claude
2684095e2f
Co-authored-by: claude <claude@jpaul.io> Co-committed-by: claude <claude@jpaul.io>
78 lines
3.4 KiB
Bash
Executable File
78 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Module 19 lab — what a CI job could see if it ran on THIS machine.
|
|
#
|
|
# Run this on any machine you'd consider turning into a self-hosted runner (your laptop is fine for
|
|
# the exercise). It does NOT change anything — it only LOOKS. The point is to make concrete what is
|
|
# otherwise abstract: a "workflow step" is just a shell command, so whatever this read-only script
|
|
# can see, a malicious workflow step (e.g. from a pull request) running on this runner can see too.
|
|
#
|
|
# bash inspect-runner.sh
|
|
#
|
|
# Then paste the output into your AI and ask it to rank, worst-first, what a malicious PR could
|
|
# steal or reach if this were your runner. That conversation IS the security tradeoff for this module.
|
|
|
|
set -u
|
|
|
|
line() { printf '\n=== %s ===\n' "$1"; }
|
|
|
|
line "WHO AND WHERE"
|
|
echo "hostname : $(hostname 2>/dev/null)"
|
|
echo "user : $(whoami 2>/dev/null) (root? $( [ "$(id -u 2>/dev/null)" = 0 ] && echo YES || echo no ))"
|
|
echo "os : $(uname -srm 2>/dev/null)"
|
|
echo " >> A runner should run as a dedicated low-privilege user, never root, never your login."
|
|
|
|
line "SECRETS SITTING IN THE ENVIRONMENT"
|
|
# Don't print values — just the names. Seeing the NAMES is enough to make the point.
|
|
env | grep -iE 'token|secret|key|password|passwd|credential|aws|gcp|azure|api' | cut -d= -f1 | sort -u \
|
|
| sed 's/^/ exposed env var: /' || true
|
|
echo " >> Any of these is readable by every job step. Scope runner secrets to the absolute minimum."
|
|
|
|
line "CREDENTIAL FILES ON DISK"
|
|
for p in \
|
|
"$HOME/.aws/credentials" \
|
|
"$HOME/.config/gcloud" \
|
|
"$HOME/.azure" \
|
|
"$HOME/.docker/config.json" \
|
|
"$HOME/.kube/config" \
|
|
"$HOME/.netrc" \
|
|
"$HOME/.git-credentials" ; do
|
|
[ -e "$p" ] && echo " FOUND: $p"
|
|
done
|
|
echo " (nothing listed above = none of those common credential stores are present here)"
|
|
|
|
line "SSH KEYS (pivot material)"
|
|
if [ -d "$HOME/.ssh" ]; then
|
|
ls -1 "$HOME/.ssh" 2>/dev/null | sed 's/^/ ~\/.ssh\//'
|
|
echo " >> Private keys here let a compromised job hop to every host you can SSH to."
|
|
else
|
|
echo " no ~/.ssh directory"
|
|
fi
|
|
|
|
line "DOCKER SOCKET (root-equivalent if present)"
|
|
if [ -S /var/run/docker.sock ]; then
|
|
echo " /var/run/docker.sock EXISTS and is reachable."
|
|
echo " >> Access to the Docker socket is effectively root on the host. Big deal."
|
|
else
|
|
echo " no reachable docker socket"
|
|
fi
|
|
|
|
line "PRIVATE NETWORK REACH (the reason you self-host — and the reason it's dangerous)"
|
|
# Probe a few common private ranges' gateways and any hosts you care about.
|
|
# Edit these to match your network for a sharper result.
|
|
PROBES=( "192.168.0.1:80" "192.168.1.1:80" "10.0.0.1:80" )
|
|
for hp in "${PROBES[@]}"; do
|
|
host="${hp%%:*}"; port="${hp##*:}"
|
|
if timeout 2 bash -c ">/dev/tcp/${host}/${port}" 2>/dev/null; then
|
|
echo " REACHABLE: ${host}:${port}"
|
|
fi
|
|
done
|
|
echo " (edit the PROBES list above to test your real internal hosts — databases, deploy targets)"
|
|
echo " >> Every reachable internal host is something a compromised runner can attack or exfiltrate."
|
|
|
|
line "BOTTOM LINE"
|
|
echo "Everything listed above is what a self-hosted runner on this box would hand to ANY job it runs,"
|
|
echo "including a job defined by a pull request you haven't merged. That is the tradeoff. Mitigate with:"
|
|
echo " - ephemeral runners (fresh environment per job)"
|
|
echo " - a dedicated low-priv user on an isolated network segment"
|
|
echo " - least-privilege secrets, and NEVER attach this to a public repo without fork-PR approval"
|