{"id":34143,"date":"2019-10-31T21:56:37","date_gmt":"2019-10-31T18:56:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/19-4-iz-1000-samyh-populyarnyh-kontejnerov-docker-soderzhat-pustoj-parol-root\/"},"modified":"2019-10-31T21:56:37","modified_gmt":"2019-10-31T18:56:37","slug":"19-4-iz-1000-samyh-populyarnyh-kontejnerov-docker-soderzhat-pustoj-parol-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/19-4-iz-1000-samyh-populyarnyh-kontejnerov-docker-soderzhat-pustoj-parol-root","title":{"rendered":"19.4% of the 1000 most popular Docker containers have an empty root password","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jerry Gamblin decided to investigate how widespread the recently discovered issue<\/a><\/noindex> in Docker images of the Alpine distribution related to the specification of an empty password for the root user. An analysis of a thousand of the most popular containers from the Docker Hub catalog showed<\/a><\/noindex>, that among 194<\/a><\/noindex> of these, 19.4% have a blank password set for root without account lockout (\"root:::0:::::\" instead of \"root:!::0:::::\").<\/p>\n

In the case of using shadow and linux-pam packages in the container, the use of an empty root password , rather than taking focus.<\/a><\/noindex> can escalate privileges within the container if there is unprivileged access to the container or after exploiting a vulnerability in an unprivileged service running in the container. It is also possible to connect to the container with root privileges if there is access to the infrastructure, i.e., the ability to connect via terminal to the TTY specified in the \/etc\/securetty list. SSH access with an empty password is blocked.<\/p>\n

The most popular among containers with an empty root password<\/a><\/noindex> include microsoft\/azure-cli<\/a><\/noindex>, kylemanna\/openvpn<\/a><\/noindex>, governmentpaas\/s3-resource<\/a><\/noindex>, phpmyadmin\/phpmyadmin<\/a><\/noindex>, mesosphere\/aws-cli<\/a><\/noindex> and hashicorp\/terraform<\/a><\/noindex>, which have over 10 million downloads. Additionally, the following containers are noted:
\ngovuk\/gemstash-alpine<\/a><\/noindex> (500k), monsantoco\/logstash<\/a><\/noindex> (5 million),
\navhost\/docker-matrix-riot<\/a><\/noindex> (1 million),
\nazuresdk\/azure-cli-python<\/a><\/noindex> (5 million)
\nand ciscocloud\/haproxy-consul<\/a><\/noindex> (1 million). Almost all of these containers are based on Alpine and do not use shadow and linux-pam packages. The only exception is microsoft\/azure-cli, which is based on Debian.<\/p>\n

<\/a><\/noindex><\/p>\n

Source: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u0436\u0435\u0440\u0440\u0438 \u0413\u0430\u043c\u0431\u043b\u0438\u043d (Jerry Gamblin) \u0440\u0435\u0448\u0438\u043b \u0432\u044b\u044f\u0441\u043d\u0438\u0442\u044c \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 Docker-\u043e\u0431\u0440\u0430\u0437\u0430\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Alpine, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435\u043c \u043f\u0443\u0441\u0442\u043e\u0433\u043e \u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root. \u0410\u043d\u0430\u043b\u0438\u0437 \u0442\u044b\u0441\u044f\u0447\u0438 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 Docker Hub \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0432 194 \u0438\u0437 \u043d\u0438\u0445 (19.4%) \u0434\u043b\u044f root \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043f\u0443\u0441\u0442\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c \u0431\u0435\u0437 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 («root:::0:::::» \u0432\u043c\u0435\u0441\u0442\u043e «root:!::0:::::»). \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-34143","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4719.4% of the 1000 most popular Docker containers have an empty root password | ProHoster","description":"Jerry Gamblin decided to investigate how widespread the recently discovered issue in Docker images is.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/19-4-iz-1000-samyh-populyarnyh-kontejnerov-docker-soderzhat-pustoj-parol-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4719.4% \u0438\u0437 1000 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 Docker \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u043f\u0443\u0441\u0442\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c root | ProHoster","og:description":"\u0414\u0436\u0435\u0440\u0440\u0438 \u0413\u0430\u043c\u0431\u043b\u0438\u043d (Jerry Gamblin) \u0440\u0435\u0448\u0438\u043b \u0432\u044b\u044f\u0441\u043d\u0438\u0442\u044c \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 Docker-\u043e\u0431\u0440\u0430\u0437\u0430\u0445.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/19-4-iz-1000-samyh-populyarnyh-kontejnerov-docker-soderzhat-pustoj-parol-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:56:37+00:00","article:modified_time":"2019-10-31T18:56:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34143","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 18:05:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:13:07","updated":"2026-01-21 18:05:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/34143","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=34143"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/34143\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=34143"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=34143"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=34143"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}