Category: Dev Ops

All about code tracking and management for example, Azure DevOPS branching and merging, Release management, Continuous integration (CI) and Continuous deployment (CD).

Scan docker containers for log4j/Log4Shell exploit

If you are running docker container on Unraid, follow these steps to scan containers; Open up a terminal window in unraid and copy/paste the following

curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

This will install the grype package. “temporarily, if you reboot you will have to re-install the package again.”

Then use this command in the terminal window to list your docker containers

docker image ls -a

Once you have the name for your docker image, you can run the grype tool in the terminal window.

$grype "docker-image-name":"tag"

for examplel

grype linuxserver/sonarr:develop

The tool will then scan the image for all vulnerabilities and will print them all out on the screen as a list. Look for log4j.

Pulled from housewrecker/gaps..

log4j-api 2.14.1 2.15.0 GHSA-jfh8-c2jp-5v3q Critical

pulled from jbartlett777/diskspeed..

log4j 1.2.16 GHSA-2qrg-x229-3v8q Critical

log4j 1.2.16 CVE-2019-17571 Critical

log4j 1.2.16 CVE-2020-9488 Low

log4j 1.2.17 GHSA-2qrg-x229-3v8q Critical

log4j 1.2.17 CVE-2019-17571 Critical

log4j 1.2.17 CVE-2020-9488 Low

One last thing, you can install this tool on a different device but you’ll probably have to;

chown "user" /usr/local/bin/

“temporarily” on the terminal of your different device to make it work. The tool just pulls the current docker image from dockerhub so it doesn’t need to be ran on the same machine if you don’t want to.

Resources

Log4j/Log4Shell exploit — best practices? from unRAID

Window server core configuraiton

Windows Core is mostly PowerShell and command driven. Here are some key questions and answers to get you started with this flavor.

Is there any way I can tell windows to automatically try to find drivers for all devices (of course after I establish network connection) so I don’t have to click on each device?

Try configuring windows (with the help of sconfig.cmd) to search windows updates for device drivers. Check the following links

https://docs.microsoft.com/en-us/windows-server/get-started/sconfig-on-ws2016

https://technet.microsoft.com/en-us/library/cc753091(v=ws.11).aspx

How can I Install drivers manually on core?

You can manually install drivers on Windows Server core with Pnputil. Check the following link,

Installing Drivers on Windows Server Core

Is there a way to use device manager from remote server?

Yes, you can use access the device manager of your core server from other computers MMC snap-in. Check the following link (section 1.3)
https://technet.microsoft.com/en-us/library/jj574205(v=ws.11).aspx

Server is ethernet connected on LAN, means exposed to the internet?

You may have an Internet connection, but you are almost certainly behind a NAT router, not directly connected to the Internet.  Normally, that NAT router is the only machine that faces the Internet, has a direct connection, and is under constant attack by numerous bots roaming the IP’s of the Internet. 

You only have a local IP for your local network.  Only the router has your true IP that is seen on the Internet.  When your browser or NTP service (or other Internet need you may have) needs to see something on the Internet, it makes a connection to an Internet server, and your router notes that connection and allows that server to respond, using the associated ports of your connection.  The router will route those responses back to your machine, and not any other. 

The outside bots and servers cannot attack or connect to your machine, because they can’t even see it, and they don’t know your local IP.  The only contact that outside machines can have with your machine is strictly through connections your machine initiates first, through your router.

Now if you *did* want to put your server directly on the Internet, most routers have a setting where they can put any machine into a ‘DMZ’, a special unprotected zone, which means the Internet is directly connected to any machine you choose!  And the router won’t block any Internet traffic then, but allow all of it to come through to you. 

I would strongly advise you to first disconnect ALL of your drives, and backup your boot drive, because you will be very rapidly attacked!  Never use the DMZ unless you have a lot of security experience!