Chii chingakanganise CI/CD pipelines?

Kubatanidzwa nguva dzose uye kupa nguva dzose (CI/CD) pipelines ndiwo hwaro hwesangano ripi zvaro resoftware rinogadzira software nenzira "yemazuva ano". Kugadzira otomatiki kunopa simba guru, asi vazhinji vanogadzira mapurogiramu havazivi basa rinodiwa.

Developer: Ehe, tinotora CI/CD chibatiso zvakakomba uye vane simba guru pavachengeti vemakodhi, ongorora commits pamberi pekubatanidzwa kwemasangano; mabasa uye pipelinevanochengetwa nevashandi vakuru, vanochengetedza kuti vasaburitse zvakavanzika mu pipelineUye chishandiso ichi chakaiswa nevashandi vanoziva chinhu ichi. Chii chingakanganisika?

Anodiwa mugadziri, CI/CD masisitimu acho akaomarara. Nzvimbo yayo yakakura yekurwiswa yakakwezva vanhu vanoita zvematsotsi. Zviri nani kungwarira uye kusazvivimba zvakanyanya.

Dzimwe nguva gadziriro yekutanga inochengetwa uye inova shamwari yepamoyo yevapambi vematsotsi. Zvikanganiso zvakakosha zvinogona kuwanikwa mu CI/CD pipeline manyuko, muchimiro chesystem, kana kuti maererano nemaitiro nemamiriro ezvinhu esystem. pipeline uye kuti zvinotanga sei.

Muchinyorwa chino tichazviisa munzvimbo dzevatambi vakaipa. Fungidzira kuti tiri kuverenga pfungwa dze M3M3N70 (Memento Mori?) uye Hasha dzeMadhamu pane imwe nzvimbo mugomba rerima, pamwe mumutauro usiri wekumadokero, asi usambopotsa kuti zvakaipa zviri kupararira pasi rose.

 

Munguva yekare zvaive nyore kwazvo…

M3M3N70: Kudzokera kunguva yekare, bhizinesi redu raive nyore kwazvo… Hapana mazuva aishanda zvakanaka, mapurogiramu aivhurika zvikuru aine nyore kushandisa vulns, uye taigona kufamba nekukasira.

Hasha dzeMadhamu: Fu#@Hell! Vamwe vane pfungwa dzakaipa asi zvinhu zvakachinja. Varume vakuru vakaisa pfungwa dzavo pazvinonyadzisira zveAppSec.

M3M3N70: Ehe. Asi mapenzi matsva ndiwo mainjiniya. Kwatiri, zvave nyore kushandisa zvishandiso zvinoshandiswa nevarume ava. CI, kunyanya, mugodhi wegoridhe! Matokeni ekuwana data kubva kuCloud, SCM zvitupa, mapassword ekugadzira database, makiyi eSSH epachivande, zvitupa zvevamwe vashandisi veCI… Kubva pazvinhu zvinofinha zvedevelopment kuenda kune chaiyo kwaive kushoma.

Kuita otomatiki kwekuvaka, kuyedza uye kutumira software ine CI/CD Chishandiso chinowanzoda kupa zvakavanzika kumirairo nematanho. Uye kazhinji zvinoburitswa, zvichikonzera mhedzisiro yakaipa.

Pipelinevanoda zvakavanzika izvo dzimwe nguva zvinoburitswa pachena

M3M3N70: The code monkeys slipped their AWS keys in a pipeline on a GitHub commit, later they removed the thing but not changed git history. For our scripts it was trivial to scan the history, grab the key and wreak havoc.

Pamwe nguva dzakanaka dzekare dzaive dzekutsvaga munhoroondo yeGit .env faira (mugadziri akanganwa kuriwedzera pa .gitignore):

AWS_ACCESS_KEY_ID=AKIA...
AWS_SECRET_ACCESS_KEY=wJalrXUtn...
AWS_REGION=us-east-1
APP_FOLDER=...
S3BUCKET=...

iyo yakashandiswa muGitHub workflow .github/deploy.yaml zvaive nechinhu chakadai:

jobs:
  build:
    name: Automated build and deployment into AWS
    runs-on: 	ubuntu-22.04
    steps:
      # Load environment from .env file
      - id: dotenv
        uses: falti/dotenv-action@v1.0.2
        
      - name: Configure AWS Credentials
        uses:
        with:
          args: --acl public-read --follow-symlinks --delete 
          aws-access-key-id: $
          aws-secret-access-key: $
          aws-region: $
      
      # ... build steps skipped ...
      
      -  name: Upload compiled code for deployment
         working-directory: $/packaged_app
         run: aws s3 cp my-app.zip s3://$ 
         
      - name: Deploy the app
        run: aws deploy create-deployment ...

