Questions tagged [security]
For questions related to IT Security, Information Security or DevSecOps.
103
questions
1
vote
1
answer
307
views
Are using TestContainers safe for integration tests?
I have a discussion with our DevOps about using Testcontainers for integration tests. It's a tool to bring up throw-away containers for testing. The testcontainers need a environment variable ...
- 113
2
votes
1
answer
504
views
Azure Security Center with Ubuntu 19
Has anyone successfully gotten the Azure Security Center agent to work with Ubuntu 19? My omsconfig.log is full of messages like
This event indicates that failure happens when LCM is trying to get ...
- 1,086
3
votes
1
answer
3k
views
Accessing TPM from inside a Docker Container
I want to implement Vault as part of the DevOps build pipeline to store all the secrets like passwords and certificates. I understand that Vault keeps the data encrypted but I have been asked to look ...
- 155
0
votes
2
answers
344
views
What is the most common server permission policy for web application deployment?
I have a server with Ubuntu with a web server (Apache or Nginx) running a PHP application. The application consists of the following parts:
An executable code that handles HTTP requests (say in the /...
- 101
1
vote
1
answer
114
views
How can I expose port 3389 using a secure approach
Within our legacy infrastructure we need to keep port 3389 exposed so that we can remote desktop into this server (note that we can't go back and utilize IaC to prevent this).
We currently restrict ...
- 177
6
votes
2
answers
152
views
Securing communication between cloud VMs without private networks. Any strategy besides building own VPN? Spiped?
I am working on an application that requires a number of different services (web application + database + worker queues, XMPP server for messaging, redis, central authentication via LDAP, etc). For my ...
- 161
4
votes
1
answer
354
views
How to securely pass sensitive data to EC2 Spot instances?
Right now, we only use EC2 on-demand instances, and we provision sensitive data (credentials, private keys, etc.) on the instances' EBS which are encrypted with a KMS key.
My understanding is that I ...
- 155
1
vote
0
answers
133
views
How to setup external service (keycloak) to protect an app in kubernetes? [closed]
I have a java application protected by keycloak (that's an standalone application for session control which runs on port 9080).
Keycloak is available to world because during auth process, my app ...
- 111
2
votes
0
answers
97
views
What security loopholes does Istio tackle?
My application consists of four microservices. (hr, salary, stock and employee). Users of the application access the "hr" service using http. To fulfill this request the hr microservice communicates ...
- 203
2
votes
1
answer
7k
views
How can you pass private environment variables to FARGATE tasks specified from a Docker Compose config
I am using an existing docker-compose.yml to migrate an app to ECS. The config references several $ENV vars which I used to pass in simply as environment variables when running docker-compose up. One ...
- 249
-3
votes
2
answers
2k
views
How can CaaS, PaaS, and FaaS users know if the operating system of their server environment is of the newest release?
Please consider this chart a moment; it shows the different hosting models common today:
From the chart I learn that CaaS, PaaS and FaaS are three hosting-models by which a user can't control the OS ...
user5176
2
votes
1
answer
801
views
Context of DevOps in ISO 27001 security audits
Correct me if I am wrong, ISO 27001 addresses mostly organizational and operational aspects. This sounds a little bit abstract and regulatory.
On the other hand, in DevOps, if you wish DevSecOps, ...
- 6,802
0
votes
2
answers
189
views
Understanding and tweaking AWS policies for job functions
There are quite many possibilities to configure AWS policies; Amazon has therefore provided policies for job functions.
Now is it anyhow possible to sneak into JSON code of these policies to learn in ...
- 6,802
5
votes
2
answers
5k
views
Docker security risks passing secrets over environment variables
I'm new to Docker and want to put my Django web application into containers.
For the last couple days I'm struggling with passing credentials safe to containers.
Online there is always the hint ...
- 153
1
vote
1
answer
2k
views
Error during setup of clairctl for container scanning with clair
I am trying to setup clairctl to scan our application images and so wanted to install the full stack of clairctl, clair scanner & postgress database. I did the following steps:
Acquired a VM ...
- 121
2
votes
1
answer
82
views
How to avoid an avalanche of images in Openshift when security patches keep coming in?
Our applications are based on tomcat, strictly speaking on tomcat base s2i image provided by RedHat. This is updated quite frequently, and we need to comply to some regulations and apply the updates. ...
