Stratus

README.md

@@ -9,35 +9,23 @@ NOTICE: this repository also contains malware samples, it is possible your AV so
 Instructions & prerequisites:
 -----------------------------
 
-- [docker compose](https://docs.docker.com/compose/)
-- copy of this repository
-- all the commands should be run in the same directory hwere you cloned the repository. docker compose will pick up the configuration file automatically
-- run `docker compose pull` to pull the dependencies
-- run `docker compose build` to build the custom container with preinstalled tools
+- Access to Stratus (stratus.fi.muni.cz)
+  - make sure to configure your SSH key under Settings -> Auth -> Public SSH Key
 
-  - if there are updates, you need to re-run this step, run `docker compose down` first to remove any previous work
+![sshkey.png](sshkey.png)
 
-- run `docker compose up -d` to start the containers. You should see containers `postgres` and `vault` as running in logs.
 
-  - Check that there is no error in those two containers!
-  - run `docker compose down` to shutdown the running containers
 
-    - shutting down all containers will also remove all data, all work/modifications you have done will be reset
-    - you can use this to reset your environment if you misconfigure something
+Installation:
+---
 
-- you are now ready for the exercise!
+Create a Debian12 VM machine with the default options:
 
+![vm_creation.png](vm_creation.png)
 
-Manual installation
--------------------
 
-If there is a problem with the docker compose containers or you wish to not use the docker then the following software is required:
-
-- password protected PostgreSQL instance + postgres client
-- [Hashicorp Vault](https://www.vaultproject.io)
-- python3 with venv, build and pip modules installed
-- [diffoscope & strip-nondeterminism tools](https://reproducible-builds.org/tools/)
-- gcc
-
-You can also refer to the included docker configuration files which basically contains installation instructions of all dependencies into ubuntu
+When the VM boots up, login via ssh and run the following command:
 
+```shell
+curl "https://raw.githubusercontent.com/SourceCode-AI/secure_coding/refs/heads/master/install_debian.sh"|bash
+```

cheat_sheet.md

@@ -1,54 +1,3 @@
-Reproducible builds exercise
-============================
-
-Reproducing a package ~ 20min
-
-Exec inside the container `docker compose run --rm -ti secure_coding  /bin/bash`
-
-```shell
-root@7ccad3d01d39:/# cd /local_data/python_package/
-
-root@7ccad3d01d39:/local_data/python_package# ls
-pyproject.toml  secure_coding_demo_package
-
-root@7ccad3d01d39:/local_data/python_package# python3 -m build
-...
-Successfully built secure_coding_demo_package-0.0.1.tar.gz and secure_coding_demo_package-0.0.1-py3-none-any.whl
-
-
-root@7ccad3d01d39:/local_data/python_package# diffoscope dist/secure_coding_demo_package-0.0.1-py3-none-any.whl /local_data/prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl
-
-root@7ccad3d01d39:/local_data/python_package# mkdir /local_data/html
-root@7ccad3d01d39:/local_data/python_package# diffoscope dist/secure_coding_demo_package-0.0.1-py3-none-any.whl /local_data/prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl --html-dir /local_data/html
-
-root@7ccad3d01d39:/local_data/python_package# strip-nondeterminism dist/secure_coding_demo_package-0.0.1-py3-none-any.whl
-root@7ccad3d01d39:/local_data/python_package# diffoscope dist/secure_coding_demo_package-0.0.1-py3-none-any.whl /local_data/prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl
-root@7ccad3d01d39:/local_data/python_package# md5sum dist/secure_coding_demo_package-0.0.1-py3-none-any.whl /local_data/prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl
-
-e11a303eef41e70032b4130652e740be  dist/secure_coding_demo_package-0.0.1-py3-none-any.whl
-e11a303eef41e70032b4130652e740be  /local_data/prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl
-```
-
-
-compare compiled code ~5 min
-```shell
-root@8157f590f783:/# cd /local_data/
-root@8157f590f783:/local_data# diff hello_world.c malwaretest.c
-4c4
-< 	printf("Hello world\n");
----
-> 	printf("malwaretest\n");
-
-
-gcc hello_world.c -o a.out
-gcc malwaretest.c -o b.out
-
-diffoscope a.out b.out
-
-```
-
-CTX Malware exercise ~ 15 min
-
 