M3M3N70: wow! Makiyi iwayo aishanda! Takatanga taedza shanduko yeinocuos muapp, ndokuzowedzera marwadzo sezvo varume ivavo vaiita sevasingazive. Bingo! Mushandirapamwe wakakura…

Munhu akaipa uyu akangoshandisa makiyi eAWS kuisa application yakagadziriswa ine malware ndokuzoshandisa murairo wekuisa nemagwaro akadaro. Zvakavanzika zvakaburitswa, pamwe neruzivo rwuri mu pipeline"Mushandirapamwe wakadini!" zvingangoreva kuti Memento yakaparadza murombo.

Chinotiudza Memento pano ndechekuti kana pangoitika kubuda kwepachivande, semakiyi eAWS ari mumuenzaniso, unofanirwa kubvisa chakavanzika (tenderedza makiyi ari pamusoro apa) pakarepoNguva dzose pane hwindo rekuratidzwa pakati pekubuda kwemvura commit uye kusashanda kwakavanzika; Kunyorazve nhoroondo yeGit kwakaoma (kunyangwe hurumende ine hudzvanyiriri yakaoma yakaedza kunyora nhoroondo yakadaro patsva, asi hazvina kubatsira) uye pamwe haina kubudirira (shamwari dzedu dzingangodaro dzakaita sedzakatorwa kare kare nepachivande. commit). Tenderedza makiyi nekukasika, uye nyengetera uchiverenga magwaro ezviitiko zveakaundi yakanangwa panguva yekuratidzwa!

Pamwe masangano anofanira kurambidza kushandisa zvakavanzika zvenguva refu mu CI/CD pipelines, uye wozvitsiva nemagwaro epanguva. Mumuenzaniso wapfuura nemakiyi eAWS muzviito zveGitHub, zvakachengeteka kushandisa Mupi weOpenID Connect (OIDC) kuti uwane zvitupa zvenguva pfupi zvinodiwa pakuita zviito.

Hasha dzeMadhamu: Waive nerombo rakanaka! Kuburitsa ma script ane makiyi akaomeswa kwaive tsika yakajairika kare, kunyangwe pamabhaketi eS3 aisvikika pachena. Chaunongoda kuita kungoyambuka zvinhu zviri mubhaketi woita grepping kuti uwane zvinhu zvinonakidza.

Dzimwe nguva nzvimbo yaishandiswa pakuisa (bhaketi reAWS S3 mumuenzaniso uyu) yaivhurika kuti iverengerwe nevanhu vekunze, nekuda kwekusagadzikana kwekugadzirisa (kwaisaonekwa). Chii chakaitika? Hasha dzeMadhamu yakashandiswa yakaita seiyi:

aws s3 ls --recursive s3://<bucket_name>/<path>/ | \
awk '{print $4}' | \
xargs -I FNAME sh -c "echo FNAME; \
  aws s3 cp s3://<bucket_name>/FNAME - | \
  grep '<regex_pattern>'"

Bhaketi iri ringangodaro rakagadzirwa mu template yekugovera iyo inogona kuongororwa otomatiki kuti ione kana paine zvikanganiso zvekuchengetedza.

Kugadziriswa kwechishandiso kwaive chinhu chekutamba nacho kwatiri

Kuti tipe mienzaniso chaiyo ngatitaurei nezvayo Jenkins, chimwe chezvishandiso zveCI zvakakurumbira.

Hasha dzeMadhamu: Unoyeuka here bhokisi rekuti "Enable Security" riri muJenkins, uye kuti mangani masangano akasarudza kusaishandisa kuti zvive nyore? Uye avo "Munhu wese anogona kuita chero chinhu"Mvumo dzakasanganiswa sedzakajairwa here?" Uye maJenkins plugins aya anonetsa, akadai se GitHub OAuth pluginMunhu akaigadzirisa akasarudza "Regai READ permissions kune vese Authenticated Users" uye "Use GitHub repository permissions", zvichitipa mukana wekuwana mapurojekiti avo ese.

(Ndinokumbira ruregerero, Jenkins, nekukuratidzai semuenzaniso 😉

Ramba uine hunyanzvi (kunyange wakapindwa muropa) kumitemo yekuchengetedza. Chimwe chacho Chengetedza nekusingaperi musimboti: zvinodzora zvinofanirwa kushandiswa pakugadzirisa kwakachengeteka zvakanyanya. Kuchengetedzwa kunofanirwa kuvakwa mukati CI/CD zvishandiso uye pipelinekubva pakutanga, pane kuva chinhu chaizofungwa nezvacho. Asi kuva nyore kushandisa uye nyore kushandisa zvinowanzopesana nekuchengetedzwa.

