<div dir="ltr">Hello Eric, <div><br></div><div>To be honest, if we have anyone authenticating to the systems in any way we are not following our IAC standards. This current VPC is a snowflake and it was treated as one. Things were manually done and configurations were changed. And yes that should be tracked by specific users. The current IDM users should be the users that are used for authentication in the snowflake situations. </div><div><br></div><div>If we continue to auth to these vpc's and make one-off modification we will continue to have the issues that we do today. If we capture the issues and or features and get them prioritized and developed as code the user issue will become a mute point. </div><div><br></div><div>We also have an issue in git to automate the scans and to have the artifacts shipped to S3 for review. Once this is in place we will no longer need to make the modification and allow SSH or port 22 access into the systems. </div><div><br></div><div>I would argue that opening the system for security scanning is our biggest security risk currently. </div><div><br></div><div>Let's take these next couple of weeks and really lock down the system. If we work together and outline the correct requirements and get them implemented as code we will all sleep better at night. Oh and it will make cybercom happy. </div><div><br></div><div>The next major task will be to leverage IAC to build a more secure VPC with our current code base that currently addresses some of the concerns and move the apps into that VPC. We will continue this pattern as we evolve the IAC and the process. i.e. let's build the feedback loop and continue to develop. </div><div><br></div><div>Thanks, </div><div><br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><p style="color:rgb(0,0,0);font-family:RedHatText,sans-serif;font-weight:bold;margin:0px;padding:0px;font-size:14px;text-transform:capitalize"><span>KEVIN</span> <span>O'DONNELL </span></p><p style="color:rgb(0,0,0);font-family:RedHatText,sans-serif;font-size:12px;margin:0px;text-transform:capitalize"><span>ARCHITECT MANAGER</span></p><p style="color:rgb(0,0,0);font-family:RedHatText,sans-serif;margin:0px 0px 4px;font-size:12px"><a href="https://www.redhat.com/" style="color:rgb(0,136,206);margin:0px" target="_blank">Red Hat <span>Red Hat NA Public Sector Consulting</span></a></p><div style="color:rgb(0,0,0);font-family:RedHatText,sans-serif;font-size:medium;margin-bottom:4px"></div><p style="color:rgb(0,0,0);font-family:RedHatText,sans-serif;margin:0px;font-size:12px"><span style="margin:0px;padding:0px"><a href="mailto:kodonnell@redhat.com%20M:240-605-4654" style="color:rgb(0,0,0);margin:0px" target="_blank">kodonnell@redhat.com</a> M: 240-605-4654</span></p><div style="color:rgb(0,0,0);font-family:RedHatText,sans-serif;font-size:medium;margin-top:12px"><table border="0"><tbody><tr><td width="100px"><a href="https://red.ht/sig" target="_blank"><img src="https://static.redhat.com/libs/redhat/brand-assets/latest/corp/logo.png" width="90" height="auto"></a></td></tr></tbody></table></div><table border="0"><tbody><tr><td width="100px"></td></tr></tbody></table>
</div></div></div></div></div></div></div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Dec 20, 2019 at 9:13 AM Blade, Eric D [US] (MS) <<a href="mailto:Eric.Blade@ngc.com">Eric.Blade@ngc.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-5875133126815580884WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">I just want to clarify on the topic of the EC2-user. The key is attribution. We need to know who or what is configuring the systems.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">We are repeatedly seeing the ec2-user account used to manually configure systems. Ec2-user should only be used to perform programmatic tasks from committed and
