-
Notifications
You must be signed in to change notification settings - Fork 0
/
atom.xml
1380 lines (1118 loc) · 84.5 KB
/
atom.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
<title><![CDATA[bitJudo]]></title>
<link href="http://bitjudo.com/atom.xml" rel="self"/>
<link href="http://bitjudo.com/"/>
<updated>2014-06-09T20:42:21-04:00</updated>
<id>http://bitjudo.com/</id>
<author>
<name><![CDATA[a couple of geeks]]></name>
</author>
<generator uri="http://octopress.org/">Octopress</generator>
<entry>
<title type="html"><![CDATA[Encrypting AWS Instance Storage]]></title>
<link href="http://bitjudo.com/blog/2014/06/09/encrypting-aws-instance-storage/"/>
<updated>2014-06-09T20:43:52-04:00</updated>
<id>http://bitjudo.com/blog/2014/06/09/encrypting-aws-instance-storage</id>
<content type="html"><![CDATA[<p><strong>Encrypted Data at Rest</strong> is the big term that has been floating around for several years. Just recently AWS started offering encrypted EBS volumes, the only problem with that is you cannot encrypt Instance Storage (aka Ephemeral Storage) volumes or Root volumes. This solution will not work for Root volumes, but it will for the Ephemeral volumes. The only potential problem with the encrypted EBS volumes is that AWS retains controls of the encryption keys for you in their IAM system. However since you’ve chosen to use the cloud that might not be a problem. Thankfully using SaltStack and my previous trick <a href="">Just in Time Encryption Keys using SaltStack</a>, you can automatically encrypt your Instance Storage on your EC2 Instances giving you that extra layer of security. This can be extremely beneficial if you want to convey to your clients that you are doing <strong>Full Disk Encryption</strong> and you want the ability to use SSD storage instead of EBS volumes.</p>
<!-- more -->
<h2>Overview</h2>
<p>Using the same principles from my previous post about using SaltStack to deliver the encryption keys you can automatically encrypt all instance storage very quickly and effectively using LUKS. You will need SaltStack installed, with the <a href="https://github.com/saltstack/salt-contrib/blob/master/grains/ec2_tags.py">EC2 Grains plugin</a> (Please note that you’ll need the Boto python plugin installed for it to work). The EC2 Grains plugin gathers all the metadata from about your instance and updates the minion’s grain information. Using the EC2 grains we can find all attached ephemeral (aka instance storage) disks and encrypt them at boot.</p>
<p>Current this state has only been tested on Ubuntu systems, but should be easily expandable to others as well, just need to make sure the proper LVM packages are installed.</p>
<p>This state also stores the encrypt volume paths in a grain, so that you can access them from other states in Salt.</p>
<h2>The Breakdown</h2>
<p><strong>Lines 1 and 2</strong> are basic setup for the state, if you want to set a custom password, just make sure you set a <code>instanceluks:password</code> pillar data. You can also do per volume or drive passwords, on <strong>Line 25</strong></p>
<p><strong>Lines 4 through 16</strong> install the necessary crypsetup and LVM for ubuntu, with a little bit of work other operating systems can be supported.</p>
<p><strong>Line 18</strong> starts the loop through the instance storage (ephemeral disk)</p>
<p><strong>Line 19</strong> checks to see if the ephemeral disk exists, <strong>Note:</strong> Earlier I stated you had to install the ec2_tags.py grains module, this is why.</p>
<p><strong>Line 25</strong> if you set <code>instanceluks:passwords:NAME</code> in your pillar data, the state will use it, else it will use the global password set on <strong>Line 2</strong>.</p>
<p>The rest of the state are all the state commands to check if the LUKS partition has already been created, if not then create it, otherwise mount it after unlocking the volume.</p>
<p>After each volume is encrypted and mounted the state stores the volume mount path back into the hosts grains so that other states can access it, see <strong>Lines 60-63</strong></p>
<h2>The Full State</h2>
<div><script src='https://gist.github.com/8f88244ba6f8c253cfca.js?file=instanceluks.state'></script>
<noscript><pre><code>{%- set numbers = ['0', '1', '2', '3', '4', '5', '6', '7', '8'] -%}
{%- set global_password = salt['pillar.get']('instanceluks:password', 'testing12345') -%}
{% if grains['os_family'] == 'Debian' %}
instanceluks_crypto_package:
pkg:
- name: cryptsetup
- order: 5
- installed
instanceluks_lvm2_package:
pkg:
- name: lvm2
- order: 6
- installed
{% endif %}
{% for num in numbers %}
{%- set device = salt['grains.get']('ec2_block-device-mapping_ephemeral' + num, false) -%}
{% if device %}
{%- if grains['os_family'] == 'Debian' -%}
{%- set device = device|replace("sd", "xvd") -%}
{%- endif -%}
{%- set name = "data" + num -%}
{%- set password = salt['pillar.get']('instanceluks:passwords:' + name, global_password) -%}
instanceluks_umount_{{ num }}:
cmd.run:
- name: umount /dev/{{ device }}
- onlyif: df | grep /dev/{{ device }}
- order: 10
instanceluks_encrypt_{{ num }}:
cmd.run:
- unless: cryptsetup luksUUID /dev/{{ device }}
- name: echo "{{ password }}" | cryptsetup luksFormat /dev/{{ device }}
- order: 12
instanceluks_open_{{ num }}:
cmd.run:
- unless: stat /dev/mapper/{{ name }}
- name: echo "{{ password }}" | cryptsetup luksOpen /dev/{{ device }} {{ name }}
- order: 14
instanceluks_format_{{ num }}:
cmd.run:
- unless: lsblk -f /dev/mapper/{{ name }} | grep ext4
- name: mkfs.ext4 /dev/mapper/{{ name }}
- order: 16
instanceluks_mount_{{ num }}:
mount.mounted:
- name: /{{ name }}
- device: /dev/mapper/{{ name }}
- fstype: ext4
- mkmnt: True
- persist: False
- order: 18
instanceluks_grain_{{ num }}:
grains.list_present:
- name: instanceluks_volumes
- value: /{{ name }}
{% endif %}
{% endfor %}</code></pre></noscript></div>
<h2>Conclusion</h2>
<p>If you find this useful let me know. As always comments, questions, critique, etc is always welcome. Cheers!</p>
]]></content>
</entry>
<entry>
<title type="html"><![CDATA[Partial Continuous Deployment with Docker and SaltStack]]></title>
<link href="http://bitjudo.com/blog/2014/05/13/partial-continuous-deployment-with-docker-and-saltstack/"/>
<updated>2014-05-13T21:10:57-04:00</updated>
<id>http://bitjudo.com/blog/2014/05/13/partial-continuous-deployment-with-docker-and-saltstack</id>
<content type="html"><![CDATA[<p>If you haven’t figured out by now, I’m a big fan of both <a href="http://www.docker.io">Docker</a> and <a href="http://www.saltstack.com">SaltStack</a>. I’ve been using them both separately for a while now, but recently started using them together. Here’s my first iteration of continuous deployment using Docker and SaltStack.</p>
<p>This article will show you how to use <code>SaltStack</code> to re-deploy a container when a new version becomes available. I’ve made a few assumptions: (1) you know what Docker and SaltStack are, (2) you understand what a SaltStack State is, and (3) that you will use a docker index/registry to pull in your docker images (check out my <a href="https://github.com/ekristen/docker-index">docker-index</a> project).</p>
<p>This post will break down the state file to explain each step, so even if you are not a Salt guru it should generally make sense. I won’t cover building docker images or how to trigger SaltStack to run the state file. (That might come in a future article.)</p>
<!-- more -->
<h1>The Salt State</h1>
<p>What makes this all possible is a crafting a SaltStack state to run certain commands when certain conditions apply. For example you can have the state stop a running container if a new version of an image is available, but if the image hasn’t changed then do nothing.</p>
<p>For the rest of this article we’ll be using <a href="https://github.com/ekristen/docker-index">docker index</a> (just an application I wrote) as the example application to deploy.</p>
<p>If you want to skip the explanation and just grab the whole state file, jump down the page a bit.</p>
<h2>The State Explained</h2>
<h3>Step 1 – Always Pull the Most Recent Image</h3>
<p>First we want to make sure to <strong>ALWAYS</strong> pull the latest image. We use different tags based on the environment, <code>:dev</code> for dev, <code>:qa</code> for quality assurance, <code>:prod</code> for production. This allows taggging specific versions for release to different environments, but also allows us to tag an application as its version number plus the environment it goes to. By making the state always perform a pull we make sure that the latest image pushed to the registry is pulled down and ready.</p>
<figure class='code'><figcaption><span>docker-index.sls </span></figcaption>
<div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
<span class='line-number'>3</span>
<span class='line-number'>4</span>
<span class='line-number'>5</span>
</pre></td><td class='code'><pre><code class='yaml'><span class='line'><span class="l-Scalar-Plain">docker_index_image</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="l-Scalar-Plain">docker.pulled</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">name</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">index.docker.io/ekristen/docker-index:dev</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">force</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">True</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">order</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">100</span>
</span></code></pre></td></tr></table></div></figure>
<h3>Step 2 — Stop If New Image Available</h3>
<p>Next, we check and see if the latest version is running. We want the state to be idempotent if possible.</p>
<figure class='code'><figcaption><span>docker-index.sls </span></figcaption>
<div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
<span class='line-number'>3</span>
<span class='line-number'>4</span>
<span class='line-number'>5</span>
<span class='line-number'>6</span>
<span class='line-number'>7</span>
</pre></td><td class='code'><pre><code class='yaml'><span class='line'><span class="l-Scalar-Plain">docker_index_stop_if_old</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="l-Scalar-Plain">cmd.run</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">name</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker stop docker_index</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">unless</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker inspect --format "{{ .Image }}" docker_index | grep $(docker images | grep "index.docker.io/ekristen/docker-index:dev" | awk '{ print $3 }')</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">require</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">docker</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker_index_image</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">order</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">111</span>
</span></code></pre></td></tr></table></div></figure>
<p>The <code>unless</code> basically looks at the list of available images and grabs the unique hash of <code>index.docker.io/ekristen/docker-index:dev</code> and then greps the <code>.Image</code> value from the <code>inspect</code> command of the current running container named <code>docker-index</code>. This works because in <strong>Step 1</strong> we made sure we pulled down the latest version of the <code>dev</code> tag.</p>
<h3>Step 3 – Remove If We Stopped</h3>
<p>If we stopped the container in <strong>Step 2</strong> then we want to also remove the container so that we can re-deploy it in <strong>Step 3</strong> and start it in <strong>Step 4</strong>.</p>
<figure class='code'><figcaption><span>docker-index.sls </span></figcaption>
<div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
<span class='line-number'>3</span>
<span class='line-number'>4</span>
<span class='line-number'>5</span>
<span class='line-number'>6</span>
<span class='line-number'>7</span>
</pre></td><td class='code'><pre><code class='yaml'><span class='line'><span class="l-Scalar-Plain">docker_index_remove_if_old</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="l-Scalar-Plain">cmd.run</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">name</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker rm docker_index</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">unless</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker inspect --format "{{ .Image }}" docker_index | grep $(docker images | grep "index.docker.io/ekristen/docker-index:dev" | awk '{ print $3 }')</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">require</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">cmd</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker_index_stop_if_old</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">order</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">112</span>
</span></code></pre></td></tr></table></div></figure>
<p>The <code>unless</code> does the same as in <strong>Step 2</strong> and checks to ensure the existing container is using a different image then the latest one.</p>
<h3>Step 4 – Create the Container</h3>
<p>Now that we have successfully stopped and removed the old container, we can install the new container, and start it up (<strong>Step 5</strong>)</p>
<p>This part of the state defines the container and installs it but does not start it.</p>
<figure class='code'><figcaption><span>docker-index.sls </span></figcaption>
<div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
<span class='line-number'>3</span>
<span class='line-number'>4</span>
<span class='line-number'>5</span>
<span class='line-number'>6</span>
<span class='line-number'>7</span>
<span class='line-number'>8</span>
<span class='line-number'>9</span>
<span class='line-number'>10</span>
<span class='line-number'>11</span>
<span class='line-number'>12</span>
<span class='line-number'>13</span>
</pre></td><td class='code'><pre><code class='yaml'><span class='line'><span class="l-Scalar-Plain">docker_index_container</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="l-Scalar-Plain">docker.installed</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">name</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker_index</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">image</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">index.docker.io/ekristen/docker-index:dev</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">environment</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="s">"REDIS_HOST"</span><span class="p-Indicator">:</span> <span class="s">"192.168.1.100"</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="s">"REDIS_PORT"</span><span class="p-Indicator">:</span> <span class="s">"6379"</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="s">"PORT"</span><span class="p-Indicator">:</span> <span class="s">"5100"</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">ports</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="s">"5100/tcp"</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">require</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">docker</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker_index_image</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">order</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">120</span>
</span></code></pre></td></tr></table></div></figure>
<h3>Step 5 – Start the Container</h3>
<p>We are almost done. Finally we want to make sure the container is running.</p>
<p><strong>Note:</strong> Unfortunately the documentation on the docker states is still pretty rough. Pay close attention when you are defining port bindings, they must be double indented to work properly!</p>
<figure class='code'><figcaption><span>docker-index.sls </span></figcaption>
<div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