Kune kesi yaJenkins, kusimbiswa kwakavakirwa mukati hakuna kusimba: usamboshandisa nzira dzekusimbisa dzakavakirwa mukati muJenkinsZviri nani kusarudza nzira yechitatu (SAML, LDAP, Google …), ine Role-based Authorization Strategy (“RBAC”) plugin. Uye chenjerera zvakanyanya ne admin nhoroondo.

Chenjerera kuti basa rako rinoitwa sei uye pipeline mafaira ari muJenkins anobatwa. Zvimwe chete ne Plugin yekugadzira seCode uye mafaira ayo ekugadzirisa, anoshanda kune magadzirirwo eJenkins.

Kubva pakuzvigadzirira wega CI/CD masisitimu eSaaS akavakirwa pamakore anobvisa dzimwe njodzi dzingangoitika dzinobvumira kufamba kwedivi mukati me network yesangano, asi akawedzera dzimwe, dzakadai sekuvhura kubatana kwekunze pakati pemasisitimu emukati aripo ne ekunze. CI/CD tool.

Masangano anofanira kuedzaciskungwarira kwakakodzera pakuomesa CI/CD sisitimu, kutanga nemagadzirirwo anodzvinyirira zvakanyanya uye kuvhura zvishoma nezvishoma nemvumo shoma dzinodiwa dze pipeline nhanho.

Kugadzirisa kuchengetedzeka mu CI/CD Zvishandiso zvinogona kunge zvakaoma. Mazhinji ane maplugins kana ma extensions ane zvakawanda zvezvipingamupinyi uye anoda kugadziriswa.

Ma scanner ekuchengetedza asina kurongeka zvakanaka ezvishandiso zvakaoma kudaro, kana kuti ma benchmarks anogona kubatsira.

Kuisa kodhi mukati pipeline mirairo yekunakidzwa uye purofiti

M3M3N70: Wakamboshandisa Untrusted Code Checkouts here, iyo zviito nemascripts zviri nyore kushandisa panjodzi yekuiswa kwemirairo?

Chikamu chino chinoratidza kuti pipeline pacharo panogona kunge paine zvikanganiso zvekunyora kodhi zvinogonesa vanhu vakaipa kuisa kodhi isina kurongeka mu pipeline pasina kuchinja pipeline tsime racho pacharoSemuenzaniso uchishandisa PR

Muenzaniso wekutanga we mafambiro eGitHub asina kunaka:

# INSECURE. Provided as an example only.
on:
  pull_request_target #1

jobs:
  build:
    name: Build and test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
        with:
          ref: $ #2

      - uses: actions/setup-node@v1
      - run: |
          npm install #3
          npm build
      # ... more steps ...

Kubatanidza pull_request_target Kutanga kwekushanda kwemabasa nekutarisa pachena PR isina kuvimbika inzira ine njodzi inogona kutungamira mukukanganisa kwekuchengetedza. Mumuenzaniso, musanganiswa wakashata we:

• pull_request_target chiitiko, icho chine mvumo yekunyora kune iyo target repository nezvakavanzika zve target repository, kunyangwe kubva kumaforogo ekunze, uye chinoshanda mumamiriro ezvinhu eiyo target repository yePR,
• tarisa kodhi yePR kubva kunobva, repo isina kuvimbika,
• kutanga chero chinyorwa chingashanda pane zviri mukati zvinodzorwa nePR, senge kana npm install, uye
• kusashandisa mamiriro ezvinhu pakuita kuti pave nekukonzeresa pull_request_target Chiitiko ichi chinofanira kungoitwa chete kana chimwe chinhu chinonzi 'PR iyi yakaongororwa' chakapihwa PR (vashandisi vekunze havagone kupa PR mavara).

Muenzaniso wechipiri unosanganisira mashoko asina kuvimbika (kubva pane dambudziko, mhinduro kana pull request) senzvimbo yenharo dzakatumirwa kune pipeline raira kuburikidza nematauriro. Uyu ndiwo pipeline vhezheni yedambudziko rekuisa murairo weOS.

- name: Check title
  run: |
    title="$"
    if [[ ! $title =~ ^.*:\ .*$ ]]; then
      echo "Bad issue title"
      exit 1
    fi

Kushanda kwekumhanya kunogadzira script yechinguvana yeshell yakavakirwa patemplate, ne $ yakatsiva, zvichiita kuti ive panjodzi yekupindwa ne "shell command injection". Munhu anorwisa ane account yeGitHub yenhema anogona kukonzera dambudziko nemusoro wenyaya. a"; bad_code_goes_here;#, uye bhururu! 

