Cooking security sans@night

Cooking Security
Speaker:

Joshua Timberman Technical Evangelist
‣ joshua@opscode.com
‣ @jtimberman
‣ www.opscode.com
Copyright © 2010 Opscode, Inc - All Rights Reserved 1

% whoami

System Administrator
Web Operations
Opscode Cookbooks
Training and Support


Developers?
Systems Administrators?
“Business” People?

http://www.ﬂickr.com/photos/timyates/2854357446/sizes/l/


Just what is
Conﬁguration
Management?


A picture is worth...


A thousand words!
“... Is a field of management that focuses on
establishing and maintaining consistency of a system's
or product's performance and its functional and
physical attributes with its requirements, design, and
operational information throughout its life. For
information assurance, [it] can be defined as the
management of security features and assurances
through control of changes made to hardware,
software, firmware, documentation, test, test fixtures,
and test documentation throughout the life cycle of an
information system.” - en.wikipedia.org


Infrastructure as Code is...
A technical
domain revolving
around building
and managing
infrastructure
programmatically

http://www.ﬂickr.com/photos/kwerfeldein/2634561264/sizes/o/

Enable the reconstruction of
the business from nothing
but a source code
repository, an application
data backup, and bare metal
resources.

Understand the goals

Automation
Stability
Scalability
Security


Security

Copyright © 2010 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/anonymouscollective/2291896028/ 10

Policy Compliance

Copyright © 2010 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/gi/168406150/ 11

Policy Compliance

Not a silver bullet
Best practices, applied


template "#{home_dir}/.ssh/authorized_keys" do
source "authorized_keys.erb"
owner u['uid']
group u['id']
mode "0600"
variables :ssh_keys => u['ssh_keys']
end

%<%= group %> ALL=(ALL) NOPASSWD: ALL


Enable the business


Auditing and
Documentation

Copyright © 2010 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/hryckowian/2176673733/ 15

Auditing and Documentation

Declarative language
Version control


package "ntp" do
action :install
end

service "ntp" do
action :start
end

template "/etc/ntp.conf" do
source "ntp.conf.erb"
owner "root"
group "root"
mode 0644
end


% git log ntp/recipes/default.rb
commit a5991547215757ed25e2944f93faa437fad1e5a5
Author: jtimberman <joshua@opscode.com>
Date: Sun Sep 27 23:39:05 2009 -0600

cook-188, update copyright notices, regen metadata too

commit 524ee910f391acadec52362419ce27dbdcdb9969
Author: jtimberman <joshua@opscode.com>
Date: Wed Mar 4 17:08:10 2009 -0700

cook-13, add ntp cookbook


Its like built-in change
management


Logging subsystems

Copyright © 2010 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/mikeyworld/3588020070/ 20

Defense in Depth is hard

Copyright © 2010 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/furryscalyman/2081849769/ 21

Managing Infrastructure Is Hard
Has Always Been

Big players
1980

1989 • Reach just a handful of large,
enterprise customers

1999 • Require custom implementations with
large professional services bills

• Deployed exclusively on-premise
2001
• Acquired by companies with large
consulting organizations (IBM, HP, CA)
Copyright © 2010 Opscode, Inc. – Conﬁdential – Do Not Redistribute

Defense in Depth...

Conﬁguration layers
Access controls
Incident handling
‣ Rebuilding/redeployment


You need system
integration

Copyright © 2010 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/opalsson/3773629074/ 24

http://www.brooklynstreetart.com/theBlog/wp-content/uploads/2008/12/swedish_chef_bork-sleeper-cell.jpg

At a High Level...

