{"id":34141,"date":"2019-10-31T21:56:37","date_gmt":"2019-10-31T18:56:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-19-populyarnejshih-docker-obrazov-net-parolya-dlya-root\/"},"modified":"2019-10-31T21:56:37","modified_gmt":"2019-10-31T18:56:37","slug":"v-19-populyarnejshih-docker-obrazov-net-parolya-dlya-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/v-19-populyarnejshih-docker-obrazov-net-parolya-dlya-root","title":{"rendered":"\u00cen 19% dintre cele mai populare imagini Docker nu exist\u0103 parol\u0103 pentru root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>S\u00e2mb\u0103t\u0103, 18 mai, Jerry Gamblin de la Kenna Security <noindex><a rel=\"nofollow\" href=\"https:\/\/www.kennasecurity.com\/20-of-the-1000-most-popular-docker-containers-have-no-root-password\/\">a verificat<\/a><\/noindex> 1000 dintre cele mai populare imagini de pe Docker Hub pentru parola utilizat\u0103 pentru utilizatorul root. \u00cen 19% din cazuri, aceasta s-a dovedit a fi goal\u0103.<\/p>\n<p><img decoding=\"async\" alt=\"\u00cen 19% dintre cele mai populare imagini Docker nu exist\u0103 parol\u0103 pentru root\" src=\"\/wp-content\/uploads\/50d68e9378a116909318240ae1ca318a.png\" style=\"display:block;margin: 0 auto;\" \/><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Povestea din spate cu Alpine<\/h2>\n<p>\nMotivul pentru cercetarea efectuat\u0103 a fost raportul de vulnerabilitate Talos ap\u0103rut la \u00eenceputul acestei luni (<noindex><a rel=\"nofollow\" href=\"https:\/\/talosintelligence.com\/vulnerability_reports\/TALOS-2019-0782\">TALOS-2019-0782<\/a><\/noindex>), autorii c\u0103ruia \u2014 mul\u021bumit\u0103 descoperirii lui Peter Adkins de la Cisco Umbrella \u2014 au raportat c\u0103 imaginile Docker cu popularul distribuitor de containere Alpine nu au parol\u0103 pentru root:<\/p>\n<blockquote><p>\u201eVersiunile oficiale ale imaginilor Docker Alpine Linux (\u00eencep\u00e2nd cu v3.3) con\u021bin o parol\u0103 NULL pentru utilizatorul root. Aceast\u0103 vulnerabilitate a ap\u0103rut ca urmare a unei regresii prezentate \u00een decembrie 2015. Esen\u021ba acesteia const\u0103 \u00een faptul c\u0103 sistemele desf\u0103\u0219urate cu versiunile problematice ale Alpine Linux \u00eentr-un container \u0219i care folosesc Linux PAM sau un alt mecanism care utilizeaz\u0103 fi\u0219ierul sistemului shadow ca baz\u0103 de date pentru autentificare, pot accepta o parol\u0103 nul\u0103 (NULL) pentru utilizatorul root.\u201d<\/p><\/blockquote>\n<p>\nVersiunile de imagini Docker cu Alpine afectate de problem\u0103 erau 3.3\u20143.9 inclusiv, precum \u0219i ultimul release edge.<\/p>\n<p>Autorii au oferit urm\u0103toarea recomandare utilizatorilor afecta\u021bi de problem\u0103:<\/p>\n<blockquote><p>\u201eContul root ar trebui s\u0103 fie dezactivat explicit \u00een imaginile Docker construite pe baza versiunilor problematice Alpine. Exploatarea probabil\u0103 a vulnerabilit\u0103\u021bii depinde de mediu, deoarece succesul acesteia necesit\u0103 un serviciu sau o aplica\u021bie expus\u0103 care utilizeaz\u0103 Linux PAM sau un mecanism similar\u201d.<\/p><\/blockquote>\n<p>\nProblema a fost <noindex><a rel=\"nofollow\" href=\"https:\/\/alpinelinux.org\/posts\/Docker-image-vulnerability-CVE-2019-5021.html\">remediat\u0103<\/a><\/noindex> \u00een Alpine versiunilor 3.6.5, 3.7.3, 3.8.4, 3.9.2 \u0219i edge (snapshot din 20190228), iar posesorii imaginilor afectate au fost sf\u0103tui\u021bi s\u0103 comenteze linia cu root \u00een <code>\/etc\/shadow<\/code> sau s\u0103 se asigure c\u0103 pachetul <code>linux-pam<\/code>.