Hasha dzeMadhamu: Ah, varume ivavo vaivhura musuwo wekuisa murairo nekungovhura dambudziko…

Kwaive nekusagadzikana kwekuita kodhi muzviito zveGitHub, senge gajira-comment, zvagadziriswa. Ndapota verengai "Kuisa zvinhu zvisina kuvimbika mumabasa eGitHub" nekuda kwemashoko akazara.

Dzidziso yenyaya iyi: Usambofa wakatenga maPR kubva kune vanhu vasina kuvimbika usina kutanga waongorora maPR. 'Kusavimbwa' pano, kunze kwekunge paine humbowo hwekuti kwakabva kupi, zvinogona kureva chero account yemugadziri inogona kubiwa.

 

Kuiswa kwemalware kusingatarisirwi pano!

Kuenderera mberi kutumirwa ndiyo nguva yekupedzisira yekuzvigadzira otomatiki, asi mugumo iwoyo unogona kukanganiswa nekushaikwa kwezvidzoro zvakakodzera zvekubvumidza pa pipeline kuyerera.

Njodzi dzekuiswa kwe otomatiki zvizere kubva kunobva commit Kumasystem ekugadzira zvinhu kunosanganisira mukana wekuti kodhi yakaipa ishandiswe munzvimbo dzekugadzira zvinhu pasina kuonekwa, pamwe nemukana wekuti zvikanganiso mukuita kwekutumira zvinhu zvikonzere kukanganiswa kana kudzimwa kwezvinhu.

Kuti vaderedze njodzi idzi, zvinowanzokurudzirwa kuti masangano aise "chikamu chakaoma" mukuita kwavo basa, izvo zvinoda mvumo yevanhu zvisati zvaburitswa zvaendeswa kunzvimbo dzekupedzisira.

Vari kuvhara magonhi

Hasha dzeMadhamu: Mapassword iwayo anofadza ari mu CI/CD zvishandiso zviri kubviswa. Kupinda mu /var/lib/jenkins/secrets/initialAdminPassword Haisi nzira yakanaka. Maturusi mazhinji ari kupa 2FA, iyo Covid yakaita kuti ive yakakurumbira, uye kunyangwe tsoko ine usimbe iri kuishandisa!

M3M3N70: Tiri kurwisa 2FA, asi hazvisi nyore kudaro. Zvakaoma kubata varume ivavo, sezvo "Scatter Swine" yakaita naTwilioNemakiyi eWebAuthn zvakaoma zvikuru. Zvirinani, tinogona kuedza kuba makuki kuti usashandise MFA, asi ndinofanira kupinda mubhokisi remugadziri.

Kusimbiswa kweMulti-Factor idanho rakanaka rekuderedza njodzi yekubuda kwezvicherwa zvekusimbisa. Zvizhinji zvezvishandiso zveDevOps zvemazuva ano zvinotsigira MFA. Uye makiyi ekusimbisa pasi peWebAuthn / U2F (ona Purojekiti yeFIDO2) pamwe ndiyo sarudzo yakanakisa yeMFA muDevOps, kana ikachengetedzwa zvakanaka.

Hasha dzeMadhamu: Varume veDevOps vari kumuka. Vane chinhu "chisina ropafadzo" muropa ravo. Uye havasisiri ma code monkeys. Iye zvino tabatwa nemhosva nevaongorori.

Saizvozvo, pipelines ikozvino dzakasimba zvishoma kupfuura makore maviri apfuura, nemabasa asina simba uye zvinyorwa zvakabviswa, uye nematanho ekuwedzera ekuongorora kuchengetedzwa akatoona madropper edu akavanzwa muchivande. commits nemapakeji atakaba.

Mubvunzo wemuverengi: maitiro ekuvaka software kubva kumasosi uye kuisa mukugadzira ibhizinesi rine njodzi here? Unogona kuona maDevOps ako ari padanho re nguva dzakanaka kune vakaipa?

Ekupedzisira Mazano

Kwekutanga ne CI/CD pipelines?

Kurudziro yekutanga iri nyore pano: Nokungwarira ongorora pipelines (vari inonyanya kukosha zviwanikwa) zvekuchengetedza. Ongororo dzinodhura asi dzinodiwa, uye dzinofanira kuitwa nemazvo. Vanoongorora vanofanira kuziva zvekutarisa. Danho rega rega rinofanira kuongororwa kuti harina zvikanganiso.

Pamwe musanganiswa wevaongorori vane hunyanzvi vakashandisa ma "automatic malicious code scanners" ungabatsira.

