johnfitzpatrick

- rule: Blacklisted Containers
  desc: >
    Detect the initial process started by a container that is from a list of blacklisted containers.
  condition: container_started and container and blacklisted_containers
  output: Container started is blacklisted (user=%user.name command=%proc.cmdline %container.info image=%container.image.repository:%container.image.tag)
  priority: WARNING
  tags: [container, mitre_lateral_movement]

- macro: blacklisted_containers
  condition: (container.name startswith 'k8s_actor_actor')

johnfitzpatrick

pkg_name=sample_profile
pkg_version=0.1.0
pkg_origin=originname
pkg_deps=(chef/inspec)
pkg_build_deps=(chef/inspec core/jq-static)
pkg_svc_user=root
pkg_license=Apache-2.0

do_before() {
  # Exit with error if not in the directory with 'inspec.yml'.

johnfitzpatrick

pkg_name=national-parks
pkg_origin=myorigin
pkg_version="6.3.0"
pkg_maintainer="The Habitat Maintainers <humans@habitat.sh>"
pkg_license=("Apache-2.0")
pkg_deps=(core/tomcat8 core/jre8)
pkg_build_deps=(core/jdk8/8u131 core/maven)
pkg_svc_user="root"
do_prepare(){ export JAVA_HOME=$(hab pkg path core/jdk8) ; }
do_build()

johnfitzpatrick

[nodejs_demo]
plan_path = "nodejs_demo/habitat"

johnfitzpatrick

[status]
enabled = true

johnfitzpatrick

[css]
background_color = 'green'

johnfitzpatrick

pkg_name=nodejs_demo
pkg_origin=myorigin
pkg_version="0.2.0"
pkg_scaffolding="core/scaffolding-node"

pkg_exports=(
  [port]=app.port
)
pkg_exposes=(port)

johnfitzpatrick

version: '3'
services:
  mongodb:
    image: core/mongodb
    command: --peer ${HOSTIP}    
    environment:
      HAB_MONGODB: "[mongod.net]\nbind_ip = '0.0.0.0'\n[mongod.security]\ncluster_auth_mode = ''"
  national-parks01:
    image: MYORIGIN/national-parks:latest
    command: --peer mongodb --strategy at-once --bind database:mongodb.default

johnfitzpatrick

curl https://raw.githubusercontent.com/habitat-sh/habitat/master/components/hab/install.sh | sudo bash

johnfitzpatrick

mongodb_database = "demo"

[server]
port = "8080"
shutdown-port = "8005"
redirect-port = "8443"