**. Vous devez obtenir un résultat similaire à ceci en ce qui concerne la sécurité des images et les fichiers de leur construction : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | ... | ||
| - | [INFO] 4 - Container Images and Build File | ||
| - | [WARN] 4.1 - Ensure a user for the container has been created | ||
| - | [WARN] | ||
| - | [NOTE] 4.2 - Ensure that containers use only trusted base images | ||
| - | [NOTE] 4.3 - Ensure that unnecessary packages are not installed in the container | ||
| - | [NOTE] 4.4 - Ensure images are scanned and rebuilt to include security patches | ||
| - | [WARN] 4.5 - Ensure Content trust for Docker is Enabled | ||
| - | [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images | ||
| - | [WARN] | ||
| - | [WARN] | ||
| - | [INFO] 4.7 - Ensure update instructions are not use alone in the Dockerfile | ||
| - | [INFO] | ||
| - | [NOTE] 4.8 - Ensure setuid and setgid permissions are removed | ||
| - | [PASS] 4.9 - Ensure that COPY is used instead of ADD in Dockerfiles | ||
| - | [NOTE] 4.10 - Ensure secrets are not stored in Dockerfiles | ||
| - | [NOTE] 4.11 - Ensure only verified packages are installed | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | ====5.1 - [WARN] 4.1 - Ensure a user for the container has been created==== | ||
| - | |||
| - | Les processus dans le conteneur **root-nginx** tourne sous l'UID de root. Ceci est l' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====5.2 - [WARN] 4.5 - Ensure Content trust for Docker is Enabled==== | ||
| - | |||
| - | Cette ligne indique que le support de Content trust n'a pas été activé. Content trust permet de s' | ||
| - | |||
| - | Pour activer le Content trust, il faut positionner la valeur de la variable **DOCKER_CONTENT_TRUST** à **1** : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | DOCKER_CONTENT_TRUST=1 | ||
| - | root@debian9: | ||
| - | </ | ||
| - | |||
| - | Re-démarrez la machine virtuelle **Manager** et démarrez le conteneur **mysql** : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | mysql | ||
| - | root@debian9: | ||
| - | CONTAINER ID IMAGE | ||
| - | 54606c03c52c | ||
| - | </ | ||
| - | |||
| - | Exécutez de nouveau le script et notez le contenu de la section 4 : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | ... | ||
| - | [INFO] 4 - Container Images and Build File | ||
| - | [WARN] 4.1 - Ensure a user for the container has been created | ||
| - | [WARN] | ||
| - | [NOTE] 4.2 - Ensure that containers use only trusted base images | ||
| - | [NOTE] 4.3 - Ensure that unnecessary packages are not installed in the container | ||
| - | [NOTE] 4.4 - Ensure images are scanned and rebuilt to include security patches | ||
| - | [PASS] 4.5 - Ensure Content trust for Docker is Enabled | ||
| - | [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images | ||
| - | [WARN] | ||
| - | [WARN] | ||
| - | [INFO] 4.7 - Ensure update instructions are not use alone in the Dockerfile | ||
| - | [INFO] | ||
| - | [NOTE] 4.8 - Ensure setuid and setgid permissions are removed | ||
| - | [PASS] 4.9 - Ensure that COPY is used instead of ADD in Dockerfiles | ||
| - | [NOTE] 4.10 - Ensure secrets are not stored in Dockerfiles | ||
| - | [NOTE] 4.11 - Ensure only verified packages are installed | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====5.3 - [WARN] 4.6 - Ensure that HEALTHCHECK instructions have been added to container images==== | ||
| - | |||
| - | Quand une image est construite il est possible d'y mettre un **HEALTHCHECK** dont le statut peut être vérifié par Docker afin de relancer le conteneur si nécessaire. | ||
| - | |||
| - | Pour mettre en place un HEALTHCHECK, | ||
| - | |||
| - | < | ||
| - | HEALTHCHECK --interval=20s --timeout=3s CMD curl -f http:// | ||
| - | </ | ||
| - | |||
| - | Ce test permet de vérifier que le conteneur peut atteindre l'URL indiqué tous les 20 secondes et produit une erreur au bout de 3 secondes. | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | =====LAB #6 - Sécurisation du Container Runtime===== | ||
