Ukuhlanganiswa okuqhubekayo kunye nokunikezelwa okuqhubekayo (CI/CD) pipelines zisisiseko sayo nayiphi na intlangano yesoftware eyakha isoftware ngendlela "yanamhlanje". Ukwenziwa kwezinto ngokuzenzekelayo kunika amandla amakhulu, kodwa uninzi lwabaphuhlisi alunalo uxanduva oluhambisana nako.
umbhekisi: Ewe, siyathatha CI/CD ukhuseleko nzulu kwaye banolawulo oluqinileyo kubagcini beekhowudi, uphononongo commitngaphambi kokudibana kwemibutho; imisebenzi kunye pipelinezigcinwa ngabasebenzi abaphezulu, bayayinyamekela into yokuba zingaphumi iimfihlo pipelineKwaye esi sixhobo safakelwa ngabasebenzi abayaziyo loo nto. Yintoni enokubangela ingxaki?
Mphuhlisi othandekayo, CI/CD iinkqubo zintsonkothile. Uhlaselo lwayo olubanzi lutsale abantu ababangela inkohlakalo. Kungcono ulumke kwaye ungaze uzithembe kakhulu.
Uqwalaselo olumiselweyo ngamanye amaxesha luyagcinwa kwaye lube ngumhlobo olungileyo wabaphangi. Iziphene ezibalulekileyo zinokubakho kwi CI/CD pipeline imithombo, kuqwalaselo lwenkqubo, okanye malunga nenkqubo kunye nomxholo wenkqubo pipeline kunye nendlela eqaliswa ngayo.
Kule posi siza kuzifaka ezihlangwini zabadlali ababi. Khawuthelekelele ukuba besifunda iingcamango zika- M3M3N70 (Isikhumbuzo Mori?) kunye Umsindo weManzi ndaweni ithile kwi-dark web, mhlawumbi ngolwimi olungelulo olwaseNtshona, kodwa ungaze uphoswe kukuba ububi busasazeke kwihlabathi liphela.
Kumaxesha amandulo kwakulula kakhulu…
M3M3N70: Sibuyela kumaxesha amandulo amnandi ishishini lethu belilula kakhulu… Iintsuku ezingenanto zaziziziqhamo eziphantsi, ii-apps zazivulekile kwaye kulula ukuzisebenzisa ii-vulns, kwaye sasinokuhamba ecaleni ngephanyazo.
Umsindo weManzi: Fu#@Hell! Abanye abantu abanengqondo yomvundla phaya, kodwa izinto zitshintshile. Amadoda amakhulu athetha izinto ezingaqhelekanga ngaloo nto imbi ye-AppSec.
M3M3N70: Ewe. Kodwa izidenge ezintsha ngabaphuhlisi. Kuthi, kube lula ukusebenzisa izixhobo ezisetyenziswa ngaba bantu. I-CI, ngakumbi, yimigodi yegolide! Iithokheni zokufikelela kwilifu, SCM iziqinisekiso, amagama ayimfihlo edathabheyisi yemveliso, izitshixo zabucala ze-SSH, iziqinisekiso zabanye abasebenzisi be-CI… Ukutsiba kwizinto zophuhliso ezikruqulayo ukuya kwizinto zokwenyani bekuyinto engenamsebenzi.
Ukwenza izinto ngokuzenzekelayo xa kusakhiwa, kuvavanywa kwaye kusetyenziswa isoftware ene CI/CD Isixhobo sidla ngokufuna ukudlulisela iimfihlo kwimiyalelo ngamanyathelo. Kwaye zihlala zivuza, nto leyo enemiphumo emibi kakhulu.
PipelineSifuna iimfihlo ezithi ngamanye amaxesha zivulwe
M3M3N70: The code monkeys slipped their AWS keys in a pipeline on a GitHub commit, later they removed the thing but not changed git history. For our scripts it was trivial to scan the history, grab the key and wreak havoc.
