Fabio: Warn if fabio is run as root

[magiconair]

Follow up from #195 which suggest that fabio should refuse to start as root unless you pass an -insecure flag. I'm still not fully convinced that users will just use the flag as workaround. Everybody has a right to shoot him/herself in the foot but I'm open for discussion.

[sean-]

PostgreSQL does this and it’s been a useful safety precaution that has probably prevented many incidents. That said, it’s also extremely irritating as an operator when diving into a problem as root. Or even when I’m in a secured contained environment and there is only one process, but now I have to manage the creation and lookup of a user/UID. In an ideal world I’d rather see a big obnoxious warning when the flag is used and a once-an-hour log entry nagging the user that the process is running as root (vs only at startup time).

[mterron]

I stand by what I said in the original thread. It is the software responsibility to do the right thing, in this case refuse to run as root. If you really really really want to (even though it is a bad idea in 99.9999% of the cases), there's a cli switch that will allow you to do that.

Let's make doing the right thing the easy thing to do. +1 on the hourly WARNING when running as root, great idea.

The last ~25 years has proven beyond doubt that "secure by default" is the only reasonable choice, as the large majority of users/operators WILL NOT take steps to secure their deployments and WILL ignore "a big obnoxious warning" as long as the "thing" runs.

If you know what you are doing and want to run with decreased security for your environment, adding a cli switch that is clearly explained to you when you try to do something that's potentially unsafe is not a big deal. Same if you are building containers, adding a user on the build phase is trivial work and industry best practice.

[magiconair]

@mterron I agree that the software should do the right thing but there is a valid case for running fabio as root inside a container if it is the only app. Static go binaries like fabio run from a SCRATCH container where there is no user management. Making this mandatory would mean to require a full-blown OS to support that which just increases the size and the attack surface. Also, containers provide the root abstraction for that reason, IMHO. You can be root but you're not root outside your container.

Also, if users will ignore a warning in the logs then they will just use the switch if is there. :)

OK, then the path forward is to refuse to run as root unless you specify -insecure. Issue a visible warning at startup and one WARN log message every hour.

[mterron]

Just 1 comment. Container root (in linux) IS the host system root. There's
a new user mapping feature but not widely deployed afaik.

[magiconair]

That's how I understand that but you'd have to break out of the container first, right? Isn't the point of containers to prevent that?

[mterron]

This is probably semantics, but IMO as a Security professional, containers in linux don't exist. The kernel have no idea what a container is, the only thing it knows about is cgroups and namespaces.

On other OSs, a container is a kernel primitive so the control and segmentation is stronger (see Solaris/Illumos Zones) and multitenancy is possible (and encouraged).

[magiconair]

I've pushed a PR which will add a recurring warning which is written to the logs during startup and once an hour if fabio is run as root. The message of the warning changes slightly when the new -insecure flag is used noting that with version 1.7 fabio will refuse to start when run as root.

[magiconair]

2017/10/23 16:37:48 [INFO] Running fabio as UID=0 EUID=0 GID=0
2017/10/23 16:37:48 [WARN]

    ************************************************************
    You are running fabio as root with the '-insecure' flag
    Please check the fabio wiki for alternatives
    ************************************************************

and

2017/10/23 16:38:09 [INFO] Running fabio as UID=0 EUID=0 GID=0
2017/10/23 16:38:09 [INFO] Setting GOMAXPROCS=8
2017/10/23 16:38:09 [WARN]

    ************************************************************
    You are running fabio as root without the '-insecure' flag
    This will stop working with fabio 1.7!
    ************************************************************

[magiconair]

This way users have time to adjust to the change in default behavior.

[johnypony3]

It is now almost a year later. the dockerhub image is still running as root. why?

[stevenscg]

@johnypony3 I was just back checking on this as well. We are moving all of our containers away from root user, so I will probably build my own on alpine and a non-root user.

[leprechau]

@johnypony3 feel free to submit a PR to adjust the project Dockerfile. The required changes should be adding a USER directive and a setcap execution before dropping privileges.