 Vault
 =====
@@ -60,13 +9,8 @@ Vault KV
 
 ```bash
 # verify creds
-
-docker compose logs vault
-
-docker compose exec -ti vault /bin/sh
-
-
 vault status
+# vault operator unseal
 vault login
 
 # Store secret
@@ -99,25 +43,11 @@ curl -H "X-Vault-Request: true" -H "X-Vault-Token: $(vault print token)" http://
 ```
 
 
-
 Vault PostgresQL Integration
 ============================
 
 ~ 20 min
 
-Setup DB
-```shell
-docker compose exec -ti vault /bin/sh
-apk add postgresql-client
-
-/ # psql -h postgres -U postgres
-Password for user postgres: not_so_secure_default_password
-postgres=# create database secure_data;
-postgres=# \c secure_data;
-secure_data=# create table users (name VARCHAR(255));
-secure_data=# \q
-
-```
 
 Configure vault
 ```shell
@@ -129,8 +59,8 @@ Success! Enabled the database secrets engine at: database/
 / # vault write database/config/secure_db \
  plugin_name="postgresql-database-plugin" \
  allowed_roles="secure_coding_role" \
- connection_url="postgresql://{{username}}:{{password}}@postgres:5432/secure_data" \
- username="postgres" \
+ connection_url="postgresql://{{username}}:{{password}}@<YOUR_IP>:5432/secure_db?sslmode=disable" \
+ username="vault" \
  password="not_so_secure_default_password"
 Success! Data written to: database/config/secure_db
 
@@ -156,3 +86,77 @@ secure_data=> INSERT INTO users VALUES ('ratata');
 ERROR:  permission denied for table users
 ```
 
+
+
+Reproducible builds exercise
+============================
+
+Reproducing a package ~ 20min
+
+```shell
+root@debian12:/secure_coding# cd /secure_coding/local_data/
+root@debian12:/secure_coding/local_data# tree
+.
+├── hello_world.c
+├── malwaretest.c
+├── prebuild_package
+│   └── secure_coding_demo_package-0.0.1-py3-none-any.whl
+└── python_package
+    ├── pyproject.toml
+    └── secure_coding_demo_package
+        ├── __init__.py
+        └── sneaky_package
+            └── __init__.py
+
+5 directories, 6 files
+
+
+root@debian12:/secure_coding/local_data# cd python_package/
+root@debian12:/secure_coding/local_data/python_package# python3 -m build
+...
+Successfully built secure_coding_demo_package-0.0.1.tar.gz and secure_coding_demo_package-0.0.1-py3-none-any.whl
+
+
+root@debian12:/secure_coding/local_data/python_package# strip-nondeterminism dist/secure_coding_demo_package-0.0.1-py3-none-any.whl
+root@debian12:/secure_coding/local_data/python_package# strip-nondeterminism dist/secure_coding_demo_package-0.0.1-py3-none-any.whl
+root@debian12:/secure_coding/local_data/python_package# diffoscope dist/secure_coding_demo_package-0.0.1-py3-none-any.whl ../prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl
+root@debian12:/secure_coding/local_data/python_package# md5sum dist/secure_coding_demo_package-0.0.1-py3-none-any.whl ../prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl
+81cab8eab03f8255a8c05bb014c40824  dist/secure_coding_demo_package-0.0.1-py3-none-any.whl
+81cab8eab03f8255a8c05bb014c40824  ../prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl
+
+root@7ccad3d01d39:/secure_coding/python_package# mkdir /secure_coding/html
+root@7ccad3d01d39:/secure_coding/python_package# diffoscope dist/secure_coding_demo_package-0.0.1-py3-none-any.whl /secure_coding/prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl --html-dir /local_data/html
+
+
+```
+
+
+compare compiled code ~5 min
+```shell
+root@debian12:/secure_coding/local_data# cd /secure_coding/local_data/
+root@debian12:/secure_coding/local_data# ls
+hello_world.c  malwaretest.c  prebuild_package	python_package
+root@debian12:/secure_coding/local_data# cat hello_world.c
+root@debian12:/secure_coding/local_data# cat malwaretest.c
+
+root@debian12:/secure_coding/local_data# gcc hello_world.c -o a.out
+root@debian12:/secure_coding/local_data# gcc malwaretest.c -o b.out
+root@debian12:/secure_coding/local_data# ls
+a.out  b.out  hello_world.c  malwaretest.c  prebuild_package  python_package
+root@debian12:/secure_coding/local_data# diffoscope a.out b.out
+
+```
+
+CTX Malware exercise ~ 15 min
+---
+
+
+```shell
+root@debian12:/secure_coding/local_data# mkdir /var/www/html/diffoscope
+root@debian12:/secure_coding/local_data# diffoscope a.out wannabe_ransomware --html-dir /var/www/html/diffoscope
+
+root@debian12:/secure_coding# cd /secure_coding/malware/
+root@debian12:/secure_coding/malware# ls
+b40297af54e3f99b02e105f013265fd8d0a1b1e1f7f0b05bcb5dbdc9125b3bb5.gz  ctx-0.1.2.tar.gz
+root@debian12:/secure_coding/malware# diffoscope ctx-0.1.2.tar.gz b40297af54e3f99b02e105f013265fd8d0a1b1e1f7f0b05bcb5dbdc9125b3bb5.gz
+```

