Yini engase ihambe kabi ngayo CI/CD pipelines?

Ukuhlanganiswa okuqhubekayo kanye nokulethwa okuqhubekayo (CI/CD) pipelineAma-s ayisisekelo sanoma iyiphi inhlangano yesofthiwe eyakha isofthiwe ngendlela "yesimanje". Ukuzenzakalela kunikeza amandla amakhulu, kodwa iningi labathuthukisi liyaphuthelwa umthwalo wemfanelo ohambisana nakho.

Unjiniyela: Yebo, sithatha CI/CD nokuvikeleka ngokungathi sína futhi nginokulawula okuqinile kubanakekeli bekhodi, isibuyekezo commitngaphambi kokuhlanganiswa; imisebenzi kanye pipelinezigcinwa ngabasebenzi abaphezulu, ziyanakekela ukuthi zingaphumi izimfihlo ku- pipelineFuthi ithuluzi lafakwa ngabasebenzi abaziyo le nto. Yini engase ihambe kabi?

Sawubona mthuthukisi, CI/CD izinhlelo ziyinkimbinkimbi. Uhlaselo lwayo olubanzi luhehe abantu abahlaselayo. Kungcono uqaphele futhi ungalokothi uzethembe ngokweqile.

Ukucushwa okuzenzakalelayo ngezinye izikhathi kugcinwa futhi kube umngane omkhulu wabaduni. Amaphutha abucayi angaba khona ku CI/CD pipeline imithombo, ekucushweni kohlelo, noma eduze kwenqubo kanye nomongo we pipeline nokuthi kubangelwa kanjani.

Kulesi sihloko sizozifaka ezicathulweni zabadlali ababi. Ake sithi besifunda imicabango ka- I-M3M3N70 (Isikhumbuzo Mori?) kanye Ulaka Lwexhaphozi endaweni ethile ebumnyameni obumnyama, mhlawumbe ngolimi olungesilo olwasentshonalanga, kodwa ungalokothi uphuthelwe ukuthi ububi busakazeke emhlabeni wonke.

 

Ezikhathini zakudala kwakulula kakhulu…

I-M3M3N70: Sibuyela ezikhathini ezinhle zakudala ibhizinisi lethu belilula kakhulu… Izinsuku ezingenalutho zaziyizithelo eziphansi, izinhlelo zokusebenza zazivulekile kakhulu futhi kulula ukuzisebenzisa, futhi sasikwazi ukuhamba ngokuphazima kweso.

Ulaka Lwexhaphozi: Fu#@Hell! Abanye banengqondo efana neyemvundla laphaya, kodwa izinto zashintsha. Amadoda amakhulu afaka inkohliso enkulu kulolo daba lwe-AppSec.

I-M3M3N70: Yebo. Kodwa iziwula ezintsha yizo ezithuthukisayo. Kithina, kube lula ukusebenzisa amathuluzi asetshenziswa yilaba bantu. I-CI, ikakhulukazi, iyimayini yegolide! Amathokheni okufinyelela amafu, SCM iziqinisekiso, amaphasiwedi esizindalwazi sokukhiqiza, okhiye abayimfihlo be-SSH, iziqinisekiso zabanye abasebenzisi be-CI… Ukusuka ezintweni zokuthuthukisa eziyisicefe uye kwezangempela kwakuyinto encane kakhulu.

Ukwenza ngokuzenzakalelayo ukwakha, ukuhlola nokufaka isofthiwe nge CI/CD ithuluzi livame ukudinga ukudlulisela izimfihlo emiyalweni ngezinyathelo. Futhi ngokuvamile ziyavuza, kube nemiphumela emibi kakhulu.

Pipelinesidinga izimfihlo ezivame ukuvuza

M3M3N70: The code monkeys slipped their AWS keys in a pipeline on a GitHub commit, later they removed the thing but not changed git history. For our scripts it was trivial to scan the history, grab the key and wreak havoc.

