19.4% na manyan kwantena Docker 1000 sun ƙunshi kalmar sirri mara tushe

Jerry Gamblin ya yanke shawarar gano yadda sabbin aka gano ya yaɗu matsala a cikin Hotunan Docker na rarraba Alpine, hade da ƙayyade kalmar sirri mara amfani don tushen mai amfani. Binciken dubunnan shahararrun kwantena daga kundin Docker Hub ya nuna, me a ciki 194 daga cikin waɗannan (19.4%) an saita kalmar sirri mara amfani don tushen ba tare da kulle asusun ba ("tushen:: 0::::::" maimakon "tushen:: 0::::::").

Idan kwandon yana amfani da fakitin inuwa da linux-pam, yi amfani da kalmar sirri mara tushe Yana da damar Haɓaka gata a cikin akwati idan ba ku da damar shiga kwantena mara gata ko bayan yin amfani da rauni a cikin sabis mara gata da ke gudana a cikin akwati. Hakanan zaka iya haɗawa da akwati tare da haƙƙin tushen idan kana da damar yin amfani da kayan aiki, watau. ikon haɗi ta tasha zuwa TTY da aka kayyade a cikin /etc/securetty list. An katange shiga tare da kalmar sirri mara kyau ta hanyar SSH.

Mafi shahara tsakanin kwantena tare da komai tushen kalmar sirri su ne microsoft/azure-cli, kylemanna/openvpn, governmentpaas/s3- albarkatun, phpmyadmin/phpmyadmin, mesosphere/aws-cli и hashicorp/terraform, wanda ke da abubuwan saukarwa sama da miliyan 10. Ana kuma haskaka kwantena
govuk/gemstash-alpine (500), monsantoco/logstash (5 miliyan),
avhost/docker-matrix-riot (1 miliyan),
azuresdk/azure-cli-python (miliyan 5)
и ciscocloud/haproxy-consul (miliyan 1). Kusan duk waɗannan kwantena suna dogara ne akan Alpine kuma ba sa amfani da fakitin inuwa da linux-pam. Banda kawai shine microsoft/azure-cli bisa Debian.

source: budenet.ru