install_debian.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+
+
+if [ "$EUID" -ne 0 ]
+  then echo "Please run as root"
+  exit
+fi
+
+
+cd /
+apt-get update
+apt-get install -y gpg
+
+wget -O - https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
+echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
+
+apt-get update
+apt-get install -y  nano gcc wget jq screen python3-venv python3-pip strip-nondeterminism tree postgresql postgresql-client vault git python3-pip xxd binutils-multiarch openssl nginx
+
+apt-get install -y diffoscope-minimal --no-install-suggests --no-install-recommends
+pip install build==1.2.1 wheel==0.43.0 setuptools==61.0 --break-system-packages
+
+git clone https://github.com/SourceCode-AI/secure_coding.git /secure_coding
+
+echo "listen_addresses='*'">>/etc/postgresql/15/main/postgresql.conf
+
+echo "host    all             all              0.0.0.0/0                       scram-sha-256">>/etc/postgresql/15/main/pg_hba.conf
+echo "host    all             all              ::/0                            scram-sha-256">>/etc/postgresql/15/main/pg_hba.conf
+
+#PG_PASSWD=$(openssl rand -hex 16)
+sudo -u postgres createdb secure_db
+sudo -u postgres psql -c "create role vault with login superuser password 'not_so_secure_default_password'";
+sudo -u postgres psql --db secure_db -c "create table users (name VARCHAR(255));";
+sudo -u postgres psql --db secure_db -c "insert into users values ('john doe');";
+systemctl restart postgresql
+
+#pip3 install build --break-system-packages
+echo "export VAULT_SKIP_VERIFY=true">>/etc/bash.bashrc
+echo "export VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:8200">>/etc/bash.bashrc
+echo "export VAULT_ADDR=http://127.0.0.1:8200">>/etc/bash.bashrc
+touch /tmp/automation_finished

local_data/python_package/pyproject.toml

@@ -13,5 +13,5 @@ requires-python = ">=3.9"
 
 
 [build-system]
-requires = ["setuptools>=61.0"]
+requires = ["setuptools==61.0", "wheel==0.43.0"]
 build-backend = "setuptools.build_meta"