Git dvcs and Information Security Review
Download as ODP, PDF0 likes303 views
How to configure Apache, SSH and NGiNX for hosting Git repo *and* passing Information Security Reviews in a large company?
![22
Git – SSH with GITOLITE
command="[path]/gitolite-shell
user1",[more options]
ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAQEA
18S2t...
command="[path]/gitolite-shell
user2",[more options]
ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAQEA
rXtCT...
~/.ssh/authorized_keys](https://image.slidesharecdn.com/gitdvcsandisr-141017140130-conversion-gate01/85/Git-dvcs-and-Information-Security-Review-22-320.jpg)
Ad
More Related Content
What's hot (19)
Viewers also liked (6)
Ad
Similar to Git dvcs and Information Security Review (20)
Ad
Recently uploaded (20)
Git dvcs and Information Security Review
- 1. Faites de votre projet un succès DVCS in big enterprise Security challenges
- 2. 2 Contestants DVCS in Big Enterprise FIGHT!
- 3. 3 Me (1/2) Daniel CHAFFIOL Softeam Cadextan (1999) DVCS in Big Enterprise BNP-Paribas Société Générale HSBC
- 4. 4 Me (2/2) DVCS in Big Enterprise VonC Stack Overflow (2008) Git Hg – SVN - ClearCase Eclipse - Jenkins
- 5. 5 Goal Installation Communication ISR DVCS in Big Enterprise
- 6. 6 1 Installation : Git all alone DVCS in Big Enterprise
- 7. 7 Git - Installation Step 1 Step 2 git config --global user.name myUsername Step 3 git config --global user.email my.user@email git config --global color.ui always git config --global alias.st status git config --global alias.lg git log --graph --online
- 8. 8 Git - Result .git .git
- 9. 9 Git - DefauLt .git .git ?
- 10. 10
- 11. 11 Git - LISTENER .git .git
- 12. 12 Git – LISTENERS ? .git .git .git .git .git .git
- 13. 13 Git – LISTENER SERVER .git .git .git .git .git
- 14. 14 Git - RECAP
- 15. 15
- 16. 16 1 Listeners: Git not-so-easy DVCS in Big Enterprise 2
- 17. 17 Git – MEET The LISTENERS
- 18. 18 Git – Apache SetEnv GIT_PROJECT_ROOT /.../... SetEnv GIT_HTTP_EXPORT_ALL ScriptAlias /git/ git-core/git-http-backend/ <Location /git> Order deny,allow Allow from all </Location>
- 19. 19 Git – Apache with authentication SetEnv GIT_PROJECT_ROOT /.../... SetEnv GIT_HTTP_EXPORT_ALL ScriptAlias /git/ git-core/git-http-backend/ <Location /git> Order deny,allow Require valid-user AuthType Basic AuthBasicProvider ldap </Location>
- 20. 20 Git – Apache with AUTHORIZATION SetEnv GIT_PROJECT_ROOT /.../... SetEnv GIT_HTTP_EXPORT_ALL ScriptAlias /git/ .../gitolite-shell/ SetEnv GIT_HTTP_BACKEND .../git-http-backend <Location /git> Order deny,allow Require valid-user AuthType Basic AuthBasicProvider ldap </Location>
- 21. 21 Git – Apache with AUTHORIZATION SetEnv GIT_PROJECT_ROOT /.../... SetEnv GIT_HTTP_EXPORT_ALL ScriptAlias /git/ .../gitolite-shell/ SetEnv GIT_HTTP_BACKEND .../git-http-backend <Location /git> Order deny,allow Require valid-user Require ldap-group xxx AuthType Basic AuthBasicProvider ldap </Location>
- 22. 22 Git – SSH with GITOLITE command="[path]/gitolite-shell user1",[more options] ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA 18S2t... command="[path]/gitolite-shell user2",[more options] ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA rXtCT... ~/.ssh/authorized_keys
- 23. 23 Git – Nginx with REVERSE PROXY ssl on; ssl_certificate .../itsvc.world.company.crt; ssl_certificate_key .../itsvc.world.company.key; location /git/ { proxy_pass https://Srv:8080/git/; } location /gitweb/ { proxy_pass https://Srv:8081/gitweb/; }
- 24. 24 Git - RECAP
- 25. 25
- 26. 26 ISR ISR DVCS in Big Enterprise
- 27. 27 ISR: Hell on Wheels ISR DVCS in Big Enterprise
- 28. 28 1 ISR & Git: Hell on wheels DVCS in Big Enterprise 3
- 29. 29
- 30. 30 ISR infrastructure Application DVCS in Big Enterprise
- 31. 31 ISR DVCS in Big Enterprise infrastructure
- 32. 32 Git – INFRA (no cache) Http Cache control Options -Indexes CacheIgnoreHeaders Set- Cookie SetEnv no-cache SetEnv no-store SetEnv must-revalidate Header merge Cache-Control no-cache Header add Pragma no-cache Header merge Cache-Control no-store Header merge Cache-Control must-revalidate
- 33. 33 Git – INFRA (no weak cipher) SSLProtocol all -SSLv2 -SSLv3 SSLHonorCipherOrder on SSLCipherSuite ... SSL Ciphers ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers ...