<span class='line-number'>3</span>
<span class='line-number'>4</span>
<span class='line-number'>5</span>
<span class='line-number'>6</span>
<span class='line-number'>7</span>
<span class='line-number'>8</span>
<span class='line-number'>9</span>
<span class='line-number'>10</span>
</pre></td><td class='code'><pre><code class='yaml'><span class='line'><span class="l-Scalar-Plain">docker_index_running</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="l-Scalar-Plain">docker.running</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">container</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker_index</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">port_bindings</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="s">"5001/tcp"</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="l-Scalar-Plain">HostIp</span><span class="p-Indicator">:</span> <span class="s">"0.0.0.0"</span>
</span><span class='line'> <span class="l-Scalar-Plain">HostPort</span><span class="p-Indicator">:</span> <span class="s">"5100"</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">require</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">docker</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker_index_container</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">order</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">121</span>
</span></code></pre></td></tr></table></div></figure>
<h2>The Whole State</h2>
<p>Here is the state file in its entirety.</p>
<figure class='code'><figcaption><span>docker-index.sls </span></figcaption>
<div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
<span class='line-number'>3</span>
<span class='line-number'>4</span>
<span class='line-number'>5</span>
<span class='line-number'>6</span>
<span class='line-number'>7</span>
<span class='line-number'>8</span>
<span class='line-number'>9</span>
<span class='line-number'>10</span>
<span class='line-number'>11</span>
<span class='line-number'>12</span>
<span class='line-number'>13</span>
<span class='line-number'>14</span>
<span class='line-number'>15</span>
<span class='line-number'>16</span>
<span class='line-number'>17</span>
<span class='line-number'>18</span>
<span class='line-number'>19</span>
<span class='line-number'>20</span>
<span class='line-number'>21</span>
<span class='line-number'>22</span>
<span class='line-number'>23</span>
<span class='line-number'>24</span>
<span class='line-number'>25</span>
<span class='line-number'>26</span>
<span class='line-number'>27</span>
<span class='line-number'>28</span>
<span class='line-number'>29</span>
<span class='line-number'>30</span>
<span class='line-number'>31</span>
<span class='line-number'>32</span>
<span class='line-number'>33</span>
<span class='line-number'>34</span>
<span class='line-number'>35</span>
<span class='line-number'>36</span>
<span class='line-number'>37</span>
<span class='line-number'>38</span>
<span class='line-number'>39</span>
<span class='line-number'>40</span>
<span class='line-number'>41</span>
<span class='line-number'>42</span>
<span class='line-number'>43</span>
<span class='line-number'>44</span>
<span class='line-number'>45</span>
<span class='line-number'>46</span>
</pre></td><td class='code'><pre><code class='yaml'><span class='line'><span class="l-Scalar-Plain">docker_index_image</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="l-Scalar-Plain">docker.pulled</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">name</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">index.docker.io/ekristen/docker-index:dev</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">force</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">True</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">order</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">100</span>
</span><span class='line'>
</span><span class='line'><span class="l-Scalar-Plain">docker_index_stop_if_old</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="l-Scalar-Plain">cmd.run</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">name</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker stop docker_index</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">unless</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker inspect --format "{{ .Image }}" docker_index | grep $(docker images | grep "index.docker.io/ekristen/docker-index:dev" | awk '{ print $3 }')</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">require</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">docker</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker_index_image</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">order</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">111</span>
</span><span class='line'>
</span><span class='line'><span class="l-Scalar-Plain">docker_index_remove_if_old</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="l-Scalar-Plain">cmd.run</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">name</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker rm docker_index</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">unless</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker inspect --format "{{ .Image }}" docker_index | grep $(docker images | grep "index.docker.io/ekristen/docker-index:dev" | awk '{ print $3 }')</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">require</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">cmd</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker_index_stop_if_old</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">order</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">112</span>
</span><span class='line'>
</span><span class='line'><span class="l-Scalar-Plain">docker_index_container</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="l-Scalar-Plain">docker.installed</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">name</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker_index</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">image</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">index.docker.io/ekristen/docker-index:dev</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">environment</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="s">"REDIS_HOST"</span><span class="p-Indicator">:</span> <span class="s">"192.168.1.100"</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="s">"REDIS_PORT"</span><span class="p-Indicator">:</span> <span class="s">"6379"</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="s">"PORT"</span><span class="p-Indicator">:</span> <span class="s">"5100"</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">ports</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="s">"5100/tcp"</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">require</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">docker</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker_index_image</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">order</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">120</span>
</span><span class='line'>
</span><span class='line'><span class="l-Scalar-Plain">docker_index_running</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="l-Scalar-Plain">docker.running</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">container</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker_index</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">port_bindings</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="s">"5001/tcp"</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="l-Scalar-Plain">HostIp</span><span class="p-Indicator">:</span> <span class="s">"0.0.0.0"</span>
</span><span class='line'> <span class="l-Scalar-Plain">HostPort</span><span class="p-Indicator">:</span> <span class="s">"5100"</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">require</span><span class="p-Indicator">:</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">docker</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">docker_index_container</span>
