puppet-sec-lint 0.5.13 → 0.5.14

Sign up to get free protection for your applications and to get access to all the features.
Files changed (12) hide show
  1. checksums.yaml +4 -4
  2. data/.idea/modules.xml +1 -0
  3. data/Gemfile.lock +1 -1
  4. data/README.md +24 -8
  5. data/docs/http-without-tls.md +42 -0
  6. data/docs/images/puppet-sec-lint_configurations.png +0 -0
  7. data/docs/invalid-ip-addr-binding.md +1 -1
  8. data/lib/lol2.pp +11 -0
  9. data/lib/manifest.pp +83 -0
  10. data/lib/puppet-sec-lint/version.rb +2 -2
  11. data/puppet-sec-lint.gemspec +2 -2
  12. metadata +9 -4
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: bfaad87ab6375c69dd2cb27773653373587f35e3cc74d4cba47c0bb05a69bd18
4
- data.tar.gz: 9c5a606fc0867a133d38ab6033f9fe6b66eaae4a8e7426f45d59fea1ff3d4b34
3
+ metadata.gz: e4f5d30d4bf9e32338bf3c81fa619d6cb6560870343d01a62905282ac5724d6e
4
+ data.tar.gz: d6d63ef87f2df9654f2edac1a1b75f3525b2bc514e46608f2990923b830a5134
5
5
  SHA512:
6
- metadata.gz: 26a4648b94a03331d14bcb1da29938809c5869b8f013c9f4510bfdd3dbf8557139ff66a5cb8834066cdd103ade3631001f4a7ebbc9d09b1292c4a7ec4413d96f
7
- data.tar.gz: ce98ccc1b55c37bc67d3ba4bafdd68fee493af13cffcab88af893ce276a0b5ba860d4b0a3deb2dc9210e467e24d8f61f14395b9bab2db314c1354df8a8711351
6
+ metadata.gz: 90e1f2fddbc2d97ad919d54e98870650f4d56b944676ff8f115a29b84395ae9413770d4985f45510fd77a5de46b5a4377b404974eb8265aca8a18087a9392d83
7
+ data.tar.gz: 88312bf0a323156a1eb265700079cacf07c19e92c190d6b497acf28e2b08a92b7cb56ec7e656649ffff5865dfb7b08f546b0dc90f72fcba13fbf8e6fe2e8cd43
data/.idea/modules.xml CHANGED
@@ -2,6 +2,7 @@
2
2
  <project version="4">
3
3
  <component name="ProjectModuleManager">
4
4
  <modules>
5
+ <module fileurl="file://$PROJECT_DIR$/.idea/modules/docs.iml" filepath="$PROJECT_DIR$/.idea/modules/docs.iml" />
5
6
  <module fileurl="file://$PROJECT_DIR$/.idea/puppet-sec-lint.iml" filepath="$PROJECT_DIR$/.idea/puppet-sec-lint.iml" />
6
7
  </modules>
7
8
  </component>
data/Gemfile.lock CHANGED
@@ -1,7 +1,7 @@
1
1
  PATH
2
2
  remote: .
3
3
  specs:
4
- puppet-sec-lint (0.5.13)
4
+ puppet-sec-lint (0.5.14)
5
5
  inifile (~> 3.0.0)
6
6
  launchy (~> 2.5.0)
7
7
  logger (~> 1.4.3)
data/README.md CHANGED
@@ -25,14 +25,6 @@ If the linter is called with a folder, all puppet files inside are recursively a
25
25
  puppet-sec-lint /folder
26
26
  ```
27
27
 
28
- To open the configurations page to better tune the different rules applied, use the appropriate flag:
29
-
30
- ```bash
31
- puppet-sec-lint -c
32
- ```
33
- (this will open the configurations page on the computer default web browser)
34
-
35
-
36
28
  ### Integration with Visual Studio Code
37
29
 
38
30
  The linter can also work inside Visual Studio code. For it, please ensure that the 'puppet-sec-lint' gem was installed on your system.