- 141
2
votes
1
answer
54
views
Bad practice having a single SSH gateway with access to all environments?
I have started at a new company and am in the process of locking down SSH access to be through a single SSH gateway server.
My question is, should I create a separate SSH gateway server for each ...
- 21
1
vote
1
answer
261
views
Possibility of container breakout compared to VM (virtual machines)
What is exactly the (higher) vulnerability at least theoretically of a container compared to VM? given, all security recommendations are implemented (like, user context is root, no host sensitive ...
- 6,802
0
votes
1
answer
55
views
What are best practices for securing connections between CI and artifact managers in the cloud?
Bitbucket, github, circleci are examples of Continuous Integration and Continuous Deployment (CI/CD) tools in the cloud.
In the past, a lot of companies ran all services, like CI/CD and artifact ...
- 13.1k
1
vote
1
answer
83
views
Does the Chef bash resource create history entries?
I know that using a password in the command line is a bad idea because bash commands can be recorded in history.
If I run a command in the chef bash resource though, when I look up the history I don'...
3
votes
0
answers
246
views
Encrypted at rest persistent volume in kubernetes? [closed]
Is there a recommended approach to using encrypted file system for persistent volumes in kubernetes?
Perhaps mounting a LUKS fs disk image file ?
- 257
2
votes
2
answers
132
views
How do you know which secrets and credentials of your production services were used, and by whom/what?
The context of the question is Secrets management.
As the title says, how do you know which secrets and credentials of your production services were used, and by whom/what?
- 103
1
vote
2
answers
83
views
How do you change a secret that half of your production applications use right now?
The context of the question is Secrets management.
As the title says, how do you change a secret that half of your production applications use right now?
- 103
7
votes
3
answers
464
views
When your micro service in production needs a secret, where is the secret stored and retrieved from?
The context of the question is Secrets management.
How do you manage storing and retrieving secrets for your micro service which is in production?
- 103
4
votes
2
answers
4k
views
Docker MongoDB image - How to specify credentials other than in the compose file?
I'm using this docker image https://hub.docker.com/_/mongo/. That image provides a way of initializing a mongodb root database user with env variables which I can specify in the compose file as ...
- 143
3
votes
2
answers
160
views
Mitigating Maven Central risks as seen from the DevSecOps perspective
AFAIK there are two official primary repositories for Maven packages (Java language):
search.maven.org offered by Sonatype Inc.
mvnrepository.com offered by a private person @frodriguez
Now ...
- 6,802
0
votes
1
answer
51
views
From a security perspective, to which location should one copy an app inside a docker image?
I use docker to deploy a lot of apps since a couple of years. Today I ask myself, should I copy my app to a different location in the docker image? I used to copy the file to the root, e.g. COPY . /...
- 13.1k
6
votes
5
answers
12k
views
How to list security groups for the specific instance via CLI?
I'm looking for syntax like:
aws ec2 describe-security-groups --instance-id i-0xyz
however, the above sub-command doesn't support --instance-id parameter.
I've checked and there are --filters and --...
- 7,781
34
votes
5
answers
24k
views
Where to put ansible-vault password
We are planning to use ansible vault in our project to prevent leaking passwords or keys in git.
The idea is to put all our sensitive data into a plain file then encrypt this file with ansible-vault ...
- 1,759
1
vote
1
answer
3k
views
terraform chef provisioning - cannot validate certificate for 10.90.239.223 because it doesn't contain any IP SANs
While configuring the chef provisioner I am running into the following error after running 'terraform apply'
chef_environment.terraform_01: Post https://10.90.239.223/organizations/mykitchen/...
- 466
3
votes
1
answer
65
views
Is it possible to securely delete a file from a virtual disk in a cloud provider?
Considering that virtual hard drives are generally formatted using something like ext3 that abstracts away from the underlying block device, which in and of itself is an abstraction over the top of a ...
- 11.6k
2
votes
1
answer
618
views
Issue integrating acunetix with jenkins
The first of all, thank you for reading my question, I really appreciate it! I am trying to integrate jenkins and acunetix (a vulnerability scanner software), but it seems to be near impossible...My ...
- 21
2
votes
1
answer
914
views
Real-World Validating the Integrity of a Docker Container
I'm interested in information and experiences surrounding Docker security. I'd like to understand ways that a user/client could validate the contents of an image to ensure that the packaged ...
