Is SSH server in GlusterFS containers really needed? about gluster-kubernetes HOT 10 CLOSED

from gluster-kubernetes.

@humblec thanks for the quick reply. Is there any environment variable to turn SSH off, or should I run some command in each container of the daemonset?

from gluster-kubernetes.

I see this is a bit of an old ticket, but a client of mine just got hit with bandwidth overages of $900

I wasn't aware of the following:

• another copy of sshd was running and open to the internet on port 2222 for no reason
• that sshd_config allowed for passwords (really)
• that password was easy enough to be brute forced in a relatively quick manner by this botnet.

This was thankfully only a lab/dev cluster, and I'm not upset with any of you guys, more at the host for failing to mention anything about this, they surely knew about it.

So I had a node with an infected container containing a botnet called BillGates. And of course this is lovely because we know this container usually runs as a daemonset, in hostnetwork, privileged mode.

Is there anything I can help contribute to make this a more minimal image? Is SystemD really necessary in a container(is that a hard requirement for lvm or something)? And maybe ssh should not be on by default for kubernetes since it's not even necessary.

I saved alot of information and the binaries/exported container from the infection if anyone wants to review it but it's pretty simple it bruteforced the root password of the glusterfs container running sshd and setup shop in /etc/init.d. If you would like any of it, just let me know

Joe
[email protected]

from gluster-kubernetes.

@joeblackwaslike @webwurst the password had already disabled in gluster container and the images were rebuilt some time back. May be they havent pulled the latest images.

from gluster-kubernetes.

@mcapuccini Sorry this has sat silent so long. Did you manage to find a suitable solution?

from gluster-kubernetes.

@jarrpa I ended up making my own containers, but I'd be happy to switch to the official one if there is a way to turn of ssh when I start the container

from gluster-kubernetes.

@mcapuccini I think building a different container would be the only reasonable way to do this. Thought just thinking off the top of my head: If there was a startup script that called init instead of calling init directly, we could detect an environment variable that would allow us to disable sshd... however, then the container is still telling Docker that it's listening on port 2222 (via EXPOSE) wouldn't it?

from gluster-kubernetes.

@mcapuccini hopefully soon. We are revisiting gluster/gluster-containers#18

from gluster-kubernetes.

I heard of another case like this. But there the hoster took down the node after it got infected..

from gluster-kubernetes.

While we have at least reached an update, the reoslution of this issue lies in https://github.com/gluster/gluster-containers . Closing this issue.

from gluster-kubernetes.