</span><span class='line'> <span class="p-Indicator">-</span> <span class="l-Scalar-Plain">order</span><span class="p-Indicator">:</span> <span class="l-Scalar-Plain">121</span>
</span></code></pre></td></tr></table></div></figure>
<h1>Conclusion</h1>
<p>This solution works fairly well for my purpose. Docker is fast, and I plan to use this in a rolling restart configuration in production. The fact that it first stops the running container, removes it and then starts the new one isn’t a big deal for me. In my other environments, a few second hiccup is perfectly acceptable while the old is removed and the new is started.</p>
<p>I also have a few other tricks with Docker that I hope to be writing about soon, so please check back, and let me know what you thought about this article.</p>
]]></content>
</entry>
<entry>
<title type="html"><![CDATA[Docker Scripts - Updated]]></title>
<link href="http://bitjudo.com/blog/2014/05/07/docker-scripts-updated/"/>
<updated>2014-05-07T21:35:28-04:00</updated>
<id>http://bitjudo.com/blog/2014/05/07/docker-scripts-updated</id>
<content type="html"><![CDATA[<p>In a follow up to the original post <a href="">Docker Scripts</a>, Docker has made it so that you no longer need to have <code>jq</code> installed, you can do everything with the <code>docker</code> client’s inspect command and its (semi)new format feature.</p>
<p>I’ve updated the scripts to use the format command.</p>
<!-- more -->
<h2>Update Scripts</h2>
<h3>docker-get-ip</h3>
<figure class='code'><figcaption><span>docker-get-ip </span></figcaption>
<div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
</pre></td><td class='code'><pre><code class='bash'><span class='line'><span class="c"># Usage: docker-get-ip (name or sha)</span>
</span><span class='line'><span class="o">[</span> -n <span class="s2">"$1"</span> <span class="o">]</span> <span class="o">&&</span> docker inspect --format <span class="s2">"{{ .NetworkSettings.IPAddress }}"</span> <span class="nv">$1</span>
</span></code></pre></td></tr></table></div></figure>
<h3>docker-get-id</h3>
<figure class='code'><figcaption><span>docker-get-id </span></figcaption>
<div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
</pre></td><td class='code'><pre><code class='bash'><span class='line'><span class="c"># Usage: docker-get-id (friendly-name)</span>
</span><span class='line'><span class="o">[</span> -n <span class="s2">"$1"</span> <span class="o">]</span> <span class="o">&&</span> docker inspect --format <span class="s2">"{{ .ID }}"</span> <span class="nv">$1</span>
</span></code></pre></td></tr></table></div></figure>
<h3>docker-get-image</h3>
<p>I find this one useful for DevOps uses, when I have the friendly name, I can compare the current running container’s image with the one I expect it to have (like an update) and redeploy.</p>
<figure class='code'><figcaption><span>docker-get-image </span></figcaption>
<div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
</pre></td><td class='code'><pre><code class='bash'><span class='line'><span class="c"># Usage: docker-get-image (friendly-name)</span>
</span><span class='line'><span class="o">[</span> -n <span class="s2">"$1"</span> <span class="o">]</span> <span class="o">&&</span> docker inspect --format <span class="s2">"{{ .Image }}"</span> <span class="nv">$1</span>
</span></code></pre></td></tr></table></div></figure>
<h3>docker-get-state</h3>
<figure class='code'><figcaption><span>docker-get-state </span></figcaption>
<div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
</pre></td><td class='code'><pre><code class='bash'><span class='line'><span class="c"># Usage: docker-get-state (friendly-name)</span>
</span><span class='line'><span class="o">[</span> -n <span class="s2">"$1"</span> <span class="o">]</span> <span class="o">&&</span> docker inspect --format <span class="s2">"{{ .State.Running }}"</span> <span class="nv">$1</span>
</span></code></pre></td></tr></table></div></figure>
<h2>Conclusion</h2>
<p>These are just easy shortcuts, I’m sure you can write these in different ways or as aliases. Perhaps others will find this useful.</p>
]]></content>
</entry>
<entry>
<title type="html"><![CDATA[Analyzing an Android app with Docker and Androguard]]></title>
<link href="http://bitjudo.com/blog/2014/04/24/analyzing-an-android-app-with-docker-and-androguard/"/>
<updated>2014-04-24T19:48:05-04:00</updated>
<id>http://bitjudo.com/blog/2014/04/24/analyzing-an-android-app-with-docker-and-androguard</id>
<content type="html"><![CDATA[<h2>TL;DR</h2>
<p>Have you wanted to get into analyzing Android apps—for vulnerabilities,
malware, or just for fun? Maybe you’ve experienced problems getting an
environment setup because of complex tool dependencies, long READMEs, or just
never really knew where to get started? This article can help. Using docker I
can show you how to tear apart your first Android application, and maybe even
find some vulnerabilities while you’re at it.</p>
<!-- more -->
<h2>Dependencies</h2>
<p>I assume you have a working docker setup. If you aren’t sure how to set it up
on your platform, try following one of these
<a href="http://docs.docker.io/installation/">guides</a>.</p>
<h2>Download the repo</h2>
<p>First check out the code from
<a href="https://github.com/dweinstein/dockerfile-androguard">github</a> by running <code>git
clone [email protected]:dweinstein/dockerfile-androguard.git</code> or <code>git clone
https://github.com/dweinstein/dockerfile-androguard.git</code>.</p>
<p>This repo uses a <code>Dockerfile</code> to declare all the dependencies that you would
need if you were going to install the
<a href="https://code.google.com/p/androguard/">Androguard</a> tool your self. If you want
to know how to do it all manually, you can
<a href="https://code.google.com/p/androguard/wiki/Installation">see</a> for yourself.</p>
<h2>Build</h2>
<p>After cloning the repository, <code>cd</code> into the directory and you should see something like this:</p>
<figure class='code'><div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
</pre></td><td class='code'><pre><code class=''><span class='line'>➜ dockerfile-androguard git:(master) ls
</span><span class='line'>Dockerfile Makefile README.md data-container</span></code></pre></td></tr></table></div></figure>
<p>You can build by doing a <code>make build</code></p>
<h2>Run</h2>
<p>Once built, you have all you need to start analyzing your first app. I even put
an app in the repository for you to have something to play with right away! Just do a <code>make run</code>
and you should get something like this:</p>
<figure class='code'><div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
<span class='line-number'>3</span>
<span class='line-number'>4</span>
<span class='line-number'>5</span>
<span class='line-number'>6</span>
<span class='line-number'>7</span>
<span class='line-number'>8</span>
<span class='line-number'>9</span>
<span class='line-number'>10</span>
<span class='line-number'>11</span>
<span class='line-number'>12</span>
<span class='line-number'>13</span>
<span class='line-number'>14</span>
<span class='line-number'>15</span>
<span class='line-number'>16</span>
<span class='line-number'>17</span>
<span class='line-number'>18</span>
<span class='line-number'>19</span>
<span class='line-number'>20</span>
<span class='line-number'>21</span>
<span class='line-number'>22</span>
<span class='line-number'>23</span>
<span class='line-number'>24</span>
<span class='line-number'>25</span>
<span class='line-number'>26</span>
<span class='line-number'>27</span>
<span class='line-number'>28</span>
</pre></td><td class='code'><pre><code class=''><span class='line'>➜ dockerfile-androguard git:(master) make run
</span><span class='line'>make -C data-container build
</span><span class='line'>docker build -t androguard-data .