- 34. 34 Git – INFRA (ssh banner) Banner /path/to/.ssh.banner SSH Banners Big Bank Legal Notice This is a computer system owned by Big Bank Plc. All programs and data on this system are the property of or licensed by Big Bank Plc...
- 35. 35 Git – INFRA (no service discovery) ServerTokens Prod Service discovery server_tokens off;
- 36. 36 ISR Application DVCS in Big Enterprise
- 37. 37 Git – Application (no XFS) Header always append X-Frame-Options DENY Cross-Frame Scripting (XFS) add_header X-Frame-Options DENY;
- 38. top.location=location 38 Git – Application (no XFS) Header always append X-Frame-Options DENY Cross-Frame Scripting (XFS) <script>if (top != self) </script> </body> add_header X-Frame-Options DENY;
- 39. 39 Git – Application (no auto-completion) Gitweb: no auto-complete <script src="jquery.min.js" /> <script src="doc_ready.js" /> </body> doc_ready.js: $(document).ready(function() { $("input"). attr("autocomplete", "off"); });
- 40. 40 Git – Application (gitweb : login page) Gitweb: limited login attempts <section class="container"> <h1>Login to App</h1> <form method="POST" action=""> <input type="text" name="httpd_username" value="" /> <input type="password" name="httpd_password" value="" /> <input type="submit" name="login" value="Login">
- 41. 41 Git – Application (Apache: new directives) Gitweb: limited login attempts AP_INIT_TAKE1( "AuthFormAttempts", set_attempts, NULL, ACCESS_CONF, "Maximum number of login attempts."), AP_INIT_TAKE1( "AuthFormLockout", set_lockout, NULL, ACCESS_CONF, "Lockout time in seconds if number of login attempts is exceeded."), mod_auth_form.c
- 42. 42 Git – Application (apache : login attempts & lockout) AuthFormAttempts 4 AuthFormLockout 180 Gitweb: limited login attempts
- 43. 43 ISR: RECAP infrastructure Application DVCS in Big Enterprise
- 44. 44 Let's just put Git in place... it will be easy!
- 45. 45 Let's just put Git in place... It will be easy!
