Scanning configuration files: Ansible, Dockerfile, Compose
You automatically find security mistakes in Ansible playbooks, Dockerfiles and Compose files, write your own checks and tie scanning to pull requests.
Level 301 · 15 lessons · 12 practice labs
Lessons
Configuration as code
- The risks of configuration as code
- Common misconfigurations: open ports, root, plain passwords
- Short task: find the misconfigurations in three files by hand
Scanners
- Scanning Dockerfiles and Compose with Checkov
- Scanning Ansible with KICS
- ansible-lint and security rules
- Checking Ansible Vault use
- Short task: scan an infrastructure repository with two tools
Your own checks
- Writing your own check
- Skipping a check with a reason
- Policy as code: an introduction to OPA and Rego
- A Compose policy with conftest
- Short task: write a policy that rejects privileged containers
Capstone
- Catching configuration drift
- Capstone: add scanning and a policy gate to a team’s infrastructure repository
Practice labs
- Find the misconfigurations in three files by hand: Mark open ports, root users and plain passwords in a Dockerfile, a Compose file and an Ansible file.
- Fix the misconfigurations you found: Bind the port to loopback, add an unprivileged user and move the password to a variable.
- Map the risks of configuration as code in one repository: Work out who can change it, how changes are applied and where secrets live, and justify the three riskiest points.
- Scan a Dockerfile and Compose file with Checkov: Run the scan and list the IDs of the failed checks.
- Scan an infrastructure repository with two tools and compare: Put Checkov and KICS output side by side and separate shared from unique findings.
- Clean up a role repository with ansible-lint and a Vault check: Fix the security rule findings, move unencrypted secret variables into Ansible Vault and show the check comes out clean.
- Skip a check with a reason: Add a skip comment with its justification for an accepted finding and confirm it shows as skipped in the report.
- Write a policy that rejects privileged containers: Write a Rego rule forbidding the privileged setting and socket mounts and test it on two Compose files with conftest.
- Write the organisation’s own check and publish it with tests: Write a custom check requiring resource limits and a pinned image for every service and test it with passing and failing samples.
- Compare the definition in the repository with the running configuration: Compare the Compose definition with the running containers’ settings and list the differences.
- Catch configuration drift with a scheduled check: Write a job that runs Ansible in check mode and produces a report when it finds a difference.
- Add scanning and a policy gate to an infrastructure repository: In Selvikent Belediyesi’s repository wire the scan and conftest policy into the pre-merge check and show a change that breaks the rule is rejected.
About this course
You automatically find security mistakes in Ansible playbooks, Dockerfiles and Compose files, write your own checks and tie scanning to pull requests.
What you will learn
- Configuration as code
- Scanners
- Your own checks
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.