</span><span class='line'>Uploading context 133.1 kB
</span><span class='line'>Uploading context
</span><span class='line'>Step 0 : FROM busybox
</span><span class='line'> ---> 769b9341d937
</span><span class='line'>Step 1 : ADD apks /apks
</span><span class='line'> ---> Using cache
</span><span class='line'> ---> 595c1e66e01f
</span><span class='line'>Step 2 : VOLUME ["/apks"]
</span><span class='line'> ---> Using cache
</span><span class='line'> ---> 7d40787633a5
</span><span class='line'>Step 3 : VOLUME ["/notes"]
</span><span class='line'> ---> Using cache
</span><span class='line'> ---> c0dc7db54a78
</span><span class='line'>Step 4 : CMD ["/bin/true"]
</span><span class='line'> ---> Using cache
</span><span class='line'> ---> 845911656aad
</span><span class='line'>Successfully built 845911656aad
</span><span class='line'>make -C data-container run
</span><span class='line'>docker run --name androguard_data androguard-data &> /dev/null
</span><span class='line'>make[1]: [run] Error 1 (ignored)
</span><span class='line'>docker run -t -i --rm --volumes-from androguard_data androguard
</span><span class='line'>/usr/local/lib/python2.7/dist-packages/ipython-2.0.0-py2.7.egg/IPython/frontend.py:30: UserWarning: The top-level `frontend` package has been deprecated. All its subpackages have been moved to the top `IPython` level.
</span><span class='line'> warn("The top-level `frontend` package has been deprecated. "
</span><span class='line'>Androlyze version 2.0
</span><span class='line'>In [1]: </span></code></pre></td></tr></table></div></figure>
<p>This is an interactive shell session where you can begin to play with the apk
which I stored under <code>data-container/apks/test.apk</code>. Inside the container though it’ll
show up as <code>/apks/test.apk</code>.</p>
<figure class='code'><div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
<span class='line-number'>3</span>
</pre></td><td class='code'><pre><code class=''><span class='line'>In [1]: ls -lh /apks/
</span><span class='line'>total 128K
</span><span class='line'>-rw-r--r-- 1 root root 125K Apr 23 15:10 test.apk</span></code></pre></td></tr></table></div></figure>
<p>Load the APK into our APK object:</p>
<figure class='code'><div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
</pre></td><td class='code'><pre><code class=''><span class='line'>In [2]: apk = APK('apks/test.apk')</span></code></pre></td></tr></table></div></figure>
<p>List the files inside of it:</p>
<figure class='code'><div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
<span class='line-number'>3</span>
<span class='line-number'>4</span>
<span class='line-number'>5</span>
<span class='line-number'>6</span>
<span class='line-number'>7</span>
<span class='line-number'>8</span>
<span class='line-number'>9</span>
<span class='line-number'>10</span>
<span class='line-number'>11</span>
<span class='line-number'>12</span>
<span class='line-number'>13</span>
<span class='line-number'>14</span>
<span class='line-number'>15</span>
<span class='line-number'>16</span>
<span class='line-number'>17</span>
</pre></td><td class='code'><pre><code class=''><span class='line'>In [3]: apk.get_files()
</span><span class='line'>Out[3]:
</span><span class='line'>[u'META-INF/MANIFEST.MF',
</span><span class='line'> u'META-INF/APKIL.SF',
</span><span class='line'> u'META-INF/APKIL.RSA',
</span><span class='line'> u'res/layout/activity_main.xml',
</span><span class='line'> u'res/menu/activity_main.xml',
</span><span class='line'> u'AndroidManifest.xml',
</span><span class='line'> u'resources.arsc',
</span><span class='line'> u'res/drawable-hdpi/ic_action_search.png',
</span><span class='line'> u'res/drawable-hdpi/ic_launcher.png',
</span><span class='line'> u'res/drawable-ldpi/ic_launcher.png',
</span><span class='line'> u'res/drawable-mdpi/ic_action_search.png',
</span><span class='line'> u'res/drawable-mdpi/ic_launcher.png',
</span><span class='line'> u'res/drawable-xhdpi/ic_action_search.png',
</span><span class='line'> u'res/drawable-xhdpi/ic_launcher.png',
</span><span class='line'> u'classes.dex']</span></code></pre></td></tr></table></div></figure>
<p>Load up some more complex analysis objects:</p>
<figure class='code'><div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
<span class='line-number'>3</span>
<span class='line-number'>4</span>
<span class='line-number'>5</span>
<span class='line-number'>6</span>
<span class='line-number'>7</span>
</pre></td><td class='code'><pre><code class=''><span class='line'>In [4]: analysis = AnalyzeAPK('apks/test.apk')
</span><span class='line'>
</span><span class='line'>In [5]: analysis
</span><span class='line'>Out[5]:
</span><span class='line'>(<androguard.core.bytecodes.apk.APK instance at 0x1ce7c20>,
</span><span class='line'> <androguard.core.bytecodes.dvm.DalvikVMFormat at 0x1cdbfd0>,
</span><span class='line'> <androguard.core.analysis.analysis.uVMAnalysis instance at 0x326ed88>)</span></code></pre></td></tr></table></div></figure>
<p>Get the application’s <a href="http://developer.android.com/training/basics/activity-lifecycle/starting.html">main
activity</a>
