Add cure53 security audit report #1065

RichiH · 2018-06-15T14:25:17Z

No description provided.

Signed-off-by: Richard Hartmann <richih@richih.org>

juliusv · 2018-06-15T14:29:11Z

content/docs/operating/security.md

+
+## External audits
+
+CNCF sponsored an external security audit by cure53 which ran from April 2018


I would link both the CNCF and cure53.

I thought they would be obvious once you are this deep in our pages, but will do.

juliusv · 2018-06-15T14:30:27Z

content/docs/operating/security.md

+
+CNCF sponsored an external security audit by cure53 which ran from April 2018
+to June 2018. You can find the final report of the audit
+[here](assets/downloads/2018-06-11--cure53_security_audit.pdf).


It's nice to provide somewhat larger links than the word "here".

How about You can find more details in the [final report of the audit](assets/downloads/2018-06-11--cure53_security_audit.pdf).

Signed-off-by: Richard Hartmann <richih@richih.org>

brian-brazil

I've like to have #1063 in before this.

brian-brazil · 2018-06-15T14:33:07Z

content/docs/operating/security.md

@@ -106,7 +106,7 @@ If using a client-library-provided HTTP handler, it should not be possible for
 malicious requests that reach that handler to cause issues beyond those
 resulting from additional load and failed scrapes.

-## Authentication/Authorisation/Encryption
+## Authentication, Authorisation, and Encryption


Hmm, aren't we meant to be using US spellings? I must have let this one slip though.

Don't care which as long as we are consistent; changed.

brian-brazil · 2018-06-15T14:34:04Z

content/docs/operating/security.md

+
+## External audits
+
+[CNCF](https://cncf.io) sponsored an external security audit by


Should we summarise this here?

I think yes. Attribution is important in both FLOSS & security and I would like to acknowledge the fact that CNCF spent money on us.

I meant more, that we should add a few sentences summarising the report.

Signed-off-by: Richard Hartmann <richih@richih.org>

brian-brazil

👍, just fix that one small error.

brian-brazil · 2018-06-15T15:25:40Z

content/docs/operating/security.md

+[cure53](https://cure53.de) which ran from April 2018 to June 2018.
+
+The audit found no major concerns outside of the scope of this document. It
+re-iterated on the importance of following what is layed out here.


juliusv · 2018-06-15T16:40:44Z

content/docs/operating/security.md

+[CNCF](https://cncf.io) sponsored an external security audit by
+[cure53](https://cure53.de) which ran from April 2018 to June 2018.
+
+The audit found no major concerns outside of the scope of this document. It


This is really an unduly generous interpretation of what the report says and omits that the report strongly suggests to change our practices. Also I don't think that this document here would even give people an idea that e.g. the CORS and XSRF vulnerabilities exist and need to be protected against. Those are pretty severe IMO. If an attacker can make me visit a website and then they can either read all my Prometheus data or shut down my Prometheus server, that seems bad, and almost nobody reading this document would anticipate those problems from what is written here.

Signed-off-by: Richard Hartmann <richih@richih.org>

brian-brazil · 2018-07-01T23:12:07Z

content/docs/operating/security.md

+[cure53](https://cure53.de) which ran from April 2018 to June 2018.
+
+The audit found concerns regarding Prometheus' secrity model, but following
+what is layed out in this document should guard against most of them.


brian-brazil · 2018-07-01T23:12:47Z

content/docs/operating/security.md

+
+The audit found concerns regarding Prometheus' secrity model, but following
+what is layed out in this document should guard against most of them.
+In particular, the CORS (PRM-01-001) and CSRF (PRM-01-003) attack vectors might


They're in this doc now, and many attack vectors are non-obvious. Putting it like this make it seem as though reading this doc is not sufficient.

brian-brazil · 2018-07-01T23:13:30Z

content/docs/operating/security.md

+[CNCF](https://cncf.io) sponsored an external security audit by
+[cure53](https://cure53.de) which ran from April 2018 to June 2018.
+
+The audit found concerns regarding Prometheus' secrity model, but following


I don't think this really captures it, and this document covers everything mentioned.

lucperkins · 2018-08-15T22:47:57Z

content/docs/operating/security.md

+be non-obvious.
+
+For more details, please read the
+[final report of the audit](assets/downloads/2018-06-11--cure53_security_audit.pdf).


Remove the assets from this URL

Are you certain? grep -ri assets content implies otherwise.

