Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Nmap fix #362

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Nmap fix #362

wants to merge 3 commits into from

Conversation

domwhewell
Copy link

Issue

#357

Description of the Change

This change adds the nmap binary to both local and production django containers.

Production django container is not running as root and cannot run an nmap scan with -sS:

  • libcap has been added to the production docker container in order to set the nmap binary capabilities so as to not require root
  • An NMAP_PRIVILEGED environment variable has also been added to tell the nmap binary that it has the required capabilities already instead of checking for root

Alternate Designs

Running the container as root in production is a security risk. So this was not explored.
Nmap can be used without priviledges using the environment variable or using a --privileged option. Using the --privileged option would require this to be added to the rolodex tasks function instead.

Possible Drawbacks

Nmap is installed on the container potentially allowing anyone who has access to the container cli to run a SYN scan against the localhost or other servers not owned by the user

Verification Process

  • Checked the Dockerfile setup the queue container as expected - correct binarys installed, cap's set correctly, env variable set
  • Run the nmap binary on the container using docker exec - nmap binary runs without error
  • Spun up the production containers and added a task to scan servers - task completes without error

Release Notes

  • Added nmap binary to local and production Dockerfile's
  • Set capabilities on nmap binary so root priviledges are not required

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants