From af2ae328e7cb810d2282ae615791cc10b840b9a9 Mon Sep 17 00:00:00 2001 From: akusei Date: Sun, 18 Oct 2020 16:12:21 -0700 Subject: [PATCH] [FEATURE] Container privilege de-escalation (#1370) * support for running as non-root * forgot to save file * removed write perms for user on entrypoint script * preserve existing user behavior * fix entrypoint permissions to account for non-root user * typo in chmod on line 63 * better entrypoint script; moved to root * execute bit * support for running as non-root * forgot to save file * removed write perms for user on entrypoint script * preserve existing user behavior * fix entrypoint permissions to account for non-root user * typo in chmod on line 63 * better entrypoint script; moved to root * execute bit * very rough draft documentation * added missing header * typo changes -> changed * Update entrypoint.sh Co-authored-by: Amir Zarrinkafsh * Apply suggestions from code review looks good Co-authored-by: Amir Zarrinkafsh --- Dockerfile | 12 +++-- Dockerfile.arm32v7 | 11 ++-- Dockerfile.arm64v8 | 11 ++-- docs/security/measures.md | 102 ++++++++++++++++++++++++++++++-------- entrypoint.sh | 10 ++++ 5 files changed, 112 insertions(+), 34 deletions(-) create mode 100755 entrypoint.sh diff --git a/Dockerfile b/Dockerfile index eac6adc16..2e82d933c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -51,16 +51,20 @@ GOOS=linux GOARCH=amd64 CGO_ENABLED=1 go build -tags netgo -ldflags '-s -w -link # =================================== FROM alpine:3.12.0 -RUN apk --no-cache add ca-certificates tzdata +COPY --from=builder-backend /go/src/app/cmd/authelia/authelia ./ +COPY ./entrypoint.sh /usr/local/bin/entrypoint.sh + +RUN apk --no-cache add ca-certificates su-exec tzdata WORKDIR /app -COPY --from=builder-backend /go/src/app/cmd/authelia/authelia ./ - EXPOSE 9091 VOLUME /config ENV PATH="/app:${PATH}" +ENV PUID=0 +ENV PGID=0 -CMD ["authelia", "--config", "/config/configuration.yml"] +ENTRYPOINT ["/usr/local/bin/entrypoint.sh"] +CMD ["--config", "/config/configuration.yml"] diff --git a/Dockerfile.arm32v7 b/Dockerfile.arm32v7 index f90677fed..c15f8c302 100644 --- a/Dockerfile.arm32v7 +++ b/Dockerfile.arm32v7 @@ -55,18 +55,21 @@ GOOS=linux GOARCH=arm CGO_ENABLED=1 CC=arm-linux-musleabihf-gcc go build -tags n FROM arm32v7/alpine:3.12.0 COPY ./qemu-arm-static /usr/bin/qemu-arm-static +COPY --from=builder-backend /go/src/app/cmd/authelia/authelia ./ +COPY ./entrypoint.sh /usr/local/bin/entrypoint.sh -RUN apk --no-cache add ca-certificates tzdata && \ +RUN apk --no-cache add ca-certificates su-exec tzdata && \ rm /usr/bin/qemu-arm-static WORKDIR /app -COPY --from=builder-backend /go/src/app/cmd/authelia/authelia ./ - EXPOSE 9091 VOLUME /config ENV PATH="/app:${PATH}" +ENV PUID=0 +ENV PGID=0 -CMD ["authelia", "--config", "/config/configuration.yml"] +ENTRYPOINT ["/usr/local/bin/entrypoint.sh"] +CMD ["--config", "/config/configuration.yml"] diff --git a/Dockerfile.arm64v8 b/Dockerfile.arm64v8 index 8fb7a2521..6bc6c956b 100644 --- a/Dockerfile.arm64v8 +++ b/Dockerfile.arm64v8 @@ -55,18 +55,21 @@ GOOS=linux GOARCH=arm64 CGO_ENABLED=1 CC=aarch64-linux-musl-gcc go build -tags n FROM arm64v8/alpine:3.12.0 COPY ./qemu-aarch64-static /usr/bin/qemu-aarch64-static +COPY --from=builder-backend /go/src/app/cmd/authelia/authelia ./ +COPY ./entrypoint.sh /usr/local/bin/entrypoint.sh -RUN apk --no-cache add ca-certificates tzdata && \ +RUN apk --no-cache add ca-certificates su-exec tzdata && \ rm /usr/bin/qemu-aarch64-static WORKDIR /app -COPY --from=builder-backend /go/src/app/cmd/authelia/authelia ./ - EXPOSE 9091 VOLUME /config ENV PATH="/app:${PATH}" +ENV PUID=0 +ENV PGID=0 -CMD ["authelia", "--config", "/config/configuration.yml"] +ENTRYPOINT ["/usr/local/bin/entrypoint.sh"] +CMD ["--config", "/config/configuration.yml"] diff --git a/docs/security/measures.md b/docs/security/measures.md index ae9c4e86e..d9f0d064f 100644 --- a/docs/security/measures.md +++ b/docs/security/measures.md @@ -30,17 +30,17 @@ post nginx has written on [HSTS]. ## Protection against username enumeration -Authelia adaptively delays authentication attempts based on the mean (average) of the -previous 10 successful attempts, and a small random interval to make it even harder to -determine if the attempt was successful. On start it is assumed that the last 10 attempts +Authelia adaptively delays authentication attempts based on the mean (average) of the +previous 10 successful attempts, and a small random interval to make it even harder to +determine if the attempt was successful. On start it is assumed that the last 10 attempts took 1000ms, this quickly grows or shrinks to the correct value over time regardless of the -authentication backend. +authentication backend. -The cost of this is low since in the instance of a user not existing it just sleeps to delay +The cost of this is low since in the instance of a user not existing it just sleeps to delay the login. Lastly the absolute minimum time authentication can take is 250ms. Both of these measures also have the added effect of creating an additional delay for all authentication attempts reducing the likelihood a password can be brute-forced even if regulation settings are too permissive. - + ## Protections against password cracking (File authentication provider) Authelia implements a variety of measures to prevent an attacker cracking passwords if they @@ -50,8 +50,8 @@ First and foremost Authelia only uses very secure hashing algorithms with sane a The first and default hashing algorithm we use is Argon2id which is currently considered the most secure hashing algorithm. We also support SHA512, which previously was the