@@ -43,12 +35,36 @@ Now, after that the extension is activate, it should be activated automatically
43
35
 
44
36
  ![puppet-sec-lint console execution](docs/images/puppet-sec-lint_vscode.png)
45
37
 
38
+ ###Customization of Linter Rules
39
+
40
+ All rules applied by the linter to detect vulnerabilities can be configured to better adapt the tool to any project conventions and requirements.
41
+
42
+ To open the configurations page, use the appropriate flag:
43
+
44
+ ```bash
45
+ puppet-sec-lint -c
46
+ ```
47
+ (this will open the configurations page on the computer default web browser)
48
+
49
+ ![puppet-sec-lint configurations page](docs/images/puppet-sec-lint_configurations.png)
50
+
46
51
  ## Development
47
52
 
53
+ ### Development of new rules
54
+
55
+ The linter was built on top of a modular architecture, which means that new customizable rules can be added fairly easy facing the discovery of new scenarios and vulnerabilities.
56
+
57
+ <!--
58
+ (add instructions on how to clone, build and run tool)
59
+
60
+ (add instructions on where and how to add new rule and configurations)
61
+ -->
62
+
48
63
  <!--After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
49
64
 
50
65
  To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).-->
51
66
 
67
+
52
68
  ## Contributing
53
69
 
54
70
  <!-- Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/puppet-sec-lint. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/[USERNAME]/puppet-sec-lint/blob/master/CODE_OF_CONDUCT.md). -->
data/docs/http-without-tls.md ADDED
@@ -0,0 +1,42 @@
1
+ ---
2
+ title: Use HTTP without TLS
3
+ permalink: /http-without-tls/
4
+ layout: default
5
+ ---
6
+
7
+ # Use HTTP without TLS
8
+
9
+ ## What is it?
10
+
11
+ Connecting to a server using the regular HTTP protocol instead of the secure HTTPS, which uses TLS, doesn't allow for an encrypted connection. This means that all the data is sent in plaintext and easily viewed and modified by anyone, including malicious attackers.
12
+
13
+ ### Example
14
+ Providing a server to run the PHPMyAdmin application:
15
+ ```puppet
16
+ define phpmyadmin::server (
17
+ $blowfish_key = md5("${::fqdn}${::ipaddress}"),
18
+ $absolute_uri = "http://${::fqdn}/phpmyadmin/",
19
+ $config_file = $::phpmyadmin::params::config_file
20
+ )
21
+ ```
22
+ This newly created service will be available to clients through a non secure HTTP address.
23
+
24
+ A more secure way of hosting the server would be by using an HTTPS url:
25
+ ```puppet
26
+ define phpmyadmin::server (
27
+ $blowfish_key = md5("${::fqdn}${::ipaddress}"),
28
+ $absolute_uri = "https://${::fqdn}/phpmyadmin/",
29
+ $config_file = $::phpmyadmin::params::config_file
30
+ )
31
+ ```
32
+
33
+
34
+ ## How can it be exploited?
35
+
36
+ When a connection is made to a website using a non-secure HTTP address, all communications are sent unencrypted. An attacker can capture the traffic sent and received by a victim, for example, in the same Wifi network. After analyzing his traffic, the attacker can extract sensitive information exchanged by the victim with the websites visited, like passwords and tokens.
37
+
38
+ The attacker can then use this information to attack his victim, by logging in and impersonating him in several different websites that don't use the TLS protocol.
39
+
40
+ ## How to avoid it?
41
+
42
+ All connections to internet addresses or made available to the public by a service configured with a Puppet manifest must use some kind of secure protocol, to ensure the confidentiality, authenticity and integrity of all data exchanged. Making an HTTPS connection is the easiest way to do this and it's also the recommended way of addressing this security vulnerability. In some cases, if the transferred information is verified afterwards by an hashing algorithm, like packages transferred from a repository, then this solution can be considered optional.
data/docs/invalid-ip-addr-binding.md CHANGED
@@ -6,7 +6,7 @@ layout: default
6
6
 
7
7
  # Invalid IP Address binding
8
8
 
9
- ## What it it?