reviewed code as part of initial provisioning. If the code to provision and configure systems is unavailable, then you must create attributable accounts to perform changes to the systems.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Any use of ec2-user remote login or su to ec2-user will be flagged as a violation and the source IP or user account logged as the violating source. Any manual/command
line activities MUST be performed using an attributable user account.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">If that is not clear, please let me know and I will attempt to elaborate further.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Thank you<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Book Antiqua",serif;color:rgb(112,48,160)">Eric Blade, GXPN, GPEN<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Book Antiqua",serif;color:rgb(31,73,125)">Unified Platform System Coordinator<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Book Antiqua",serif;color:rgb(31,73,125)">Northrop Grumman Mission Systems<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Book Antiqua",serif;color:rgb(31,73,125)">Work: 410.649.0706<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Book Antiqua",serif;color:rgb(31,73,125)">Mobile: 240.258.8089<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> Kevin O'Donnell <<a href="mailto:kodonnel@redhat.com" target="_blank">kodonnel@redhat.com</a>>
<br>
<b>Sent:</b> Thursday, December 19, 2019 6:22 PM<br>
<b>To:</b> Lastrilla, Jet <<a href="mailto:jlastrilla@mitre.org" target="_blank">jlastrilla@mitre.org</a>><br>
<b>Cc:</b> Feiglstok, Colleen M [US] (MS) <<a href="mailto:Colleen.Feiglstok@ngc.com" target="_blank">Colleen.Feiglstok@ngc.com</a>>; BRYAN, AUSTEN R Capt USAF AFMC AFLCMC/HNCP <<a href="mailto:austen.bryan.1@us.af.mil" target="_blank">austen.bryan.1@us.af.mil</a>>; DIROCCO, ROGER E GG-13 USAF AFMC ESC/AFLCMC/HNCP <<a href="mailto:roger.dirocco.4@us.af.mil" target="_blank">roger.dirocco.4@us.af.mil</a>>; <a href="mailto:platformONE@redhat.com" target="_blank">platformONE@redhat.com</a>; Tim Gast <<a href="mailto:tg@braingu.com" target="_blank">tg@braingu.com</a>>;
Bubb, Mike <<a href="mailto:mbubb@mitre.org" target="_blank">mbubb@mitre.org</a>>; TRAMBLE, ELIJAH Q Capt USAF AFMC AFLCMC/HNC <<a href="mailto:elijah.tramble.1@us.af.mil" target="_blank">elijah.tramble.1@us.af.mil</a>>; <a href="mailto:tj.zimmerman@braingu.com" target="_blank">tj.zimmerman@braingu.com</a>; LOPEZDEURALDE, RICHARD A Lt Col USAF AFMC AFLCMC/HNCP <<a href="mailto:richard.lopezdeuralde@us.af.mil" target="_blank">richard.lopezdeuralde@us.af.mil</a>>; Blade, Eric D [US] (MS) <<a href="mailto:Eric.Blade@ngc.com" target="_blank">Eric.Blade@ngc.com</a>>;
RAMIREZ, JOSE A CTR USAF AFMC AFLCMC/HNCP <<a href="mailto:jose.ramirez.50.ctr@us.af.mil" target="_blank">jose.ramirez.50.ctr@us.af.mil</a>>; Leonard, Michael C. <<a href="mailto:leonardm@mitre.org" target="_blank">leonardm@mitre.org</a>>; REINHARDT, MELISSA A GG-13 USAF AFMC AFLCMC/HNCP <<a href="mailto:melissa.reinhardt.2@us.af.mil" target="_blank">melissa.reinhardt.2@us.af.mil</a>>; Taylor Biggs <<a href="mailto:taylor@redhat.com" target="_blank">taylor@redhat.com</a>>; Miller, Timothy J. <<a href="mailto:tmiller@mitre.org" target="_blank">tmiller@mitre.org</a>>;
CRISP, JOSHUA M GS-09 USAF AFMC AFLCMC/HNCP <<a href="mailto:joshua.crisp.2@us.af.mil" target="_blank">joshua.crisp.2@us.af.mil</a>>; BOGUE, STEVEN E CTR USAF AFMC AFLCMC/HNCP <<a href="mailto:steven.bogue.1.ctr@us.af.mil" target="_blank">steven.bogue.1.ctr@us.af.mil</a>>; Wilcox, John R. (San Antonio, TX) [US] (MS) <<a href="mailto:John.R.Wilcox@ngc.com" target="_blank">John.R.Wilcox@ngc.com</a>><br>