| - | |||
| - | Exécutez de nouveau le script **docker-bench-security.sh**, | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | ... | ||
| - | [INFO] 5 - Container Runtime | ||
| - | [WARN] 5.1 - Ensure that, if applicable, an AppArmor Profile is enabled | ||
| - | [WARN] | ||
| - | [WARN] 5.2 - Ensure that, if applicable, SELinux security options are set | ||
| - | [WARN] | ||
| - | [PASS] 5.3 - Ensure Linux Kernel Capabilities are restricted within containers | ||
| - | [PASS] 5.4 - Ensure that privileged containers are not used | ||
| - | [PASS] 5.5 - Ensure sensitive host system directories are not mounted on containers | ||
| - | [PASS] 5.6 - Ensure sshd is not run within containers | ||
| - | [PASS] 5.7 - Ensure privileged ports are not mapped within containers | ||
| - | [NOTE] 5.8 - Ensure that only needed ports are open on the container | ||
| - | [PASS] 5.9 - Ensure the host's network namespace is not shared | ||
| - | [WARN] 5.10 - Ensure that the memory usage for containers is limited | ||
| - | [WARN] | ||
| - | [WARN] 5.11 - Ensure CPU priority is set appropriately on the container | ||
| - | [WARN] | ||
| - | [WARN] 5.12 - Ensure that the container' | ||
| - | [WARN] | ||
| - | [PASS] 5.13 - Ensure that incoming container traffic is bound to a specific host interface | ||
| - | [WARN] 5.14 - Ensure that the ' | ||
| - | [WARN] | ||
| - | [PASS] 5.15 - Ensure the host's process namespace is not shared | ||
| - | [PASS] 5.16 - Ensure the host's IPC namespace is not shared | ||
| - | [PASS] 5.17 - Ensure that host devices are not directly exposed to containers | ||
| - | [INFO] 5.18 - Ensure that the default ulimit is overwritten at runtime if needed | ||
| - | [INFO] | ||
| - | [PASS] 5.19 - Ensure mount propagation mode is not set to shared | ||
| - | [PASS] 5.20 - Ensure the host's UTS namespace is not shared | ||
| - | [PASS] 5.21 - Ensure the default seccomp profile is not Disabled | ||
| - | [NOTE] 5.22 - Ensure docker exec commands are not used with privileged option | ||
| - | [NOTE] 5.23 - Ensure that docker exec commands are not used with the user=root option | ||
| - | [PASS] 5.24 - Ensure that cgroup usage is confirmed | ||
| - | [WARN] 5.25 - Ensure that the container is restricted from acquiring additional privileges | ||
| - | [WARN] | ||
| - | [WARN] 5.26 - Ensure that container health is checked at runtime | ||
| - | [WARN] | ||
| - | [INFO] 5.27 - Ensure that Docker commands always make use of the latest version of their image | ||
| - | [WARN] 5.28 - Ensure that the PIDs cgroup limit is used | ||
| - | [WARN] | ||
| - | [INFO] 5.29 - Ensure that Docker' | ||
| - | [INFO] | ||
| - | [PASS] 5.30 - Ensure that the host's user namespaces are not shared | ||
| - | [PASS] 5.31 - Ensure that the Docker socket is not mounted inside any containers | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | Les problèmes de sécurité qu'il convient à résoudre sont indiqués par les annotations **[WARN]**. | ||
| - | |||
| - | ====6.1 - [WARN] 5.1 - Ensure AppArmor Profile is Enabled==== | ||
| - | |||
| - | Cet avertissement est présent parce que le conteneur n' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====6.2 - [WARN] 5.2 - Ensure SELinux security options are set, if applicable==== | ||
| - | |||
| - | Cet avertissement est présent parce que le conteneur n' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====6.3 - [WARN] 5.10 - Ensure memory usage for container is limited==== | ||
| - | |||
| - | Cet avertissement est du au fait que les conteneurs ont automatiquement accès à la totalité de la RAM de l' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | b04b2a6f0dd93da21a8b7640afc319406e42868a141f90936dbcf52ab5bffb0d | ||
| - | root@debian9: | ||
| - | CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS | ||