Okay, I see now that there's a URL re-write rule in place for static assets. I do think, though, that the URL needs to begin with /assets rather than assets since this is not the index page.

RichiH · 2018-08-18T19:01:48Z

@lucperkins Suggestions as to verbiage around the contended parts?

lucperkins · 2018-09-07T16:50:11Z

@RichiH @brian-brazil Would it be possible to ship this without the summary paragraph for now? We should get the results out to the public. I'd be happy to write up a more detailed summary once the PDF is out.

Also, Richie, make sure to update the URL of the PDF to /assets/downloads/2018-06-11--cure53_security_audit.pdf.

brian-brazil · 2018-09-07T16:53:13Z

That sounds like a good idea.

RichiH · 2018-09-07T17:03:17Z

I don't have my keys with me in China, but feel free to push over me and merge.

Signed-off-by: lucperkins <lucperkins@gmail.com>

RichiH added 2 commits June 15, 2018 16:23

Add cure53 security report

0ba64ad

Signed-off-by: Richard Hartmann <richih@richih.org>

Improve formatting of navigation

f710a9c

Signed-off-by: Richard Hartmann <richih@richih.org>

RichiH changed the title ~~Add cre53 security audit report~~ Add cure53 security audit report Jun 15, 2018

juliusv reviewed Jun 15, 2018

View reviewed changes

Work in feedback by @juliusv

900b929

Signed-off-by: Richard Hartmann <richih@richih.org>

brian-brazil reviewed Jun 15, 2018

View reviewed changes

RichiH added 2 commits June 15, 2018 16:41

Work in feedback by @juliusv & @brian-brazil

ad2d4dc

Signed-off-by: Richard Hartmann <richih@richih.org>

Work in feedback by @brian-brazil

80f559b

Signed-off-by: Richard Hartmann <richih@richih.org>

brian-brazil reviewed Jun 15, 2018

View reviewed changes

juliusv reviewed Jun 15, 2018

View reviewed changes

Take @julisuv feedback into account

42bb621

Signed-off-by: Richard Hartmann <richih@richih.org>

brian-brazil reviewed Jul 1, 2018

View reviewed changes

lucperkins reviewed Aug 15, 2018

View reviewed changes

lucperkins force-pushed the richih/security_audit branch from bd817c6 to b83a8b1 Compare September 10, 2018 19:35

Remove audit description

0a4a778

Signed-off-by: lucperkins <lucperkins@gmail.com>

lucperkins force-pushed the richih/security_audit branch from b83a8b1 to 0a4a778 Compare September 10, 2018 19:39

Update PDF download URL

7c93614

Signed-off-by: lucperkins <lucperkins@gmail.com>

lucperkins merged commit 04ebe44 into master Sep 10, 2018

aylei pushed a commit to aylei/docs that referenced this pull request Oct 28, 2019

update the loader pprof-addr default port (prometheus#1065)

1dd0e76

caniszczyk deleted the richih/security_audit branch March 24, 2020 19:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add cure53 security audit report #1065

Add cure53 security audit report #1065

RichiH commented Jun 15, 2018

juliusv Jun 15, 2018

RichiH Jun 15, 2018

juliusv Jun 15, 2018

brian-brazil left a comment

brian-brazil Jun 15, 2018

RichiH Jun 15, 2018

brian-brazil Jun 15, 2018

RichiH Jun 15, 2018

brian-brazil Jun 15, 2018

RichiH Jun 15, 2018

brian-brazil left a comment

brian-brazil Jun 15, 2018

juliusv Jun 15, 2018

brian-brazil Jul 1, 2018

brian-brazil Jul 1, 2018

brian-brazil Jul 1, 2018

lucperkins Aug 15, 2018

RichiH Aug 18, 2018

lucperkins Aug 20, 2018

RichiH commented Aug 18, 2018

lucperkins commented Sep 7, 2018

brian-brazil commented Sep 7, 2018

RichiH commented Sep 7, 2018 via email


		## External audits

		CNCF sponsored an external security audit by cure53 which ran from April 2018


		## External audits

		[CNCF](https://cncf.io) sponsored an external security audit by

Add cure53 security audit report #1065

Add cure53 security audit report #1065

Conversation

RichiH commented Jun 15, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brian-brazil left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brian-brazil left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

RichiH commented Aug 18, 2018

lucperkins commented Sep 7, 2018

brian-brazil commented Sep 7, 2018

RichiH commented Sep 7, 2018 via email