Mhlawumbe izikhathi ezinhle zakudala kwakuwukuthola emlandweni we-Git .env ifayela (unjiniyela ukhohliwe ukulifaka ku .gitignore):

AWS_ACCESS_KEY_ID=AKIA...
AWS_SECRET_ACCESS_KEY=wJalrXUtn...
AWS_REGION=us-east-1
APP_FOLDER=...
S3BUCKET=...

eyayisetshenziswa ku-workflow ye-GitHub .github/deploy.yaml okwakuqukethe into efana nale:

jobs:
  build:
    name: Automated build and deployment into AWS
    runs-on: 	ubuntu-22.04
    steps:
      # Load environment from .env file
      - id: dotenv
        uses: falti/dotenv-action@v1.0.2
        
      - name: Configure AWS Credentials
        uses:
        with:
          args: --acl public-read --follow-symlinks --delete 
          aws-access-key-id: $
          aws-secret-access-key: $
          aws-region: $
      
      # ... build steps skipped ...
      
      -  name: Upload compiled code for deployment
         working-directory: $/packaged_app
         run: aws s3 cp my-app.zip s3://$ 
         
      - name: Deploy the app
        run: aws deploy create-deployment ...

M3M3N70: wow! Lezo zikhiye ze-aws bezisebenza! Siqale sahlola ushintsho lwe-inocuos kuhlelo lokusebenza, sabe sesengeza usizi njengoba labo bantu babebonakala bengazi. I-Bingo! Yeka umkhankaso…

Umdlali omubi usebenzise nje okhiye be-AWS ukulayisha uhlelo lokusebenza oluguquliwe olune-malware wabe esesebenzisa umyalo wokuthumela oneziqinisekiso ezinjalo. Izimfihlo eziputshukile, kanye nolwazi oluqukethwe ku- pipeline"Yeka umkhankaso!" mhlawumbe kusho ukuthi iMemento yalimaza isisulu esimpofu.

Lokho i-Memento esitshela khona lapha ukuthi uma sekuvele ukuvuza okuyimfihlo, njengezihluthulelo zokufinyelela ze-AWS esibonelweni, kufanele uhoxise imfihlo (jikelezisa izihluthulelo ezingenhla) ngokusheshaKuhlala kukhona ifasitela lokudalulwa phakathi kokuvuza commit kanye nokuchithwa okuyimfihlo; ukubhala kabusha umlando we-Git kunzima (ngisho nombuso oqinile wobushiqela wazama ukubhala kabusha umlando onjalo, kodwa kwanhlanga zimuka nomoya) futhi mhlawumbe awuzange uphumelele (abangane bethu kungenzeka ukuthi bakopishe ngaphambi kwendawo yokugcina ngokuvuza okuyimfihlo. commit). Jikelezisa okhiye ngokushesha, bese uthandaza ngenkathi ufunda izingodo zomsebenzi ze-akhawunti eqondiwe ngesikhathi sokubona!

Mhlawumbe izinhlangano kufanele vimbela ukusebenzisa izimfihlo zesikhathi eside ku CI/CD pipelines, bese uzishintsha ngeziqinisekiso zesikhashana. Esibonelweni sangaphambilini ngezihluthulelo ze-AWS ezenzweni ze-GitHub, kuphephile ukusebenzisa i- Umhlinzeki we-OpenID Connect (OIDC) ukuthola iziqinisekiso zesikhashana ezidingekayo ukuze kwenziwe izenzo.

Ulaka Lwexhaphozi: Ube nenhlanhla enkulu! Ukuvuza kwezikripthi ezinezihluthulelo eziqinile kwakuyinto evamile ezinsukwini zakudala, ngisho nasemabhakedeni e-S3 afinyeleleka emphakathini. Okudingeka ukwenze nje ukuzulazula ezintweni ezisebhakedeni bese wenza ukugoba ukuze uthole izinto ezithakazelisayo.

Ngezinye izikhathi indawo esetshenziselwa ukuthunyelwa (ibhakede le-AWS S3 kulesi sibonelo) yayivulekele ukufundwa ngabantu bangaphandle, ngenxa yephutha lokucushwa (elingazange libonwe). Ulaka Lwexhaphozi ukusetshenziswa kwakufana nalokhu:

aws s3 ls --recursive s3://<bucket_name>/<path>/ | \
awk '{print $4}' | \
xargs -I FNAME sh -c "echo FNAME; \
  aws s3 cp s3://<bucket_name>/FNAME - | \
  grep '<regex_pattern>'"

Ibhakede cishe lakhiwe kuthempulethi yokulungiselela engaskenwa ngokuzenzakalelayo ukuze kutholakale amaphutha okuphepha.

