{"id":34141,"date":"2019-10-31T21:56:37","date_gmt":"2019-10-31T18:56:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-19-populyarnejshih-docker-obrazov-net-parolya-dlya-root\/"},"modified":"2019-10-31T21:56:37","modified_gmt":"2019-10-31T18:56:37","slug":"v-19-populyarnejshih-docker-obrazov-net-parolya-dlya-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/v-19-populyarnejshih-docker-obrazov-net-parolya-dlya-root","title":{"rendered":"19% popul\u0101r\u0101ko Docker att\u0113lu nav paroles saknes lietot\u0101jam","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Pag\u0101ju\u0161aj\u0101 sestdien\u0101, 18. maij\u0101, Jerry Gamblin no Kenna Security <noindex><a rel=\"nofollow\" href=\"https:\/\/www.kennasecurity.com\/20-of-the-1000-most-popular-docker-containers-have-no-root-password\/\">p\u0101rbaud\u012bja<\/a><\/noindex> 1000 popul\u0101r\u0101kos att\u0113lus no Docker Hub, lai noskaidrotu, k\u0101ds ir paroli lietot\u0101jam root. 19% gad\u012bjumos t\u0101 izr\u0101d\u012bj\u0101s tuk\u0161a.<\/p>\n<p><img decoding=\"async\" alt=\"19% popul\u0101r\u0101ko Docker att\u0113lu nav paroles saknes lietot\u0101jam\" src=\"\/wp-content\/uploads\/50d68e9378a116909318240ae1ca318a.png\" style=\"display:block;margin: 0 auto;\" \/><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>V\u0113sture ar Alpine<\/h2>\n<p>\nP\u0113t\u012bjuma iemesls bija \u0161\u012b m\u0113ne\u0161a s\u0101kum\u0101 public\u0113tais Talos Vulnerability Report (<noindex><a rel=\"nofollow\" href=\"https:\/\/talosintelligence.com\/vulnerability_reports\/TALOS-2019-0782\">TALOS-2019-0782<\/a><\/noindex>) ar autoru \u2014 pateicoties Peter Adkins no Cisco Umbrella \u2014 kur\u0161 pazi\u0146oja, ka Docker att\u0113li ar popul\u0101ro konteineru distrib\u016bciju Alpine nav paroli lietot\u0101jam root:<\/p>\n<blockquote><p>\u00abOfici\u0101l\u0101s Docker att\u0113lu versijas Alpine Linux (s\u0101kot no v3.3) satur NULL- paroli lietot\u0101jam root. \u0160\u012b ievainojam\u012bba rad\u0101s regresijas rezult\u0101t\u0101, kas tika ieviesta 2015. gada decembr\u012b. T\u0101s b\u016bt\u012bba ir t\u0101da, ka sist\u0113mas, kas izvietotas ar problem\u0101tisk\u0101m versij\u0101m Alpine Linux konteineros un izmanto Linux PAM vai citu meh\u0101nismu, kas izmanto sist\u0113mas failu shadow k\u0101 autentifik\u0101cijas datub\u0101zi, var pie\u0146emt nulles (NULL) paroli lietot\u0101jam root\u00bb.<\/p><\/blockquote>\n<p>\nProbl\u0113mu IT risin\u0101\u0161an\u0101 identific\u0113t\u0101s Docker att\u0113lu versijas ar Alpine bija 3.3\u20143.9, k\u0101 ar\u012b jaun\u0101k\u0101 edge versija.<\/p>\n<p>Autori deva \u0161\u0101du ieteikumu lietot\u0101jiem, kas saskaras ar \u0161o probl\u0113mu:<\/p>\n<blockquote><p>\u00abLietot\u0101ja konts root ir skaidri j\u0101izsl\u0113dz Docker att\u0113los, kas veidoti, pamatojoties uz problem\u0101tisk\u0101m versij\u0101m Alpine. Ievainojam\u012bbas potenci\u0101l\u0101 izmanto\u0161ana ir atkar\u012bga no vides, jo t\u0101s pan\u0101kumiem nepiecie\u0161ama pakalpojuma vai lietojumprogrammas pieejam\u012bba, kas izmanto Linux PAM vai l\u012bdz\u012bgu meh\u0101nismu\u00bb.<\/p><\/blockquote>\n<p>\nProbl\u0113ma bija <noindex><a rel=\"nofollow\" href=\"https:\/\/alpinelinux.org\/posts\/Docker-image-vulnerability-CVE-2019-5021.html\">ir nov\u0113rsta<\/a><\/noindex> Alpine versij\u0101s 3.6.5, 3.7.3, 3.8.4, 3.9.2 un edge (20190228 snapshot), un att\u0113lu \u012bpa\u0161niekiem, kas saskaras ar \u0161o probl\u0113mu, tika ieteikts izkoment\u0113t rindu ar root <code>\/etc\/shadow<\/code> vai p\u0101rliecin\u0101ties, ka nav instal\u0113ts <code>linux-pam<\/code>.