| - | b04b2a6f0dd9 | ||
| - | ^C | ||
| - | </ | ||
| - | |||
| - | Supprimez le conteneur et re-créez le avec une limite de mémoire : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | CONTAINER ID IMAGE | ||
| - | b04b2a6f0dd9 | ||
| - | 5b31fe1e13bc | ||
| - | 7788c67c3b69 | ||
| - | root@debian9: | ||
| - | b0 | ||
| - | root@debian9: | ||
| - | 095472e5096a57277230ff94822d9bd0ad479ad26a33cbf83ec381cdb02910e1 | ||
| - | root@debian9: | ||
| - | CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS | ||
| - | 095472e5096a | ||
| - | ^C | ||
| - | </ | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====6.4 - [WARN] 5.11 - Ensure CPU priority is set appropriately on the container==== | ||
| - | |||
| - | Cet avertissement est du au fait que les conteneurs ont automatiquement accès à tous les CPU de l' | ||
| - | |||
| - | La valeur de cpu-shares est relative à la valeur par défaut de **1024**. Un valeur de 512 permet au conteneur d' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====6.5 - [WARN] 5.12 - Ensure the container' | ||
| - | |||
| - | Afin de minimiser le risque de compromettre un conteneur par la présence de code malicieux, il est conseillé de démarrer les conteneurs en lecture seule, sauf pour les volumes qui nécessitent un accès en écriture/ | ||
| - | |||
| - | Créez le fichier **write_a_file** dans le conteneur **mysql** : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | </ | ||
| - | |||
| - | La Commande **docker container diff** indique les différences apportées au conteneur par rapport à l' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | A / | ||
| - | C /run | ||
| - | C /run/mysqld | ||
| - | A / | ||
| - | A / | ||
| - | A / | ||
| - | A / | ||
| - | A / | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez que la sortie indique les changements apportés au conteneur. | ||
| - | </ | ||
| - | |||
| - | Arrêtez et supprimez le conteneur : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | mysql | ||
| - | root@debian9: | ||
| - | mysql | ||
| - | </ | ||
| - | |||
| - | Lancez un conteneur mysql en lecture seule : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | 7788c67c3b692515f63f4659a8f40af397bfbde97485e2e40c500c16b158045b | ||
| - | root@debian9: | ||
| - | CONTAINER ID IMAGE | ||
| - | 7788c67c3b69 | ||
| - | </ | ||
| - | |||
| - | Créez le fichier **write_a_file** dans le conteneur **mysql** : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | touch: cannot touch '/ | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez l' | ||
| - | </ | ||
| - | |||
| - | Exécutez la commande **docker container diff** : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez que la commande ne retourne aucune sortie. En effet le conteneur étant en lecture seule, aucun changement ne peut intervenir. | ||
| - | </ | ||
| - | |||
| - | ====6.6 - [WARN] 5.14 - Ensure ' | ||
| - | |||
| - | Cet avertissement concerne la politique de re-démarrage du conteneur. La politique **on-failure[: | ||
| - | |||
| - | # docker container run -d --name mysql --read-only --restart on-failure: | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====6.7 - [WARN] 5.25 - Ensure the container is restricted from acquiring additional privileges==== | ||
| - | |||
| - | Pour complémenter la configuration précédemment mise en place, il convient de lancer le conteneur en utilisant l' | ||
| - | |||
| - | # docker container run -d --name mysql --read-only --restart on-failure: | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====6.8 - [WARN] 5.26 - Ensure container health is checked at runtime==== | ||
| - | |||
| - | Voir l' | ||
| - | |||
| - | ====6.9 - [WARN] 5.28 - Ensure PIDs cgroup limit is used==== | ||
| - | |||
| - | Sans l' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | </ | ||
| - | |||
| - | L' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | CONTAINER ID IMAGE | ||
| - | 05b11e44e595 | ||
| - | ... | ||
