GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-19 00:32:34 +01:00
Code Issues Projects Releases Packages Wiki Activity

Merge branch 'master' into docker-benchmark-1.12.0

Browse source
This commit is contained in:
Thomas Sjögren 2017-01-23 12:14:23 +01:00 committed by GitHub
commit 27773128f8
7 changed files with 75 additions and 43 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
Dockerfile
View file

@ -1,23 +1,27 @@
FROM alpine:3.2 FROM alpine:3.5
LABEL org.label-schema.name="docker-bench-security" \ LABEL org.label-schema.name="docker-bench-security" \
org.label-schema.url="https://dockerbench.com" \ org.label-schema.url="https://dockerbench.com" \
org.label-schema.vcs-url="https://github.com/docker/docker-bench-security.git" org.label-schema.vcs-url="https://github.com/docker/docker-bench-security.git"
ENV VERSION 1.10.0 ENV VERSION 1.12.6
ENV SHA256 cadc6025c841e034506703a06cf54204e51d0cadfae4bae62628ac648d82efdd
WORKDIR /usr/bin WORKDIR /usr/bin
RUN apk update && \ RUN apk update && \
apk upgrade && \ apk upgrade && \
apk --update add curl && \ apk --update add coreutils wget ca-certificates && \
curl -sS https://get.docker.com/builds/Linux/x86_64/docker-$VERSION > docker-$VERSION && \ wget https://get.docker.com/builds/Linux/x86_64/docker-$VERSION.tgz && \
curl -sS https://get.docker.com/builds/Linux/x86_64/docker-$VERSION.sha256 > docker-$VERSION.sha256 && \ wget https://get.docker.com/builds/Linux/x86_64/docker-$VERSION.tgz.sha256 && \
sha256sum -c docker-$VERSION.sha256 && \ sha256sum -c docker-$VERSION.tgz.sha256 && \
ln -s docker-$VERSION docker && \ echo "$SHA256 docker-$VERSION.tgz" | sha256sum -c - && \
chmod u+x docker-$VERSION && \ tar -xzvf docker-$VERSION.tgz -C /tmp && \
apk del curl && \ mv /tmp/docker/docker . && \
rm -rf /var/cache/apk/* chmod u+x docker* && \
rm -rf /tmp/docker* && \
apk del wget ca-certificates && \
rm -rf /var/cache/apk/* docker-$VERSION.tgz docker-$VERSION.tgz.sha256
RUN mkdir /docker-bench-security RUN mkdir /docker-bench-security

