{"id":34141,"date":"2019-10-31T21:56:37","date_gmt":"2019-10-31T18:56:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-19-populyarnejshih-docker-obrazov-net-parolya-dlya-root\/"},"modified":"2019-10-31T21:56:37","modified_gmt":"2019-10-31T18:56:37","slug":"v-19-populyarnejshih-docker-obrazov-net-parolya-dlya-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/v-19-populyarnejshih-docker-obrazov-net-parolya-dlya-root","title":{"rendered":"19% of the most popular Docker images lack a password for root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Last Saturday, May 18, Jerry Gamblin from Kenna Security reviewed<\/a><\/noindex> the 1000 most popular images from Docker Hub for the password used for the root user. In 19% of cases, it was found to be empty.<\/p>\n

\"19%<\/a><\/noindex><\/p>\n

Background on Alpine<\/h2>\n

\nThe motivation for this mini-research was the Talos Vulnerability Report that appeared earlier this month (TALOS-2019-0782<\/a><\/noindex>), authored by Peter Adkins from Cisco Umbrella, which reported that Docker images with the popular container distribution Alpine do not have a password for root:<\/p>\n

\"Official versions of Docker images of Alpine Linux (starting from v3.3) contain a NULL password for the root user. This vulnerability emerged from a regression introduced in December 2015. The essence of the issue is that systems deployed with problematic versions of Alpine Linux in a container and using Linux PAM or another mechanism relying on the system's shadow file as the authentication database may accept a NULL password for the root user.\"<\/p><\/blockquote>\n

\nThe versions of Docker images with Alpine known to be problematic were from 3.3 to 3.9 inclusive, as well as the latest edge release.<\/p>\n

The authors provided the following recommendation for affected users:<\/p>\n

\"The root account should be explicitly disabled in Docker images built on the problematic versions of Alpine. The likelihood of exploiting the vulnerability depends on the environment, as its success requires a service or application exposed externally that uses Linux PAM or another similar mechanism.\"<\/p><\/blockquote>\n

\nThe problem was has been closed<\/a><\/noindex> in Alpine versions 3.6.5, 3.7.3, 3.8.4, 3.9.2, and edge (20190228 snapshot), and users with affected images were advised to comment out the line with root in \/etc\/shadow<\/code> or ensure the absence of the package linux-pam<\/code>.<\/p>\n

Continuation from Docker Hub<\/h2>\n

\nJerry Gamblin decided to find out how widespread the practice of using null passwords in containers might be. For this, he wrote a small Bash script<\/a><\/noindex>, the essence of which is quite simple:<\/p>\n