| - | root@debian9: | ||
| - | 05 | ||
| - | root@debian9: | ||
| - | environment: | ||
| - | environment: | ||
| - | environment: | ||
| - | environment: | ||
| - | environment: | ||
| - | environment: | ||
| - | ^C | ||
| - | </ | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | Supprimez maintenant tous les conteneurs déjà créées : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | CONTAINER ID IMAGE | ||
| - | 095472e5096a | ||
| - | 5b31fe1e13bc | ||
| - | 7788c67c3b69 | ||
| - | root@debian9: | ||
| - | 095 | ||
| - | root@debian9: | ||
| - | 5b31fe1e13bc | ||
| - | 7788c67c3b69 | ||
| - | 095472e5096a | ||
| - | root@debian9: | ||
| - | CONTAINER ID IMAGE | ||
| - | </ | ||
| - | |||
| - | Re-créez le conteneur mysql en intégrant les points vus ci-dessus : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | df54974ebc11fe357f6e8e9b0f8499aee2658af435e32a45058a1e49fcd3dc24 | ||
| - | root@debian9: | ||
| - | CONTAINER ID IMAGE | ||
| - | df54974ebc11 | ||
| - | </ | ||
| - | |||
| - | Exécutez de nouveau le script **docker-bench-security.sh**, | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | ... | ||
| - | [INFO] 5 - Container Runtime | ||
| - | [WARN] 5.1 - Ensure that, if applicable, an AppArmor Profile is enabled | ||
| - | [WARN] | ||
| - | [PASS] 5.2 - Ensure that, if applicable, SELinux security options are set | ||
| - | [PASS] 5.3 - Ensure Linux Kernel Capabilities are restricted within containers | ||
| - | [PASS] 5.4 - Ensure that privileged containers are not used | ||
| - | [PASS] 5.5 - Ensure sensitive host system directories are not mounted on containers | ||
| - | [PASS] 5.6 - Ensure sshd is not run within containers | ||
| - | [PASS] 5.7 - Ensure privileged ports are not mapped within containers | ||
| - | [NOTE] 5.8 - Ensure that only needed ports are open on the container | ||
| - | [PASS] 5.9 - Ensure the host's network namespace is not shared | ||
| - | [PASS] 5.10 - Ensure that the memory usage for containers is limited | ||
| - | [PASS] 5.11 - Ensure CPU priority is set appropriately on the container | ||
| - | [PASS] 5.12 - Ensure that the container' | ||
| - | [PASS] 5.13 - Ensure that incoming container traffic is bound to a specific host interface | ||
| - | [PASS] 5.14 - Ensure that the ' | ||
| - | [PASS] 5.15 - Ensure the host's process namespace is not shared | ||
| - | [PASS] 5.16 - Ensure the host's IPC namespace is not shared | ||
| - | [PASS] 5.17 - Ensure that host devices are not directly exposed to containers | ||
| - | [INFO] 5.18 - Ensure that the default ulimit is overwritten at runtime if needed | ||
| - | [INFO] | ||
| - | [PASS] 5.19 - Ensure mount propagation mode is not set to shared | ||
| - | [PASS] 5.20 - Ensure the host's UTS namespace is not shared | ||
| - | [PASS] 5.21 - Ensure the default seccomp profile is not Disabled | ||
| - | [NOTE] 5.22 - Ensure docker exec commands are not used with privileged option | ||
| - | [NOTE] 5.23 - Ensure that docker exec commands are not used with the user=root option | ||
| - | [PASS] 5.24 - Ensure that cgroup usage is confirmed | ||
| - | [PASS] 5.25 - Ensure that the container is restricted from acquiring additional privileges | ||
| - | [WARN] 5.26 - Ensure that container health is checked at runtime | ||
| - | [WARN] | ||
| - | [INFO] 5.27 - Ensure that Docker commands always make use of the latest version of their image | ||
| - | [PASS] 5.28 - Ensure that the PIDs cgroup limit is used | ||
| - | [INFO] 5.29 - Ensure that Docker' | ||
| - | [INFO] | ||
| - | [PASS] 5.30 - Ensure that the host's user namespaces are not shared | ||
| - | [PASS] 5.31 - Ensure that the Docker socket is not mounted inside any containers | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | =====LAB #7 - Sécurisation des Images avec Docker Content Trust===== | ||
| - | |||
| - | **Docker Content Trust (DCT)** a été introduit avec Docker Engine 1.8 et Docker CS Engine 1.9.0. DCT permet la vérification de l' | ||
