[{"_1":2,"_149":-5,"_150":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_142":143},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.layers.$namespace.$reponame.$tag.(images).($imageUrlDigest)",{"_27":28,"_29":30,"_75":76,"_77":-7,"_78":-7,"_79":-7,"_80":-7,"_81":-5,"_82":-5,"_83":11,"_84":11,"_69":85,"_133":11,"_103":64,"_134":102,"_135":68,"_44":45,"_136":11,"_137":21,"_138":47,"_139":-5,"_140":11,"_141":11},"scanningType","none","tagData",{"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_60":61,"_62":34,"_63":64,"_65":66,"_67":68,"_69":70,"_71":49,"_72":61,"_73":58,"_74":21},"content_type","unrecognized","creator",3289,"full_size",460079857,"id",2602468,"images",[41],{"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":47,"_55":-5,"_56":36,"_57":58,"_59":-5},"architecture","amd64","digest","sha256:dda185e1d4c1483827689171ceb3f93410de77709178dbc78f97527c9bb4031a","features","","last_pulled","2026-08-29T13:24:17.138030717Z","last_pushed","2016-10-22T03:28:24Z","os","linux","os_features","os_version","size","status","inactive","variant","last_updated","2016-10-22T03:28:23.097563Z","last_updater","last_updater_username","jumanjiman","media_type","application/octet-stream","name","wip2","repository",119283,"tag_last_pulled","tag_last_pushed","tag_status","v2","tagImages",[],"layerOrdinals","packageName","cveId","sbom","scoutSummary","staticSummary","isScoutPaymentRequired","canSeeVulnerabilities",{"_86":87,"_88":89,"_91":92,"_93":94,"_95":11,"_60":96,"_97":98,"_99":100,"_67":102,"_103":64,"_104":105,"_106":-5,"_107":108,"_57":108,"_109":110,"_111":-5,"_112":113,"_114":115,"_116":11,"_117":64,"_118":119,"_124":11,"_125":126,"_130":64,"_131":132},"categories",[],"content_types",[90,32],"image","date_registered","2015-01-10T00:49:09.591602Z","description","hardened ssh jump host based on latest fedora stable","is_private","2016-10-22T04:29:36.4875Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[66,101],"application/vnd.docker.distribution.manifest.v1+prettyjws","wormhole","namespace","pull_count",3423,"repository_type","star_count",1,"status_description","active","source","collaborator_count",0,"full_description","## Overview\r\n\r\nProvide docker-based development environments to support\r\n100-500 concurrent workspaces on a single server. The idea\r\nis for developers to **edit code** and perform\r\n**light compilation or testing** within the workspace.\r\n\r\n* Serious testing is the duty of a continuous integration server.\r\n* Serious compilation is the duty of a build server.\r\n\r\nPlease add any issues you find with this software\r\nto the upstream [wormhole](https://github.com/jumanjihouse/wormhole/issues).\r\n\r\n[Architectural considerations](#architectural-considerations)
\r\n[OVAL vulnerability scan](#oval-vulnerability-scan)
\r\n[Test harness](#test-harness)
\r\n[User instructions](#user-instructions)
\r\n[Admin instructions](#admin-instructions)
\r\n[Contributing](https://github.com/jumanjihouse/wormhole/blob/master/CONTRIBUTING.md)
\r\n[License](https://github.com/jumanjihouse/wormhole/blob/master/LICENSE)
\r\n\r\n\r\n## Architectural considerations\r\n\r\n![admin](https://cloud.githubusercontent.com/assets/332496/3352907/edec295c-fa65-11e3-8044-f80d3f0af3c0.png)\r\n\r\n![user](https://f.cloud.github.com/assets/332496/2528015/529d5c36-b50b-11e3-9e89-707062e47b36.png)\r\nsource: [`docs/uml.md`](https://github.com/jumanjihouse/wormhole/blob/master/docs/uml.md)\r\n\r\n**Notes**:\r\n\r\n* User data lives in a data container and\r\n persists across upgrades of the app container.\r\n\r\n* sshd is restrictive:\r\n - ssh host key persists across upgrades of the app container.