Kurudziro yechipiri ndeyekuti dzidzisa vagadziri vemabhuku vanonyora pipelineuye dzichengetedze dzakachengetekaZvinhu zvekufunga nezvazvo:

• Maitiro ekugadzirisa authentication nemazvo nemabasa emukati neegore, kudzivirira dambudziko rekubata marekodhi enguva refu.
• Maitiro ekuderedza pipelines kune chaiwo maturusi ainoda kuwana. Nheyo yekuti ropafadzo shoma ionekwe zvakare.
• Maitiro ekunyora matanho ekugadzira pipelineinogona kudzokororwa sekushandura shanduro, uye kudzivirira zvikanganiso zvekushandisa murairo.
• Maitiro ekubvumidza kuiswa kwezvirongwa kubva pamaonero ekuchengetedza (ivo vamwe!): ndedzipi kuchengetedzwa standards dzinofanira kuenzaniswa uye kuti ungawedzera sei macheki/mageti anoenderana mu pipelines.

Kurudziro yechitatu ndeyekuti gadzirisa iyo CI/CD hurongwa hwakakodzera. Kusimbiswa kwakasimba, hapana mapassword akajairika kana marongero asina kuchengetedzeka, kodzero shoma… Chengetedza zvikanganiso zviri mumaplugins nema extensions akaiswa. Izvi zvinogona kunge zviri izvo zvinonyanya kutaurwa, ndapota rambai makatarisa.

Kurudziro yechina ndeyekuti shandisa simba re CI/CD pipelines yekuchengetedza otomatikiKuongororwa kwekodhi yekwakabva (SAST), kuongorora kuumbwa kwezvinyorwa (SCA), ma secrets ekuskena ma leaks, ma anti-malware tools, container security scanners, kana automated runtime detectors (DAST ne malware) zvinogona kuitwa nguva dzose pa pipelineUye sangano rako rinogona kusimbisa standardnezve kufukidza kwekuchengetedzwa kwekuchengetedza mu CI/CD.

Yeuka, zvishandiso izvi hazvibvisi ongororo yenyanzvi kubva muequation, zvikasadaro unogona kunge uine pfungwa yenhema yekuchengetedzeka.

Kana uchinyatsogona OWASP top-tens, chirongwa chakanaka chachangobva kuitwa ndicho OWASP Wepamusoro 10 CI/CD Chengetedzo Ngozi.

Chiziviso Chekuzviramba

(1) Mienzaniso iri muchinyorwa chino iri kushandisa GitHub se SCM, AWS semupi wegore, uye GitHub Actions kana Jenkins se CI/CD chishandiso. Hazvina kusimba / hazvina kuchengetedzeka kupfuura dzimwe nzira dzavo. Hapana chinangwa chakaipa chevatori venhau! Zvishandiso izvi zvine simba uye zvinoda kushandiswa nemazvo.

(2) M3M3N70 uye Hasha dzeMadhamu vanhu vengano. Kufanana nevanhu kana mapoka, kurarama kana kufa, kunongova kungoitikawo zvako… kana kuti ndizvozvo here?

Kuti uverenge zvimwe

• Haymore, A. nevamwe. "Nyaya gumi dzechokwadi dzekuti takabvumirana sei CI/CD pipelines ”NCC Group, Ndira 2022.
• configure-aws-credentials Chiito cheGitHub uye Kugadzirisa OpenID Connect muAmazon Web Services kuti uwane rumwe ruzivo rwekuti ungashandisa sei mirairo yeAWS yekuisa muGitHub workflows.
• Lobacevski J. "Kuchengetedza zviito zvako zveGitHub uye mashandiro ebasa zvakachengeteka Chikamu 1: Kudzivirira zvikumbiro zve pwn"GitLab Security Lab, Zvita 2020.
• Lobacevski J. "Kuchengetedza zviito zvako zveGitHub uye mashandiro ebasa zvakachengeteka Chikamu 2: Mashoko asina kuvimbika"GitLab Security Lab, Ndira 2021.
• OWASP. (or) ZVINOITA KUTI MUNHU ASHURE "OWASP Top 10" CI/CD Njodzi dzekuchengetedza””Chikunguru 2022.
• Saltzer J. naSchroeder M. "Kudzivirirwa kweRuzivo muMakombiyuta"Kubvumbi 1975. Mitemo yekuchengetedza yakashanduka netekinoroji, asi makore makumi mana nemanomwe gare gare pfungwa zhinji dzeS&S dzichiri kushanda.
• UK NCSC. "Chengetedza kuvaka nekuisa zvinhu pabasa" pipeline". UK National CyberSecurity Center, Kukadzi 2019.