We have a CI server which is installed as the
builduser and all tasks are executed as that respective user at the OS level. We have many teams sharing the build server which means the
build user and its resources are shared.
Each team also manages different environments and this requires ssh connectivity from the build server. Because we are driving automation, passwordless connectivity was initially setup to facilitate running automated tasks remotely (
build user's public key copied to the
authorized_keys file on the remote host).
This as you can imagine poses a security concern since any user running a task can access any environment.
One solution would be to use something like
sshpass (provide the ssh password as an argument) and have different user/password combinations for each environment. At the task level create role based ACLs to lock down who can see the password as it seems like it will be in plaintext. Another concerning thing I'm curious to find out more about is the command exposure here. I have been lead to believe that users can peak into the running process and see what commands the
build user has executed - is this possible without root privileges? (even better if someone can illustrate how this can be done or point me to some documentation)
Apart from validating my approach, I'm also looking for recommendations on how this problem can be potentially solved.