| - | |||
| - | DCT est utilisé par le **Docker Hub Registry** mais peut aussi être mis en place dans des Registry privés, notamment grâce à la mise en place du **[[https:// | ||
| - | |||
| - | DCT est basé sur l' | ||
| - | |||
| - | Pour plus d' | ||
| - | |||
| - | ====7.1 - DOCKER_CONTENT_TRUST==== | ||
| - | |||
| - | Pour utiliser **Docker Content Trust (DCT)**, il convient de vérifier que la valeur de la variable **DOCKER_CONTENT_TRUST** est **1** : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | 1 | ||
| - | </ | ||
| - | |||
| - | Dans le cas contraire, il faut fixer la valeur de la variable à 1 : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | 1 | ||
| - | </ | ||
| - | |||
| - | ====7.2 - DCT et la commande docker pull==== | ||
| - | |||
| - | Afin d' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | Login with your Docker ID to push and pull images from Docker Hub. If you don't have a Docker ID, head over to https:// | ||
| - | Username: < | ||
| - | Password: < | ||
| - | WARNING! Your password will be stored unencrypted in / | ||
| - | Configure a credential helper to remove this warning. See | ||
| - | https:// | ||
| - | |||
| - | Login Succeeded | ||
| - | </ | ||
| - | |||
| - | Pour constater l' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | Error: remote trust data does not exist for docker.io/ | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez l' | ||
| - | </ | ||
| - | |||
| - | Par contre, toutes les images de type **official** sont signées : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | Using default tag: latest | ||
| - | Pull (1 of 1): centos: | ||
| - | sha256: | ||
| - | 729ec3a6ada3: | ||
| - | Digest: sha256: | ||
| - | Status: Downloaded newer image for centos@sha256: | ||
| - | Tagging centos@sha256: | ||
| - | docker.io/ | ||
| - | </ | ||
| - | |||
| - | Cette image est maintenant présente sur **manager.i2tch.loc** : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | REPOSITORY | ||
| - | ubuntu | ||
| - | nginx | ||
| - | alpine | ||
| - | mysql | ||
| - | centos | ||
| - | </ | ||
| - | |||
| - | ===L' | ||
| - | |||
| - | Il est aussi possible d' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | unsigned: Pulling from i2tch/ | ||
| - | 10d70a43a9f9: | ||
| - | 4f4fb700ef54: | ||
| - | 8951e3a91277: | ||
| - | d1814ff35b8b: | ||
| - | ff2a2bbf6141: | ||
| - | b7205da5c3c9: | ||
| - | 458ea241cc75: | ||
| - | 74d1c0702786: | ||
| - | c66f3692932d: | ||
| - | 9224bd1b9757: | ||
| - | Digest: sha256: | ||
| - | Status: Downloaded newer image for i2tch/ | ||
| - | docker.io/ | ||
| - | |||
| - | root@debian9: | ||
| - | REPOSITORY | ||
| - | ubuntu | ||
| - | nginx | ||
| - | alpine | ||
| - | mysql | ||
| - | centos | ||
| - | i2tch/ | ||
| - | |||
| - | root@debian9: | ||
| - | Untagged: i2tch/ | ||
| - | Untagged: i2tch/ | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | Deleted: sha256: | ||
| - | </ | ||
| - | |||
| - | ====7.3 - DCT et la commande docker push==== | ||
| - | |||
| - | Pour envoyer l' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | </ | ||
| - | |||
| - | L' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | REPOSITORY | ||
| - | ubuntu | ||
| - | nginx latest | ||
| - | < | ||
| - | alpine | ||
| - | mysql latest | ||
| - | centos | ||
| - | </ | ||
| - | |||
| - | Lors du push vers le registry privé, il faut créer des passphrases pour **deux** clefs : | ||
| - | |||
| - | * la **root** key aussi connue sous le nom **offline** key (ID 192fc7e), qui est uniquement demandée la **première** fois après la mise en place de DCT lors de la création d'un **repositry**, | ||
| - | * la **repository** key aussi connue sous le nom **tagging** key (ID 168c754), utilisée pour signer l' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | The push refers to repository [docker.io/< | ||
| - | 77cae8ab23bf: | ||
| - | alpine: digest: sha256: | ||