(the first class that runs when the app starts…</p>
<figure class='code'><div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
</pre></td><td class='code'><pre><code class=''><span class='line'>In [6]: apk.get_main_activity()
</span><span class='line'>Out[6]: u'com.example.gangrene.GangreneActivity'
</span></code></pre></td></tr></table></div></figure>
<p>Get all classes/methods that have the word <code>gangrene</code> in them:</p>
<figure class='code'><div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
<span class='line-number'>3</span>
<span class='line-number'>4</span>
<span class='line-number'>5</span>
<span class='line-number'>6</span>
<span class='line-number'>7</span>
<span class='line-number'>8</span>
<span class='line-number'>9</span>
<span class='line-number'>10</span>
<span class='line-number'>11</span>
<span class='line-number'>12</span>
</pre></td><td class='code'><pre><code class=''><span class='line'>In [7]: show_Paths(analysis[1], analysis[2].tainted_packages.search_packages('gangrene'))
</span><span class='line'>1 Lcom/example/gangrene/GangreneActivity;->onCreate(Landroid/os/Bundle;)V (0x34) ---> Lcom/example/gangrene/GangreneActivity$1;-><init>(Lcom/example/gangrene/GangreneActivity;)V
</span><span class='line'>1 Lcom/example/gangrene/GangreneActivity$1;->onClick(Landroid/view/View;)V (0x1a) ---> Lcom/example/gangrene/GangreneActivity;->startService(Landroid/content/Intent;)Landroid/content/ComponentName;
</span><span class='line'>1 Lcom/example/gangrene/GangreneActivity;->onCreate(Landroid/os/Bundle;)V (0xa) ---> Lcom/example/gangrene/GangreneActivity;->setContentView(I)V
</span><span class='line'>1 Lcom/example/gangrene/GangreneActivity;->onCreate(Landroid/os/Bundle;)V (0x24) ---> Lcom/example/gangrene/GangreneActivity;->findViewById(I)Landroid/view/View;
</span><span class='line'>1 Lcom/example/gangrene/GangreneActivity;->onCreateOptionsMenu(Landroid/view/Menu;)Z (0x0) ---> Lcom/example/gangrene/GangreneActivity;->getMenuInflater()Landroid/view/MenuInflater;
</span><span class='line'>1 Lcom/example/gangrene/Feeder;->onCreate()V (0x54) ---> Lcom/example/gangrene/Feeder$ServiceHandler;-><init>(Lcom/example/gangrene/Feeder; Landroid/os/Looper;)V
</span><span class='line'>1 Lcom/example/gangrene/Feeder;->onStartCommand(Landroid/content/Intent; I I)I (0x52) ---> Lcom/example/gangrene/Feeder$ServiceHandler;->obtainMessage()Landroid/os/Message;
</span><span class='line'>1 Lcom/example/gangrene/Feeder;->onStartCommand(Landroid/content/Intent; I I)I (0x66) ---> Lcom/example/gangrene/Feeder$ServiceHandler;->sendMessage(Landroid/os/Message;)Z
</span><span class='line'>1 Lcom/example/gangrene/Feeder$ServiceHandler;->handleMessage(Landroid/os/Message;)V (0x2c) ---> Lcom/example/gangrene/Feeder;->stopSelf(I)V
</span><span class='line'>1 Lcom/example/gangrene/Feeder$ServiceHandler;->handleMessage(Landroid/os/Message;)V (0x6a) ---> Lcom/example/gangrene/Feeder;->getFilesDir()Ljava/io/File;
</span><span class='line'>1 Lcom/example/gangrene/Feeder$ServiceHandler;->handleMessage(Landroid/os/Message;)V (0xb6) ---> Lcom/example/gangrene/Feeder;->access$0(Lcom/example/gangrene/Feeder;)I</span></code></pre></td></tr></table></div></figure>
<p>What’s this <code>Feeder</code> thing?</p>
<p>Let’s find all “paths” for the package name <code>Feeder</code>. This results in us seeing all
classes/methods that have the word <code>Feeder</code> in their package path.</p>
<figure class='code'><div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
<span class='line-number'>3</span>
<span class='line-number'>4</span>
<span class='line-number'>5</span>
<span class='line-number'>6</span>
<span class='line-number'>7</span>
</pre></td><td class='code'><pre><code class=''><span class='line'>In [8]: show_Paths(analysis[1], analysis[2].tainted_packages.search_packages('Feeder'))
</span><span class='line'>1 Lcom/example/gangrene/Feeder;->onCreate()V (0x54) ---> Lcom/example/gangrene/Feeder$ServiceHandler;-><init>(Lcom/example/gangrene/Feeder; Landroid/os/Looper;)V
</span><span class='line'>1 Lcom/example/gangrene/Feeder;->onStartCommand(Landroid/content/Intent; I I)I (0x52) ---> Lcom/example/gangrene/Feeder$ServiceHandler;->obtainMessage()Landroid/os/Message;
</span><span class='line'>1 Lcom/example/gangrene/Feeder;->onStartCommand(Landroid/content/Intent; I I)I (0x66) ---> Lcom/example/gangrene/Feeder$ServiceHandler;->sendMessage(Landroid/os/Message;)Z
</span><span class='line'>1 Lcom/example/gangrene/Feeder$ServiceHandler;->handleMessage(Landroid/os/Message;)V (0x2c) ---> Lcom/example/gangrene/Feeder;->stopSelf(I)V
</span><span class='line'>1 Lcom/example/gangrene/Feeder$ServiceHandler;->handleMessage(Landroid/os/Message;)V (0x6a) ---> Lcom/example/gangrene/Feeder;->getFilesDir()Ljava/io/File;
</span><span class='line'>1 Lcom/example/gangrene/Feeder$ServiceHandler;->handleMessage(Landroid/os/Message;)V (0xb6) ---> Lcom/example/gangrene/Feeder;->access$0(Lcom/example/gangrene/Feeder;)I
</span></code></pre></td></tr></table></div></figure>
<p>Cool, so Feeder looks like an android
<a href="http://developer.android.com/reference/android/app/Service.html">Service</a>.