Ukucushwa okuzenzakalelayo kwethuluzi kwakuyithoyizi kithi

Ukuze sinikeze izibonelo eziqondile ake sixoxe ngazo Jenkins, elinye lamathuluzi e-CI athandwa kakhulu.

Ulaka Lwexhaphozi: Uyakhumbula ibhokisi lokuhlola elithi “Vumela Ukuphepha” eJenkins, nokuthi zingaki izinhlangano ezikhethe ukungalisebenzisi ukuze kube lula? Nalezo “Noma ubani angenza noma yini"i-combos yemvume njengokuzenzakalelayo? Futhi lawo ma-plugin e-Jenkins akhathazayo, njenge-" I-plugin ye-GitHub OAuthUmuntu owayihlela wakhetha kokubili okuthi “Nikeza izimvume ze-READ kubo bonke abasebenzisi abaqinisekisiwe” kanye nokuthi “Sebenzisa izimvume zokugcina ze-GitHub”, okusinika ukufinyelela kuwo wonke amaphrojekthi abo.

(Ngiyaxolisa, Jenkins, ngokukubeka njengesibonelo 😉

Hlala unolwazi (ngisho nomlutha) ngezimiso zokuphepha. Enye yazo Vikela ngokuzenzakalelayo isimiso: izilawuli kufanele zibekwe ngokuzenzakalelayo kuzilungiselelo eziphephile kakhulu ngangokunokwenzeka. Ukuphepha kufanele kwakhiwe CI/CD amathuluzi kanye pipelinekusukela phansi kuya phezulu, kunokuba kube yinto ecatshangelwa kamuva. Kodwa ubungane nokulula kokusebenzisa kuvame ukungqubuzana nokuphepha.

Ngecala likaJenkins, ukuqinisekiswa okwakhelwe ngaphakathi kubuthakathaka kakhulu: ungalokothi usebenzise izindlela zokuqinisekisa ezakhelwe ngaphakathi eJenkins. Kungcono ukhethe indlela evela eceleni (i-SAML, i-LDAP, i-Google …), ene-plugin ye-Role-based Authorization Strategy (“RBAC”). Futhi qaphela kakhulu nge admin i-akhawunti.

Qaphela ukuthi umsebenzi kanye pipeline amafayela aseJenkins ayaphathwa. Okufanayo nalokhu I-plugin yokucushwa njengekhodi kanye namafayela ayo okucushwa, asebenza ekucushweni kweJenkins.

Ukusuka ekuziphatheni ngokwakho CI/CD izinhlelo ze-SaaS ezisekelwe efwini zisusa ezinye izingozi ezingaba khona ezivumela ukunyakaza okuseceleni ngaphakathi kwenethiwekhi yenhlangano, kodwa zengeze ezinye, njengokudinga ukuvula ukuxhumana kwangaphandle phakathi kwezinhlelo zangaphakathi ezikhona kanye nezinhlelo zangaphandle. CI/CD ithuluzi.

Izinhlangano kufanele zisebenzisecisukunakekelwa okufanele ekuqiniseni CI/CD uhlelo, luqala ngezilungiselelo ezikhawulelwe kakhulu bese luvula kancane kancane ngezimvume ezincane ezidingekayo ze pipeline izinyathelo.

Ukulungiselela ukuphepha ku- CI/CD Amathuluzi angaba nzima kakhulu. Amaningi anama-plugin noma izandiso ezinobungozi obukhulu futhi adinga ukubuyekezwa.

Izikena zokuhlela kabi ukuphepha zamathuluzi anjalo ayinkimbinkimbi, noma izilinganiso zingasiza.

Ikhodi yokufaka ku pipeline imiyalo yokuzijabulisa nenzuzo

I-M3M3N70Wake wasebenzisa ama-Untrusted Code Checkouts, lapho izenzo nezikripthi ezisengozini yokufakwa komyalo?