Mhlawumbi amaxesha akudala amnandi yayikukufumana kwimbali yeGit .env ifayile (umphuhlisi ulibele ukuyongeza kuyo .gitignore):
AWS_ACCESS_KEY_ID=AKIA...AWS_SECRET_ACCESS_KEY=wJalrXUtn...AWS_REGION=us-east-1APP_FOLDER=...S3BUCKET=...
eyayisetyenziswa kumsebenzi weGitHub .github/deploy.yaml eyayinento efana nale:
jobs:
build:
name: Automated build and deployment into AWS
runs-on: ubuntu-22.04
steps:
# Load environment from .env file
- id: dotenv
uses: falti/dotenv-action@v1.0.2
- name: Configure AWS Credentials
uses:
with:
args: --acl public-read --follow-symlinks --delete
aws-access-key-id: $
aws-secret-access-key: $
aws-region: $
# ... build steps skipped ...
- name: Upload compiled code for deployment
working-directory: $/packaged_app
run: aws s3 cp my-app.zip s3://$
- name: Deploy the app
run: aws deploy create-deployment ...
M3M3N70: wow! Ezo zihluthulelo ze-aws bezisebenza! Siqale savavanya utshintsho lwe-inocuos kwi-app, saza songeza ubukhali njengoko abo bantu babebonakala bengazi. I-Bingo! Hayi indlela ebeyiphulo ngayo…
Lo mdlali ungalunganga usebenzise nje amaqhosha e-AWS ukulayisha usetyenziso oluguquliweyo olune-malware waza wasebenzisa umyalelo wokuhambisa onezo ziqinisekiso. Iimfihlo ezivuzayo, kunye nolwazi oluqulethwe kwi pipeline"Hayi indlela eli phulo elibi ngayo!" mhlawumbi lithetha ukuba iMemento yatshabalalisa ixhoba elihlwempuzekileyo.
Oko uMemento asixelela kona apha kukuba xa sele kwenzeke ukuvuza okuyimfihlo, njengezitshixo zokufikelela ze-AWS kumzekelo, kuya kufuneka urhoxise imfihlo (jikisa izitshixo ezingasentla) ngokukhawulezaKusoloko kukho ifestile yokubonakalisa phakathi kokuvuza commit kunye nokuchithwa okuyimfihlo; ukubhala kwakhona imbali yeGit kunzima (kwanelizwe elinobuzwilakhe elinzima lazama ukubhala ngokutsha imbali enjalo, kodwa alizange liphumelele) kwaye mhlawumbi alizange liphumelele (abahlobo bethu basenokuba bazenzele igama elifana neli ngaphambi kwendawo yokugcina izinto ngokuvuza okuyimfihlo. commitJikelezisa amaqhosha ngoko nangoko, uze uthandaze ngelixa ufunda iirekhodi zomsebenzi zeakhawunti ekujoliswe kuyo ngexesha lewindow yokubona!
Mhlawumbi imibutho kufuneka ukuvinjelwa kokusetyenziswa kweemfihlo zexesha elide CI/CD pipelines, kwaye uzibeke endaweni yazo ii-temporal credentials. Kumzekelo odlulileyo ngee-AWS keys kwizenzo zeGitHub, kukhuselekile ukusebenzisa i Umboneleli we-OpenID Connect (OIDC) ukufumana iziqinisekiso zexesha elifutshane ezifunekayo kwizenzo.
Umsindo weManzi: Ubunethamsanqa kakhulu! Ukuvuza kwezikripthi ezinezitshixo eziqinileyo kwakuyinto eqhelekileyo ngemihla yakudala, kwanakwiibhakethi ze-S3 ezifikelelekayo esidlangalaleni. Okwakufuneka ukwenze kukunqumla izinto ezikwibhakethi uze wenze i-grepping ukuze ufumane izinto ezinomdla.
Ngamanye amaxesha indawo esetyenziselwa ukusasazwa (ibhakethi ye-AWS S3 kulo mzekelo) yayivulelekile ukuba ifundwe ngabantu bangaphandle, ngenxa yesiphako soqwalaselo (esingabonwanga). Umsindo weManzi ukusetyenziswa bekufana noku:
aws s3 ls --recursive s3://<bucket_name>/<path>/ | \
awk '{print $4}' | \
xargs -I FNAME sh -c "echo FNAME; \
aws s3 cp s3://<bucket_name>/FNAME - | \
grep '<regex_pattern>'"
Ibhakethi mhlawumbi yenziwe kwitemplate yokubonelela enokuskenwa ngokuzenzekelayo ukuze kukhangelwe iziphene zokhuseleko.