What happens when the <code>handleMessage</code> gets called back? Let’s decompile the
whole apk (using <a href="https://code.google.com/p/androguard/wiki/Decompiler">dad</a>),
but focus on the Feeder class for the moment:</p>
<figure class='code'><div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
<span class='line-number'>3</span>
<span class='line-number'>4</span>
<span class='line-number'>5</span>
<span class='line-number'>6</span>
<span class='line-number'>7</span>
<span class='line-number'>8</span>
<span class='line-number'>9</span>
<span class='line-number'>10</span>
<span class='line-number'>11</span>
<span class='line-number'>12</span>
<span class='line-number'>13</span>
<span class='line-number'>14</span>
<span class='line-number'>15</span>
<span class='line-number'>16</span>
<span class='line-number'>17</span>
<span class='line-number'>18</span>
<span class='line-number'>19</span>
<span class='line-number'>20</span>
<span class='line-number'>21</span>
<span class='line-number'>22</span>
<span class='line-number'>23</span>
<span class='line-number'>24</span>
<span class='line-number'>25</span>
<span class='line-number'>26</span>
<span class='line-number'>27</span>
<span class='line-number'>28</span>
<span class='line-number'>29</span>
<span class='line-number'>30</span>
<span class='line-number'>31</span>
</pre></td><td class='code'><pre><code class=''><span class='line'>In [9]: a, d, dx = AnalyzeAPK("apks/test.apk", decompiler="dad")
</span><span class='line'>In [10]: print d.CLASS_Lcom_example_gangrene_Feeder.get_source()
</span><span class='line'>package com.example.gangrene;
</span><span class='line'>public class Feeder extends android.app.Service {
</span><span class='line'> final public java.util.Random randnumber;
</span><span class='line'> final private long durSec;
</span><span class='line'> private android.os.Looper mServiceLooper;
</span><span class='line'> private int bufferLengthBytes;
</span><span class='line'> private com.example.gangrene.Feeder$ServiceHandler mServiceHandler;
</span><span class='line'> final private int iterations;
</span><span class='line'> final public static String DTAG;
</span><span class='line'> final private int fileSizeBytes;
</span><span class='line'>
</span><span class='line'> public android.os.IBinder onBind(android.content.Intent p3)
</span><span class='line'> {
</span><span class='line'> android.util.Log.e("Feeder", "in onBind in Feeder service");
</span><span class='line'> return 0;
</span><span class='line'> }
</span><span class='line'>
</span><span class='line'> public void onCreate()
</span><span class='line'> {
</span><span class='line'> super.onCreate();
</span><span class='line'> android.util.Log.e("Feeder", "in onCreate in Feeder service");
</span><span class='line'> android.widget.Toast.makeText(this, "service created", 0).show();
</span><span class='line'> android.os.HandlerThread v0 = new android.os.HandlerThread("ServiceStartArguments", 10);
</span><span class='line'> v0.start();
</span><span class='line'> this.mServiceLooper = v0.getLooper();
</span><span class='line'> this.mServiceHandler = new com.example.gangrene.Feeder$ServiceHandler(this, this.mServiceLooper);
</span><span class='line'> return;
</span><span class='line'> }
</span><span class='line'>...</span></code></pre></td></tr></table></div></figure>
<p>That’s pretty darn readable… because the APK was not
<a href="http://developer.android.com/tools/help/proguard.html">obfuscated</a>.</p>
<p>But going back to what was said earlier, we’re interested in the <code>handleMessage</code> callback:</p>
<figure class='code'><div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
<span class='line-number'>3</span>
<span class='line-number'>4</span>
<span class='line-number'>5</span>
<span class='line-number'>6</span>
<span class='line-number'>7</span>
<span class='line-number'>8</span>
<span class='line-number'>9</span>
<span class='line-number'>10</span>
<span class='line-number'>11</span>
<span class='line-number'>12</span>
<span class='line-number'>13</span>
<span class='line-number'>14</span>
<span class='line-number'>15</span>
</pre></td><td class='code'><pre><code class=''><span class='line'>In [11]: print d.CLASS_Lcom_example_gangrene_Feeder_ServiceHandler.METHOD_handleMessage.source()
</span><span class='line'>public void handleMessage(android.os.Message p24)
</span><span class='line'> {
</span><span class='line'> int v5 = 0;
</span><span class='line'> while(true) {
</span><span class='line'> int v4 = (v5 + 1);
</span><span class='line'> try {
</span><span class='line'> java.io.FileInputStream v14.close();
</span><span class='line'> v5 = v4;
</span><span class='line'> } catch (java.io.IOException v17) {
</span><span class='line'> v5 = v4;
</span><span class='line'> }
</span><span class='line'> }
</span><span class='line'> v5 = v4;
</span><span class='line'> }</span></code></pre></td></tr></table></div></figure>
<p>That’s odd, looks like an infinite loop that just closes an input stream (File)
over and over again… what a silly app. Looks like the author just wanted to
troll someone :–)</p>
<p>Here’s what I think they meant to do:</p>
<figure class='code'><div class="highlight"><table><tr><td class="gutter"><pre class="line-numbers"><span class='line-number'>1</span>
<span class='line-number'>2</span>
<span class='line-number'>3</span>
<span class='line-number'>4</span>
<span class='line-number'>5</span>
<span class='line-number'>6</span>
<span class='line-number'>7</span>
<span class='line-number'>8</span>
<span class='line-number'>9</span>
<span class='line-number'>10</span>
<span class='line-number'>11</span>
<span class='line-number'>12</span>
<span class='line-number'>13</span>
<span class='line-number'>14</span>
<span class='line-number'>15</span>
<span class='line-number'>16</span>
<span class='line-number'>17</span>
<span class='line-number'>18</span>
<span class='line-number'>19</span>
<span class='line-number'>20</span>
<span class='line-number'>21</span>
<span class='line-number'>22</span>
<span class='line-number'>23</span>
<span class='line-number'>24</span>
<span class='line-number'>25</span>
<span class='line-number'>26</span>
<span class='line-number'>27</span>
<span class='line-number'>28</span>
<span class='line-number'>29</span>
<span class='line-number'>30</span>
<span class='line-number'>31</span>
<span class='line-number'>32</span>
<span class='line-number'>33</span>
<span class='line-number'>34</span>
<span class='line-number'>35</span>
<span class='line-number'>36</span>
<span class='line-number'>37</span>
<span class='line-number'>38</span>
<span class='line-number'>39</span>
<span class='line-number'>40</span>
<span class='line-number'>41</span>
<span class='line-number'>42</span>
<span class='line-number'>43</span>
<span class='line-number'>44</span>
<span class='line-number'>45</span>
<span class='line-number'>46</span>
<span class='line-number'>47</span>
<span class='line-number'>48</span>
</pre></td><td class='code'><pre><code class=''><span class='line'>int counter = 0;
</span><span class='line'>while (counter++ < iterations) {
</span><span class='line'>
</span><span class='line'> long endTime = System.currentTimeMillis() + durSec * 1000;
</span><span class='line'> FileOutputStream fout = null;
</span><span class='line'> FileInputStream rand = null;
</span><span class='line'> int bytesRead = 0;
</span><span class='line'> long startTime = 0;