Lesi sigaba sibonisa ukuthi pipeline ngokwayo ingaba namaphutha okubhala ikhodi avumela abenzi ababi ukufaka ukwenziwa kwekhodi ngokungahleliwe ku pipeline ngaphandle kokushintsha pipeline umthombo uqoboIsibonelo, ukusebenzisa i-PR

Isibonelo sokuqala se- ukuhamba komsebenzi kwe-GitHub okungekuhle:

# INSECURE. Provided as an example only.
on:
  pull_request_target #1

jobs:
  build:
    name: Build and test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
        with:
          ref: $ #2

      - uses: actions/setup-node@v1
      - run: |
          npm install #3
          npm build
      # ... more steps ...

Ukuhlanganisa pull_request_target Isiqalisi somsebenzi ngokuhlola okucacile kwe-PR engathembekile kuwumkhuba oyingozi ongaholela ekwehlisweni kwesitoreji. Esibonelweni, inhlanganisela engeyinhle yalokhu:

• pull_request_target umcimbi, ozenzakalelayo onemvume yokubhala endaweni yokugcina okuqondiwe kanye nezimfihlo zendawo yokugcina okuqondiwe, ngisho nasezimfolweni zangaphandle, futhi usebenza kumongo wendawo yokugcina okuqondiwe ye-PR,
• hlola ikhodi ye-PR emthonjeni, i-repo engathembekile,
• qala noma yisiphi iskripthi esingasebenza kokuqukethwe okulawulwa yi-PR, njengasesimweni se- npm install, Futhi
• ukungasebenzisi isimo ekuqaliseni pull_request_target umcimbi uzosebenza kuphela uma uhlobo oluthile lwelebula 'le-PR ihlolwe' lunikezwe i-PR (abasebenzisi bangaphandle abakwazi ukunikeza amalebula ku-PR).

Isibonelo sesibili sithatha okokufaka okungathembekile (kusuka enkingeni, kumazwana noma pull request) njengomthombo wezimpikiswano ezidluliselwe ku- pipeline umyalo ngezinkulumo. Lona pipeline inguqulo yobuthakathaka bokufakwa komyalo we-OS.

- name: Check title
  run: |
    title="$"
    if [[ ! $title =~ ^.*:\ .*$ ]]; then
      echo "Bad issue title"
      exit 1
    fi

Umsebenzi wokuqalisa ukhiqiza iskripthi sesikhashana segobolondo esisekelwe kuthempulethi, nge $ esikhundleni salokho, okwenza kube sengozini yokufakwa komyalo wegobolondo. Umhlaseli one-akhawunti ye-GitHub mbumbulu angadala inkinga ngesihloko a"; bad_code_goes_here;#, futhi qhuma! 

Ulaka Lwexhaphozi: O, labo bantu babevula umnyango wokufakwa komyalo ngokuvula nje inkinga…

Kube nobuthakathaka bokusebenzisa ikhodi ezenzweni ze-GitHub, njengokuthi ukuphawula kwe-gajira, manje sekulungisiwe. Sicela ufunde "Okufakwayo okungathembekile emisebenzini yokusebenza yeGitHub" ukuze uthole imininingwane egcwele.

Ukuziphatha kwendaba: Ungalokothi ukhokhe futhi wakhe ama-PR emithonjeni engathembekile ngaphandle kokubukeza i-PR kuqala. 'Ukungathembeki' lapha, ngaphandle kokuthi ngaphansi kokuqinisekiswa okunonya kwemvelaphi, kungasho noma iyiphi i-akhawunti yonjiniyela engase ithathwe kabi.

 

Ukufakwa kwe-malware okungahlosiwe lapha!

Ukuthunyelwa okuqhubekayo umvuthwandaba wokuzenzakalelayo, kodwa lowo mvuthwandaba ungaphazanyiswa ukuntuleka kwezilawuli zokugunyazwa ezifanele ku- pipeline ukugeleza.

Izingozi zokuthunyelwa okuzenzakalelayo ngokuphelele kusuka emthonjeni commit Izinhlelo zokukhiqiza zifaka phakathi amandla okuthi ikhodi enonya isetshenziswe ezindaweni zokukhiqiza ngaphandle kokutholakala, kanye namathuba amaphutha enkambisweni yokuthunyelwa angabangela ukuphazamiseka noma ukungasebenzi.

