Secure your Docker images

Transcription

1 Secure your Docker images With Notary and Yubikey Dr. Udo Seidel

2 Agenda Introduction The Update Framework Notary Yubikey Getting started Summary

3 Me :-) Teacher of mathematics and physics PhD in experimental physics Started with Linux in 1996 With Amadeus since 2006 Before: Linux/UNIX trainer Solution Engineer in HPC and CAx environment Now: Architecture & Technical Governance

4 Introduction

5 Docker for Dummies Set of Libraries Executables Other files Very image-based Separation via several namespaces

6 Docker work-flow $ docker pull $ docker run/start/stop/... $ docker commit/create/... $ docker push

7 Docker security Host Docker Daemon Docker Image Docker Instance

8 Docker work-flow security Store Upload Download Run

9 The Update Framework

10 Link to software management Source Target Download Content

11 Basic idea Plugin architecture Easier integration Easier to expand Digital signatures Proven technology Key management is crucial Meta data

12 Meta-Data Enhanced security Whom to trust Version system Cryptographic checksums Enhanced role model Delegation Separation of duties

13 TUF Roles I Root Delegates trust Uses keys Target What is trusted by clients Can delegate too

14 TUF Roles II Snapshot (latest) version of meta data Update info for clients Timestamp Prevent out-of-data attacks Keys kept online Mirror Optional

15 The two aspects of TUF Several implementations Python Ruby Haskell... Go :-) Specification!

16 Notary

17 Notary and TUF Go implementation Base of Docker Content Trust Not limited to docker

18 High level architecture Client-Server model 3 server components Server Signer Database TCP/IP based communication TLS possible... mandatory

19 High level architecture

20 Notary Server PoC for client REST API Port Default: 443 or 4443 Configurable Client need to know

21 Notary Signer Cryptographic operations Data store Database Memory PKCS#11 via softhsm2 Ports 4444 for HTTP 7899 for GRPC

22 Notary Database ATM: MySQL only Standard port: tables Private keys Timestamp keys Meta data

23 Roles and keys TUF specification 4 different roles See TUF before Mirror droped Keys per role Data format: JSON

24 Root The base/start/entry point Two kinds Global Local Like root-ca in SSL/TLS world

25 Target Main user interaction Corresponds to file, directory, repository Meta data Files File sizes Default validity: 3 years BASE64 coded SHA256 checksums Signed by target role

26 Snapshot Management of root target.json Consistent view of software repository Meta Data Files File sizes Default validity: 3 years BASE64 coded SHA256 checksums Signed by Snapshot role

27 Timestamp Management of snapshot.json Meta Data File File size Default validity: 14 days BASE64 coded SHA256 checksums Signed by Timestamp role Key stored on server only

28 The client notary $HOME/.notary/

29 Docker Content Trust (DCT) Since Engine version 1.8 Notary: foundation but 'hidden'

30 Docker Content Trust Interaction via docker Mixed repository content (De-)Activation $ DOCKER_CONTENT_TRUST=0 1 $ disable content trust=true false

31 Yubikey

32 Secure your (root) keys See root CA keys for SSL Secure and mobile How? Encrypted $HOME Encrypted USB sticks??? => Yubikey (4)

33 Yubikey 4 Personal Identity Verification Two-Factor-Authentication Different Standards Here: FIDO and U2F One-Time-Passwords Chip Card Interface Device

34 Yubikey-PIV and Docker/Notary Notary root key Storage 4 in total In addition to $HOME Access Docker-Speak Changing content of repository New/change docker images

35 Yubikey-U2F and Docker/Notary Enhance security Generation of root keys Access to root keys Humans no machines/robots Fine for manual tasks

36 Universal 2 Factor Authentication

37 Yubikey in Docker action

38 Yubikey 4 Beyond Docker Github Dropbox Gmail Google apps Disk encryption

39 Getting Started

40 Getting Started Notary (easy) Use official Docker Hub image :-) TLS quite tricky Drop docker and use notary Yubikey optional

41 Getting Started Notary (less easy) Setup GO build environment Download and compile notary Configure and startup Manually Via Docker Compose TLS quite tricky Yubikey optional

42 Getting Started Yubikey (easy) Yubikey mandatory :-) Test Repo on Docker Hub Enable DCT Insert Yubikey before pcscd $ docker pull/push

43 Getting Started Yubikey (less easy) Yubikey mandatory Setup own Registry Setup Notary (see before) Enable DCT Insert Yubikey before pcscd $ docker pull/push

44 Summary

45 Take Aways Good start Early days Only Docker Image security What is next? Other Yubikey functions? Other Tokens?

46 References

47 Thank you!

48 Secure your Docker images Linux?!? With Notary and Yubikey Dr. Udo Seidel