\r\n\r\n* Weak firewall allows:\r\n - inbound from Internet to wormhole ephemeral TCP ports\r\n - outbound from wormhole to Internet on all ports\r\n\r\n* Strong firewall allows:\r\n - inbound from wormhole IP to internal TCP 22\r\n - no outbound connections other than return traffic for inbound connections\r\n\r\n* Must be capable of running on CoreOS. Therefore no outside dependencies.\r\n\r\n* Internal infrastructure should use appropriate access control mechanisms\r\n based on risk evaluation of the wormhole.\r\n\r\n\r\n## OVAL vulnerability scan\r\n\r\nThe Red Hat Security Response Team provides OVAL definitions\r\nfor all vulnerabilities (identified by CVE name) that affect RHEL or Fedora.\r\nThis enables users to perform a vulnerability scan and\r\ndiagnose whether the system is vulnerable.\r\n\r\nThe Dockerfile in this repo adds a script to download the latest\r\nOVAL definitions from Red Hat and perform a vulnerability scan\r\nagainst the image. If the image has one or more known vulnerabilies,\r\nthe script exits non-zero, and the `docker build` fails.\r\n\r\nImplications:\r\n\r\n* We **must resolve all known vulnerabilities**\r\n in order to successfully build an image.\r\n\r\n* The scan is time-dependent as of image build, so\r\n we should rebuild the image when Red Hat updates the OVAL feed.\r\n\r\n* The vulnerability scan is distinct from the *SCAP secure configuration scan*\r\n described [by the test harness](#test-harness).\r\n\r\nIt is possible to scan an existing image:\r\n\r\n docker run --rm -t jumanjiman/wormhole /usr/sbin/oval-vulnerability-scan.sh\r\n\r\nThe exact output of the vulnerability scan varies according to the\r\nlatest Red Hat OVAL feed, but it looks similar to this snapshot from August 2014:\r\n\r\n -snip copious checks-\r\n\r\n RHSA-2014:1051: flash-plugin security update (Critical)\r\n oval-com.redhat.rhsa-def-20141051\r\n CVE-2014-0538\r\n CVE-2014-0540\r\n CVE-2014-0541\r\n CVE-2014-0542\r\n CVE-2014-0543\r\n CVE-2014-0544\r\n CVE-2014-0545\r\n pass\r\n\r\n RHSA-2014:1052: openssl security update (Moderate)\r\n oval-com.redhat.rhsa-def-20141052\r\n CVE-2014-3505\r\n CVE-2014-3506\r\n CVE-2014-3507\r\n CVE-2014-3508\r\n CVE-2014-3509\r\n CVE-2014-3510\r\n CVE-2014-3511\r\n pass\r\n\r\n RHSA-2014:1053: openssl security update (Moderate)\r\n oval-com.redhat.rhsa-def-20141053\r\n CVE-2014-0221\r\n CVE-2014-3505\r\n CVE-2014-3506\r\n CVE-2014-3508\r\n CVE-2014-3510\r\n pass\r\n\r\n vulnerability scan exit status 0\r\n\r\nTODO: Implement some sort of CD system to poll the OVAL feed and rebuild\r\nthe image on any update. https://github.com/jumanjiman/docker-gocd may be\r\na candidate for the solution.\r\n\r\n\r\n## Test harness\r\n\r\nRSpec documents key behaviors and assures no regressions:\r\n\r\n contributor friction\r\n there should not be any\r\n\r\n jumanjiman/wormhole\r\n should use correct docker API version\r\n image should be available\r\n image properties\r\n should expose ssh port and only ssh port\r\n should have volume /home/user\r\n should have volume /media/state/etc/ssh\r\n\r\n admin scripts\r\n given user handle=\"booga\"\r\n everybody knows pubkey\r\n booga knows privkey\r\n `build.sh $handle \"$pubkey\"` creates wormhole from 2 containers\r\n \"booga-data\" is a persistent read-write container\r\n should exist\r\n should be stopped\r\n should be created from busybox\r\n should export /home/user volume read-write\r\n should export /media/state/etc/ssh volume read-write\r\n should not mount any volumes\r\n \"booga\" is a read-only app container\r\n should exist\r\n should be running\r\n should run unprivileged\r\n should