search

canonical / lxd-demo-server

The LXD demo server
https://linuxcontainers.org/lxd/try-it
Apache License 2.0
74 stars 26 forks source link

Whitelist Fedora mirrors #14

Closed techtonik closed 6 years ago

techtonik commented 6 years ago

Being able to execute Fedora in Ubuntu is a killer feature, IMHO. )

But there is nothing to test even if container started. It comes even without Python. I can not copy/paste code to prove that, because of #5, but it would be much better experience being able to install some packages, and for that at least https://mirrors.fedoraproject.org/ should be whitelisted.

stgraber commented 6 years ago

As I mentioned in the linuxcontainers.org issue, Internet access is blocked on purpose for security reason.

It is possible for someone to create a fedora container or any distro for that matter in the try-it environment and to then get a shell inside it, proving that it does work. Installing packages in there is out of scope and allowing it would be a potential security and legal risk for us.

techtonik commented 6 years ago

But Ubuntu http://archive.ubuntu.com/ works. Why not allow the same with official Fedora path?

stgraber commented 6 years ago

As mentioned in the other issue, the reason why some servers under ubuntu.com and canonical.com are reachable from try-it is because I'm either the one in charge of those services or I've worked with the sysadmins that do and so in the event that someone is using tryit to attack any of those services, they know what this is and how to reach me.

techtonik commented 6 years ago

But package service is only used to fetch software. Everything else will be done from LXD server. It is also possible to pipe bad shellcode to terminal.

techtonik commented 6 years ago

Or you mean that LXD can be then used to attack those servers? Then any host can be used to do so.

stgraber commented 6 years ago

Yes, any host can be used to do so, but the problem here is that it's my IP address which would be used for such an attack and so would legally be my responsibility.

techtonik commented 6 years ago

That's not right. Any host can be hacked. Making best known efforts to secure the site should be enough to be clean from accusation.

  1. Whitelist Fedora mirror with limiting requests by request/second
  2. Get stats about container traffic patterns
  3. Provide a DNS record that allows to contact you (automatically?) in case of DoS or other incident

Why it is not possible?

stgraber commented 6 years ago

It's possible, I just have no intention of doing any of it. I'm the one providing the service and so I get to make the decision on what I find acceptable to allow and what I don't.

This service is provided as a way to try LXD by following a set of step by step instructions. Those instructions work perfectly fine with the current network restrictions so there's really no reason to open things up any more than they are today.

techtonik commented 6 years ago

So somebody should take the task of creating a LXD solution with explanation how to secure it and monitor incidents so that it can be deployed as a backend to various online tutorials like Katacoda instead of Docker.