Made to Order Software Corporation Logo
Home

member

Docker, an advanced chroot utility

Fri, 11/29/2019 - 19:09 —


Chasm—just like a Docker creates a chasm between two sets of software

SECURITY WARNING

Before installing Docker and containers with services on your Linux system, make sure to read and understand the risks as mentioned on this Docker and iptables page. Especially, Docker will make all your containers visible to the entire world through your Internet connection. This is great if you want to indeed share that service with the rest of the world, it's very dangerous if you are working on that container service since it could have security issues that need patching and such. Docker documents a way to prevent that behavior by adding the following rule to your firewall:

iptables -I DOCKER-USER -i eth0 ! -s 192.168.1.0/24 -j DROP

This means that unless the IP address matches 192.168.1.0/24, the access is refused. The `eth0` interface name should be replaced with the interface name you use as the external ethernet connection. During development, you should always have such a rule.

That has not worked at all for me because my local network includes many other computers on my LAN and this rule blocks them all. So really not a useful idea.

Instead, I created my own entries based on some other characteristics. That includes the following lines in my firewall file:

*filter
:DOCKER-USER - [0:0]

-A DOCKER-USER -j early_forward
-A DOCKER-USER -i eno1 -p tcp -m conntrack --ctorigdstport 80 --ctdir ORIGINAL -j DROP
-A DOCKER-USER -i eno1 -p tcp -m conntrack --ctorigdstport 8080 --ctdir ORIGINAL -j DROP
-A DOCKER-USER -i eno1 -p tcp -m conntrack --ctorigdstport 8081 --ctdir ORIGINAL -j DROP

My early_forward allows my LAN to continue to work. These are my firewall rules that allow my LAN computers to have their traffic forwarded as expected.

Then I have three rules that block port 80, 8080, and 8081 from Docker.

Docker will add new rules that will appear after (albeit not within the DOCKER-USER list) and will open ports for whatever necessary service you install in your Dockers.

Note that the only ports you have to block are ports that Docker will share and that you have otherwise open on your main server. If Docker opens port 5000 and your firewall does not allow connections to port 5000 from the outside, then you're already safe. On my end I have Apache running so as a result I block quite usual HTTP ports from Docker.

Docker

As we are helping various customers, we encounter new technologies.

In the old days, we used chroot to create a separate environment where you could have your own installation and prevent the software from within that environment access to everything on your computer. This is particularly useful for publicly facing services liek Apache, Bind, etc.

Brief Overview of CRISC Certification Exam

Sat, 06/23/2018 - 14:08 —

The CRISC, also known as Certified in Risk and Information Systems Control, is a vendor-neutral certification that validates a professional’s knowledge and experience in the fields of information system control & risk management. The certificate is developed and administered by ISACA and designed for the individuals who work with organizations in mitigating business risks and implement information system controls.

Organizations in today’s world must consistently enhance their infrastructure so that they can survive and thrive in today’s competitive environment. It is a ...

Set Target (dynamic)

SWF Action
Action Category: 
Movie
Action Details: 
(dynamic)
Action Identifier: 
32
Action Structure: 
<n.a.>
Action Length: 
0 byte(s)
Action Stack: 
pop 1 (s)
Action Operation: 
s1 := pop();
set_target(s1);
Action Flash Version: 
3
See Also: 
Call Method
DefineSprite
Get Member
Set Member
Set Target

Pop one string from the stack. If the string is the empty string, then the next actions apply to the main movie. Otherwise it is the name of a Sprite1 and the followings actions apply to that Sprite only.

  • 1. Note that the name of a sprite is specified in the PlaceObject2 tag so as to be able to include the same DefineSprite tag multiple times and still be able to distinguish each instance.

With

SWF Action
Action Category: 
Control
Action Details: 
0
Action Identifier: 
148
Action Structure: 
unsigned short   f_size;
Action Length: 
2 byte(s)
Action Stack: 
pop 1 (o)
Action Operation: 
with o1
  // execute f_size bytes of actions
  ...
end with;
Action Flash Version: 
5
See Also: 
Set Target
Set Target (dynamic)

The variable references within the following f_size bytes of action are taken as names of members of the specified object o1. When no member of that name is available in that object, the previous With, or the corresponding global variable is queried. This is similar to the Pascal language with instruction or to the Set Target (dynamic) for movies.