be created from jumanjiman/wormhole\r\n should use volumes from booga-data\r\n should have hostname wormhole.example.com\r\n should be limited to 512 MiB RAM\r\n `docker logs` should show sshd running on sshd port\r\n should expose internal sshd port and only sshd port\r\n should map internal sshd port to an outside ephemeral port\r\n\r\n arcanist (phabricator client)\r\n `arc` is in user path\r\n `arc version` is functional\r\n uses bash autocompletion\r\n\r\n BZ1099206 (slow test)\r\n home directory should exist\r\n go get should work\r\n\r\n user convenience\r\n man -k returns results\r\n locate returns the path for issue.net\r\n\r\n shell-shock\r\n should resolve CVE-014-6271\r\n should resolve CVE-014-7169\r\n\r\n eiffelstudio\r\n has command-line eiffel compiler in path\r\n has estudio in path\r\n\r\n ldc D compiler\r\n compiles a D program (PENDING: https://bugzilla.redhat.com/show_bug.cgi?id=1176361)\r\n\r\n locale archive\r\n supports C\r\n supports POSIX\r\n supports en_US.utf8\r\n supports en_US.UTF-8\r\n\r\n SCAP secure configuration checks (slow test)\r\n should pass all tests\r\n /etc/securetty should be a zero-size file\r\n\r\n prohibited packages\r\n should not have at installed\r\n should not have prelink installed\r\n should not have sudo installed\r\n\r\n prohibited commands\r\n should not have the at command\r\n should not have the crond command\r\n should not have the crontab command\r\n should not have the /usr/sbin/prelink command\r\n\r\n rhc (openshift client)\r\n `rhc` is in user path\r\n `rhc --version` is functional\r\n\r\n sshd config\r\n auth\r\n should use privilege separation\r\n should use pam\r\n should allow pubkeyauthentication\r\n should deny passwordauthentication\r\n should deny gssapiauthentication\r\n should deny kerberosauthentication\r\n should deny challengeresponseauthentication\r\n tunnels and forwarding\r\n should deny ssh tunnels\r\n should deny TCP forwarding\r\n should deny X11 forwarding\r\n should deny gateway ports\r\n Common Configuration Enumeration (CCE)\r\n CCE-3660-8 Disable remote ssh from accounts with empty passwords\r\n CCE-3845-5 idle timeout interval should be set appropriately\r\n CCE-4325-7 Disable SSH protocol version 1\r\n CCE-4370-3 Disable SSH host-based authentication\r\n CCE-4387-7 Disable root login via SSH\r\n CCE-4431-3 SSH warning banner should be enabled\r\n CCE-4475-0 Disable emulation of rsh command through sshd\r\n CCE-14061-6 \"keep alive\" msg count should be set appropriately\r\n CCE-14491-5 Use appropriate ciphers for SSH\r\n CCE-14716-5 Users should not be allowed to set env options\r\n obscurity\r\n should hide patch level\r\n\r\n users with interactive shells\r\n should only include \"root\" and \"user\"\r\n su\r\n \"user\" cannot su\r\n\r\n Finished in 1 minute 6.35 seconds (files took 0.45472 seconds to load)\r\n 61 examples, 0 failures\r\n\r\n\r\nThe OpenSCAP secure configuration test shown above uses a\r\n[tailoring file](wormhole/wormhole-devenv-xccdf.xml)\r\nto adjust the upstream checks.\r\nIt expands to this inside the container:\r\n\r\n Title gpgcheck Enabled In Main Yum Configuration\r\n Rule ensure_gpgcheck_globally_activated\r\n Result pass\r\n\r\n Title gpgcheck Enabled For All Yum Package Repositories\r\n Rule ensure_gpgcheck_never_disabled\r\n Result pass\r\n\r\n Title Shared Library Files Have Restrictive Permissions\r\n Rule file_permissions_library_dirs\r\n Result pass\r\n\r\n Title Shared Library Files Have Root Ownership\r\n Rule file_ownership_library_dirs\r\n Result pass\r\n\r\n Title System Executables Have Restrictive Permissions\r\n Rule file_permissions_binary_dirs\r\n Result