<\/p>\n<h2>Continuare de pe Docker Hub<\/h2>\n<p>\nJerry Gamblin a dorit s\u0103 afle \u201ec\u00e2t de r\u0103sp\u00e2ndit\u0103 poate fi practica utiliz\u0103rii parolelor NULL \u00een containere\u201d. Pentru a face acest lucru, a scris un mic <noindex><a rel=\"nofollow\" href=\"https:\/\/gist.github.com\/jgamblin\/fd94d9078709fe68d13f36f82c29fdab\">script Bash<\/a><\/noindex>, ale c\u0103rui scop este destul de simplu:<\/p>\n<ul>\n<li> printr-o cerere curl la API-ul de pe Docker Hub se solicit\u0103 o list\u0103 a imaginilor Docker g\u0103zduite acolo;<\/li>\n<li> prin jq, aceasta este sortat\u0103 pe c\u00e2mpul <code>popularity<\/code>, iar din rezultatele ob\u021binute r\u0103m\u00e2ne prima mie;<\/li>\n<li> pentru fiecare dintre ele se execut\u0103 <code>docker pull<\/code>;<\/li>\n<li> pentru fiecare imagine ob\u021binut\u0103 de pe Docker Hub se execut\u0103 <code>docker run<\/code> citind prima linie din fi\u0219ier <code>\/etc\/shadow<\/code>;<\/li>\n<li> dac\u0103 valoarea liniei s-a dovedit a fi egal\u0103 cu <code>root:::0:::::<\/code>, numele imaginii este salvat \u00eentr-un fi\u0219ier separat.<\/li>\n<\/ul>\n<p>\nCe a ie\u0219it? <noindex><a rel=\"nofollow\" href=\"https:\/\/gist.github.com\/jgamblin\/6015a2020c1de3bc3aab19b361573b7f\">\u00een acest fi\u0219ier<\/a><\/noindex> s-au g\u0103sit 194 de linii cu numele unor imagini Docker populare cu sisteme Linux, \u00een care utilizatorul root nu are parol\u0103 setat\u0103:<\/p>\n<blockquote><p>\u00abPrintre cele mai cunoscute nume din aceast\u0103 list\u0103 se num\u0103r\u0103 govuk\/governmentpaas, hashicorp, microsoft, monsanto \u0219i mesosphere. Iar kylemanna\/openvpn este cel mai popular container din list\u0103, av\u00e2nd o statistic\u0103 de peste 10 milioane de pull-uri.\u00bb<\/p><\/blockquote>\n<p>\nMerit\u0103, totu\u0219i, s\u0103 men\u021bion\u0103m c\u0103 acest fenomen nu \u00eenseamn\u0103 neap\u0103rat o vulnerabilitate direct\u0103 \u00een securitatea sistemelor care le utilizeaz\u0103: totul depinde de modul \u00een care sunt utilizate. <i>(vezi comentariul din cazul Alpine de mai sus)<\/i>. Totu\u0219i, \u201emoralitatea acestei fabule\u201d am v\u0103zut-o deja de multe ori: simplitatea vizibil\u0103 are adesea \u0219i o revers\u0103, despre care trebuie s\u0103 ne amintim mereu \u0219i al c\u0103rei impact trebuie s\u0103-l lu\u0103m \u00een considerare \u00een scenariile noastre de utilizare a tehnologiei.<\/p>\n<h2>P.S.<\/h2>\n<p>\nCiti\u021bi \u0219i \u00een blogul nostru:<\/p>\n<ul>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/337448\/\">Statisticile privind sistemele de operare de baz\u0103 \u00een imaginile de pe Docker Hub<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440504\/\">Docker \u0219i Kubernetes \u00een medii cu cerin\u021be stricte de securitate<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/439964\/\">Vulnerabilitatea CVE-2019-5736 \u00een runc, care permite ob\u021binerea drepturilor de root pe gazd\u0103<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/337154\/\">VM Docker vulnerabil\u0103 \u2014 puzzle virtual despre Docker \u0219i pentesting<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/452754\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043c\u0438\u043d\u0443\u0432\u0448\u0443\u044e \u0441\u0443\u0431\u0431\u043e\u0442\u0443, 18 \u043c\u0430\u044f, Jerry Gamblin \u0438\u0437 Kenna Security \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u043b 1000 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0441 Docker Hub \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0432 \u043d\u0438\u0445 \u043f\u0430\u0440\u043e\u043b\u044c \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root. \u0412 19% \u0441\u043b\u0443\u0447\u0430\u0435\u0432 \u043e\u043d \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043f\u0443\u0441\u0442\u044b\u043c. \u041f\u0440\u0435\u0434\u044b\u0441\u0442\u043e\u0440\u0438\u044f \u0441 Alpine \u041f\u043e\u0432\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e \u043c\u0438\u043d\u0438-\u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0442\u0430\u043b \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0438\u0439\u0441\u044f \u0440\u0430\u043d\u0435\u0435 \u0432 \u044d\u0442\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 Talos Vulnerability Report (TALOS-2019-0782), \u0430\u0432\u0442\u043e\u0440\u044b \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u2014 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043d\u0430\u0445\u043e\u0434\u043a\u0435 Peter [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34141","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043c\u0438\u043d\u0443\u0432\u0448\u0443\u044e \u0441\u0443\u0431\u0431\u043e\u0442\u0443, 18 \u043c\u0430\u044f, Jerry Gamblin \u0438\u0437 Kenna Security \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u043b.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/v-19-populyarnejshih-docker-obrazov-net-parolya-dlya-root\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 19% \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0435\u0439\u0448\u0438\u0445 Docker-\u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u043d\u0435\u0442 \u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f root | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043c\u0438\u043d\u0443\u0432\u0448\u0443\u044e \u0441\u0443\u0431\u0431\u043e\u0442\u0443, 18 \u043c\u0430\u044f, Jerry Gamblin \u0438\u0437 Kenna Security \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u043b.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/v-19-populyarnejshih-docker-obrazov-net-parolya-dlya-root\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:56:37+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:56:37+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00cen 19% dintre cele mai populare imagini Docker nu exist\u0103 parol\u0103 pentru root | ProHoster","description":"S\u00e2mb\u0103ta trecut\u0103, 18 mai, Jerry Gamblin de la Kenna Security a verificat.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/v-19-populyarnejshih-docker-obrazov-net-parolya-dlya-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 19% \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0435\u0439\u0448\u0438\u0445 Docker-\u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u043d\u0435\u0442 \u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f root | ProHoster","og:description":"\u0412 \u043c\u0438\u043d\u0443\u0432\u0448\u0443\u044e \u0441\u0443\u0431\u0431\u043e\u0442\u0443, 18 \u043c\u0430\u044f, Jerry Gamblin \u0438\u0437 Kenna Security \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u043b.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/v-19-populyarnejshih-docker-obrazov-net-parolya-dlya-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:56:37+00:00","article:modified_time":"2019-10-31T18:56:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34141","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 18:05:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:13:00","updated":"2026-01-21 18:05:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/34141","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=34141"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/34141\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=34141"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=34141"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=34141"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}