Toggle Quality

SWF Action
Action Category: 
Movie
Action Details: 
0
Action Identifier: 
8
Action Structure: 
<n.a.>
Action Length: 
0 byte(s)
Action Stack: 
n.a.
Action Operation: 
if (_root.quality == HIGH_QUALITY) {
  _root.set_quality(LOW_QUALITY);
}
else {
  _root.set_quality(HIGH_QUALITY);
}
Action Flash Version: 
1
See Also: 
Get Member
Get Property
Set Member
Set Property

Change the quality level from low to high and vice versa. At this time, not sure what happens if you use medium!

Note that the quality is defined on the root only and affects the entire output.

Newer SWF versions (since version 5) should use the movie quality variable member instead of this direct action.

Set Target

SWF Action
Action Category: 
Movie
Action Details: 
(dynamic)
Action Identifier: 
139
Action Structure: 
string   f_target;
Action Length: 
-1 byte(s)
Action Stack: 
n.a.
Action Operation: 
set_target(f_target);
Action Flash Version: 
1
See Also: 
Call Method
DefineSprite
Get Member
Set Member
Set Target (dynamic)

If the string f_target is the empty string, then the next actions apply to the main movie.

Otherwise it is the name of a Sprite and the followings actions apply to that Sprite only.

In order to use a dynamic name for the target, use Set Target (dynamic) instead.

Set Member

SWF Action
Action Category: 
Objects
Action Details: 
0
Action Identifier: 
79
Action Structure: 
<n.a.>
Action Length: 
0 byte(s)
Action Stack: 
pop 2 (a), pop 1 (o)
Action Operation: 
a1 := pop();
a2 := pop();
o3 := pop();
o3[a2] = a1;
Action Flash Version: 
5
See Also: 
Get Member
Get Property
Set Property
Call Method

Pop a value a1 representing the new member value.

Pop one string or integer a2 representing the name of the member to modified or create.

Finally, pop an object reference o3.

If the member a2 doesn't exists yet, create it.

Finally, sets the object member a2 to the value a1.

Random

SWF Action
Action Category: 
Arithmetic
Action Details: 
0
Action Identifier: 
48
Action Structure: 
<n.a.>
Action Length: 
0 byte(s)
Action Stack: 
pop 1 (n), push 1 (i)
Action Operation: 
n1 := pop();
r := random(n1);
push(r);
Action Flash Version: 
4
See Also: 
Integral Part

Pop one number representing the maximum value (not included) that the random() function can return, push the generated value on the stack. n1 should not be zero or negative.

Since version 5, you should use the Math.rand() member function instead of this action.

New

SWF Action
Action Category: 
Objects
Action Details: 
0
Action Identifier: 
64
Action Structure: 
<n.a.>
Action Length: 
0 byte(s)
Action Stack: 
pop 1 (s), pop 1 (i), pop i2 (a)
Action Operation: 
s1 := pop();
i2 := pop();
for(idx := 3; idx <= i2 + 2; ++idx) {
  aidx := pop();
}
o := new s1;
o.s1(a3, a4, ... a(i2 + 2));
push(o);
Action Flash Version: 
5
See Also: 
Declare Object
Duplicate Sprite
Extends
Get Member
Implements
New Method
Set Member

Pop the class name for the new object to create. Pop the number of arguments. Pop each argument (if i2 is zero, then no arguments are popped.) Create an object of class s1. Call the constructor function (which has the same name as the object class: s1). The result of the constructor is discarded. Push the created object on the stack. The object should then be saved in a variable or object member.

Implements

SWF Action
Action Category: 
Objects
Action Details: 
0
Action Identifier: 
44
Action Structure: 
<n.a.>
Action Length: 
0 byte(s)
Action Stack: 
pop 1 (o), pop 1 (i), pop i2 (o)
Action Operation: 
o1 := pop();
i2 := pop();
for (idx := 3; idx <= i2 + 2; ++idx) {
  oidx := pop();
}
o1 implements o3, o4, o5, ... , o(i2 +2)
Action Flash Version: 
7
See Also: 
Cast Object
Declare Object
Extends
Instance Of
Type Of

This action declares an object as a sub-class of one or more interfaces. The syntax here is simple, the real implementation is quite unbelievably difficult to fathom.

The following shows you how you can add an implements of interfaces "A" and "B" to the class "C". Notice that class "C" needs to already exist. Here we assume that all classes are defined in the global scope.

	push data "_global"
	get variable
	push data "A"
	get member
	push data "_global"
	get variable
	push data "B"
	get ...