default. -Secondly Authelia uses salting with all hashing algorithms. These salts are generated with a random -string generator, which is seeded every time it's used by a cryptographically secure 1024bit prime number. +Secondly Authelia uses salting with all hashing algorithms. These salts are generated with a random +string generator, which is seeded every time it's used by a cryptographically secure 1024bit prime number. This ensures that even if an attacker obtains the file, each password has to be brute forced individually. Lastly Authelia's implementation of Argon2id is highly tunable. You can tune the key length, salt @@ -60,12 +60,12 @@ used, iterations (time), parallelism, and memory usage. To read more about this ## User profile and group membership always kept up-to-date (LDAP authentication provider) -Authelia by default refreshes the user's profile and membership every 5 minutes. Additionally, it -will invalidate any session where the user could not be retrieved from LDAP based on the user filter, for +Authelia by default refreshes the user's profile and membership every 5 minutes. Additionally, it +will invalidate any session where the user could not be retrieved from LDAP based on the user filter, for example if they were deleted or disabled provided the user filter is set correctly. These updates occur when a user accesses a resource protected by Authelia. -These protections can be [tuned](../configuration/authentication/ldap.md) according to your security policy +These protections can be [tuned](../configuration/authentication/ldap.md) according to your security policy by changing refresh_interval, however we believe that 5 minutes is a fairly safe interval. ## Notifier security measures (SMTP) @@ -73,12 +73,12 @@ by changing refresh_interval, however we believe that 5 minutes is a fairly safe By default the SMTP Notifier implementation does not allow connections that are not secure. As such all connections require the following: -1. TLS Connection (STARTTLS or SMTPS) has been negotiated before authentication or sending emails (unauthenticated +1. TLS Connection (STARTTLS or SMTPS) has been negotiated before authentication or sending emails (unauthenticated connections require it as well) 2. Valid X509 Certificate presented to the client during the TLS handshake There is an option to disable both of these security measures however they are -not recommended. You should only do this in a situation where you control all +not recommended. You should only do this in a situation where you control all networks between Authelia and the SMTP server. The following configuration options exist to configure the security level: @@ -91,12 +91,12 @@ automatically when a SMTP notifier is configured with the SMTPS port of 465. ### Configuration Option: disable_verify_cert This is a YAML boolean type (true/false, y/n, 1/0, etc). This disables the X509 PKI -verification mechanism. We recommend using the trusted_cert option over this, as +verification mechanism. We recommend using the trusted_cert option over this, as disabling this security feature makes you vulnerable to MITM attacks. ### Configuration Option: disable_require_tls -This is a YAML boolean type (true/false, y/n, 1/0, etc). This disables the +This is a YAML boolean type (true/false, y/n, 1/0, etc). This disables the requirement that all connections must be over TLS. This is only usable currently with authentication disabled (comment the password) and as such is only an option for SMTP servers that allow unauthenticated relay (bad practice). @@ -107,8 +107,8 @@ This is a YAML string type. This specifies the file location of a pub certificat that can be used to validate the authenticity of a server with a self signed certificate. This can either be the public cert of the certificate authority used to sign the certificate or the public key itself. They must be in the PEM -format. The certificate is added in addition to the certificates trusted by the -host machine. If the certificate is invalid, inaccessible, or is otherwise not +format. The certificate is added in addition to the certificates trusted by the +host machine. If the certificate is invalid, inaccessible, or is otherwise not configured; Authelia just uses the hosts certificates. ### Explanation @@ -129,14 +129,14 @@ for information. ### Session security We have a few options to configure the security of a session. The main and most important -one is the session secret. This is used to encrypt the session data when when stored in the +one is the session secret. This is used to encrypt the session data when when stored in the Redis key value database. This should be as random as possible. -Additionally you can configure the validity period of sessions. For example in a highly -security conscious domain you would probably want to set the session remember_me_duration +Additionally you can configure the validity period of sessions. For example in a highly +security conscious domain you would probably want to set the session remember_me_duration to 0 to disable this feature, and set an expiration of something like 2 hours and inactivity of 10 minutes. This means the hard limit or the time the session will be destroyed no matter -what is 2 hours, and the soft limit or the time a user can be inactive for is 10 minutes. +what is 2 hours, and the soft limit or the time a user can be inactive for is 10 minutes. ### More protections measures with Nginx @@ -152,7 +152,7 @@ add_header Pragma "no-cache"; # Clickjacking / XSS protection -# We don't want Authelia's login page to be rendered within a , +# We don't want Authelia's login page to be rendered within a , #