opendev
/
infra-specs
Code Issues Proposed changes

Revise security spec to discuss SSH keys 

We missed this in the first pass. We need to protect the private key to
reduce the impact of any ansible-playbook escapes.

Change-Id: Id7ef192f87fc665feb89629f1a8d0b75f9de5f9b
This commit is contained in:
Clint Byrum 2017-05-03 09:28:26 -07:00
parent b6c6c619d3
commit a32f84b439
1 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
specs/zuulv3-executor-security.rst
View File

@ -137,6 +137,33 @@ on it may be necessary to define per-job space limitations.
Evaluation of methods of containment will assume that this change precedes
or accompanies any implementation.
Access Credentials
------------------
We need to grant `ansible-playbook` the ability to access test nodes.
Since our only allowed Ansible connection method is SSH, we can
narrow this to SSH key access. Ideally we can allow the untrusted
`ansible-playbook` to use an SSH key to access test nodes without exposing
key material.
SSH Agent
~~~~~~~~~
The executor already is configured for a path to an SSH private key file.
This file could be added into the contained chroot, but that would expose
the private key material to the untrusted playbook, which would allow
said malicious actor to log the key and use it to access other test
nodes as long as that SSH key is used.
Instead we can use `ssh-agent` and expose the socket to the contained
`ansible-playbook`. Because `ssh-agent` only signs challenges, it will
mean that a malicious user will have to be able to do more than just log
the private key to make use of it, and their access to the key will end
when their access to `ssh-agent` ends.
This will require making sure the socket is visible inside containment,
and passing in the environment necessary to help `ssh` find it.
Available Containment Methods
-----------------------------