OS compatibility environment #507

VakarisZ · 2019-12-09T11:05:00Z

OS compatibility environment

Addresses #506
Creates an env. on AWS that allows us to test OS compatibility
Workflow as follows:

Configure terraform
terraform apply
Upload binaries/update branch of monkey island
Restart other machines
On boot machines try to download and launch monkey

Checklist

OS	AMI	Bits
Island (Windows server 2019)	Private AMI: ami-01cc9554aa0b4c00e	64
Windows 2003SP2	Racemi-Windows_Server-2003-R2_SP2-English-32Bit-Base-2015.12.31 - ami-01e4fa6d	32
Windows 2003	Racemi Windows 2003 R2 (x86_64) eu-central-1 - ami-9e023183	64
Windows 2008 (vista)	Windows_Server-2008-SP2-English-32Bit-Base-2019.11.13 - ami-0acaec54bac5cbb8f	32
Windows 2008R2 (vista)	Microsoft Windows Server 2008 R2 Base - ami-0f41c4b97d72ae2b7	64
Windows 2008 (vista)	Windows_Server-2008-SP2-English-64Bit-Base-2019.08.16 - ami-0252def122d07efd3	64
Windows 2012 (win8)	Microsoft Windows Server 2012 Base - ami-0d8c60e4d3ca36ed6	64
Windows 2012R2 (win8)	Microsoft Windows Server 2012 R2 Base - ami-08dcceb529e70f875	64
Windows 2016 (win10)	Windows_Server-2016-English-Full-Base-2019.11.13 - ami-02a6791b44938cfcd	64
Windows 2019 (win10)	Microsoft Windows Server 2019 Base - ami-09fe2745618d2af42	64
Ubuntu 12.04	ubuntu/images/hvm/ubuntu-precise-12.04-amd64-server-20120424 - ami-003d0b1d	64
Ubuntu 14.04	Ubuntu Server 14.04 LTS (HVM), SSD Volume Type - ami-067ee10914e74ffee	64
Ubuntu 19.04	ubuntu/images-testing/hvm-ssd/ubuntu-disco-daily-amd64-server-20190702 - ami-001b87954b72ea3ac	64
CentOS-6	CentOS Linux 6 x86_64 HVM EBS ENA 1901_01-74e73035-3435-48d6-88e0-89cc02ad83ee-ami-079f4a7926b6b99ab.4 - ami-07fa74e425f2abf29	64
CentOS-7	CIS Centos Linux 7 Benchmark v2.2.0.11 - Level 1-dc51a635-30f4-4fbe-8bc5-aa54bc6c8cc0-ami-0b6e771174f57d220.4 - ami-0034b52a39b9fb0e8	64
CentOS-8	CentOS 8 Minimal Latest with Updates-f399b70b-09d8-4df4-ba78-bc1813b4b257-ami-063710974a98495cb.4 - ami-0034c84e4e9c557bd	64
RHEL 5	RHEL-5.11_GA-20150209-i386-1-Hourly2-GP2 - ami-a48cbfb9	32
RHEL 6	RHEL-6.10_HVM-20190524-x86_64-0-Hourly2-GP2 - ami-0af3f0e0918f47bcf	64
RHEL 7	RHEL-7.7_HVM-20191119-x86_64-2-Hourly2-GP2 - ami-0b5edb134b768706c	64
RHEL 8	Red Hat Enterprise Linux 8 (HVM), SSD Volume Type - ami-0badcc5b522737046	64
Debian 7	debian-wheezy-amd64-hvm-2015-01-28-ebs - ami-98043785	64
Debian 8	debian-jessie-amd64-hvm-2015-04-25-23-22-ebs - ami-02724d1f	64
Debian 9	debian-stretch-hvm-x86_64-gp2-2019-08-13-59243 - ami-0134bbbf8dbf52a1c	64
Kali 2019.3	Kali Linux 2019.3-8b7fdfe3-8cd5-43cc-8e5e-4e0e7f4139d5-ami-0327257c586faca43.4 - ami-05d64b1d0f967d4bf	64
SUSE 11	suse-sles-11-sp4-v20160214-hvm-ssd-x86_64 - ami-0083986c	64
SUSE 12	SUSE Linux Enterprise Server 12 SP4 (HVM), SSD Volume Type - ami-07b12b913a7e36b08	64
Oracle linux 6	Oracle Enterprise Linux 6.10-574ffd6e-c8a8-497b-88d4-629e59ffc3f6-ami-0b1e3bbd20cd3f253.4 - ami-0f9b69f34108a3770	64
Oracle linux 7	Oracle Enterprise Linux 7.6 v0.8-3ca50f33-b703-4471-9819-4af00bd3f8b2-ami-07ac8d612369ec137.4 - ami-001e494dc0f3372bc	64

danielguardicore · 2019-12-19T08:48:18Z

Can you add to all the OS compat machines a tag that is
purpose:os_compat or something similar?
So we can easily filter by them in the UI and run commands on all of them?

removed unused ubuntu machine

ShayNehmad

Looks good, some minor comments.

