Setting Up Pod Security Policies in Kubernetes

This video demonstrates how to configure Pod Security Policies in Kubernetes. To me, this has the difficulty level at 8/10.

It covers the admission controller, and how important on the service account. Then it talks about policies and RBAC. 

The written instruction is available at https://octetz.com/docs/2018/2018-12-07-psp/

Hacking and Hardening Kubernetes Clusters by Example [I]

Although this is a 4 years old webinar, I found it is still worth for today. The goals of this webinar is to raise the awareness risk in K8s and demonstrate the 'live' hacking and attacking a K8s. It also provides some hardening methods and tips.

• Defaults in use early tend to stay in use.
• Systems hardened late tend to break.
  

The webinar introduces a number of tools for securing K8s and a lot of hardening tips for your K8s cluster.

KubeATF - A tool used to automate the creation, validation, and destruction of K8s in a consistent way.

Bulkhead - A plugin that perform security posture scans on all nodes from within your K8s.

Links:

• KubeATF
• Sonobuoy-plugin - bulkhead
• Webinar slides
• Webinar demos
  

 

Kubernetes Security Best Practices

Kubernetes Security Best Practices by Ian Lewis, Google 

Containers give developers the ability to isolate applications from one another, but that’s not enough. Resource isolation is much different that security isolation. How do we make applications deployed in containers more secure? What tools can be we apply to our containers running in Kubernetes to make them more secure? How can we apply policy to our network and services to make sure applications only have access to what they need and nothing more? 

In this talk, attendees will learn about the risks and attack surfaces of a Kubernetes cluster. s-We'll look at tools like PodSecurityPolicy, SELinux, AppArmor, seccomp, and sandboxed containers in action to improve the security of containers. We’ll then go up the stack and learn how to apply network policy to containers to further improve security.

Agenda:

• Security 101
• Defense in depth (redundant 
  
• Limit the attack surface 
• Least privilege
  
• Runtime security
• Attacking Kubernetes cluster itself, Kubernetes API server
  
• Host security
• RBAC
• API Firewall
• Network security
• NetworkPolicy
• Secured access to etcd
• Run as non-root
• Read-only root filesystem
• no new privileges (allowPrivilegeEscalation:false)
• Sandboxed Pod
• seccomp/AppArmor/SELinux
• restrict kubelet permissions
• Policy enforcement
• istio
• Use kube-bench
  

Kubernetes Security: Attacking and Defending K8s Clusters

Note:

• Initial access with 
• known vuln
• Exposed dashboard or 
• Kube API server 
• Exploitation / Execution 
• API endpoint
• get a shell access
  
• Internal recon 
•  env | grep -i kube
• /var/run/secrets/kubernetes.io/serviceaccount
• container introspection
  
• Post-exploitation / Presistence
• privilege escalation
• pod/container escape via privileged pod
  
• Defending K8s
• curl -k https://192.168.1.1:6443
• CIS Kebernetes Benchmark (120+ security checks)
  
• kube-bench (golang)
  
• Image scan
• Clair, docker scan, smartcheck, snyk, Trivy
  
• Cloud-native runtime protection
• Falco (CNCF)
  
• The Pods
• AllowPrivilegeEscalation = false
• ReadOnlyRootFileSystem = true
• RunAsNonRoot = true 
• Use Seccomp, AppArmor and SELinux
  
• Pod Security Policies (PSP) - applied at cluster level (deprecated)
• PSP replacement
• OPA / Gatekeeper
• Kyverno (yaml)
  
• PodSecurity
  
• RBAC (Role Based Access Control)
• --authorization-mode=Node,RBAC
  
• Secure those exposed etcd (cluster objects)
• Encryption at rest not default
  
• The Network Policy
• Among all the pods
• Pods with kube-system namespace
• The Audit Logs
• not enabled by default
• Update K8s !!
  

 

Links:

• K8s Security: Attacking and Defending K8s Cluster
• http://katanasec.com/
• Awesome Kubernetes (K8s) Security
  

Find Windows 10/11 OEM product key command

Most modern desktop and laptop comes with Windows 8 or 10 keys embedded in BIOS. With Windows being installed as VM, someone can find and retrieve Windows 10/11 key using Linux host OS. The key helps to activate the Windows version without any input from users.

$ sudo cat /sys/firmware/acpi/tables/MSDM | tail -1

If oyu are running Windows OS, you can also retrieve the product with wmic:

c:\> wmic  path softwarelicensingservice get OA3xOriginalProductKey

OA3xOriginalProductKey
XXXXX-42F7Y-XXXXX-YRMYC-XXXXX