[lxc-devel] [PATCH] CentOS and Fedora Templates: Harden root passwords and add static MAC network addresses.
S.Çağlar Onur
caglar at 10ur.org
Tue Dec 31 15:59:36 UTC 2013
Hi Michael,
On Thu, Dec 26, 2013 at 6:08 PM, Michael H. Warfield <mhw at wittsend.com> wrote:
> CentOS and Fedora Templates: Harden root passwords and add static MAC network addresses.
>
> 1) Add logic to root password setting. Root password is now set to
> "Root-${name}-${RANDOM} to defeat common brute force scans.
> 2) Enhance exit messages to explain root password and password changing.
Not an objection but a question. What about creating the container
using either quiet parameter or via API? In that case user is unlikely
to see that output hence won't be able to login the box.
> 3) Add random generated hwaddr (MAC) entires for any network interfaces
> in default config copied to container.
> 4) Add shell variable expansion of default config.
> 5) Cross patch templates to bring them more into coherence with each other.
>
> Signed-off-by: Michael H. Warfield <mhw at WittsEnd.com>
> ---
> templates/lxc-centos.in | 114 +++++++++++++++++++++++++++++++++++++-----------
> templates/lxc-fedora.in | 99 +++++++++++++++++++++++++++++++++++++----
> 2 files changed, 180 insertions(+), 33 deletions(-)
>
> diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
> index 7d47715..5bb5349 100644
> --- a/templates/lxc-centos.in
> +++ b/templates/lxc-centos.in
> @@ -33,6 +33,7 @@ default_path=@LXCPATH@
> # We really need something better here!
> root_password=root
>
> +# These are only going into comments in the resulting config...
> lxc_network_type=veth
> lxc_network_link=lxcbr0
>
> @@ -256,8 +257,10 @@ EOF
> mknod -m 600 ${dev_path}/initctl p
> mknod -m 666 ${dev_path}/ptmx c 5 2
>
> - echo "setting root passwd to $root_password"
> + echo "Setting root passwd to '$root_password'"
> echo "root:$root_password" | chroot $rootfs_path chpasswd
> + # Also set this password as expired to force the user to change it!
> + chroot $rootfs_path passwd -e root
>
> # This will need to be enhanced for CentOS 7 when systemd
> # comes into play... /\/\|=mhw=|\/\/
> @@ -374,6 +377,7 @@ copy_centos()
> # i prefer rsync (no reason really)
> mkdir -p $rootfs_path
> rsync -a $cache/rootfs/ $rootfs_path/
> + echo
> return 0
> }
>
> @@ -428,28 +432,71 @@ install_centos()
> return $?
> }
>
> -copy_configuration()
> +create_hwaddr()
> {
> + echo $(dd if=/dev/urandom bs=8 count=1 2>/dev/null | md5sum
> + | sed -e 's/\(..\)\(..\)\(..\)\(..\)\(..\).*/fe:\1:\2:\3:\4:\5/')
> +}
>
> +copy_configuration()
> +{
> mkdir -p $config_path
> +
> + grep -q "^lxc.rootfs" $config_path/config 2>/dev/null || echo "
> +lxc.rootfs = $rootfs_path
> +" >> $config_path/config
> +
> + # The following code is to create static MAC addresses for each
> + # interface in the container. This code will work for multiple
> + # interfaces in the default config.
> + mv $config_path/config $config_path/config.def
> + while read LINE
> + do
> + # This should catch variable expansions from the default config...
> + if expr "${LINE}" : '.*\$' > /dev/null 2>&1
> + then
> + LINE=$(eval "echo \"${LINE}\"")
> + fi
> +
> + # There is a tab and a space in the regex bracket below!
> + # Seems that \s doesn't work in brackets.