ShayNehmad · 2020-02-09T10:12:48Z

envs/monkey_maker/README.md

+Also review `./terraform/config.tf` file.
+
+Launch the environment by going into `terraform` folder and running
+```angular2html


angular2html? did you mean 'sh'?

Pycharm added this by default for some reason

ShayNehmad · 2020-02-09T10:13:02Z

envs/monkey_maker/README.md

+
+Contents of `accessKeys` file should be as follows:
+
+```


and ini language specifier

ShayNehmad · 2020-02-09T10:13:36Z

envs/monkey_maker/README.md

+terraform apply
+```
+
+### Usage


Level 2 header, not 3

ShayNehmad · 2020-02-09T10:15:18Z

envs/monkey_maker/terraform/infra.tf

+  ingress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }


Seems overly permissive

You mean ingress or egress?

Egress is ok.
Ingress, the alternative is locking it to the users current public IP, which requires the user to input it.

Instead of that, I'd rather user specify a SSH public key.

Machines are not vulnerable and some of them require manual login for testing, so I think we're good

ShayNehmad · 2020-02-09T10:16:36Z

envs/monkey_maker/terraform/instances.tf

@@ -0,0 +1,25 @@
+resource "aws_instance" "island_windows" {


Are these Islands, or just build machines? Name accordingly.

If they ARE Islands: Why do we need Islands here?

We need islands to check results...

ShayNehmad · 2020-02-09T10:17:17Z

envs/os_compatibility/README.md

+## Usage
+
+1. Launch os_compat_ISLAND machine and upload your binaries/update island. Reset island environment.
+2. Launch/Reboot all other os_compat test machines (Can be filtered with tag "Puropose: os_compat_instance")


Puropose typo

ShayNehmad · 2020-02-09T10:25:05Z

envs/os_compatibility/README.md

+
+For windows_2008_r2 Administrator:AGE(MP..txL
+
+The following machines does not download monkey automatically, so you'll have to manually check them:


Add instructions on how to manually verify these machines

What do you mean verify?

ShayNehmad · 2020-02-09T10:59:00Z

envs/os_compatibility/test_compatibility.py

@@ -0,0 +1,62 @@
+import pytest
+
+from envs.monkey_zoo.blackbox.island_client.monkey_island_client import MonkeyIslandClient


danielguardicore · 2020-02-17T07:41:03Z

envs/monkey_maker/README.md

+
+To login to windows use Administrator: %HwuzI!Uzsyfa=cB*XaQ6xxHqopfj)h) credentials
+
+You'll find docker files in `/home/ubuntu/docker_envs/linux/...`


Does this make sense? Why are we not pulling latest docker files from internet?

We can skip the build step

You want me to add that we also need to pull the latest changes before building? Isn't that kind of self explanatory, that if you want to build monkey of a certain branch you need to pull that branch? If we skip the build step, user will have to check image name manually?

danielguardicore · 2020-02-17T07:47:40Z

envs/os_compatibility/terraform/infra.tf

+  ingress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }


Doesn't need to be all ports, just 5000 and 22.

And 3389. And 5001. But I don't know if it's worth the hassle to allow only the ports that are the only ones open anyways. Or are there some unsecure open ports by default?

Or we can just limit the source to LAN and add our remote machines manually

Yes, or you can add it as a terraform parameter variable. Either works for me.

danielguardicore · 2020-02-17T07:48:09Z

envs/os_compatibility/terraform/infra.tf

+resource "aws_security_group" "os_compat_instance" {
+  name        = "os_compat_instance"
+  description = "Disables remote access to vulnerable instances"
+  vpc_id      = "${aws_vpc.os_compat_vpc.id}"
+
+  ingress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }


Why do we want the target instances ot be world accessible? Does each one have a unique password?

danielguardicore · 2020-02-17T07:48:42Z

envs/os_compatibility/test_compatibility.py

+machine_list = {
+    "10.0.0.36": "centos_6",
+    "10.0.0.37": "centos_7",
+    "10.0.0.38": "centos_8",
+    "10.0.0.42": "suse_12",
+    "10.0.0.41": "suse_11",
+    "10.0.0.99": "kali_2019",
+    "10.0.0.86": "rhel_6",
+    "10.0.0.87": "rhel_7",
+    "10.0.0.88": "rhel_8",
+    "10.0.0.77": "debian_7",
+    "10.0.0.78": "debian_8",
+    "10.0.0.79": "debian_9",
+    "10.0.0.66": "oracle_6",
+    "10.0.0.67": "oracle_7",
+    "10.0.0.22": "ubuntu_12",
+    "10.0.0.24": "ubuntu_14",
+    "10.0.0.29": "ubuntu_19",
+    "10.0.0.4": "windows_2003_r2_32",
+    "10.0.0.5": "windows_2003",
+    "10.0.0.8": "windows_2008",
+    "10.0.0.6": "windows_2008_32",
+    "10.0.0.12": "windows_2012",
+    "10.0.0.11": "windows_2012_r2",
+    "10.0.0.116": "windows_2016",
+    "10.0.0.119": "windows_2019",
+}


Not for this PR, but is it possible to parse the terraform file and build the dict from that?