Ukuze kuncishiswe lezi zingozi, kuvame ukunconywa ukuthi izinhlangano zisebenzise “isinyathelo esinzima” enqubweni yazo yokusabalalisa, okudinga imvume yomuntu ngaphambi kokuba ukukhishwa kuthunyelwe ezindaweni zokugcina.

Bavala iminyango

Ulaka Lwexhaphozi: Lawo maphasiwedi azenzakalelayo ajabulisayo ku CI/CD amathuluzi ayasulwa. Ukufinyelela ku- /var/lib/jenkins/secrets/initialAdminPassword manje sekuyindlela efile. Amathuluzi amaningi manje ahlinzeka nge-2FA, eyenze yathandwa yi-Covid, futhi ngisho nenkawu yekhodi evilapha kakhulu lapho iyayisebenzisa!

I-M3M3N70: Silwa ne-2FA, kodwa akulula kangako. Kunzima ukubabulala labo bantu, njengoba "I-Scatter Swine" yenze noTwilio. Ngokhiye beWebAuthn kunzima kakhulu. Okungenani, singazama ukweba amakhukhi ukuze udlule i-MFA, kodwa kudingeka ngingene ebhokisini lonjiniyela.

Ukuqinisekiswa Kwezici Eziningi kuyisinyathelo esihle endleleni efanele yokunciphisa ingozi yokuvuza kwezimfihlo zokuqinisekisa. Iningi lamathuluzi e-DevOps anamuhla asekela i-MFA. Futhi okhiye bokuqinisekisa ngaphansi kwe-WebAuthn / U2F (bheka Iphrojekthi ye-FIDO2) mhlawumbe kuyindlela engcono kakhulu ye-MFA ku-DevOps, uma iphathwa kahle.

Ulaka Lwexhaphozi: Amadoda e-DevOps ayavuka. Anento "engenalo ilungelo" egazini lawo. Futhi awasenawo amakhodi. Manje sesibanjwa ngesandla esiqinile ngababuyekezi.

Empeleni, pipelineAma-s manje aseqinile kancane kunaseminyakeni embalwa edlule, ngezenzo ezibuthakathaka kanye nezikripthi ezisusiwe, kanye nezinyathelo ezengeziwe zokuhlola ukuphepha ezithole ngisho nama-dropper ethu afihliwe ekusithekeni. commitamaphakheji kanye namaphakeji esiwadunile.

Umbuzo kumfundi: ingabe inqubo yokwakha isofthiwe evela emithonjeni kanye nokusetshenziswa ekukhiqizeni ibhizinisi eliyingozi? Ungabona ama-DevOps akho esigabeni se izikhathi ezinhle ngenxa yabantu ababi?

Izincomo Zokugcina

Ungaqala kuphi CI/CD pipelines?

Isincomo sokuqala silula lapha: Ngokucophelela ukubuyekeza pipelines (kunjalo okubalulekile izinsizakusebenza) zezinkinga zokuphepha. Ukubuyekezwa kuyabiza kodwa kuyadingeka, futhi kufanele kwenziwe ngendlela efanele. Ababuyekezi kufanele bazi ukuthi yini okufanele bayibheke. Isinyathelo ngasinye kumele sihlolwe amaphutha.

Mhlawumbe inhlanganisela yababuyekezi abangochwepheshe abahlome ngezikena zekhodi ezinonya ezizenzakalelayo ingasiza.

Isincomo sesibili ukuthi qeqesha abathuthukisi ababhalayo pipelinefuthi uzigcine ziphephileIzinto okufanele uzicabangele:

• Indlela yokusingatha kahle ubuqiniso ngezinsizakalo zangaphakathi nezefu, ugweme inkathazo yokuphatha iziqinisekiso zesikhathi eside.
• Indlela yokukhawulela pipelines kusethi eqondile yezinsizakusebenza edinga ukufinyelela kuzo. Isimiso samalungelo amancane siyakhanya futhi.
• Indlela yokubhala izinyathelo zokwenza pipelines ingaphinde ikhiqizwe njengokuphina inguqulo, nokugwema ubuthakathaka bokufaka umyalo.
• Indlela yokuvuma ukusetshenziswa ngokombono wokuphepha (yibo abanye!): yikuphi ukuphepha standardama-s kufanele afaniswe nokuthi ungawafaka kanjani amasheke/amasango ahambisanayo ku- pipelines.