> + KEY=$(expr $LINE : '\s*\([^ ]*\)\s*=')
> +
> + if [[ "${KEY}" != "lxc.network.hwaddr" ]]
> + then
> + echo ${LINE} >> $config_path/config
> +
> + if [[ "${KEY}" == "lxc.network.link" ]]
> + then
> + echo "lxc.network.hwaddr = $(create_hwaddr)" >> $config_path/config
> + fi
> + fi
> + done < $config_path/config.def
> +
> + rm -f $config_path/config.def
> +
> cat <<EOF >> $config_path/config
> lxc.utsname = $utsname
> lxc.tty = 4
> lxc.pts = 1024
> -lxc.rootfs = $rootfs_path
> -lxc.mount = $config_path/fstab
> +lxc.mount = $config_path/fstab
> lxc.cap.drop = sys_module mac_admin mac_override sys_time
>
> lxc.autodev = $auto_dev
>
> +# When using LXC with apparmor, uncomment the next line to run unconfined:
> +#lxc.aa_profile = unconfined
> +
> # example simple networking setup, uncomment to enable
> #lxc.network.type = $lxc_network_type
> #lxc.network.flags = up
> #lxc.network.link = $lxc_network_link
> #lxc.network.name = eth0
> -# additional example for veth network type, static MAC address,
> -# and persistent veth device name on host side
> +# Additional example for veth network type
> +# static MAC address,
> #lxc.network.hwaddr = 00:16:3e:77:52:20
> +# persistent veth device name on host side
> +# Note: This may potentially collide with other containers of same name!
> #lxc.network.veth.pair = v-$name-e0
>
> #cgroups
> @@ -460,8 +507,6 @@ lxc.cgroup.devices.allow = c 1:5 rwm
> # consoles
> lxc.cgroup.devices.allow = c 5:1 rwm
> lxc.cgroup.devices.allow = c 5:0 rwm
> -lxc.cgroup.devices.allow = c 4:0 rwm
> -lxc.cgroup.devices.allow = c 4:1 rwm
> # /dev/{,u}random
> lxc.cgroup.devices.allow = c 1:9 rwm
> lxc.cgroup.devices.allow = c 1:8 rwm
> @@ -473,13 +518,12 @@ EOF
>
> cat <<EOF > $config_path/fstab
> proc proc proc nodev,noexec,nosuid 0 0
> -devpts dev/pts devpts defaults 0 0
> sysfs sys sysfs defaults 0 0
> EOF
>
> if [ $? -ne 0 ]; then
> - echo "Failed to add configuration"
> - return 1
> + echo "Failed to add configuration"
> + return 1
> fi
>
> return 0
> @@ -489,22 +533,21 @@ clean()
> {
>
> if [ ! -e $cache ]; then
> - exit 0
> + exit 0
> fi
>
> # lock, so we won't purge while someone is creating a repository
> (
> - flock -x 200
> - if [ $? != 0 ]; then
> - echo "Cache repository is busy."
> - exit 1
> - fi
> -
> - echo -n "Purging the download cache for centos-$release..."
> - rm --preserve-root --one-file-system -rf $cache && echo "Done." || exit 1
> - exit 0
> + flock -x 200
> + if [ $? != 0 ]; then
> + echo "Cache repository is busy."
> + exit 1
> + fi
>
> - ) 200>/var/lock/subsys/lxc-centos
> + echo -n "Purging the download cache for centos-$release..."
> + rm --preserve-root --one-file-system -rf $cache && echo "Done." || exit 1
> + exit 0
> + ) 200>@LOCALSTATEDIR@/lock/subsys/lxc-centos
> }
>
> usage()
> @@ -554,6 +597,12 @@ if [ ! -z "$clean" -a -z "$path" ]; then
> exit 0
> fi
>
> +# Let's do something better for the initial root password.
> +# It's not perfect but it will defeat common scanning brute force
> +# attacks in the case where ssh is exposed. It will also be set to
> +# expired, forcing the user to change it at first login.
> +root_password=Root-${name}-${RANDOM}
> +
> if [ -z "${utsname}" ]; then
> utsname=${name}
> fi
> @@ -572,7 +621,7 @@ fi
> # utsname and hostname = Container_Name.Domain_Name
>
> if [ $(expr "$utsname" : '.*\..*\.') = 0 ]; then
> - if [ -n "$(dnsdomainname)" ]; then
> + if [[ "$(dnsdomainname)" != "" && "$(dnsdomainname)" != "localdomain" ]]; then
> utsname=${utsname}.$(dnsdomainname)
> fi
> fi
> @@ -666,5 +715,20 @@ if [ ! -z $clean ]; then
> clean || exit 1
> exit 0
> fi
> -echo "container rootfs and config created, default root password is '$root_password'"
> -echo "edit the config file to check/enable networking setup"
> +echo "
> +Container rootfs and config have been created.