Possible yes, trivial - I don't think so. And definitely not worth the trouble.

… bit

codecov · 2020-03-18T09:55:29Z

Codecov Report

❗ No coverage uploaded for pull request base (develop@34c2ff6). Click here to learn what that means.
The diff coverage is n/a.

@@            Coverage Diff             @@
##             develop     #507   +/-   ##
==========================================
  Coverage           ?   56.15%           
==========================================
  Files              ?      105           
  Lines              ?     3588           
  Branches           ?        0           
==========================================
  Hits               ?     2015           
  Misses             ?     1573           
  Partials           ?        0

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 34c2ff6...acdef95. Read the comment docs.

VakarisZ added 6 commits December 9, 2019 12:39

Initial infra with a couple of example machines and island

e886608

Added working modern instances. win2003 and kali not working

dd435be

Added all machines to the terraform list

79dade2

Added monkey maker env that's responsible for monkey building islands

63569df

Added readmes, improved instance naming

f2c7b1a

Added a pytest to test compatibility, fixed typo in folder name

48dcc88

VakarisZ added 2 commits December 19, 2019 13:54

Added purpose tag, but not tested

d956f85

Fixed a bug that caused some machines not to launch the latest binary,

65aff1d

removed unused ubuntu machine

VakarisZ self-assigned this Jan 20, 2020

Updated docs and instance info in terraform. Some bugfixes.

02fafae

ShayNehmad requested a review from danielguardicore January 20, 2020 11:33

ShayNehmad added Enhancement Issue that describes an enhancement to a current feature. Monkey labels Jan 20, 2020

ShayNehmad added this to In progress in Monkey Dev Board via automation Jan 20, 2020

ShayNehmad added this to the 1.8.0 milestone Jan 20, 2020

VakarisZ added 2 commits January 20, 2020 16:37

Updated AMI of windows maker, updated windows_2008_r2 ami

978918e

Updated with 2008 r2 that can run the monkey

d9fbc12

ShayNehmad suggested changes Feb 9, 2020

View reviewed changes

danielguardicore reviewed Feb 17, 2020

View reviewed changes

ShayNehmad mentioned this pull request Feb 26, 2020

Test browser compatibility #555

Open

4 tasks

Addressed some CR comments and improved README's and firewall rules a…

6fe93cd

… bit

VakarisZ added 2 commits March 18, 2020 12:39

Added firewall rules to block external traffic on os_compat instances

f349d1a

Removed ingress rules from monkey maker machines

acdef95

ShayNehmad merged commit bee46c0 into develop Mar 30, 2020

Monkey Dev Board automation moved this from In progress to Done Mar 30, 2020

ShayNehmad deleted the os_compatibility_env branch April 27, 2020 18:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OS compatibility environment #507

OS compatibility environment #507

VakarisZ commented Dec 9, 2019 •

edited

danielguardicore commented Dec 19, 2019

ShayNehmad left a comment

ShayNehmad Feb 9, 2020

VakarisZ Mar 18, 2020

ShayNehmad Feb 9, 2020

ShayNehmad Feb 9, 2020

ShayNehmad Feb 9, 2020

danielguardicore Feb 17, 2020

VakarisZ Mar 18, 2020

ShayNehmad Feb 9, 2020

danielguardicore Feb 17, 2020

ShayNehmad Feb 9, 2020

ShayNehmad Feb 9, 2020

danielguardicore Feb 17, 2020

ShayNehmad Feb 9, 2020

danielguardicore Feb 17, 2020

danielguardicore Feb 17, 2020

VakarisZ Mar 18, 2020

danielguardicore Feb 17, 2020

VakarisZ Mar 18, 2020

VakarisZ Mar 18, 2020

danielguardicore Mar 18, 2020

danielguardicore Feb 17, 2020

VakarisZ Mar 18, 2020

danielguardicore Feb 17, 2020

VakarisZ Mar 18, 2020

codecov bot commented Mar 18, 2020 •

edited


		For windows_2008_r2 Administrator:AGE(MP..txL

		The following machines does not download monkey automatically, so you'll have to manually check them:

		@@ -0,0 +1,62 @@
		import pytest

		from envs.monkey_zoo.blackbox.island_client.monkey_island_client import MonkeyIslandClient


		To login to windows use Administrator: %HwuzI!Uzsyfa=cB*XaQ6xxHqopfj)h) credentials

		You'll find docker files in `/home/ubuntu/docker_envs/linux/...`

OS compatibility environment #507

OS compatibility environment #507

Conversation

VakarisZ commented Dec 9, 2019 • edited

OS compatibility environment

Checklist

danielguardicore commented Dec 19, 2019

ShayNehmad left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov bot commented Mar 18, 2020 • edited

Codecov Report

VakarisZ commented Dec 9, 2019 •

edited

codecov bot commented Mar 18, 2020 •

edited