Changes between Version 3 and Version 4 of SystemAdministration/Security


Ignore:
Timestamp:
05/18/16 14:31:35 (8 years ago)
Author:
Sander Maijers
Comment:

Add warnings/solutions for Docker Engine daemon networking security issues

Legend:

Unmodified
Added
Removed
Modified

  • SystemAdministration/Security

    v3 v4  
    9090 * Always make sure that the virtualized app drops its privileges as much as possible.
    9191
     92##### Firewalling #####
     93
     941. [https://github.com/docker/docker/issues/22054 Docker Engine daemon modifies iptables to bypass firewall rules for mapped ports by default!]
     95
     962. [https://github.com/docker/docker/issues/14041 Docker Engine daemon enabled kernel IP forwarding without adding any restricting rules on what inbound IP packets are being forwarded!]
     97
     98Possible solution to second issue, using script:
     99
     100{{{#!sh
     101
     102EXT_IF=$( ip r s 0.0.0.0/0 | cut -f5 -d" " )
     103EXT_IPV4=$( ip a s dev ${EXT_IF} | grep "inet " | awk '{print $2}' | sed 's/\/.*//' )
     104
     105iptables -t mangle -I PREROUTING 1 -i $EXT_IF ! -d $EXT_IPV4 -j DROP
     106}}}
     107
    92108#### Drupal ####
    93109[http://www.drupal.org/security]