pass\r\n\r\n Title System Executables Have Root Ownership\r\n Rule file_ownership_binary_dirs\r\n Result pass\r\n\r\n Title Direct root Logins Not Allowed\r\n Rule no_direct_root_logins\r\n Result notchecked\r\n\r\n Title Virtual Console Root Logins Restricted\r\n Rule securetty_root_login_console_only\r\n Result pass\r\n\r\n Title Serial Port Root Logins Restricted\r\n Rule restrict_serial_port_logins\r\n Result pass\r\n\r\n Title Only Root Has UID 0\r\n Rule no_uidzero_except_root\r\n Result pass\r\n\r\n Title Log In to Accounts With Empty Password Impossible\r\n Rule no_empty_passwords\r\n Result pass\r\n\r\n Title Password Hashes For Each Account Shadowed\r\n Rule no_hashes_outside_shadow\r\n Result pass\r\n\r\n Title netrc Files Do Not Exist\r\n Rule no_netrc_files\r\n Result pass\r\n\r\n Title SSH Root Login Disabled\r\n Rule sshd_disable_root_login\r\n Result pass\r\n\r\n Title SSH Access via Empty Passwords Disabled\r\n Rule sshd_disable_empty_passwords\r\n Result pass\r\n\r\n Title SSH Idle Timeout Interval Used\r\n Rule sshd_set_idle_timeout\r\n Result pass\r\n\r\n Title SSH Client Alive Count Used\r\n Rule sshd_set_keepalive\r\n Result pass\r\n\r\n\r\n## User instructions\r\n\r\nNew containers begin life with a git-suitable\r\n[`~/.bashrc`](https://github.com/ISEexchange/docker-wormhole/blob/master/.bashrc).\r\nThis is only the initial bashrc; you can modify it at any time.\r\n\r\nInside the container, your user account is literally named `user`.\r\nThat means, with default build options, your prompt inside the container is:\r\n\r\n user@wormhole:~$\r\n\r\nConnect to your container with info provided by admin:\r\n\r\n ssh -i path/to/privkey -p user@\r\n\r\n\r\n## Admin instructions\r\n\r\n### Edit global configuration\r\n\r\nClone this repo, then inspect and optionally modify `global.conf`.\r\nWhen you build a user box for the first time, the build script\r\ncopies `global.conf` into `/etc/wormhole/global.conf`.\r\n\r\n\r\n### Edit duo configuration\r\n\r\nThis step is optional. The default configuration **does not use Duo**.\r\nIf you want to use Duo Security for multi-factor authentication,\r\nyou must edit both `global.conf` and `login_duo.conf`.\r\n\r\n* When you build your first user box (see below), these two files\r\n are copied into `/etc/wormhole/`.\r\n\r\n* If you modify `/etc/wormhole/*.conf`, you must restart the user\r\n app container(s).\r\n\r\n\r\n### Build a user box\r\n\r\nUse the build script with a unique user id (such as github handle)\r\nand the user ssh pubkey to create a runtime container:\r\n\r\n user=jumanjiman\r\n pubkey=\"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArSm80/8UD/eMolUXU3j6geyNrxthnQxbE4dpwRhXU+F6fbQG+wk9SdWev9NcLLWg9a4zBUSMJUXrrU/8ik3WshSpZpqQary4ZiFFQKgSfYriouchc20S3wwFQZcbOJgH5t5wgGeNaDMzc2GRFhqbuuBiBBF+W5llk0X9CGE1o1iAlyVPAn4UfrJ4//5OXMhYwmU+fO9df3y5Kpn/0SY/lRwWuZeVVIXC+nZcFYXNzPyBVTNEooOXLVXivddtU82jfp65ggTMdLfUafZqia1/smfWQP23lU8F4ySayAOa1lhXXvrGtpxl3lu7vaSvdEg7+F4YaIhxnWZqt769joDraw== pmorgan@github\"\r\n\r\n ./build.sh $user \"$pubkey\"\r\n\r\n:warning: The build script attempts to fetch the github user's\r\nssh pubkeys and place them into the data container as authorized keys.\r\nThis is *really* bad if you create a devenv for somebody based on\r\na name that is *not* their github handle and the name is a valid\r\ngithub handle for somebody else!\r\n\r\nA runtime container should be up on a random ssh port:\r\n\r\n $ docker ps\r\n\r\n CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES\r\n 689479673e8e jumanjiman:latest /bin/sh -c /usr/sbin About an hour ago Up About an hour 0.0.0.0:49153->22/tcp jumanjiman\r\n\r\nThe build script depends on systemd and enables a \"wormhole@\"\r\nservice to start at boot-time for the container you just created and\r\npersists the port as an environment variable in `/etc/wormhole/.conf`.