9
+ ## What is it?
10
10
 
11
11
  Binding an IP address to a server or service means authorizing connections incoming from those networks. This allows to limit what kind of incoming connections a server may or may not accept. Binding the 0.0.0.0 IP address to a service means that any connection from any network is accepted.
12
12
 
data/lib/lol2.pp ADDED
@@ -0,0 +1,11 @@
1
+ # addresses bug: https://bugs.launchpad.net/keystone/+bug/1472285
2
+ class example (
3
+ $power_username= 'admin',
4
+ $power_password= ‘’,
5
+ $pwd = ‘EHDJSKD’
6
+ ){
7
+ $bind_host = ‘0.0.0.0’
8
+ $quantum_auth_url = ‘http://127.0.0.1:35357/v2.0’
9
+ “ $”tr = "hey"
10
+ $message = sha1($str)
11
+ }
data/lib/manifest.pp ADDED
@@ -0,0 +1,83 @@
1
+ #class path_attribute {
2
+ # file { 'ssh_config_file':
3
+ # path => '/etc/ssh/sshd_config',
4
+ # content => 'Bad path attribute, bad.',
5
+ # }
6
+ #}
7
+
8
+ # the following code addresses the bug: https://bugs.launchpad.net/keystone/+bug/1472285 .
9
+
10
+ class consul_template::service (
11
+ $rpc_password = '{6ad470ec62b0511b63340dca2950d750181598efnHKvN1ge',
12
+ $admin_username = 'admin',
13
+ $password = 'ceilometer',
14
+ $admin_password = 'admin',
15
+ ) {
16
+ exec { 'network-restart':
17
+ command => 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDM release-runner key',
18
+ path => '/usr/bin:/usr/sbin:/bin:/sbin',
19
+ refreshonly => true,
20
+ vmware_md5 => 'LOL',
21
+ autho => 'MD5',
22
+ cmd => 'virsh secret-define --file ${secret_xml} && virsh secret-set-value --secret ${rbd_secret_uuid} --base64 $(ceph auth get-key client.${user})',
23
+ $auth_uri => 'http://127.0.0.1:5000',
24
+ 'bind_address' => '0.0.0.0',
25
+ password => '',
26
+ }
27
+ case $::osfamily {
28
+ 'RedHat': {
29
+ exec { 'upload-img':
30
+ command => "/usr/bin/glance -N ${os_auth_url} -T ${os_tenant_name} -I ${os_username} -K ${os_password} add name=${img_name} is_public=${public} container_format=${container_format} disk_format=${disk_format} distro=${os_name} < /opt/vm/cirros-x86_64-disk.img",
31
+ unless => "/usr/bin/glance -N ${os_auth_url} -T ${os_tenant_name} -I ${os_username} -K ${os_password} index && (/usr/bin/glance -N ${os_auth_url} -T ${os_tenant_name} -I ${os_username} -K ${os_password} index | grep ${img_name})",
32
+
33
+ }
34
+ }
35
+ 'Debian': {
36
+ exec { 'upload-img':
37
+ command => "/usr/bin/glance -N ${os_auth_url} -T ${os_tenant_name} -I ${os_username} -K ${os_password} add name=${img_name} is_public=${public} container_format=${container_format} disk_format=${disk_format} distro=${os_name} < /usr/share/cirros-testvm/cirros-x86_64-disk.img",
38
