Small improvement of user experience #467

razvanstoica89 · 2021-03-09T19:48:18Z

Add details about remediation measures for host configuration tests

…fication

konstruktoid · 2021-03-09T21:09:54Z

Thanks @razvanstoica89, and it was a humble title you picked, calling this PR "small".

docker-bench-security.sh

…urity.sh files

tests/1_host_configuration.sh

tests/5_container_runtime.sh

konstruktoid · 2021-03-11T07:53:04Z

Loads of updates 👍
Will test as soon as possible.

konstruktoid · 2021-03-11T12:40:54Z

Can you poke me @razvanstoica89 when you believe you are finished with this PR so I can start testing?
No need to test if it's a work in progress.

razvanstoica89 · 2021-03-11T12:55:46Z

Yes of course. Thanks

docker-bench-security.sh

tests/1_host_configuration.sh

konstruktoid · 2021-03-25T11:02:49Z

the json file doesnt seem to be valid.

$ jq log/docker-bench-security.sh.log.json 
jq: error: docker/0 is not defined at <top-level>, line 1:
log/docker-bench-security.sh.log.json    
jq: error: bench/0 is not defined at <top-level>, line 1:
log/docker-bench-security.sh.log.json           
jq: error: security/0 is not defined at <top-level>, line 1:
log/docker-bench-security.sh.log.json                 
jq: 3 compile errors

konstruktoid · 2021-03-25T11:03:46Z

Since you've created the log directory, perhaps rename without the .sh extension

razvanstoica89 · 2021-03-27T10:21:07Z

the json file doesnt seem to be valid.

$ jq log/docker-bench-security.sh.log.json 
jq: error: docker/0 is not defined at <top-level>, line 1:
log/docker-bench-security.sh.log.json    
jq: error: bench/0 is not defined at <top-level>, line 1:
log/docker-bench-security.sh.log.json           
jq: error: security/0 is not defined at <top-level>, line 1:
log/docker-bench-security.sh.log.json                 
jq: 3 compile errors

Looks like you're trying to validate that the string "log/docker-bench-security.sh.log.json" is a valid json.
I think a better approach is cat log/docker-bench-security.log.json | jq empty.

As far as I know the only way you can get an invalid json log is to stop the script manually while it is running. Even if you run it again, you will be left with an invalid json log.

konstruktoid · 2021-03-29T10:52:30Z

Running a standrd installation without any containers:

Section A - Check results

[INFO] 1 - Host Configuration
[INFO] 1.1 - General Configuration
[NOTE] 1.1.1  - Ensure the container host has been Hardened (Not Scored)
[INFO] -c
[INFO]        * Using 20.10.5, verify is it up to date as deemed necessary
[INFO]        * Your operating system vendor may provide support and security maintenance for Docker
[INFO] 1.2 - Linux Hosts Specific Configuration
WARNING: No swap limit support
[WARN] -s
[INFO] -c
[INFO]       * Users: vagrant
[WARN] -s
[WARN] -s
[WARN] -s
[WARN] -s
[WARN] -s
[WARN] -s
[INFO] -c
[INFO]        * File not found
[INFO] -c
[INFO]         * File not found
[WARN] -s
[INFO] -c
[INFO]         * File not found

[INFO] 2 - Docker daemon configuration 
[WARN] -s
[PASS] -s
[PASS] -s
[PASS] -s
[PASS] -s
[INFO] -c
[INFO]      * Docker daemon not listening on TCP
[INFO] -c
[INFO]      * Default ulimit doesn't appear to be set
[WARN] -s
[PASS] -s

konstruktoid · 2021-03-31T10:03:10Z

Looks like you're trying to validate that the string "log/docker-bench-security.sh.log.json" is a valid json.
I think a better approach is cat log/docker-bench-security.log.json | jq empty.

You are correct, cat log/docker-bench-security.log.json | jq -r works.

razvanstoica89 · 2021-04-07T09:03:15Z

Did you manage to test the changes I made?

konstruktoid · 2021-04-07T09:29:21Z

Did you manage to test the changes I made?