Uqwalaselo oluzenzekelayo lwesixhobo lwaluyinto yokudlala kuthi
Ukuze sinike imizekelo ebonakalayo masithethe ngayo Jenkins, esinye sezona zixhobo ze-CI zidumileyo.
Umsindo weManzi: Uyakhumbula na loo bhokisi yokujonga ethi “Vumela uKhuseleko” eJenkins, kwaye zingaphi ii-org ezikhethe ukungayisebenzisi ngenxa yokuba lula? Kwaye ezo “Nabani na angenza nantoni na"ii-combos zemvume njenge-default?" Kwaye ezo plugins zeJenkins ezikhathazayo, njenge Iplagi ye-GitHub OAuthUmntu owayicwangcisayo ukhethe zombini "Imvume yokuFunda kubo bonke abasebenzisi abaqinisekisiweyo" kunye "neemvume zokusebenzisa indawo yokugcina iGitHub", nto leyo esinika ukufikelela kuzo zonke iiprojekthi zabo.
(Uxolo, Jenkins, ngokukubeka umzekelo 😉
Hlala unolwazi (nokuba ungumntu othanda utywala) kwimigaqo yokhuseleko. Enye yazo Khusela ngokungagqibekanga umgaqo: ulawulo kufuneka lusebenzise useto olukhuselekileyo kangangoko. Ukhuseleko kufuneka lwakhiwe CI/CD izixhobo kunye pipelines ukususela ekuqaleni, endaweni yokuba yinto ecingelwayo kamva. Kodwa ukuba lula ukuyisebenzisa kunye nokulula kwayo kudla ngokungqubana nokhuseleko.
Kwityala likaJenkins, ukuqinisekiswa okwakhelwe ngaphakathi kubuthathaka kakhulu: ungaze usebenzise iindlela zokuqinisekisa ezakhelwe ngaphakathi eJenkins. Kungcono ukhethe indlela yomntu wesithathu (i-SAML, i-LDAP, i-Google ...), ene-plugin ye-Role-based Authorization Strategy (“RBAC”). Kwaye lumka kakhulu nge admin akhawunti.
Lumka ngendlela osebenza ngayo kwaye pipeline iifayile eJenkins ziyaphathwa. Kunjalo nangale Iplagi yoqwalaselo njengeKhowudi kunye neefayile zayo zoqwalaselo, ezisebenza kuqwalaselo lweJenkins.
Ukusuka ekubeni yindlu ozibambela yodwa CI/CD iinkqubo ukuya kwezo ze-SaaS ezisekwe kwilifu zisusa ezinye iingozi ezinokubakho ezivumela intshukumo ecaleni kwinethiwekhi yentlangano, kodwa zongeza ezinye, njengokuvula unxibelelwano lwangaphandle phakathi kweenkqubo zangaphakathi ezikhoyo kunye ne-externalized CI/CD isixhobo.
Imibutho kufuneka isebenzisecisunonophelo olufanelekileyo ekuqiniseni CI/CD inkqubo, iqala ngeyona mimiselo ingqongqo ize ivuleke kancinci kancinci ngeemvume ezincinci ezifunekayo ze pipeline amanyathelo.
Ukumisela ukhuseleko kwi CI/CD Izixhobo zinokuba nzima kakhulu. Uninzi lwazo lunee-plugins okanye izandiso ezinezona ngxaki zininzi kwaye kufuneka zihlaziywe.
Izikena zoqwalaselo olungalunganga lokhuseleko lwezixhobo ezintsonkothileyo, okanye iindlela zokulinganisa zinokunceda.
Ukufaka ikhowudi kwi pipeline imiyalelo yokonwaba nenzuzo
M3M3N70: Ngaba wakha wasebenzisa ii-Untrusted Code Checkouts, ezo zenzo kunye nezikripthi ezisengozini yokufakwa komyalelo?
