Re: [cross-project-issues-dev] Why allowing Hudson to write to your down

["Schaefer, Doug" <Doug.Schaefer@xxxxxxxxxxxxx>]

1 optimizes to “don’t use Hudson”.

 

2 and 3 require deeper understanding than I think any project has of their code or have the resources to do. Sounds like patterns a secure JVM could detect, assuming there is such a beast.

 

4 isn’t very reliable since the malware could wake up 6 months from now. And the user’s firewall should be covering that.

 

Understanding the security weaknesses of Hudson (versus ssh at least) would be helpful to this discussion. Then we could figure ways to mitigate those.

 

:D

 

From: cross-project-issues-dev-bounces@xxxxxxxxxxx [mailto:cross-project-issues-dev-bounces@xxxxxxxxxxx] On Behalf Of Denis Roy
Sent: Wednesday, September 14, 2011 10:09 AM
To: Cross project issues
Subject: Re: [cross-project-issues-dev] Why allowing Hudson to write to your downloads is a Bad Idea.

 

On 09/14/2011 10:02 AM, Ed Merks wrote:

I agree with Doug. 

At no point have I seen anyone answer this question:

 What can be done manually to determine if what's produced by Hudson is compromised or not?

Off the top of my head:

1. run a build on a remote system and compare the pre-signed binaries.

2. run a past build and compare today's binaries with those in the past.

3. run a build and examine the execution trace.

4. run a build, run the executable and examine network output for unknown activity.

I also have to question whether this change during the SR1 shutdown phase is appropriate timing...

Go download the latest Linux Kernel from Kernel.org and tell me if there is ever a more appropriate time than 'now' to discuss security.

Denis

Regards,
Ed


On 14/09/2011 6:55 AM, Schaefer, Doug wrote:

I'll come back to something Dave Carver mentioned yesterday. If we don't trust Hudson, then we shouldn't be using it, or at least should be wrapping it up in tighter security, like a VPN for example. If someone is going to do something malicious and they're smart, you're likely not going to be able to discover it. You have to cut it at the source.

And is this not an issue other Hudson/Jenkins users have run into? What are they doing for security. Or do they trust Hudson as much as they do ssh.

Doug.