Isincomo sesithathu ukuthi lungiselela i- CI/CD uhlelo ngokunakekelwa okufanele. Ukuqinisekiswa okuqinile, awekho amaphasiwedi azenzakalelayo noma izilungiselelo ezingaphephile, amalungelo amancane... Nakekela ubuthakathaka kuma-plugins nezandiso ezifakiwe. Lokhu kungaba yinto ebalulekile kokuthunyelwe okulandelayo, sicela uhlale ubukele.

Isincomo sesine ukuthi sebenzisa i CI/CD pipelines ukuze kusebenze ngokuzenzakalelayo kokuphephaUkuhlaziywa kwekhodi yomthombo (SAST), ukuhlaziywa kokwakheka komthombo (SCA), izimfihlo zokuskena ukuvuza, amathuluzi okulwa ne-malware, izikena zokuphepha kwesitsha, noma izitholi zesikhathi sokusebenza ezenzakalelayo (i-DAST kanye ne-malware) zingasetshenziswa njalo ku- pipelineFuthi inhlangano yakho ingase iphoqelele standardmayelana nokumbozwa kokuskena kokuphepha ku CI/CD.

Khumbula, la mathuluzi awasusi ukubuyekezwa kochwepheshe kulesi sibalo, ngaphandle kwalokho ungaba nomuzwa wokulondeka ongamanga.

Uma ujwayele i-OWASP top-tens, iphrojekthi enhle yakamuva yi- I-OWASP ephezulu engu-10 CI/CD Ubungozi bokuphepha.

Inothi Lokuzihlangula

(1) Izibonelo ezikulesi sihloko zisebenzisa i-GitHub njenge SCM, i-AWS njengomhlinzeki wamafu, kanye ne-GitHub Actions noma i-Jenkins njenge CI/CD ithuluzi. Azibuthakathaka / aziphephile kunezinye izindlela zazo. Akukho nhloso embi yabezindaba! Lawa mathuluzi anamandla futhi adinga ukusetshenziswa ngendlela efanele.

(2) I-M3M3N70 futhi Ulaka Lwexhaphozi bangabalingiswa abaqanjiwe. Noma yikuphi ukufana nabantu noma amaqembu, abaphilayo noma abafayo, kumane nje kuyenzeka ngengozi… noma akunjalo?

Ukuze ufunde okwengeziwe

• UHaymore, A. nabanye. "Izindaba eziyi-10 zangempela zendlela esiye sazivumelanisa ngayo CI/CD pipelines ”Iqembu le-NCC, uJanuwari 2022.
• configure-aws-credentials Isenzo se-GitHub futhi Ilungiselela i-OpenID Connect ku-Amazon Web Services ukuthola imininingwane yokuthi ungayisebenzisa kanjani imiyalo ye-AWS yokusetshenziswa emisebenzini ye-GitHub.
• ULobacevski J. "Ukugcina Izenzo zakho ze-GitHub kanye nemisebenzi yokusebenza iphephile Ingxenye 1: Ukuvimbela izicelo ze-pwn". Ilebhu Yokuphepha ye-GitLab, Disemba 2020.
• ULobacevski J. "Ukugcina Izenzo zakho ze-GitHub kanye nemisebenzi yokusebenza iphephile Ingxenye 2: Okokufaka okungathembekile". Ilebhu Yokuphepha ye-GitLab, Jan 2021.
• I-OWASP. "I-OWASP Top 10 CI/CD Izingozi Zokuphepha”Julayi 2022.
• USaltzer J. noSchroeder M. "Ukuvikelwa Kolwazi Ezinhlelweni Zekhompyutha". Ephreli 1975. Izimiso zokuphepha zathuthuka ngobuchwepheshe, kodwa eminyakeni engama-47 kamuva imibono eminingi ye-S&S isasebenza.
• I-NCSC yase-UK. "Vikela ukwakhiwa nokusetshenziswa pipeline". Isikhungo Sikazwelonke Sokuphepha Kwe-inthanethi sase-UK, uFebhuwari 2019.