Yeah, but #467 (comment) still exists.

razvanstoica89 · 2021-04-08T10:21:09Z

Did you manage to test the changes I made?

Yeah, but #467 (comment) still exists.

Yes. You are right. By d0443cc I solved the problem reported in #467 (comment) but I didn't let you know.

konstruktoid · 2021-04-08T20:43:18Z

~$ git clone https://github.com/docker/docker-bench-security
Cloning into 'docker-bench-security'...
[...]
~$ cd docker-bench-security/
~$ git checkout -b razvanstoica89-master master
[...]
~$ git pull git://github.com/razvanstoica89/docker-bench-security.git master
[...]
~$ git log | grep -A3 d0443c
commit d0443cc817cf17452f41510954e450a320b59c6a
Author: Razvan Stoica <razvan.stoica89@gmail.com>
Date:   Mon Mar 29 15:22:14 2021 +0300
~$ curl -sSL get.docker.com | sh
[...]
$ sudo bash ./docker-bench-security.sh
# --------------------------------------------------------------------------------------------
# Docker Bench for Security v1.3.6
#
# Docker, Inc. (c) 2015-2021
#
# Checks for dozens of common best-practices around deploying Docker containers in production.
# Inspired by the CIS Docker Benchmark v1.2.0.
# --------------------------------------------------------------------------------------------

Initializing 2021-04-08T20:42:29+00:00


Section A - Check results

[INFO] 1 - Host Configuration
[INFO] 1.1 - General Configuration
[NOTE] 1.1.1  - Ensure the container host has been Hardened (Not Scored)
[PASS] -c
[INFO]        * Using 20.10.5, verify is it up to date as deemed necessary
[INFO] 1.2 - Linux Hosts Specific Configuration
WARNING: No swap limit support
[WARN] -s
[INFO] -c
[INFO]       * Users:
[WARN] -s
[WARN] -s
[WARN] -s
[WARN] -s
[WARN] -s
[WARN] -s
[INFO] -c
[INFO]        * File not found
[INFO] -c
[INFO]         * File not found
[WARN] -s
[INFO] -c
[INFO]         * File not found

[INFO] 2 - Docker daemon configuration
[WARN] -s
[PASS] -s
[PASS] -s
[PASS] -s
[PASS] -s
[INFO] -c
[INFO]      * Docker daemon not listening on TCP

razvanstoica89 · 2021-04-09T08:43:45Z

Please test it using the sudo sh ./docker-bench-security.sh command as recommended in the original README.md file.

konstruktoid · 2021-04-09T09:53:27Z

sh is linked to bash on multiple distributions.

$ sudo sh ./docker-bench-security.sh
# --------------------------------------------------------------------------------------------
# Docker Bench for Security v1.3.6
#
# Docker, Inc. (c) 2015-2021
#
# Checks for dozens of common best-practices around deploying Docker containers in production.
# Inspired by the CIS Docker Benchmark v1.2.0.
# --------------------------------------------------------------------------------------------

Initializing 2021-04-09T09:52:09+00:00


Section A - Check results

[INFO] 1 - Host Configuration
[INFO] 1.1 - General Configuration
[NOTE] 1.1.1  - Ensure the container host has been Hardened (Not Scored)
[PASS] -c
[INFO]        * Using 20.10.5, verify is it up to date as deemed necessary
[INFO] 1.2 - Linux Hosts Specific Configuration
[WARN] -s
[INFO] -c
[INFO]       * Users: 
[WARN] -s
[WARN] -s
[WARN] -s
[WARN] -s
[WARN] -s
[INFO] -c
[INFO]        * File not found
[INFO] -c
[INFO]        * File not found
[INFO] -c
[INFO]         * File not found
[WARN] -s
[INFO] -c
[INFO]         * File not found