Eli candelo libonisa ukuba pipeline ngokwayo inokuba neempazamo zokubhala ikhowudi ezivumela abenzi bobubi ukuba bafake ukuphunyezwa kwekhowudi ngokungacwangciswanga kwi pipeline ngaphandle kokutshintsha pipeline umthombo ngokwawoUmzekelo, usebenzisa i-PR
Umzekelo wokuqala we Ukuhamba komsebenzi kweGitHub okungathandekiyo:
# INSECURE. Provided as an example only.
on:
pull_request_target #1
jobs:
build:
name: Build and test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
with:
ref: $ #2
- uses: actions/setup-node@v1
- run: |
npm install #3
npm build
# ... more steps ...
Ukudibanisa pull_request_target Isiqalo somsebenzi ngokuhlola ngokucacileyo i-PR engathembekanga sisenzo esiyingozi esinokukhokelela kwingxaki yokugcina idatha. Kumzekelo, indibaniselwano engathandekiyo ye:
pull_request_targetumcimbi, onokuthi ngokungagqibekanga ube nemvume yokubhala kwindawo yokugcina ekujoliswe kuyo kunye neemfihlo zendawo yokugcina ekujoliswe kuyo, nokuba zivela kwiifolokhwe zangaphandle, kwaye usebenza kumxholo wendawo yokugcina ekujoliswe kuyo ye-PR,- jonga ikhowudi ye-PR kumthombo, i-repo engathembekanga,
- qalisa nayiphi na iskripthi esinokusebenza kumxholo olawulwa yi-PR, njengakwimeko ye
npm install, yaye - ukungasebenzisi imeko ekuqaliseni
pull_request_targetUmcimbi uza kusebenza kuphela ukuba uhlobo oluthile lweleyibhile ethi 'le PR ihlolwe' lunikwe i-PR (abasebenzisi bangaphandle abanakunika iileyibhile kwi-PR).
Umzekelo wesibini uthatha igalelo elingathembekanga (kwingxaki, izimvo okanye pull request) njengomthombo weengxoxo ezidluliselwe kwi pipeline umyalelo ngokusebenzisa ii-expressions. Le yi pipeline inguqulelo yobuthathaka bokufakwa komyalelo we-OS.
- name: Check title
run: |
title="$"
if [[ ! $title =~ ^.*:\ .*$ ]]; then
echo "Bad issue title"
exit 1
fi
Umsebenzi wokubaleka uvelisa iskripthi seshelufu sexeshana esisekwe kwitemplate, kunye $ endaweni yayo, nto leyo eyenza ukuba ibe sesichengeni sokufakwa komyalelo wegobolondo. Umhlaseli oneakhawunti yeGitHub yobuxoki unokubangela ingxaki ngesihloko a"; bad_code_goes_here;#, kwaye qhuma!
Umsindo weManzi: Owu, abo bantu babevula ucango lokufakwa komyalelo ngokuvula nje ingxaki…
Bekukho ubuthathaka bokuphunyezwa kwekhowudi kwizenzo zeGitHub, ezifana izimvo ze-gajira, ngoku ilungisiwe. Nceda ufunde "Igalelo elingathembekanga kwimisebenzi yokusebenza yeGitHub" iinkcukacha ezipheleleyo.
Ukuziphatha kwebali: Ungaze ujonge kwaye wakhe ii-PR kwimithombo engathembekanga ngaphandle kokuphonononga kuqala i-PR. 'Ukungathembeki' apha, ngaphandle kokuba kungqinisiswe ngokugqithisileyo ukuba imvelaphi iyasebenza, kunokuthetha nayiphi na iakhawunti yomphuhlisi enokuthi ithathwe.
Ukusasazwa kwe-malware okungafunekiyo apha!
Ukusasazwa okuqhubekayo yincopho yokuzenzekela, kodwa loo ncopho inokuphazanyiswa kukungabikho kolawulo olufanelekileyo lokuvunywa kwi pipeline ukuhamba.
Iingozi zokusasazwa ngokuzenzekelayo ngokupheleleyo ukusuka kumthombo commit kwiinkqubo zemveliso ziquka ukuba ikhowudi enobungozi ingasetyenziswa kwiindawo zemveliso ngaphandle kokuba ifunyanwe, kunye nokuba kukho iimpazamo kwinkqubo yokusetyenziswa ezinokubangela ukuphazamiseka okanye ukungasebenzi.