- 46. 46 ISR: RECAP infrastructure Application DVCS in Big Enterprise
- 47. Faites de votre projet un succès 21, avenue Victor Hugo 75016 Paris www.softeam.fr 47 http://www.iconarchive.com/show/free-large-boss-icons-by-aha-soft.html http://www.iconarchive.com/show/delta-icons-by-aroche.html http://www.myfonts.com/fonts/haiku/insolent/licensing.html http://www.iconarchive.com/show/plump-icons-by-zerode.html http://www.iconarchive.com/show/vista-hardware-devices-icons-by-icons-land.html http://www.iconarchive.com/show/warm-toolbar-icons-by-avosoft.html http://www.avo-soft.com/ http://www.iconarchive.com/show/nuoveXT-icons-by-saki.html http://www.iconarchive.com/show/ios7-icons-by-icons8.html (http://icons8.com/) http://www.iconarchive.com/show/oxygen-icons-by-oxygen-icons.org.html http://www.iconarchive.com/show/despicable-me-2-icons-by-designbolts.html
Editor's Notes
- #2: This is about the cognitive dissonance between: - a Decentralised tool (with light authentication scheme and no or little authorization) - a Centralized environment (with strong authentication and authorization constraint)
- #3: When a decentralised tool communicates information When Information Security Review has a look into said decentralised tool … Fight. &lt;number&gt;
- #4: Mainly large banking companies since 1999 Full resume: http://careers.stackoverflow.com/vonc &lt;number&gt;
- #5: On Stack Overflow since Stack Overflow exists (Sept. 2008) http://stackoverflow.com/users/6309/vonc &lt;number&gt;
- #6: Installing is easy Communication between Git repos is harder Being compliant with ISR (Information Security Review) is really hard. &lt;number&gt;
- #7: Installing Git on a developer&apos;s PC. Easy
- #8: &lt;number&gt; Grab an archive (.7z) on https://github.com/msysgit/msysgit/releases/ Unzip and you are up and running in no time.
- #9: &lt;number&gt; No processes involved: Git is purely a filesystem manager. However, it is only useful if you can replicate the Git repo to another PC.
- #10: &lt;number&gt; Git daemon (non-standard port) is prohibited. And enterprise doesn&apos;t allow shared folders (which has limited authorization anyway)
- #11: So, with Git alone, you end up all alone. Stranded on your PC.
- #12: &lt;number&gt; What you need, for any service communication, is: Authentication (encrypted) Authorization ACL (Access Control Level) Audit Monitoring
- #13: &lt;number&gt; Obviously, you can&apos;t deploy a listener to each node That would be a mess to maintain.
- #14: &lt;number&gt; You need one centralized server, dedicated for Git repos hosting, with a unique listener able to provide the features needed.
- #15: &lt;number&gt; And those features are: Authentication (encrypted) Authorization ACL (Access Control Level) Audit Monitoring For Git repos hosting.
- #16: So... How do we get there? How do we implement a listener with all those features?
- #17: Communication between clients and a dedicated server. The not-so-easy part.
- #18: &lt;number&gt; Listeneners (Apache, ssh) ensure the encrtypted authentication part. Gitolite does the ACL and audit part. NgiNX provides one unique url with reverse proxy to: Git GitWeb
- #19: &lt;number&gt; Git is made to be called by Apache: every Git distro shops with a perl script able to interpret an http query: git-http-backend. However, there is no authentication.
- #20: &lt;number&gt; Adding authentication means, in a big company, requiring validation from an LDAP database. But, you still don&apos;t have authorization: all the repos are available, without restriction.
- #21: &lt;number&gt; Calling gitolite instead of git-http-backend allows you to add ACL between your listener and your data (the Git repo). That will provide fine-grained ACL, up to the branch or file level for writing. Note that reading remains at the repo level: if you can access a repo, you can access all its content.
- #22: &lt;number&gt; Even before calling ACL, the first control is an LDAP one If you are not in a specific LDAP group, you don&apos;t have access to anything. https://github.com/VonC/compileEverything/commit/6944b7855ebf9756c300e51c000e1eda1ba1c83b
- #23: &lt;number&gt; An ssh listener must not provide an interactive secure shell: non-interactive access only. The forced command feature from ssh (nothing to do with Git or gitolite) will make that non-interactive session calling gitolite (with your name and the repo you want to access) See http://stackoverflow.com/a/13320256/6309
- #24: &lt;number&gt; NGiNX provides: secure access (SSL: Secure Socket Layer), a cryptographic protocol designed to provide communication security over the Internet.http://en.wikipedia.org/wiki/Transport_Layer_Security Reverse proxy to various http services (Gti, GitWeb, Gerrit), but also other services (Jenkins, Nexus, SVN, Jira, …)
- #25: &lt;number&gt; So here you have the moving parts to put in place in order to provide a listener in a big enterprise: reverse proxy SSL Apache http (web access) SSH ACL (Gitolite, with audit)
- #26: Those are your “Guardians of the Git”
- #27: &lt;number&gt; But... that listener still needs to pass the ISR (Information Security Review)
- #28: &lt;number&gt; And that process can becomes “Hell on Wheels”
- #29: Those are the challenges set by ISR for making the listeners compliant.