\r\nFor example: If the username is jumanjiman, you can run\r\n`sudo systemctl status wormhole@jumanjiman` to see:\r\n\r\n ● wormhole@jumanjiman.service - jumanjiman app container\r\n Loaded: loaded (/etc/systemd/system/wormhole@.service; enabled)\r\n Active: active (running) since Wed 2014-06-18 14:08:05 UTC; 3h 18min ago\r\n Main PID: 701 (docker)\r\n CGroup: /system.slice/system-wormhole.slice/wormhole@jumanjiman.service\r\n └─701 /usr/bin/docker run --rm -t -m 512m --volumes-from jumanjiman-data -p 49153:22 -h wormhole.example.com --name jumanjiman...\r\n\r\n\r\n Jun 18 14:08:05 ip-192-168-254-21 bash[478]: jumanjiman\r\n Jun 18 14:08:05 ip-192-168-254-21 systemd[1]: Started jumanjiman app container.\r\n Jun 18 14:08:09 ip-192-168-254-21 docker[701]: Server listening on 0.0.0.0 port 22.\r\n Jun 18 14:08:09 ip-192-168-254-21 docker[701]: Server listening on :: port 22.\r\n\r\n:warning: The default `global.conf` limits each app container to 512 MiB memory.\r\nYou can override this for a single user in `/etc/wormhole/.conf`.\r\n\r\nYou can view the current limit for a container via the sys filesystem.\r\nFor example, here is a container that was started with a 1 MiB limit:\r\n\r\n $ cat /sys/fs/cgroup/memory/lxc//memory.limit_in_bytes\r\n 1048576\r\n\r\nIf a PID inside a container gets killed due to the memory limit,\r\nyou can view details in `dmesg` output.\r\n\r\n\r\n### Backup\r\n\r\nCreate a local file called `jumanjiman-data.tar` with contents of\r\nuser data container.\r\n\r\n ./backup.sh jumanjiman\r\n\r\n\r\n### Restore user data container from backup\r\n\r\n ./restore.sh jumanjiman\r\n\r\n\r\n### Upgrade user app container\r\n\r\nRebuild the `jumanjiman/wormhole` image as described above, then...\r\n\r\n ./upgrade.sh jumanjiman\r\n\r\n\r\n### Destroy a user app+data container\r\n\r\nBackup, then discard both the app and data containers for a user.\r\n\r\n ./destroy.sh jumanjiman\r\n\r\n\r\n### Build an image for the app container\r\n\r\nThis image serves as a template for an app container.
\r\nYou can build the image locally:\r\n\r\n script/build\r\n\r\nTrigger a rebuild-and-test cycle to get latest updates:\r\n\r\n cd wormhole/\r\n date > REBUILD\r\n git add REBUILD\r\n git commit -m 'test build with latest package updates'\r\n # Open pull request.\r\n\r\n:warning: Use CoreOS to build image.\r\n\r\nFedora kernel on DigitalOcean\r\nhas an older LXC implementation that leads to inconsistent builds.\r\nFor example, it sometimes builds the base image with bad perms on\r\n`/var` and other directories that *must* be `0755`.","has_starred","hub_user","immutable_tags_settings",{"_120":11,"_121":122},"enabled","rules",[123],".*","is_automated","permissions",{"_127":21,"_128":11,"_129":11},"read","write","admin","user","storage_size",24482482197,"isOrg","reponame","tag","canDeleteTags","isHubSbxKitsEnabled","currentTab","tagAttestations","displaySecurityMetadata","showSbxLogoOverride","routes/_layout.layers.$namespace.$reponame.$tag.(images).($imageUrlDigest)._index",{"_27":28,"_79":-7,"_77":-7,"_78":-7,"_29":144,"_44":45,"_147":-7,"_148":11},{"_31":32,"_33":34,"_35":36,"_37":38,"_39":145,"_60":61,"_62":34,"_63":64,"_65":66,"_67":68,"_69":70,"_71":49,"_72":61,"_73":58,"_74":21},[146],{"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":47,"_55":-5,"_56":36,"_57":58,"_59":-5},"imageWithLayers","hasPermissionToViewRepoSettings","actionData","errors"]

jumanjiman/wormhole:wip2