38
README.md
View file

@ -2,19 +2,30 @@
![Docker Bench for Security running](https://raw.githubusercontent.com/docker/docker-bench-security/master/benchmark_log.png "Docker Bench for Security running") ![Docker Bench for Security running](https://raw.githubusercontent.com/docker/docker-bench-security/master/benchmark_log.png "Docker Bench for Security running")
The Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production. The tests are all automated, and are inspired by the [CIS Docker 1.12 Benchmark](https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1.12.0_Benchmark_v1.0.0.pdf). We are releasing this as a follow-up to our [Understanding Docker Security and Best Practices](https://blog.docker.com/2015/05/understanding-docker-security-and-best-practices/) blog post. The Docker Bench for Security is a script that checks for dozens of common
best-practices around deploying Docker containers in production. The tests are
all automated, and are inspired by the [CIS Docker 1.12 Benchmark](https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1.12.0_Benchmark_v1.0.0.pdf).
We are releasing this as a follow-up to our [Understanding Docker Security and Best Practices](https://blog.docker.com/2015/05/understanding-docker-security-and-best-practices/)
blog post.
We are making this available as an open-source utility so the Docker community can have an easy way to self-assess their hosts and docker containers against this benchmark. We are making this available as an open-source utility so the Docker community
can have an easy way to self-assess their hosts and docker containers against
this benchmark.
## Running Docker Bench for Security ## Running Docker Bench for Security
We packaged docker bench as a small container for your convenience. Note that this container is being run with a *lot* of privilege -- sharing the host's filesystem, pid and network namespaces, due to portions of the benchmark applying to the running host. Don't forget to adjust the shared volumes according to your operating system, it may not for example use systemd. We packaged docker bench as a small container for your convenience. Note that
this container is being run with a *lot* of privilege -- sharing the host's
The easiest way to run your hosts against the Docker Bench for Security is by running our pre-built container: filesystem, pid and network namespaces, due to portions of the benchmark
applying to the running host. Don't forget to adjust the shared volumes
according to your operating system, it may not for example use systemd.
The easiest way to run your hosts against the Docker Bench for Security is by
running our pre-built container:
```sh ```sh
docker run -it --net host --pid host --cap-add audit_control \ docker run -it --net host --pid host --cap-add audit_control \
-e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
-v /var/lib:/var/lib \ -v /var/lib:/var/lib \
-v /var/run/docker.sock:/var/run/docker.sock \ -v /var/run/docker.sock:/var/run/docker.sock \
-v /usr/lib/systemd:/usr/lib/systemd \ -v /usr/lib/systemd:/usr/lib/systemd \
@ -24,19 +35,26 @@ docker run -it --net host --pid host --cap-add audit_control \
Docker bench requires Docker 1.10.0 or later in order to run. Docker bench requires Docker 1.10.0 or later in order to run.
Also note that the default image and `Dockerfile` uses `FROM: alpine` which doesn't contain `auditctl`, this will generate errors in section 1.8 to 1.18. Distribution specific Dockerfiles that fixes this issue are available in the [distros directory](https://github.com/docker/docker-bench-security/tree/master/distros). Also note that the default image and `Dockerfile` uses `FROM: alpine` which
doesn't contain `auditctl`, this will generate errors in section 1.8 to 1.18.
Distribution specific Dockerfiles that fixes this issue are available in the
[distros directory](https://github.com/docker/docker-bench-security/tree/master/distros).
The [distribution specific Dockerfiles](https://github.com/docker/docker-bench-security/tree/master/distros) may also help if the distribution you're using haven't yet shipped Docker version 1.10.0 or later. The [distribution specific Dockerfiles](https://github.com/docker/docker-bench-security/tree/master/distros)
may also help if the distribution you're using haven't yet shipped Docker
version 1.10.0 or later.
## Building Docker Bench for Security ## Building Docker Bench for Security
If you wish to build and run this container yourself, you can follow the following steps: If you wish to build and run this container yourself, you can follow the
following steps:
```sh ```sh
git clone https://github.com/docker/docker-bench-security.git git clone https://github.com/docker/docker-bench-security.git
cd docker-bench-security cd docker-bench-security
docker build -t docker-bench-security . docker build -t docker-bench-security .
docker run -it --net host --pid host --cap-add audit_control \ docker run -it --net host --pid host --cap-add audit_control \
-e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
-v /var/lib:/var/lib \ -v /var/lib:/var/lib \
-v /var/run/docker.sock:/var/run/docker.sock \ -v /var/run/docker.sock:/var/run/docker.sock \
-v /usr/lib/systemd:/usr/lib/systemd \ -v /usr/lib/systemd:/usr/lib/systemd \
@ -45,6 +63,7 @@ docker run -it --net host --pid host --cap-add audit_control \
``` ```
or use [Docker Compose](https://docs.docker.com/compose/): or use [Docker Compose](https://docs.docker.com/compose/):
```sh ```sh
git clone https://github.com/docker/docker-bench-security.git git clone https://github.com/docker/docker-bench-security.git
cd docker-bench-security cd docker-bench-security
@ -59,4 +78,5 @@ cd docker-bench-security
sh docker-bench-security.sh sh docker-bench-security.sh
``` ```
This script was build to be POSIX 2004 compliant, so it should be portable across any Unix platform. This script was build to be POSIX 2004 compliant, so it should be portable
across any Unix platform.

24
distros/Dockerfile.alpine
View file

@ -1,23 +1,27 @@
FROM alpine:3.2 FROM alpine:3.5
LABEL org.label-schema.name="docker-bench-security" \ LABEL org.label-schema.name="docker-bench-security" \