- 175
8
votes
3
answers
578
views
Running unmanaged Hardware Security Modules (HSMs) in the Cloud
I have to admit to never having asked, or been asked, the question if it is possible to have a Hardware Security Module in a public cloud, by which I mean Google, Amazon or Azure. Has anyone found ...
- 11.6k
14
votes
2
answers
5k
views
Is it bad to use sudo from Jenkins?
I use Publish Over SSH plugin to deploy my apps from Jenkins to different environments. Some deployment jobs do environment preps and things like stop and restart the app server system service. Some ...
- 443
2
votes
1
answer
262
views
Sharing Gems between Chef and System Ruby
I know about the chef_gem resource obv, but in the interests of good system hygiene I would like to avoid as much as possible duplication, so I would like to share Gems between the embedded Ruby ...
- 1,086
0
votes
1
answer
165
views
Kubernetes user mode in production
Docker daemon has to run in root mode which brings up security discussions.
How is this with Kubernetes daemon - can it run not as root?
Note: both of these products allow you to reduce the scope ...
- 6,802
1
vote
1
answer
821
views
What tool is able to analyze images by connecting to clair?
This clair documentation indicates that a number of tools should be able to scan images:
clair-scanner
reg
klar
clairctl
analyze-local-images
All of them have been tried, but none of them seems to ...
- 13.1k
3
votes
1
answer
3k
views
Docker Security Scanning: How to integrate Clair with a docker private registry?
According to the following documentation it should be possible to integrate clair with a docker private registry. How to do that?
Registry Integration
Clair can be integrated directly into a ...
- 13.1k
7
votes
4
answers
3k
views
Ansible - private git repositories - SSH agent forwarding vs copying private SSH key
I recently started playing around with Ansible and it seems very nice. I don't have much experience in DevOps stuff and never really had to handle any complex scenarios. I started creating my Ansible ...
- 171
8
votes
1
answer
7k
views
Running the docker daemon without root
Inspired by What are best and comprehensive practices to consider when running docker in production? , I stumbled over Why we don't let non-root users run Docker...
They came up with docker run -ti ...
- 4,866
47
votes
7
answers
4k
views
What are best and comprehensive practices to consider when running docker in production?
Finally, you are so much in love with Docker that you want to move your online business-critical production systems with sensitive customer data to a Docker Swarm. Some might even already have done so....
- 6,802
4
votes
1
answer
472
views
Docker Sign an Image with an existing Certificate
With respect to docker's security system.
Is it possible to somehow get images signed by some entity that has trust from a company's CA-cert and then be able to find out who signed the image?
It ...
- 101
1
vote
2
answers
6k
views
How do I launch Lambda in my own VPC?
The VPC configurations option in Lambda tells this:
All AWS Lambda functions run securely inside a default system-managed
VPC. However, you can optionally configure Lambda to access resources,
...
- 2,826
1
vote
1
answer
71
views
What are known component intelligence tools?
What are available - free and commercial - solutions to create reports about components used in a software project (physically, set of source code repositories), with intelligence on features like ...
- 6,802
26
votes
6
answers
16k
views
How to prohibit access to internals of Docker container?
I want to deliver my app to customers in form of docker image. But it is crucial to ensure that end-user do not alter anything inside the container. User should only be able to run/stop the container ...
- 361
14
votes
4
answers
7k
views
Open Ports on Google Cloud Load Balancer
It seems that by default, Google Cloud load balancers expose a number of ports unecessarily. I haven't found a way to expose only 80/443 and every time I make one of their load balancers, the ...
- 189
24
votes
2
answers
11k
views
What Is SecOps?
First when I heard the word SecOps, I thought of it as a management approach that aims to connect security and operations teams, in much the same way that DevOps unifies developers and operations team....
- 1,759
7
votes
2
answers
743
views
What strategies can be employed to secure sensitive data in log files?
Working in highly regulated environments data is classified in different ways depending on the sensitivity. In some cases, this is legally enforced and must be treated differently.
Examples of a data ...
- 11.6k
12
votes
2
answers
404
views
How to storing encrypted secrets in code for a serverless.com project?
With serverless.com, the easiest way to expose a secret to an AWS Lambda function is to store it in the serverless.yml file (encrypted with KMS, for example).
But committing encrypted secrets to Git ...
- 1,241