+ unless => "/usr/bin/glance -N ${os_auth_url} -T ${os_tenant_name} -I ${os_username} -K ${os_password} index && (/usr/bin/glance -N ${os_auth_url} -T ${os_tenant_name} -I ${os_username} -K ${os_password} index | grep ${img_name})",
39
+ key => "E8CC67053ED3B199",
40
+ key_content => '-----BEGIN PGP PUBLIC KEY BLOCK-----
41
+ Version: GnuPG v1.4.11 (GNU/Linux)
42
+
43
+ mQENBE/oXVkBCACcjAcV7lRGskECEHovgZ6a2robpBroQBW+tJds7B+qn/DslOAN
44
+ 1hm0UuGQsi8pNzHDE29FMO3yOhmkenDd1V/T6tHNXqhHvf55nL6anlzwMmq3syIS
45
+ uqVjeMMXbZ4d+Rh0K/rI4TyRbUiI2DDLP+6wYeh1pTPwrleHm5FXBMDbU/OZ5vKZ
46
+ 67j99GaARYxHp8W/be8KRSoV9wU1WXr4+GA6K7ENe2A8PT+jH79Sr4kF4uKC3VxD
47
+ BF5Z0yaLqr+1V2pHU3AfmybOCmoPYviOqpwj3FQ2PhtObLs+hq7zCviDTX2IxHBb
48
+ Q3mGsD8wS9uyZcHN77maAzZlL5G794DEr1NLABEBAAG0NU9wZW5TdGFja0BDaXNj
49
+ byBBUFQgcmVwbyA8b3BlbnN0YWNrLWJ1aWxkZEBjaXNjby5jb20+iQE4BBMBAgAi
50
+ BQJP6F1ZAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRDozGcFPtOxmXcK
51
+ B/9WvQrBwxmIMV2M+VMBhQqtipvJeDX2Uv34Ytpsg2jldl0TS8XheGlUNZ5djxDy
52
+ u3X0hKwRLeOppV09GVO3wGizNCV1EJjqQbCMkq6VSJjD1B/6Tg+3M/XmNaKHK3Op
53
+ zSi+35OQ6xXc38DUOrigaCZUU40nGQeYUMRYzI+d3pPlNd0+nLndrE4rNNFB91dM
54
+ BTeoyQMWd6tpTwz5MAi+I11tCIQAPCSG1qR52R3bog/0PlJzilxjkdShl1Cj0RmX
55
+ 7bHIMD66uC1FKCpbRaiPR8XmTPLv29ZTk1ABBzoynZyFDfliRwQi6TS20TuEj+ZH
56
+ xq/T6MM6+rpdBVz62ek6/KBcuQENBE/oXVkBCACgzyyGvvHLx7g/Rpys1WdevYMH
57
+ THBS24RMaDHqg7H7xe0fFzmiblWjV8V4Yy+heLLV5nTYBQLS43MFvFbnFvB3ygDI
58
+ IdVjLVDXcPfcp+Np2PE8cJuDEE4seGU26UoJ2pPK/IHbnmGWYwXJBbik9YepD61c
59
+ NJ5XMzMYI5z9/YNupeJoy8/8uxdxI/B66PL9QN8wKBk5js2OX8TtEjmEZSrZrIuM
60
+ rVVXRU/1m732lhIyVVws4StRkpG+D15Dp98yDGjbCRREzZPeKHpvO/Uhn23hVyHe
61
+ PIc+bu1mXMQ+N/3UjXtfUg27hmmgBDAjxUeSb1moFpeqLys2AAY+yXiHDv57ABEB
62
+ AAGJAR8EGAECAAkFAk/oXVkCGwwACgkQ6MxnBT7TsZng+AgAnFogD90f3ByTVlNp
63
+ Sb+HHd/cPqZ83RB9XUxRRnkIQmOozUjw8nq8I8eTT4t0Sa8G9q1fl14tXIJ9szzz
64
+ BUIYyda/RYZszL9rHhucSfFIkpnp7ddfE9NDlnZUvavnnyRsWpIZa6hJq8hQEp92
65
+ IQBF6R7wOws0A0oUmME25Rzam9qVbywOh9ZQvzYPpFaEmmjpCRDxJLB1DYu8lnC4
66
+ h1jP1GXFUIQDbcznrR2MQDy5fNt678HcIqMwVp2CJz/2jrZlbSKfMckdpbiWNns/
67
+ xKyLYs5m34d4a0it6wsMem3YCefSYBjyLGSd/kCI/CgOdGN1ZY1HSdLmmjiDkQPQ
68
+ UcXHbA==
69
+ =v6jg
70
+ -----END PGP PUBLIC KEY BLOCK-----',
71
+
72
+ }
73
+ }
74
+ }
75
+ file { '/var/lib/gerrit/.ssh/id_rsa' :
76
+ owner => 'gerrit',
77
+ group => 'gerrit',
78
+ mode => '0600',
79
+ content => $ssh_replication_rsa_key_contents,
80
+ replace => true,
81
+ require => File['/var/lib/gerrit/.ssh']
82
+ }
83
+ }
data/lib/puppet-sec-lint/version.rb CHANGED
@@ -1,7 +1,7 @@
1
1
  # frozen_string_literal: true
2
2
 
3
3
  module PuppetSecLint
4
- VERSION = "0.5.13"
4
+ VERSION = "0.5.14"
5
5
  YEAR = "2021"
6
- AUTHOR = "Tiago Ribeiro"
6
+ AUTHOR = "TQRG"
7
7
  end
data/puppet-sec-lint.gemspec CHANGED