Ukuze kuncitshiswe le mingcipheko, kudla ngokucetyiswa ukuba imibutho isebenzise “indlela enzima” kwinkqubo yayo yokusasaza, nto leyo efuna imvume yomntu ngaphambi kokuba zikhutshwe kwiindawo ezikude.
Bayavala iingcango
Umsindo weManzi: Ezo phasiwedi ezizenzekelayo ezivuyisayo kwi CI/CD Izixhobo ziyacinywa. Ukufikelela kwi
/var/lib/jenkins/secrets/initialAdminPasswordngoku ayisekho. Izixhobo ezininzi ngoku zibonelela nge-2FA, eyathi iCovid yenza ukuba ithandwe, kwaye neyona nkawu ivilaphayo iyisebenzisa!M3M3N70: Silwa ne-2FA, kodwa akulula kangako. Kunzima ukubabulala abo bantu, njengoko "I-Scatter Swine" yenze noTwilio. Ngezitshixo zeWebAuthn kunzima kakhulu. Ubuncinane, singazama ukwenza njalo yeba iikuki ukuze udlule i-MFA, kodwa kufuneka ndingene kwibhokisi yomphuhlisi.
Ukuqinisekiswa kweMulti-Factor linyathelo elihle kwicala elifanelekileyo lokunciphisa umngcipheko wokuvuza kweemfihlo zokuqinisekiswa. Uninzi lwezixhobo zeDevOps zanamhlanje zixhasa i-MFA. Kwaye izitshixo zokuqinisekiswa phantsi kweWebAuthn / U2F (jonga Iprojekthi ye-FIDO2) mhlawumbi zezona ndlela zilungileyo ze-MFA kwi-DevOps, ukuba zilawulwa kakuhle.
Umsindo weManzi: Amadoda eDevOps ayavuka. Anento "encinci kakhulu" egazini lawo. Kwaye ayisezizo ii-code monkeys. Ngoku sibanjwa sibanjwe ngabahlaziyi.
Inyaniso, pipelineIi-s ngoku ziqinile ngakumbi kunakwiminyaka embalwa eyadlulayo, zisusiwe izenzo ezibuthathaka kunye nezikripthi, kwaye kukho amanyathelo ongezelelweyo ovavanyo lokhuseleko ade afumanisa iidropper zethu zifihliwe kwindawo efihlakeleyo. commitiipakethi kunye neepakeji esizithimbileyo.
Umbuzo kumfundi: ngaba inkqubo yokwakha isoftware evela kwimithombo kunye nokusasaza kwimveliso yishishini elinobungozi? Ngaba ungazibona iiDevOps zakho kwinqanaba le amaxesha amnandi kubantu ababi?
Iingcebiso zokugqibela
Apho ungaqala khona CI/CD pipelines?
Ingcebiso yokuqala ilula apha: Ngononophelo kwakhona pipelines (bazi luleke izixhobo) kwimiba yokhuseleko. Uhlolo luyabiza kodwa luyimfuneko, kwaye kufuneka lwenziwe ngokufanelekileyo. Abahloli kufuneka bazi ukuba bajonge ntoni. Inyathelo ngalinye kufuneka lihlolwe ukuba alinaziphene.
Mhlawumbi indibaniselwano yabahloli abaziingcali abaxhobe ngee-automated money code scanners inokunceda.
Ingcebiso yesibini kukuba qeqesha abaphuhlisi ababhalayo pipelinekwaye uzigcine zikwimeko yokhuselekoIzinto ekufuneka ziqwalaselwe:
- Indlela yokusingatha ngokufanelekileyo ukuqinisekiswa ngeenkonzo zangaphakathi nezelifu, ukunqanda ingxaki yokuphatha iziqinisekiso zexesha elide.
- Indlela yokunciphisa pipelines ukuya kwiseti echanekileyo yezixhobo ekufuneka zifikelelwe. Umgaqo welungelo elincinci ukhanya kwakhona.
- Indlela yokubhala amanyathelo okwenza pipelines ziyaphinda zivele njengokufaka i-version pinning, kwaye ziphephe ubuthathaka bokufaka umyalelo.
