DevSecOps Archives - Application Security

How to integrate Gitea with Okta (Authentication)?

Published by Bobby Lin on September 17, 2022

Start up Gitea

Create a docker.compose.yml file with the latest Gitea rootless image:

version: "3"

networks:
  gitea:
    external: false

services:
  server:
    image: gitea/gitea@sha256:ef6279e13e223d956bc417f299a3530795afcf79f3af429a5c893262c550a648
    container_name: gitea
    environment:
      - USER_UID=1000
      - USER_GID=1000
    restart: always
    networks:
      - gitea
    volumes:
      - ./gitea:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "3000:3000"
      - "222:22"

Run a command to start Gitea as a docker image in your machine:

docker-compose --project-name gitea -f docker.compose.yml up -d
docker ps -a # Check if the containers are running

Go to localhost and you can see that a local instance of Gitea is running.

Okta integration

Create a Web app in Okta:

Configure the redirect URL: http://localhost:3000/user/oauth2/okta/callback

Save the Client Id and Client secret that will be input into Gitea

You must name the authentication to be the same name under the redirect url. In this case, I have name it as okta

http://localhost:3000/user/oauth2/okta/callback

The admin should paste the Client Id and Client secrets from Okta app to the Authentication Sources tab in “Site Administration”.

Test the integration between Gitea and Okta

You will be redirected to Okta for authentication (ensure MFA is enabled preferably with FIDO2)

If this is the first time that you login with Gitea, you will need to fill in your username and email address to create an account.

How to Dockerize your project?

Published by Bobby Lin on January 30, 2022

Creating a Dockerfile

Usual steps of creating a Dockerfile of your application:

Specify Base Image
Specify any environment variables
Specify commands to run on the top of OS layer such as:
- downloading or updating dependencies
- add groups or users to run process instead of root
Copy the application files into the image.
Specify which port(s) for container to listen
Specify the command to start the application

Dockerfile Instructions	Arguments
`FROM`	Base Image or other Container Image
`RUN`	1. Passing commands (runs in shell) 2. Passing exec form: [“executable”, “p1”, “p2”] Execute command in a new layer. Examples: – Updating dependencies
`COPY`	`COPY` is preferred to `ADD` as we know clearly that `COPY` will just copy files from local directory. `ADD` is useful if you wanna copy the content in a `tar` file.
`ENTRYPOINT`	Define the command that will always be executed when the container starts. By default, Docker is using `/bin/sh -c` as the entrypoint.
`CMD`	Define the arguments that will be appended to the `ENTRYPOINT`
`WORKDIR`	Define where your commands should run. Saves the trouble of running to many `cd .....`
`EXPOSE`	Define the ports that a container listens.
`ENV`	Setting environment variables that can be used in other instructions such as `RUN`

FROM node:12-alpine
RUN apk add --no-cache python2 g++ make
EXPOSE 9091
WORKDIR /app
COPY . .
RUN yarn install --production
CMD ["node", "src/index.js"]

References:

Running a container

Make sure the port publish setting (-p) is positioned before the image tag so that it can override the image default settings.
https://stackoverflow.com/questions/66316400/cannot-reach-docker-container-port-not-bound

docker run -p 9091:9091 -t spring-boot-docker

References:

https://stackoverflow.com/questions/67120152/spring-boot-apps-port-mapping-in-docker-container

Purpose of DevSecOps and its future

Published by Bobby Lin on January 8, 2022

“…make sure that the constraint is not allowed to waste any time. Ever. It should never be waiting on other resource for anything, and it should always be working on the highest priority commitment the IT Operations organization has made to the rest of the enterprise. Always.”
The Phoenix project

The NUMBER ONE constraint in Security department is people.

It is unlikely we can hire enough people to match the number of developers and operations engineers.

The way to free up our constraint (people) is to try to automate as many tasks as possible so that the people can do the things that are unique and contextual.

Another way is to take a preventative approach by educating developers and ops engineers on best security practices that they need to follow (this means secure by defaults configurations, having documentation and guides). The famous Netflix’s paved roads….

any improvement not made at the constraint is just an illusion, yes?
The Phoenix project

Tag: DevSecOps