@@ -8,8 +8,8 @@ Gem::Specification.new do |spec|
8
8
  spec.authors = ["Tiago Ribeiro"]
9
9
  spec.email = ["tiago7b27@gmail.com"]
10
10
 
11
- spec.summary = "This is a security linter for the puppet language"
12
- spec.description = "This is a more complete security linter for the puppet language"
11
+ spec.summary = "Security vulnerabilities linter for Puppet Manifests"
12
+ spec.description = "Linter built to detect potential security vulnerabilities in Puppet manifests code. It also offers integration with Visual Studio Code https://marketplace.visualstudio.com/items?itemName=tiago1998.puppet-sec-lint-vscode"
13
13
  spec.homepage = "https://github.com/TiagoR98/puppet-sec-lint"
14
14
  spec.license = "MIT"
15
15
  spec.required_ruby_version = Gem::Requirement.new(">= 2.3.0")
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: puppet-sec-lint
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.5.13
4
+ version: 0.5.14
5
5
  platform: ruby
6
6
  authors:
7
7
  - Tiago Ribeiro
8
8
  autorequire:
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2021-05-16 00:00:00.000000000 Z
11
+ date: 2021-05-17 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: puppet-lint
@@ -128,7 +128,8 @@ dependencies:
128
128
  - - "~>"
129
129
  - !ruby/object:Gem::Version
130
130
  version: 1.4.3
131
- description: This is a more complete security linter for the puppet language
131
+ description: Linter built to detect potential security vulnerabilities in Puppet manifests
132
+ code. It also offers integration with Visual Studio Code https://marketplace.visualstudio.com/items?itemName=tiago1998.puppet-sec-lint-vscode
132
133
  email:
133
134
  - tiago7b27@gmail.com
134
135
  executables:
@@ -171,6 +172,8 @@ files:
171
172
  - docs/cyrillic-homograph-attack.md
172
173
  - docs/empty-password.md
173
174
  - docs/hard-coded-credentials.md
175
+ - docs/http-without-tls.md
176
+ - docs/images/puppet-sec-lint_configurations.png
174
177
  - docs/images/puppet-sec-lint_console.png
175
178
  - docs/images/puppet-sec-lint_vscode.png
176
179
  - docs/index.md
@@ -184,6 +187,8 @@ files:
184
187
  - lib/facades/configuration_file_facade.rb
185
188
  - lib/facades/configuration_page_facade.rb
186
189
  - lib/lol.pp
190
+ - lib/lol2.pp
191
+ - lib/manifest.pp
187
192
  - lib/puppet-sec-lint/version.rb
188
193
  - lib/rule_engine.rb
189
194
  - lib/rules/admin_by_default_rule.rb
@@ -228,5 +233,5 @@ requirements: []
228
233
  rubygems_version: 3.2.3
229
234
  signing_key:
230
235
  specification_version: 4
231
- summary: This is a security linter for the puppet language
236
+ summary: Security vulnerabilities linter for Puppet Manifests
232
237
  test_files: []