> +Edit the config file to check/enable networking setup.
> +"
> +
> +echo "The temporary password for root is: '$root_password'
> +
> +You may want to note that password down before starting the container.
> +
> +The password set up as "expired" and will require it to be changed it at
> +first login, which you should do as soon as possible. If you lose the
> +root password or wish to change it without starting the container, you
> +can change it from the host by running the following command (which will
> +also reset the expired flag):
> +
> + chroot ${rootfs_path} passwd
> +"
> diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
> index 5f66ff1..b0c214a 100644
> --- a/templates/lxc-fedora.in
> +++ b/templates/lxc-fedora.in
> @@ -33,6 +33,10 @@ default_path=@LXCPATH@
> # We really need something better here!
> root_password=root
>
> +# These are only going into comments in the resulting config...
> +lxc_network_type=veth
> +lxc_network_link=lxcbr0
> +
> # is this fedora?
> # Alow for weird remixes like the Raspberry Pi
> #
> @@ -194,8 +198,10 @@ EOF
> mknod -m 600 ${dev_path}/initctl p
> mknod -m 666 ${dev_path}/ptmx c 5 2
>
> - echo "setting root passwd to $root_password"
> + echo "Setting root passwd to '$root_password'"
> echo "root:$root_password" | chroot $rootfs_path chpasswd
> + # Also set this password as expired to force the user to change it!
> + chroot $rootfs_path passwd -e root
>
> # specifying this in the initial packages doesn't always work.
> # Even though it should have...
> @@ -243,7 +249,7 @@ configure_fedora_init()
>
> configure_fedora_systemd()
> {
> - unlink ${rootfs_path}/etc/systemd/system/default.target
> + rm -f ${rootfs_path}/etc/systemd/system/default.target
> touch ${rootfs_path}/etc/fstab
> chroot ${rootfs_path} ln -s /dev/null /etc/systemd/system/udev.service
> chroot ${rootfs_path} ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
> @@ -837,6 +843,7 @@ copy_fedora()
> # i prefer rsync (no reason really)
> mkdir -p $rootfs_path
> rsync -Ha $cache/rootfs/ $rootfs_path/
> + echo
> return 0
> }
>
> @@ -891,11 +898,53 @@ install_fedora()
> return $?
> }
>
> -copy_configuration()
> +# Generate a random hardware (MAC) address composed of FE followed by
> +# 5 random bytes...
> +create_hwaddr()
> {
> + echo $(dd if=/dev/urandom bs=8 count=1 2>/dev/null | md5sum |
> + sed -e 's/\(..\)\(..\)\(..\)\(..\)\(..\).*/fe:\1:\2:\3:\4:\5/')
> +}
>
> +copy_configuration()
> +{
> mkdir -p $config_path
> - grep -q "^lxc.rootfs" $config_path/config 2>/dev/null || echo "lxc.rootfs = $rootfs_path" >> $config_path/config
> +
> + grep -q "^lxc.rootfs" $config_path/config 2>/dev/null || echo "
> +lxc.rootfs = $rootfs_path
> +" >> $config_path/config
> +
> + # The following code is to create static MAC addresses for each
> + # interface in the container. This code will work for multiple
> + # interfaces in the default config. It will also strip any
> + # hwaddr stanzas out of the default config since we can not share
> + # MAC addresses between containers.
> + mv $config_path/config $config_path/config.def
> + while read LINE
> + do
> + # This should catch variable expansions from the default config...
> + if expr "${LINE}" : '.*\$' > /dev/null 2>&1
> + then
> + LINE=$(eval "echo \"${LINE}\"")
> + fi
> +
> + # There is a tab and a space in the regex bracket below!
> + # Seems that \s doesn't work in brackets.