[INFO] 2 - Docker daemon configuration
[WARN] -s
[PASS] -s
[PASS] -s
[PASS] -s
[PASS] -s
[INFO] -c
[INFO]      * Docker daemon not listening on TCP
^C
$ ls -l $(which sh)
lrwxrwxrwx. 1 root root 4 Jan 12 08:24 /usr/bin/sh -> bash
$ cat /etc/redhat-release 
CentOS Stream release 8
$

razvanstoica89 · 2021-04-10T09:11:32Z

I think I managed to fix this bug #467 (comment)

konstruktoid · 2021-04-12T12:18:53Z

Looks good, but I'm not sure about those impact statements.
E.g. [INFO] 5.31 - You should ensure that no containers mount docker.sock as a volume. Impact: None. Mounting docker.sock is basically server ownership.

razvanstoica89 · 2021-04-14T07:58:14Z

These impact statements refer to the impact of the implementation of remedial measures.
Not to the impact that the lack of implementation of remedial measures has.

Keep in mind that in very few situations or use cases, you want to mount docker.sock even if it is definitely not recommended.
Example: Portainer.io

konstruktoid · 2021-04-14T08:02:32Z

tests/5_container_runtime.sh

@@ -1151,7 +1151,7 @@ check_5_31() {
  local id="5.31"
  local desc="Ensure that the Docker socket is not mounted inside any containers (Scored)"
  local remediation="You should ensure that no containers mount docker.sock as a volume."
-  local remediationImpact="None."
+  local remediationImpact="If you really, really have to do this, you should use user namespaces and always ensure that the images you run with this configuration are properly audited and that you trust them in order to avoid potential breaches."


"None." is fine, since it's the remediationImpact we're talking about, why not just change "Impact" to "Remedation Impact"?

You are right. It's better None. I'm rolling back my last change. Please excuse my mistake.

konstruktoid · 2021-04-16T07:38:11Z

functions/output_lib.sh

+    fi
+    globalRemediation="${globalRemediation}\n${bldblu}[INFO]${txtrst} ${id} - ${remediation}"
+    if [ -n "${remediationImpact}" ]; then
+      globalRemediation="${globalRemediation} Impact: ${remediationImpact}"


I meant to change this Impact to Remediation Impact as in the json file.

@konstruktoid Thanks for the feedback. I made this change.

konstruktoid · 2021-04-27T08:46:46Z

Looks good!
And thanks for this massive, massive contribution.

