kgilpin

https://app.land/applications/219?mapset=1970

kgilpin

Here's a blog post about how we secured a Node.js port of Quake2 using Nginx and Conjur:

http://blog.conjur.net/how-securing-webquake-is-like-securing-an-enterprise-application

There's a link to a 6-minute video walkthrough at the end which is easy to miss so I am including it here:

Hope you find this interesting!

kgilpin

hi

<script> alert('hi') </script>

kgilpin

root@3935c7d86a07:/# cat policy-2.yml
- !user alice

- !group developers

- !grant
  role: !group developers
  member: !user alice
  

kgilpin

- !policy
  id: conjur/authn-k8s/minikube/default
  owner: !group /k8s_admin
  body:
  - !webservice
    annotations:
      kubernetes/namespace: default

  - !host client

kgilpin

- !policy
  id: myapp
  body:
  - &variables
    - !variable
      id: database/username
      annotations:
        description: Application database username
    - !variable
      id: database/password

kgilpin

Approach

Create distinct roles with specific permissions to call untrusted web services.

Client services authenticate as one of these roles when calling an untrusted web service.

Discussion

When using an externalized (Nginx) forwarder and gatekeeper, a webservice client can send a Conjur access token for its own identity. The client doesn't have to worry about the gatekeeper misusing the access token,

kgilpin

$ conjur resource:create food:$ns/bacon
{
  "id":    "sandbox:food:1eqwg0/bacon",
  "owner": "sandbox:user:kgilpin",
  "permissions": []
}

kgilpin

# Defines a Bastion server layer. 
#
# Usage:
# conjur policy load --as-group ops bastion-policy.rb
policy "bastion" do
  # Members of this group will be able to adminsiter the bastion.
  admins = group "admins"
  # Members of this group will be able to login to the bastion
  # with a regular, non-privileged account. 
  users  = group "users"

kgilpin

  # Need to find the next available device to let AWS know where to attach
  # the volume
  drive = (Array('c'..'z').map{|c| "/dev/xvd#{c}"} - Dir.glob("/dev/xvd*"))[0]
  device_id = drive[-1..-1]