| - | Signing and pushing trust metadata | ||
| - | You are about to create a new root signing key passphrase. This passphrase | ||
| - | will be used to protect the most sensitive key in your signing system. Please | ||
| - | choose a long, complex passphrase and be careful to keep the password and the | ||
| - | key file itself secure and backed up. It is highly recommended that you use a | ||
| - | password manager to generate the passphrase and keep it safe. There will be no | ||
| - | way to recover this key. You can find the key in your config directory. | ||
| - | Enter passphrase for new root key with ID 192fc7e: fenestros | ||
| - | Repeat passphrase for new root key with ID 192fc7e: fenestros | ||
| - | Enter passphrase for new repository key with ID 168c754: fenestros | ||
| - | Repeat passphrase for new repository key with ID 168c754: fenestros | ||
| - | Finished initializing " | ||
| - | Successfully signed docker.io/< | ||
| - | </ | ||
| - | |||
| - | Les clefs sont stockées dans le répertoire **~/ | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | total 8 | ||
| - | drwx------ 2 root root 4096 nov. 10 14:49 private | ||
| - | drwx------ 3 root root 4096 nov. 8 13:48 tuf | ||
| - | |||
| - | root@debian9: | ||
| - | total 8 | ||
| - | -rw------- 1 root root 447 nov. 10 14:49 168c754ea8f36ce7fbcbe2299b6d91fc0f4d594c9ed9b86916687b618d8438ac.key | ||
| - | -rw------- 1 root root 416 nov. 10 14:49 192fc7ed9543ad4bceec58886ab1d605b7433c35f7462d7343d0780d8fddf1db.key | ||
| - | root@debian9: | ||
| - | -----BEGIN ENCRYPTED PRIVATE KEY----- | ||
| - | gun: docker.io/ | ||
| - | role: targets | ||
| - | |||
| - | MIHuMEkGCSqGSIb3DQEFDTA8MBsGCSqGSIb3DQEFDDAOBAhm7HwR0y8FFAICCAAw | ||
| - | HQYJYIZIAWUDBAEqBBC729tU73wKHFQSbmZ1EVZaBIGgmGiFSs4lM5tElSGukl1B | ||
| - | HrELT9aFooFgW7oSXNLM8aFfF/ | ||
| - | 3m40g3MywHilW4rUcjoHVTTUXABGXUQ3f7h+nI15CXcZ11qRLyWbf2uywE9yYH9O | ||
| - | M7GLUcE+pTENJKfZAhRGBEL+LgXNfGI1aAVqaEbBDcDnKKf4Uj1Xu4oLJ7je8+nT | ||
| - | dg== | ||
| - | -----END ENCRYPTED PRIVATE KEY----- | ||
| - | |||
| - | root@debian9: | ||
| - | -----BEGIN ENCRYPTED PRIVATE KEY----- | ||
| - | role: root | ||
| - | |||
| - | MIHuMEkGCSqGSIb3DQEFDTA8MBsGCSqGSIb3DQEFDDAOBAiAtCzEar3AhgICCAAw | ||
| - | HQYJYIZIAWUDBAEqBBAO7hHWVoqOo6xcETQQDXRdBIGgPUoLzTz07Ajx8K3D8+Vv | ||
| - | 2NUiflMYhH/ | ||
| - | V2BwSlXp7t1Cnqp/ | ||
| - | KREO8uEq3v7HcSBBqFm0+TU+92d7hVuDApPaj0lZYP+3f7H6AjUOqu6hUoK8Ck/ | ||
| - | Ig== | ||
| - | -----END ENCRYPTED PRIVATE KEY----- | ||
| - | </ | ||
| - | |||
| - | ====7.4 - DCT et la commande docker build==== | ||
| - | |||
| - | L' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | FROM docker/ | ||
| - | RUN echo | ||
| - | </ | ||
| - | |||
| - | Lors du build de l' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | Sending build context to Docker daemon | ||
| - | |||
| - | error during connect: Post http:// | ||
| - | </ | ||
| - | |||
| - | L' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | Sending build context to Docker daemon | ||
| - | Step 1/2 : FROM docker/ | ||
| - | latest: Pulling from docker/ | ||
| - | Image docker.io/ | ||
| - | aac0c133338d: | ||
| - | a3ed95caeb02: | ||
| - | Digest: sha256: | ||
| - | Status: Downloaded newer image for docker/ | ||
| - | | ||
| - | Step 2/2 : RUN echo | ||
| - | | ||
| - | |||
| - | Removing intermediate container 694e79d3cd88 | ||
| - | | ||
| - | Successfully built 686e85ee76b8 | ||
| - | Successfully tagged < | ||
| - | </ | ||
| - | |||
| - | Lors du push de l' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | The push refers to repository [docker.io/< | ||
| - | 5f70bf18a086: | ||
| - | c22f7bc058a9: | ||
| - | nottrusted: digest: sha256: | ||
| - | Signing and pushing trust metadata | ||
| - | Enter passphrase for repository key with ID 168c754: fenestros | ||
| - | Successfully signed docker.io/< | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez l' | ||
