{"id":34143,"date":"2019-10-31T21:56:37","date_gmt":"2019-10-31T18:56:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/19-4-iz-1000-samyh-populyarnyh-kontejnerov-docker-soderzhat-pustoj-parol-root\/"},"modified":"2019-10-31T21:56:37","modified_gmt":"2019-10-31T18:56:37","slug":"19-4-iz-1000-samyh-populyarnyh-kontejnerov-docker-soderzhat-pustoj-parol-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/19-4-iz-1000-samyh-populyarnyh-kontejnerov-docker-soderzhat-pustoj-parol-root","title":{"rendered":"Il 19,4% dei 1000 container Docker pi\u00f9 popolari contiene una password root vuota","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jerry Gamblin ha voluto scoprire quanto sia diffuso il problema recentemente identificato problema<\/a><\/noindex> nelle immagini Docker della distribuzione Alpine, legato all'impostazione di una password vuota per l'utente root. L'analisi di mille dei container pi\u00f9 popolari del catalogo Docker Hub ha mostrato<\/a><\/noindex>, che si trova in 194<\/a><\/noindex> di cui (19,4%) per root \u00e8 stata impostata una password vuota senza blocco dell'account («root:::0:::::» invece di «root:!::0:::::»).<\/p>\n

In caso di utilizzo nei container dei pacchetti shadow e linux-pam, l'uso di una password vuota per root permette<\/a><\/noindex> pu\u00f2 consentire il potenziamento delle proprie privilegiate all'interno del container in presenza di accesso non privilegiato al container o dopo aver sfruttato una vulnerabilit\u00e0 in un servizio non privilegiato in esecuzione nel container. \u00c8 anche possibile connettersi al container con privilegi root se si ha accesso all'infrastruttura, ovvero la possibilit\u00e0 di connettersi tramite terminale a TTY, come indicato nella lista \/etc\/securetty. L'accesso tramite SSH con password vuota \u00e8 bloccato.<\/p>\n

I container pi\u00f9 popolari con password root vuota sono<\/a><\/noindex> sono microsoft\/azure-cli<\/a><\/noindex>, kylemanna\/openvpn<\/a><\/noindex>, governmentpaas\/s3-resource<\/a><\/noindex>, phpmyadmin\/phpmyadmin<\/a><\/noindex>, mesosphere\/aws-cli<\/a><\/noindex> e hashicorp\/terraform<\/a><\/noindex>, che contano pi\u00f9 di 10 milioni di download. Si distinguono anche i container
\ngovuk\/gemstash-alpine<\/a><\/noindex> (500 mila), monsantoco\/logstash<\/a><\/noindex> (5 milioni),
\navhost\/docker-matrix-riot<\/a><\/noindex> (1 milione),
\nazuresdk\/azure-cli-python<\/a><\/noindex> (5 milioni)
\ne ciscocloud\/haproxy-consul<\/a><\/noindex> (1 milione). Quasi tutti questi contenitori sono basati su Alpine e non utilizzano i pacchetti shadow e linux-pam. L'unica eccezione \u00e8 microsoft\/azure-cli basato su Debian.<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u0436\u0435\u0440\u0440\u0438 \u0413\u0430\u043c\u0431\u043b\u0438\u043d (Jerry Gamblin) \u0440\u0435\u0448\u0438\u043b \u0432\u044b\u044f\u0441\u043d\u0438\u0442\u044c \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 Docker-\u043e\u0431\u0440\u0430\u0437\u0430\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Alpine, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435\u043c \u043f\u0443\u0441\u0442\u043e\u0433\u043e \u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root. \u0410\u043d\u0430\u043b\u0438\u0437 \u0442\u044b\u0441\u044f\u0447\u0438 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 Docker Hub \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0432 194 \u0438\u0437 \u043d\u0438\u0445 (19.4%) \u0434\u043b\u044f root \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043f\u0443\u0441\u0442\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c \u0431\u0435\u0437 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 («root:::0:::::» \u0432\u043c\u0435\u0441\u0442\u043e «root:!::0:::::»). \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-34143","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4719.4% dei 1000 contenitori Docker pi\u00f9 popolari contengono una password vuota per root | ProHoster","description":"Jerry Gamblin ha voluto scoprire quanto fosse diffuso il problema recentemente identificato nelle immagini Docker della distribuzione Alpine, relativo all'impostazione di una password vuota per l'utente root. L'analisi di mille dei contenitori pi\u00f9 popolari nel catalogo Docker Hub ha rivelato che in 194 di essi (19.4%) per root \u00e8 stata impostata una password vuota senza il blocco dell'account (\"root:::0:::::\" invece di \"root:!::0:::::\"). In caso di utilizzo in","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/19-4-iz-1000-samyh-populyarnyh-kontejnerov-docker-soderzhat-pustoj-parol-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4719.4% \u0438\u0437 1000 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 Docker \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u043f\u0443\u0441\u0442\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c root | ProHoster","og:description":"\u0414\u0436\u0435\u0440\u0440\u0438 \u0413\u0430\u043c\u0431\u043b\u0438\u043d (Jerry Gamblin) \u0440\u0435\u0448\u0438\u043b \u0432\u044b\u044f\u0441\u043d\u0438\u0442\u044c \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 Docker-\u043e\u0431\u0440\u0430\u0437\u0430\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Alpine, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435\u043c \u043f\u0443\u0441\u0442\u043e\u0433\u043e \u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root. \u0410\u043d\u0430\u043b\u0438\u0437 \u0442\u044b\u0441\u044f\u0447\u0438 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 Docker Hub \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0432 194 \u0438\u0437 \u043d\u0438\u0445 (19.4%) \u0434\u043b\u044f root \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043f\u0443\u0441\u0442\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c \u0431\u0435\u0437 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 ("root:::0:::::" \u0432\u043c\u0435\u0441\u0442\u043e "root:!::0:::::"). \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/19-4-iz-1000-samyh-populyarnyh-kontejnerov-docker-soderzhat-pustoj-parol-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:56:37+00:00","article:modified_time":"2019-10-31T18:56:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34143","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 18:05:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:13:07","updated":"2026-01-21 18:05:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/34143","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=34143"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/34143\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=34143"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=34143"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=34143"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}