org.label-schema.url="https://dockerbench.com" \ org.label-schema.url="https://dockerbench.com" \
org.label-schema.vcs-url="https://github.com/docker/docker-bench-security.git" org.label-schema.vcs-url="https://github.com/docker/docker-bench-security.git"
ENV VERSION 1.10.0 ENV VERSION 1.12.6
ENV SHA256 cadc6025c841e034506703a06cf54204e51d0cadfae4bae62628ac648d82efdd
WORKDIR /usr/bin WORKDIR /usr/bin
RUN apk update && \ RUN apk update && \
apk upgrade && \ apk upgrade && \
apk --update add curl && \ apk --update add coreutils wget ca-certificates && \
curl -sS https://get.docker.com/builds/Linux/x86_64/docker-$VERSION > docker-$VERSION && \ wget https://get.docker.com/builds/Linux/x86_64/docker-$VERSION.tgz && \
curl -sS https://get.docker.com/builds/Linux/x86_64/docker-$VERSION.sha256 > docker-$VERSION.sha256 && \ wget https://get.docker.com/builds/Linux/x86_64/docker-$VERSION.tgz.sha256 && \
sha256sum -c docker-$VERSION.sha256 && \ sha256sum -c docker-$VERSION.tgz.sha256 && \
ln -s docker-$VERSION docker && \ echo "$SHA256 docker-$VERSION.tgz" | sha256sum -c - && \
chmod u+x docker-$VERSION && \ tar -xzvf docker-$VERSION.tgz -C /tmp && \
apk del curl && \ mv /tmp/docker/docker . && \
rm -rf /var/cache/apk/* chmod u+x docker* && \
rm -rf /tmp/docker* && \
apk del wget ca-certificates && \
rm -rf /var/cache/apk/* docker-$VERSION.tgz docker-$VERSION.tgz.sha256
RUN mkdir /docker-bench-security RUN mkdir /docker-bench-security

11
docker-bench-security.sh
View file

@ -1,13 +1,11 @@
#!/bin/sh #!/bin/sh
# ------------------------------------------------------------------------------ # ------------------------------------------------------------------------------
# Docker Bench for Security v1.1.0 # Docker Bench for Security v1.2.0
# #
# Docker, Inc. (c) 2015- # Docker, Inc. (c) 2015-
# #
# Checks for dozens of common best-practices around deploying Docker containers in production. # Checks for dozens of common best-practices around deploying Docker containers in production.
# Inspired by the CIS Docker 1.11 Benchmark: # Inspired by the CIS Docker 1.12 Benchmark.
# https://benchmarks.cisecurity.org/downloads/show-single/index.cfm?file=docker16.110
#
# ------------------------------------------------------------------------------ # ------------------------------------------------------------------------------
# Load dependencies # Load dependencies
@ -59,13 +57,12 @@ if [ -z "$logger" ]; then
fi fi
yell "# ------------------------------------------------------------------------------ yell "# ------------------------------------------------------------------------------
# Docker Bench for Security v1.1.0 # Docker Bench for Security v1.2.0
# #
# Docker, Inc. (c) 2015- # Docker, Inc. (c) 2015-
# #
# Checks for dozens of common best-practices around deploying Docker containers in production. # Checks for dozens of common best-practices around deploying Docker containers in production.
# Inspired by the CIS Docker 1.11 Benchmark: # Inspired by the CIS Docker 1.12 Benchmark.
# https://benchmarks.cisecurity.org/downloads/show-single/index.cfm?file=docker16.110
# ------------------------------------------------------------------------------" # ------------------------------------------------------------------------------"
# Warn if not root # Warn if not root

2
helper_lib.sh
View file

@ -55,7 +55,7 @@ get_command_line_args() {
get_docker_cumulative_command_line_args() { get_docker_cumulative_command_line_args() {
OPTION="$1" OPTION="$1"
if ! get_command_line_args "docker daemon" > 1 ; then if ! get_command_line_args "docker daemon" >/dev/null 2>&1 ; then
line_arg="docker daemon" line_arg="docker daemon"
else else
line_arg="dockerd" line_arg="dockerd"

4
tests/1_host_configuration.sh
View file

@ -41,8 +41,8 @@ fi
check_1_5="1.5 - Keep Docker up to date" check_1_5="1.5 - Keep Docker up to date"
docker_version=$(docker version | grep -i -A1 '^server' | grep -i 'version:' \ docker_version=$(docker version | grep -i -A1 '^server' | grep -i 'version:' \
| awk '{print $NF; exit}' | tr -d '[:alpha:]-,') | awk '{print $NF; exit}' | tr -d '[:alpha:]-,')
docker_current_version="1.12.5" docker_current_version="1.13.0"
docker_current_date="2016-12-15" docker_current_date="2017-01-18"
do_version_check "$docker_current_version" "$docker_version" do_version_check "$docker_current_version" "$docker_version"
if [ $? -eq 11 ]; then if [ $? -eq 11 ]; then
warn "$check_1_5" warn "$check_1_5"

15
tests/2_docker_daemon_configuration.sh
View file

@ -57,19 +57,26 @@ fi
check_2_6="2.6 - Configure TLS authentication for Docker daemon" check_2_6="2.6 - Configure TLS authentication for Docker daemon"
get_docker_cumulative_command_line_args '-H' | grep -vE '(unix|fd)://' >/dev/null 2>&1 get_docker_cumulative_command_line_args '-H' | grep -vE '(unix|fd)://' >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
get_command_line_args docker | grep "tlsverify" | grep "tlskey" >/dev/null 2>&1 get_docker_cumulative_command_line_args '--tlskey' | grep 'tlskey=' >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_2_6" get_docker_cumulative_command_line_args '--tlsverify' | grep 'tlsverify' >/dev/null 2>&1
info " * Docker daemon currently listening on TCP" if [ $? -eq 0 ]; then
pass "$check_2_6"
#pass " * Docker daemon currently listening on TCP with TLS and verification"
else
warn "$check_2_6"
warn " * Docker daemon currently listening on TCP with TLS, but no verification"
fi
else else
warn "$check_2_6" warn "$check_2_6"
warn " * Docker daemon currently listening on TCP without --tlsverify" warn " * Docker daemon currently listening on TCP without TLS"
fi fi
else else
info "$check_2_6" info "$check_2_6"
info " * Docker daemon not listening on TCP" info " * Docker daemon not listening on TCP"
fi fi
# 2.7 # 2.7
check_2_7="2.7 - Set default ulimit as appropriate" check_2_7="2.7 - Set default ulimit as appropriate"
get_docker_effective_command_line_args '--default-ulimit' | grep "default-ulimit" >/dev/null 2>&1 get_docker_effective_command_line_args '--default-ulimit' | grep "default-ulimit" >/dev/null 2>&1