‣ A library for configuration management
‣ A configuration management system
‣ A systems integration platform
‣ An API for your entire Infrastructure

http://www.flickr.com/photos/asten/2159525309/sizes/l/

Open source and
community


Ruby

Copyright © 2010 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/thisisbossi/3526698689/ 29

Debian Mac OS X
SuSE
CentOS
Gentoo
Solaris
ArchLinux
OpenBSD
Platforms
Windows FreeBSD
Ubuntu
Red Hat
Fedora
Scientiﬁc


Principles

Idempotent
Data-driven
Sane defaults
TMTOWTDI


Multiple applications of
an operation do not
change the result

Copyright © 2010 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/redjar/360111326/ 32

We start with APIs, you
supply data

Copyright © 2010 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/ninjanoodles/153893226/ 33

option :json_attribs,
:short => "-j JSON_ATTRIBS",
:long => "--json-attributes JSON_ATTRIBS",
:description => "Load attributes from a
Defaults are sane, but
JSON file or URL",
:proc => nil

option :node_name, changed
easily
:short => "-N NODE_NAME",
:long => "--node-name NODE_NAME",
:description => "The node name for this
client",
:proc => nil


Tim Toady is a Perl
motto

Copyright © 2010 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/lidarose/225156612 35

Chef... How
does it work?

Copyright © 2010 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/38299630@N05/3635356091/ 36

Chef Client runs on your
systems


Clients talk to a Chef
Server


Clients authenticate
with RSA keys

Copyright © 2010 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/debbcollins/3401944550/ 39

We call each system you
conﬁgure a Node

Copyright © 2010 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/peterrosbjerg/3913766224/ 40

Nodes have Attributes

Kernel info!
{
"kernel": {
"machine": "x86_64",
"name": "Darwin",
"os": "Darwin",
"version": "Darwin Kernel Version 10.4.0: Fri Apr 23 18:28:53 PDT 2010;
root:xnu-1504.7.4~1/RELEASE_I386",
"release": "10.4.0"
},
"platform_version": "10.6.4",
"platform": "mac_os_x",
"platform_build": "10F569",
"domain": "local",
Platform info!
"os": "darwin",
"current_user": "jtimberman",
"ohai_time": 1278602661.60043,
"os_version": "10.4.0",
"uptime": "18 days 17 hours 49 minutes 18 seconds",
"ipaddress": "10.13.37.116",
"hostname": "cider",
"fqdn": "cider.local",
Hostname and IP!
"uptime_seconds": 1619358
}


The server stores JSON
data about Nodes

Copyright © 2010 Opscode, Inc - All Rights Reserved http://www.ﬂickr.com/photos/jurvetson/12688704/ 42

Attributes are
Searchable
$ knife search node ‘platform:mac_os_x’
search(:node, ‘platform:mac_os_x’)


Nodes have a Run List
What Roles or Recipes to apply
in Order


Roles have a Run List
What Roles or Recipes to apply
in Order


name "webserver"
description "Systems that serve HTTP traffic"

run_list(
"role[base]",
Can include
"recipe[apache2]", other roles!
"recipe[apache2::mod_ssl]"
)

default_attributes(
"apache" => {
"listen_ports" => [ "80", "443" ]
}
)

override_attributes(
"apache" => {
"max_children" => "50"
}
)


Roles are Searchable

$ knife search role ‘max_children:50’
search(:role, ‘max_children:50’)


Chef manages
Resources on Nodes


remote_file
link
cookbook_file
service
ruby_block
template

Chef knows many
different Resources
execute user
bash git log
package deploy
http_request

Resources

Platform

Provider
http://www.ﬂickr.com/photos/acurbelo/2628837104/sizes/o/

Recipes are lists of
Resources

http://www.ﬂickr.com/photos/roadsidepictures/2478953342/sizes/o/

Order Matters


How does it help me
secure my systems?


The Beneﬁts of Automation

Efﬁciency
Economics
Scalability


Chef automation workflow

Define your policy
Write policy as simple code
Deploy configuration in testing
Deploy in production


Infrastructure as Code

Source repository
Application data backup
Bare metal resources


Leverage a community

Open Source software
Operations experts
Team collaboration


Not everything can be automated

Security people say “No”.
This is as much culture as policy.
Automating humans is hard.


Resources/Questions

www.opscode.com/chef
IRC and Mailing lists
‣ irc.freenode.net #chef
‣ lists.opscode.com

Twitter:
‣ @opscode, #opschef
‣ @jtimberman

Questions?

Cooking security sans@night

Recommended

Recommended

More Related Content

What's hot

What's hot (8)

Similar to Cooking security sans@night

Similar to Cooking security sans@night (20)

More from jtimberman

More from jtimberman (10)

Recently uploaded

Recently uploaded (20)

Cooking security sans@night