- Indlela yokuvuma ukuthunyelwa ngokwembono yokhuseleko (ngabanye!): loluphi ukhuseleko standardii-s kufuneka zihambelane kwaye ungazidibanisa njani iitshekhi/amasango ahambelanayo kwi pipelines.
Ingcebiso yesithathu kukuba qwalasela i CI/CD inkqubo ngononophelo olufanelekileyo. Uqinisekiso oluqinileyo, akukho magama agqithisiweyo amiselweyo okanye useto olungakhuselekanga, amalungelo amancinci... Lumkela ubuthathaka kwii-plugins kunye nezandiso ezifakiweyo. Oku kungaba yeyona nto iphambili kwizithuba ezilandelayo, nceda uhlale ubukele.
Ingcebiso yesine kukuba sebenzisa i CI/CD pipelines yokhuseleko oluzenzekelayoUhlalutyo lwekhowudi yomthombo (SAST), uhlalutyo lokwakheka komthombo (SCA), iimfihlo zokuskena ukuvuza, izixhobo zokulwa ne-malware, izikena zokhuseleko lwesikhongozeli, okanye izixhobo zokubona ixesha lokusebenza ezenzekelayo (i-DAST kunye ne-malware) zinokusetyenziswa rhoqo kwi pipelineKwaye umbutho wakho unganyanzelisa standardmalunga nokugubungela ukuskena ukhuseleko kwi CI/CD.
Khumbula, ezi zixhobo azisusi uphononongo lweengcali kule ngxaki, kungenjalo unokuba nemvakalelo yokhuseleko olungeyonyani.
Ukuba uqhelene ne-OWASP top-tens, iprojekthi entle yakutshanje yile OWASP Top 10 CI/CD Umngcipheko woKhuseleko.
Inqaku Lokuzihlangula
(1) Imizekelo ekweli posi isebenzisa iGitHub njenge SCM, i-AWS njengomboneleli welifu, kunye ne-GitHub Actions okanye i-Jenkins njenge CI/CD isixhobo. Azikho buthathaka/azikhuselekanga kunezinye iindlela zabo. Akukho njongo imbi yokushicilela! Ezi zixhobo zinamandla kwaye kufuneka zisetyenziswe ngokufanelekileyo.
(2) M3M3N70 kwaye Umsindo weManzi ngabalinganiswa abangeyonyani. Nakuphi na ukufana nabantu okanye amaqela, ukuphila okanye ukufa, kuyenzeka ngengozi nje... okanye akunjalo?
Ukufunda ngakumbi
- UHaymore, A. nabanye. "Amabali ali-10 okwenyani endlela esiye sazibophelela ngayo CI/CD pipelines ”Iqela le-NCC, ngoJanuwari 2022.
configure-aws-credentialsIsenzo seGitHub kwaye Ukulungiselela i-OpenID Connect kwiiNkonzo zeWebhu zeAmazon ngeenkcukacha zendlela yokusebenzisa imiyalelo ye-AWS yokusetyenziswa kwimisebenzi yokusebenza yeGitHub.- ULobacevski J. "Ukugcina iintshukumo zakho zeGitHub kunye nemisebenzi yokusebenza ikhuselekile Icandelo 1: Ukuthintela izicelo ze-pwn". Ilebhu yoKhuseleko yeGitLab, ngoDisemba 2020.
- ULobacevski J. "Ukugcina ii-GitHub Actions kunye ne-workflows zakho zikhuselekile Icandelo lesi-2: Igalelo elingathembekanga". Ilebhu yoKhuseleko yeGitLab, ngoJanuwari 2021.
- I-OWASP. "Ii-OWASP ezili-10 eziphezulu CI/CD Iingozi zoKhuseleko”Julayi 2022.
- USaltzer J. kunye noSchroeder M. "Ukukhuselwa kolwazi kwiinkqubo zekhompyutha"Ngo-Epreli 1975. Imigaqo yokhuseleko yavela ngetekhnoloji, kodwa emva kweminyaka engama-47 uninzi lweengcinga ze-S&S zisasebenza.
- I-NCSC yase-UK. "Khusela ukwakhiwa nokusasazwa pipeline". IZiko leSizwe lezoKhuseleko lwe-Intanethi lase-UK, ngoFebruwari 2019.