<b>Subject:</b> EXT :Re: [EXT] Platform1 SAR<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Colleen, <u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Thank you for the results and recommendations. We will get GIT issues crated for your findings and will prioritize the mitigation and implement them as code in our future IAC deployments. Many of the findings in the current VPC have been
mitigated in up-prod-b with our current code release. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Please let us know when you have finished and we can power down the host that you have been using for scanning. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Note for everyone: Once we power down the ec2 instance ssh or port 22 will not be externally accessible. Thus, mitigating many of the risks associated with the ec2-user and the keys. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Thanks, <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><br clear="all">
<u></u><u></u></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p style="margin:0in 0in 0.0001pt"><b><span style="font-size:10.5pt;font-family:Arial,sans-serif;color:black">KEVIN O'DONNELL <u></u><u></u></span></b></p>
<p style="margin:0in 0in 0.0001pt;text-transform:capitalize"><span style="font-size:9pt;font-family:Arial,sans-serif;color:black">ARCHITECT MANAGER<u></u><u></u></span></p>
<p style="margin:0in 0in 0.0001pt"><span style="font-size:9pt;font-family:Arial,sans-serif;color:black"><a href="https://www.redhat.com/" target="_blank"><span style="color:rgb(0,136,206)">Red Hat Red Hat NA Public Sector Consulting</span></a><u></u><u></u></span></p>
<p style="margin:0in 0in 0.0001pt"><span style="font-size:9pt;font-family:Arial,sans-serif;color:black"><a href="mailto:kodonnell@redhat.com%20M:240-605-4654" target="_blank"><span style="color:black">kodonnell@redhat.com</span></a> M: 240-605-4654<u></u><u></u></span></p>
<div style="margin-top:9pt">
<table border="0" cellpadding="0">
<tbody>
<tr>
<td style="padding:0.75pt">
<p class="MsoNormal"><a href="https://red.ht/sig" target="_blank"><span style="text-decoration:none"><img border="0" width="90" style="width: 0.9375in;" id="gmail-m_-5875133126815580884_x0000_i1025" src="https://static.redhat.com/libs/redhat/brand-assets/latest/corp/logo.png"></span></a><u></u><u></u></p>
</td>
</tr>
</tbody>
</table>
</div>
<table border="0" cellpadding="0">
<tbody>
<tr>
<td style="padding:0.75pt"></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Thu, Dec 19, 2019 at 4:52 PM Lastrilla, Jet <<a href="mailto:jlastrilla@mitre.org" target="_blank">jlastrilla@mitre.org</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal">Thanks Colleen. Sorry for the rushed feeling. If you want to take more time, please use tomorrow to do your testing. <u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thank you for all you do!!!!<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Get <a href="https://aka.ms/o0ukef" target="_blank">Outlook for iOS</a><u></u><u></u></p>
</div>
</div>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="gmail-m_-5875133126815580884gmail-m_-5629248523895447281divRplyFwdMsg">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif;color:black">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif;color:black"> Feiglstok, Colleen M [US] (MS) <<a href="mailto:Colleen.Feiglstok@ngc.com" target="_blank">Colleen.Feiglstok@ngc.com</a>><br>
<b>Sent:</b> Thursday, December 19, 2019 4:35:15 PM<br>
<b>To:</b> Lastrilla, Jet <<a href="mailto:jlastrilla@mitre.org" target="_blank">jlastrilla@mitre.org</a>>; BRYAN, AUSTEN R Capt USAF AFMC AFLCMC/HNCP <<a href="mailto:austen.bryan.1@us.af.mil" target="_blank">austen.bryan.1@us.af.mil</a>>; DIROCCO, ROGER E
GG-13 USAF AFMC ESC/AFLCMC/HNCP <<a href="mailto:roger.dirocco.4@us.af.mil" target="_blank">roger.dirocco.4@us.af.mil</a>>; Kevin O'Donnell <<a href="mailto:kodonnel@redhat.com" target="_blank">kodonnel@redhat.com</a>>;