- #30: It refers to the Union Pacific Railroad and its surveyors, laborers, prostitutes, mercenaries, and others who lived, worked and died in the mobile encampment called &quot;Hell on Wheels&quot; that followed the railhead west across the Great Plains. First transcontinental railroad in North America. ~1866
- #31: &lt;number&gt; Infrastructure: set of interconnected structural elements that provide a framework supporting an entire structure of development Application software: Set of programs providing the features allowing access to a service.
- #32: &lt;number&gt; How the structural elements need to be configured to be compliant with ISR. This isn&apos;t about Git, but about those elements themselves.
- #33: &lt;number&gt; More details with: https://github.com/VonC/compileEverything/commit/64290cc4c4b902eb3c65fb551710708b93b1fc69 http://stackoverflow.com/q/10314174/6309 Pragma is the HTTP/1.0 implementation and cache-control is the HTTP/1.1 implementation of the same concept. They both are meant to prevent the client from caching the response.
- #34: &lt;number&gt; In cryptography, a cipher (or cypher) is an algorithm for performing encryption or decryption. More details with: https://github.com/VonC/compileEverything/commit/5c35daf9aabd921c70e74e95c30fbef6db816fd4 https://github.com/VonC/compileEverything/commit/bdafe2407bc3f1e5770b248735410e148fdf4323
- #35: &lt;number&gt; More details with: https://github.com/VonC/compileEverything/commit/95a9ccfc8c1cf2848e9580b4704cd0cea07ab6cf Plc: Public Limited Company It is a limited (liability) company whose shares may be freely sold and traded to the public.
- #36: &lt;number&gt; More details with: https://github.com/VonC/compileEverything/commit/ff5bd054f2d4fc33d7df439e1a9ec47630aed900
- #37: &lt;number&gt; Application is about the features that the aforementioned pieces need to provide in order to access your service (here, the Git repos)
- #38: Cross-Frame Scripting (XFS) is client-side attack related to Cross-site Scripting (XSS) The attacker&apos;s page loads your vulnerable page inside an HTML frame; and JavaScript executing in the attacker&apos;s page steals the victims data from your page https://github.com/VonC/compileEverything/commit/4782d7b0f1d2c58c5df8a0248819694a1030ccce &lt;number&gt;
- #39: Here you start forking, managing a personal version of an application (in this instance, gitweb) https://github.com/VonC/compileEverything/commit/2d6f8924510e1390fa76fb86e4ce6cd73db646e3 &lt;number&gt;
- #40: Again forking, Gitweb: https://github.com/VonC/compileEverything/commit/96f297892cf3a9d63a1fa28a45b20b87f9290706 https://github.com/VonC/compileEverything/commit/45bcb94cd5378266723ed3d28077927562a113fc &lt;number&gt;
- #41: Add login.html for gitweb: https://github.com/VonC/compileEverything/commit/445c98b9eb003e3a5dd04dd6c7eb1d6356280108 &lt;number&gt;
- #42: &lt;number&gt; More details with C code within Apache: https://github.com/VonC/compileEverything/commit/5c6e55a221387fb757914a516c219fb0c6b9bf45
- #43: Those two directives in httpd.conf do not exist.They are the result of a new code within mod_auth_form.c https://github.com/VonC/compileEverything/commit/6f5525005da953ab2f89f4fea7a247665beefbfb &lt;number&gt;
- #44: &lt;number&gt; Infrastructure: The structural elements are not configured by default to be compliant with ISR Application software: Basic security features are missing, especially for web applications
- #45: If you are not satisfied with your Version Control System of the moment, and decide to “just install Git”... It is easy for the client (developer)
- #46: … But putting a Distributed Version Control System in a large enterprise, used to centralized processes and controls, that is no picnic.
- #47: &lt;number&gt; Infrastructure: Listeners and reverse proxy Application software: Authentication (with login management), authorization (with ACL) and audit That involves a lot of configuration (infra) and forking (specific development, application) Any question?
- #48: Here are the picture, fonts and icons references, for licence.