| - | </ | ||
| - | |||
| - | ===Créer un deuxième Repositry=== | ||
| - | |||
| - | Par contre en modifiant le tag de l' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | root@debian9: | ||
| - | REPOSITORY | ||
| - | < | ||
| - | < | ||
| - | ubuntu | ||
| - | nginx latest | ||
| - | < | ||
| - | alpine | ||
| - | mysql latest | ||
| - | centos | ||
| - | docker/ | ||
| - | |||
| - | root@debian9: | ||
| - | The push refers to repository [docker.io/< | ||
| - | 5f70bf18a086: | ||
| - | c22f7bc058a9: | ||
| - | latest: digest: sha256: | ||
| - | Signing and pushing trust metadata | ||
| - | Enter passphrase for root key with ID 192fc7e: fenestros | ||
| - | Enter passphrase for new repository key with ID 7b13d02: fenestros | ||
| - | Repeat passphrase for new repository key with ID 7b13d02: fenestros | ||
| - | Finished initializing " | ||
| - | Successfully signed docker.io/< | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez la création d'une deuxième repositry key (ID 7b13d02 au lieu de ID 168c754) lors du push de l' | ||
| - | </ | ||
| - | |||
| - | La présence de cette deuxième repositry key (**7b13d02d74264624fb201e7ae13ae694286b9f761aa86adddefd0408c7234a58.key**) peut être constatée dans le répertoire **~/ | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | total 12 | ||
| - | -rw------- 1 root root 447 nov. 10 14:49 168c754ea8f36ce7fbcbe2299b6d91fc0f4d594c9ed9b86916687b618d8438ac.key | ||
| - | -rw------- 1 root root 416 nov. 10 14:49 192fc7ed9543ad4bceec58886ab1d605b7433c35f7462d7343d0780d8fddf1db.key | ||
| - | -rw------- 1 root root 451 nov. 10 17:37 7b13d02d74264624fb201e7ae13ae694286b9f761aa86adddefd0408c7234a58.key | ||
| - | </ | ||
| - | |||
| - | En inspectant les clefs des images créées, l' | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | [ | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | "Repo Admin" | ||
| - | ] | ||
| - | } | ||
| - | ], | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | } | ||
| - | ] | ||
| - | }, | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | } | ||
| - | ] | ||
| - | } | ||
| - | ] | ||
| - | } | ||
| - | ] | ||
| - | root@debian9: | ||
| - | [ | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | "Repo Admin" | ||
| - | ] | ||
| - | } | ||
| - | ], | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | } | ||
| - | ] | ||
| - | }, | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | } | ||
| - | ] | ||
| - | } | ||
| - | ] | ||
| - | } | ||
| - | ] | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez que les clefs utilisées sont les mêmes pour les deux images. | ||
| - | </ | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | [ | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | "Repo Admin" | ||
| - | ] | ||
| - | } | ||
| - | ], | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | } | ||
| - | ] | ||
| - | }, | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | } | ||
| - | ] | ||
| - | } | ||
| - | ] | ||
| - | } | ||
| - | ] | ||
| - | </ | ||
| - | |||
| - | <WRAP center round important 60%> | ||
| - | **Important** : Notez que les clefs utilisées sont différentes. | ||
| - | </ | ||
| - | |||
| - | ===Supprimer une Signature=== | ||
| - | |||
| - | Dernièrement il est possible de supprimer la signature d'une image avec la commande **docker trust revoke** : | ||
| - | |||
| - | < | ||
| - | root@debian9: | ||
| - | Enter passphrase for repository key with ID 168c754: | ||
| - | Successfully deleted signature for < | ||
| - | root@debian9: | ||
| - | [ | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | } | ||
| - | ] | ||
| - | }, | ||
| - | { | ||
| - | " | ||
| - | " | ||
| - | { | ||
| - | " | ||
| - | } | ||
| - | ] | ||
| - | } | ||
| - | ] | ||
| - | } | ||
| - | ] | ||
| - | </ | ||
| - | |||
| - | |||
| - | ----- | ||
| - | < | ||
| - | <div align=" | ||
| - | Copyright © 2021 Hugh NORRIS | ||
| - | </ | ||
| - | </ | ||