</span><span class='line'> float deltaTms = 0;
</span><span class='line'>
</span><span class='line'> try {
</span><span class='line'> fout = new FileOutputStream(getFilesDir() + "/test.out");
</span><span class='line'> rand = new FileInputStream("/dev/urandom");
</span><span class='line'> byte buffer[] = new byte[bufferLengthBytes];
</span><span class='line'>
</span><span class='line'> while (System.currentTimeMillis() < endTime
</span><span class='line'> && bytesRead < fileSizeBytes) {
</span><span class='line'> synchronized (this) {
</span><span class='line'> try {
</span><span class='line'> //Log.d(DTAG, String.format("in job loop %d, bytes: %d", counter, bytesRead));
</span><span class='line'> bytesRead += rand.read(buffer);
</span><span class='line'> // tic
</span><span class='line'> startTime = System.currentTimeMillis();
</span><span class='line'> fout.write(buffer);
</span><span class='line'> //fout.flush();
</span><span class='line'> deltaTms += (System.currentTimeMillis() - startTime);
</span><span class='line'> // wait(sleepSec*1000);
</span><span class='line'> } catch (IOException e) {
</span><span class='line'> Log.d(DTAG, "error reading/writing bytes");
</span><span class='line'> } catch (Exception e) {
</span><span class='line'> Log.e(DTAG, "other error while in job loop");
</span><span class='line'> }
</span><span class='line'> }
</span><span class='line'>
</span><span class='line'> }
</span><span class='line'> //toc
</span><span class='line'>
</span><span class='line'>
</span><span class='line'> if (deltaTms > 0) {
</span><span class='line'> Log.d(DTAG,
</span><span class='line'> String.format(
</span><span class='line'> "wrote %d bytes in %f ms; effective write speed %f Mbytes/sec",
</span><span class='line'> bytesRead,
</span><span class='line'> deltaTms,
</span><span class='line'> Float.valueOf(bytesRead / 1024 / 1024
</span><span class='line'> / (deltaTms / 1000))));
</span><span class='line'> }
</span><span class='line'> ...</span></code></pre></td></tr></table></div></figure>
<h2>Conclusion</h2>
<p>More people should use docker to deploy tools to their community. It would make
everyone’s life easier and less time would be spent dealing with dependencies
and more time getting stuff done.</p>
<p>Happy Hacking!</p>
]]></content>
</entry>
<entry>
<title type="html"><![CDATA[Just in Time Encryption Keys using SaltStack]]></title>
<link href="http://bitjudo.com/blog/2014/03/19/just-in-time-encryption-keys-using-saltstack/"/>
<updated>2014-03-19T11:15:00-04:00</updated>
<id>http://bitjudo.com/blog/2014/03/19/just-in-time-encryption-keys-using-saltstack</id>
<content type="html"><![CDATA[<p>Recently, I was challenged with ensuring the encryption of all data at rest for several servers. Unlike laptops or desktops, server nodes need to be able to come up and down in response to various requests. When spinning up multiple nodes you definitely don’t want them waiting for human interaction. Enter SaltStack and LUKS volumes. The real challenge was how to provide full disk encryption without storing the encryption key itself on the server.</p>
<p>Since these were Linux servers, LUKS encryption made the most sense. In essence what this tutorial describes is a way to provide “just in time” delivery of disk encryption keys. This is done using SaltStack features.</p>
<p>The rest of this article is a TL;DR combined with a tutorial of sorts to help you set this up.</p>
<h2>TL;DR</h2>
<p>By taking advantage of a couple features that <a href="http://www.saltstack.com/">SaltStack</a> brings to the table, it is possible to automate the mounting of your LUKS volumes after the server has started. The salt minion has the ability to run certain states (scripts) upon start. This allows the user to run a LUKS state that will verify the existence of the volume, unlock it, and mount it. Using salt states also allows the user to build state dependencies, or trigger other states to run. These features ensure that any services requiring the encrypted volume only start after the volume is available.</p>
<!-- more -->
<h2>How it Works</h2>
<p>Upon initializing of SaltStack, the configuration tells the Salt minion to run two scripts. One script is the LUKS encryption script, which confirms that the LUKS volume exists, then unlocks and mounts it. When the LUKS script runs, it requests pillar data from the Salt master. Included in the requested data is the LUKS encryption key, which is transferred using zeromq and AES encryption. The key is temporarily stored locally on the minion while the script runs, and is deleted upon completion.</p>
<p>The second script checks whether a particular service is dependent upon the encrypted volume is running. If the specific service is found to not be running, the script will also initialize it. In this particular case, the service is a mongodb service.</p>
<p>Ultimately, we end up with the ability to mount an encrypted drive and start dependent services. However, we have relegated the encryption key to a single separate server and only temporarily transfer it to the servers that need it, exactly when they need it. In simpler terms, we’ve created a just-in-time delivery mechanism for an encryption key. While this method may not be bulletproof, I have found it preferable to storing the encryption key permanently on the same server as the paired encrypted drive.</p>
<h2>The Quasi How-To</h2>
<p>The below does not cover setup and/or configuring SaltStack, LVM or LUKS encryption. Rather, it’s an example of salt state and pillar files, some steps you can use to get going. It should be pretty straightforward.</p>
<h3>The Salt State</h3>
<p>I originally found this state and after a little bit of searching I cannot find the original place I found it, but I ended up modifying it a bit for my needs. If you know where it originally came from, let me know and I’ll make a note. The state ensures that the LVM I need is setup and then sets up the LUKS volume. If all that is already setup then the script will simply unlock and mount the LUKS volume at the the defined mount point.</p>
<p><em>Assumptions:</em> You have a non-formatted drive attached to the server and you’ve defined that in your pillar data, make sure you assign the correct drive device, otherwise you might end up erasing data.</p>
<div><script src='https://gist.github.com/9541650.js?file=luks.state'></script>
<noscript><pre><code>{% set password = pillar['encryption']['password'] %}
{% set devname = pillar['encryption']['dev_name'] %}
{% set volgroup = pillar['encryption']['vg_name'] %}
{% set mountpoint = pillar['encryption']['mountpoint'] %}
crypto-package:
pkg:
- name: cryptsetup
- order: 10
- installed
lvm2-package:
pkg:
- name: lvm2
- order: 11
- installed
{{ devname }}:
lvm.pv_present:
- order: 12
vg{{ volgroup }}:
lvm.vg_present:
- devices: {{ devname }}
- order: 13
lv{{ mountpoint }}:
cmd.run:
- unless: lvdisplay /dev/vg{{ volgroup}}/lv{{ volgroup }}
- name: lvcreate -l 100%FREE -n lv{{ volgroup }} vg{{ volgroup }}
- order: 14
enc_volume:
cmd.run:
- unless: cryptsetup luksUUID /dev/vg{{ volgroup }}/lv{{ mountpoint }}
- name: echo "{{ password }}" | cryptsetup luksFormat /dev/vg{{ volgroup }}/lv{{ mountpoint }}
- order: 15
enc_volume_open:
cmd.run:
- unless: stat /dev/mapper/{{ mountpoint }}
- name: echo "{{ password }}" | cryptsetup luksOpen /dev/vg{{ volgroup }}/lv{{ mountpoint }} {{ mountpoint }}
- order: 16