<\/p>\n<h2>Turpin\u0101jums ar Docker Hub<\/h2>\n<p>\nJerry Gamblin nol\u0113ma piev\u0113rst uzman\u012bbu, \u00abcik pla\u0161i var izplat\u012bt praksi izmantot nulles paroles konteineros\u00bb. T\u0101p\u0113c vi\u0146\u0161 uzrakst\u012bja nelielu <noindex><a rel=\"nofollow\" href=\"https:\/\/gist.github.com\/jgamblin\/fd94d9078709fe68d13f36f82c29fdab\">Bash skripts<\/a><\/noindex>, kura b\u016bt\u012bba ir vienk\u0101r\u0161a:<\/p>\n<ul>\n<li> izmantojot curl piepras\u012bjumu uz API Docker Hub, tiek piepras\u012bts t\u0101 att\u0113lu saraksts;<\/li>\n<li> izmantojot jq, tas tiek k\u0101rtots p\u0113c lauka <code>popularity<\/code>, un no ieg\u016btajiem rezult\u0101tiem paliek pirmais t\u016bkstotis;<\/li>\n<li> katram no tiem tiek izpild\u012bts <code>docker pull<\/code>;<\/li>\n<li> katram ieg\u016btajam Docker att\u0113lam tiek izpild\u012bts <code>$ docker-compose up<\/code> ar pirm\u0101s rindas las\u012b\u0161anu no faila <code>\/etc\/shadow<\/code>;<\/li>\n<li> ja rindu v\u0113rt\u012bba bija vien\u0101da ar <code>root:::0:::::<\/code>, att\u0113la nosaukums tiek saglab\u0101ts atsevi\u0161\u0137\u0101 fail\u0101.<\/li>\n<\/ul>\n<p>\nKo tad m\u0113s ieguv\u0101m? \u0160aj\u0101 <noindex><a rel=\"nofollow\" href=\"https:\/\/gist.github.com\/jgamblin\/6015a2020c1de3bc3aab19b361573b7f\">fail\u0101<\/a><\/noindex> izr\u0101d\u012bj\u0101s, ka 194 rindas ar popul\u0101ru Docker att\u0113lu nosaukumiem ar Linux sist\u0113m\u0101m, kur root lietot\u0101jam nav iestat\u012bta parole:<\/p>\n<blockquote><p>\u00abStarp visiem zin\u0101majiem v\u0101rdiem \u0161aj\u0101 sarakst\u0101 ir govuk\/governmentpaas, hashicorp, microsoft, monsanto un mesosphere. Savuk\u0101rt kylemanna\/openvpn ir popul\u0101r\u0101kais konteineris no saraksta, ar vair\u0101k nek\u0101 10 miljoniem lejupiel\u0101\u017eu\u00bb.<\/p><\/blockquote>\n<p>\nTom\u0113r j\u0101piebilst, ka pats \u0161is fenomens nenoz\u012bm\u0113 tie\u0161u sist\u0113mu dro\u0161\u012bbas ievainojam\u012bbu, kas tos izmanto: viss ir atkar\u012bgs ar\u012b no t\u0101, k\u0101 tie tiek pielietoti. <i>(skat. iepriek\u0161 min\u0113to koment\u0101ru par Alpine)<\/i>. Tom\u0113r \u00abmor\u0101le \u0161ai pasakai\u00bb jau ir redz\u0113ta daudzk\u0101rt: ac\u012bmredzam\u0101 vienk\u0101r\u0161\u012bba bie\u017ei vien sl\u0113pj ar\u012b otras puses, par kur\u0101m vienm\u0113r j\u0101atceras un kuru sekas j\u0101\u0146em v\u0113r\u0101 sav\u0101s tehnolo\u0123iju pielieto\u0161anas scen\u0101rijos.<\/p>\n<h2>P.S.<\/h2>\n<p>\nLasiet ar\u012b m\u016bsu emu\u0101ra rakstos:<\/p>\n<ul>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/337448\/\">Statistika par pamata oper\u0113t\u0101jsist\u0113m\u0101m Docker Hub att\u0113los<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440504\/\">Docker un Kubernetes dro\u0161\u012bbas pras\u012bg\u0101s vid\u0113s<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/439964\/\">Ievainojam\u012bba CVE-2019-5736 runc, kas \u013cauj ieg\u016bt root ties\u012bbas uz hosta<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/337154\/\">Vulnerable Docker VM \u2014 virtu\u0101l\u0101 galvasl\u0101de par Docker un pentest\u0113\u0161anu<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p>Avots: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/452754\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043c\u0438\u043d\u0443\u0432\u0448\u0443\u044e \u0441\u0443\u0431\u0431\u043e\u0442\u0443, 18 \u043c\u0430\u044f, Jerry Gamblin \u0438\u0437 Kenna Security \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u043b 1000 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0441 Docker Hub \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0432 \u043d\u0438\u0445 \u043f\u0430\u0440\u043e\u043b\u044c \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root. \u0412 19% \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u043e\u043d \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043f\u0443\u0441\u0442\u044b\u043c. \u041f\u0440\u0435\u0434\u044b\u0441\u0442\u043e\u0440\u0438\u044f \u0441 Alpine \u041f\u043e\u0432\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e \u043c\u0438\u043d\u0438-\u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0442\u0430\u043b \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0438\u0439\u0441\u044f \u0440\u0430\u043d\u0435\u0435 \u0432 \u044d\u0442\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 Talos Vulnerability Report (TALOS-2019-0782), \u0430\u0432\u0442\u043e\u0440\u044b \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u2014 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043d\u0430\u0445\u043e\u0434\u043a\u0435 Peter [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34141","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043c\u0438\u043d\u0443\u0432\u0448\u0443\u044e \u0441\u0443\u0431\u0431\u043e\u0442\u0443, 18 \u043c\u0430\u044f, Jerry Gamblin \u0438\u0437 Kenna Security \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u043b.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/v-19-populyarnejshih-docker-obrazov-net-parolya-dlya-root\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"lv_LV\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 19% \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0435\u0439\u0448\u0438\u0445 Docker-\u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u043d\u0435\u0442 \u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f root | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043c\u0438\u043d\u0443\u0432\u0448\u0443\u044e \u0441\u0443\u0431\u0431\u043e\u0442\u0443, 18 \u043c\u0430\u044f, Jerry Gamblin \u0438\u0437 Kenna Security \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u043b.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/v-19-populyarnejshih-docker-obrazov-net-parolya-dlya-root\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:56:37+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:56:37+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd4719% popul\u0101r\u0101kajos Docker att\u0113los nav paroli root lietot\u0101jam | ProHoster","description":"Pag\u0101ju\u0161aj\u0101 sestdien\u0101, 18. maij\u0101, Jerry Gamblin no Kenna Security veica p\u0101rbaudi.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/v-19-populyarnejshih-docker-obrazov-net-parolya-dlya-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 19% \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0435\u0439\u0448\u0438\u0445 Docker-\u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u043d\u0435\u0442 \u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f root | ProHoster","og:description":"\u0412 \u043c\u0438\u043d\u0443\u0432\u0448\u0443\u044e \u0441\u0443\u0431\u0431\u043e\u0442\u0443, 18 \u043c\u0430\u044f, Jerry Gamblin \u0438\u0437 Kenna Security \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u043b.","og:url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/v-19-populyarnejshih-docker-obrazov-net-parolya-dlya-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:56:37+00:00","article:modified_time":"2019-10-31T18:56:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34141","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 18:05:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:13:00","updated":"2026-01-21 18:05:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/34141","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=34141"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/34141\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=34141"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=34141"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=34141"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}