razvanstoica89 added 6 commits March 9, 2021 12:42

Change global variable used only locally to local variable for simpli…

94900ee

…fication

Print date and time in ISO 8601 UTC format

8e0daa1

Add support for logging remediation measures in JSON format

c351120

Append JSON logs when run multiple times

519f20b

Add new programs to the list of required programs

58205d4

Add details about remediations measure for host configuration tests

c00ef43

konstruktoid reviewed Mar 9, 2021

View reviewed changes

docker-bench-security.sh Show resolved Hide resolved

Usage instructions aligned between the README.md and docker-bench-sec…

2132b03

…urity.sh files

konstruktoid reviewed Mar 10, 2021

View reviewed changes

tests/1_host_configuration.sh Show resolved Hide resolved

konstruktoid reviewed Mar 10, 2021

View reviewed changes

tests/5_container_runtime.sh Outdated Show resolved Hide resolved

razvanstoica89 added 8 commits March 10, 2021 14:58

Fix "nohealthlocal: command not found" error

9ae0d92

Print remediation measures at the end of the logs

6c586b4

Update benchmark log photo

f769a32

Improve wording

85117ea

Set a relative image link

1623c45

Update benchmark log photo

82bbe1d

Print Section B only if it contains remediation measures

b3a36e8

Print the remediation measure only if the check is not passed

c623d3a

razvanstoica89 added 4 commits March 11, 2021 10:21

Print more details in help message

59a63dd

Move all pictures to a dedicated folder

ad62371

Change default log locations

ed23f2d

README file updated with new default logs location

82ecb7e

razvanstoica89 added 2 commits March 11, 2021 15:00

Fixed invalid JSON log

11886d4

Add new check groups

bf11d68

konstruktoid reviewed Mar 12, 2021

View reviewed changes

docker-bench-security.sh Outdated Show resolved Hide resolved

Add new folders to improve code segmentation

ee5972c

konstruktoid reviewed Mar 25, 2021

View reviewed changes

docker-bench-security.sh Outdated Show resolved Hide resolved

konstruktoid reviewed Mar 25, 2021

View reviewed changes

tests/1_host_configuration.sh Outdated Show resolved Hide resolved

Rename logs without the .sh extension

4b68c2e

razvanstoica89 added 2 commits March 28, 2021 09:47

Remove the Debian family-specific installation command

8a934ae

Overwrite the json log at each run. Beautify the json log.

86985f8

razvanstoica89 added 3 commits March 29, 2021 15:22

Bug fixing and improving source code readability

d0443cc

Remove temporary files

81ac358

Fix systemctl error when running inside a container

c67469d

Fix the printing error when using bash

38ac7ef

Update remediation impact message for test 5.31

15aa1ee

konstruktoid reviewed Apr 14, 2021

View reviewed changes

Set remediationImpact for 5.31 test to None.

e4d9bd1

konstruktoid reviewed Apr 16, 2021

View reviewed changes

Change "Impact" to "Remediation Impact" in bash log

0a59baa

konstruktoid merged commit 6a8fdcf into docker:master Apr 27, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Small improvement of user experience #467

Small improvement of user experience #467

razvanstoica89 commented Mar 9, 2021

konstruktoid commented Mar 9, 2021

konstruktoid commented Mar 11, 2021

konstruktoid commented Mar 11, 2021

razvanstoica89 commented Mar 11, 2021

konstruktoid commented Mar 25, 2021 •

edited

Loading

konstruktoid commented Mar 25, 2021

razvanstoica89 commented Mar 27, 2021

konstruktoid commented Mar 29, 2021

konstruktoid commented Mar 31, 2021

razvanstoica89 commented Apr 7, 2021

konstruktoid commented Apr 7, 2021

razvanstoica89 commented Apr 8, 2021

konstruktoid commented Apr 8, 2021

razvanstoica89 commented Apr 9, 2021

konstruktoid commented Apr 9, 2021

razvanstoica89 commented Apr 10, 2021

konstruktoid commented Apr 12, 2021

razvanstoica89 commented Apr 14, 2021 •

edited

Loading

konstruktoid Apr 14, 2021

razvanstoica89 Apr 14, 2021

konstruktoid Apr 16, 2021

razvanstoica89 Apr 19, 2021

konstruktoid commented Apr 27, 2021

Small improvement of user experience #467

Small improvement of user experience #467

Conversation

razvanstoica89 commented Mar 9, 2021

konstruktoid commented Mar 9, 2021

konstruktoid commented Mar 11, 2021

konstruktoid commented Mar 11, 2021

razvanstoica89 commented Mar 11, 2021

konstruktoid commented Mar 25, 2021 • edited Loading

konstruktoid commented Mar 25, 2021

razvanstoica89 commented Mar 27, 2021

konstruktoid commented Mar 29, 2021

konstruktoid commented Mar 31, 2021

razvanstoica89 commented Apr 7, 2021

konstruktoid commented Apr 7, 2021

razvanstoica89 commented Apr 8, 2021

konstruktoid commented Apr 8, 2021

razvanstoica89 commented Apr 9, 2021

konstruktoid commented Apr 9, 2021

razvanstoica89 commented Apr 10, 2021

konstruktoid commented Apr 12, 2021

razvanstoica89 commented Apr 14, 2021 • edited Loading

konstruktoid Apr 14, 2021

Choose a reason for hiding this comment

razvanstoica89 Apr 14, 2021

Choose a reason for hiding this comment

konstruktoid Apr 16, 2021

Choose a reason for hiding this comment

razvanstoica89 Apr 19, 2021

Choose a reason for hiding this comment

konstruktoid commented Apr 27, 2021

konstruktoid commented Mar 25, 2021 •

edited

Loading

razvanstoica89 commented Apr 14, 2021 •

edited

Loading