<a href="mailto:platformONE@redhat.com" target="_blank">platformONE@redhat.com</a> <<a href="mailto:platformONE@redhat.com" target="_blank">platformONE@redhat.com</a>>; Tim Gast <<a href="mailto:tg@braingu.com" target="_blank">tg@braingu.com</a>>; Bubb, Mike
<<a href="mailto:mbubb@mitre.org" target="_blank">mbubb@mitre.org</a>>; TRAMBLE, ELIJAH Q Capt USAF AFMC AFLCMC/HNC <<a href="mailto:elijah.tramble.1@us.af.mil" target="_blank">elijah.tramble.1@us.af.mil</a>>;
<a href="mailto:tj.zimmerman@braingu.com" target="_blank">tj.zimmerman@braingu.com</a> <<a href="mailto:tj.zimmerman@braingu.com" target="_blank">tj.zimmerman@braingu.com</a>>; LOPEZDEURALDE, RICHARD A Lt Col USAF AFMC AFLCMC/HNCP <<a href="mailto:richard.lopezdeuralde@us.af.mil" target="_blank">richard.lopezdeuralde@us.af.mil</a>>;
Blade, Eric D [US] (MS) <<a href="mailto:Eric.Blade@ngc.com" target="_blank">Eric.Blade@ngc.com</a>>; RAMIREZ, JOSE A CTR USAF AFMC AFLCMC/HNCP <<a href="mailto:jose.ramirez.50.ctr@us.af.mil" target="_blank">jose.ramirez.50.ctr@us.af.mil</a>>; Leonard, Michael
C. <<a href="mailto:leonardm@mitre.org" target="_blank">leonardm@mitre.org</a>>; REINHARDT, MELISSA A GG-13 USAF AFMC AFLCMC/HNCP <<a href="mailto:melissa.reinhardt.2@us.af.mil" target="_blank">melissa.reinhardt.2@us.af.mil</a>>; Taylor Biggs <<a href="mailto:taylor@redhat.com" target="_blank">taylor@redhat.com</a>>;
Miller, Timothy J. <<a href="mailto:tmiller@mitre.org" target="_blank">tmiller@mitre.org</a>>; CRISP, JOSHUA M GS-09 USAF AFMC AFLCMC/HNCP <<a href="mailto:joshua.crisp.2@us.af.mil" target="_blank">joshua.crisp.2@us.af.mil</a>>; BOGUE, STEVEN E CTR USAF AFMC
AFLCMC/HNCP <<a href="mailto:steven.bogue.1.ctr@us.af.mil" target="_blank">steven.bogue.1.ctr@us.af.mil</a>>; Wilcox, John R. (San Antonio, TX) [US] (MS) <<a href="mailto:John.R.Wilcox@ngc.com" target="_blank">John.R.Wilcox@ngc.com</a>><br>
<b>Subject:</b> [EXT] Platform1 SAR</span> <u></u><u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
<div>
<div>
<p>All,<u></u><u></u></p>
<p> <u></u><u></u></p>
<p>The SAR and raw results from the new security testing will be sent through NGSafe in a few moments.<u></u><u></u></p>
<p> <u></u><u></u></p>
<p>As usual, I felt very rushed with the testing, and feel like I have not done as thorough of a job as required. I was unable to log into the Web UIs, as no one from the Platform1 team gave me the account information. I had issues with Nessus, so the CVE’s
were found through OSCAP this time.<u></u><u></u></p>
<p> <u></u><u></u></p>
<p style="margin-bottom:2pt">A lot is the same as the last report, but please read through it, because there is some new information. I had to test as ec2-user again, which is another big issue that needs to be resolved ASAP. The more I use it and find out
how it is being used, the more extremely concerned I am. It has multiple keys throughout the platform located in the .ssh directory, one of which is world readable. On some hosts, a real user is using the ec2-user account to create accounts, groups, and pull
docker files. The account is non-attributable, so we have no way of knowing who is doing this. Someone could do serious damage with no consequence. I understand that the ec2-user is needed for standing up an ec2-image, but
<span style="color:black">this account should only be used for implementing IAC, so that the changes implemented by ec2-user are codified. If manual admin is required, that IAC should provision the appropriate attributable accounts, and those accounts should
be used from then on.</span> In my opinion, this is a critical finding and needs to be addressed ASAP.
<u></u><u></u></p>
<p> <u></u><u></u></p>
<p>I will be available during the day tomorrow for any questions.<u></u><u></u></p>
<p> <u></u><u></u></p>
<p>Thanks<u></u><u></u></p>
<p>Colleen<u></u><u></u></p>
<p> <u></u><u></u></p>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote></div>