> + KEY=$(expr "${LINE}" : '\s*\([^ ]*\)\s*=')
> +
> + if [[ "${KEY}" != "lxc.network.hwaddr" ]]
> + then
> + echo "${LINE}" >> $config_path/config
> +
> + if [[ "${KEY}" == "lxc.network.link" ]]
> + then
> + echo "lxc.network.hwaddr = $(create_hwaddr)" >> $config_path/config
> + fi
> + fi
> + done < $config_path/config.def
> +
> + rm -f $config_path/config.def
> +
> cat <<EOF >> $config_path/config
> lxc.utsname = $utsname
> lxc.tty = 4
> @@ -908,6 +957,18 @@ lxc.autodev = $auto_dev
> # When using LXC with apparmor, uncomment the next line to run unconfined:
> #lxc.aa_profile = unconfined
>
> +# example simple networking setup, uncomment to enable
> +#lxc.network.type = $lxc_network_type
> +#lxc.network.flags = up
> +#lxc.network.link = $lxc_network_link
> +#lxc.network.name = eth0
> +# Additional example for veth network type
> +# static MAC address,
> +#lxc.network.hwaddr = 00:16:3e:77:52:20
> +# persistent veth device name on host side
> +# Note: This may potentially collide with other containers of same name!
> +#lxc.network.veth.pair = v-$name-e0
> +
> #cgroups
> lxc.cgroup.devices.deny = a
> # /dev/null and zero
> @@ -929,6 +990,7 @@ EOF
> proc proc proc nodev,noexec,nosuid 0 0
> sysfs sys sysfs defaults 0 0
> EOF
> +
> if [ $? -ne 0 ]; then
> echo "Failed to add configuration"
> return 1
> @@ -1006,6 +1068,12 @@ if [ ! -z "$clean" -a -z "$path" ]; then
> exit 0
> fi
>
> +# Let's do something better for the initial root password.
> +# It's not perfect but it will defeat common scanning brute force
> +# attacks in the case where ssh is exposed. It will also be set to
> +# expired, forcing the user to change it at first login.
> +root_password=Root-${name}-${RANDOM}
> +
> if [ -z "${utsname}" ]; then
> utsname=${name}
> fi
> @@ -1024,7 +1092,7 @@ fi
> # utsname and hostname = Container_Name.Domain_Name
>
> if [ $(expr "$utsname" : '.*\..*\.') = 0 ]; then
> - if [ -n "$(dnsdomainname)" ]; then
> + if [[ "$(dnsdomainname)" != "" && "$(dnsdomainname)" != "localdomain" ]]; then
> utsname=${utsname}.$(dnsdomainname)
> fi
> fi
> @@ -1128,12 +1196,14 @@ if [ ! -z $clean ]; then
> clean || exit 1
> exit 0
> fi
> -echo "container rootfs and config created"
> +echo "
> +Container rootfs and config have been created.
> +Edit the config file to check/enable networking setup.
> +"
>
> if [[ -d ${cache_base}/bootstrap ]]
> then
> - echo "
> -You have successfully built a Fedora container and cache. This cache may
> + echo "You have successfully built a Fedora container and cache. This cache may
> be used to create future containers of various revisions. The directory
> ${cache_base}/bootstrap contains a bootstrap
> which may no longer needed and can be removed.
> @@ -1147,3 +1217,16 @@ This is only used in the creation of the bootstrap run-time-environment
> and may be removed.
> "
> fi
> +
> +echo "The temporary password for root is: '$root_password'
> +
> +You may want to note that password down before starting the container.
> +
> +The password set up as "expired" and will require it to be changed it at
> +first login, which you should do as soon as possible. If you lose the
> +root password or wish to change it without starting the container, you
> +can change it from the host by running the following command (which will
> +also reset the expired flag):
> +
> + chroot ${rootfs_path} passwd
> +"
> --
> 1.8.3.1
>
>
> --
> Michael H. Warfield (AI4NB) | (770) 978-7061 | mhw at WittsEnd.com
> /\/\|=mhw=|\/\/ | (678) 463-0932 | http://www.wittsend.com/mhw/
> NIC whois: MHW9 | An optimist believes we live in the best of all
> PGP Key: 0x674627FF | possible worlds. A pessimist is sure of it!
>
>
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel
>
--
S.Çağlar Onur <caglar at 10ur.org>
More information about the lxc-devel
mailing list