2

I want to install curl and openssl packages in a Docker image based on Alpine Linux that I use in production. These packages will help me with debugging SSL certificates and HTTPS connections in my Kubernetes setup.

I know that Alpine Linux is built with security in mind. Therefore, I wonder if I will compromise the security of the container in any way. For example, I wonder if curl could allow an attacker to download and execute arbitrary code somehow, or if openssl could be used to forge certificates.

I couldn't find any information on this topic on the Internet.

3
  • 1
    No, you will not compromise the security if you install curl and openssl and keep them updated.
    – ThoriumBR
    Oct 4, 2022 at 12:36
  • @ThoriumBR I like your answer, but could you clarify for me how that is the case. You can see that the other answer on this post talks about the opposite. Oct 5, 2022 at 9:12
  • 1
    If any attacker have a shell inside your container, you already lost. It's possible to use python, Perl, PHP, nc/netcat, wget, even bash to download anything, and the attacker can generate the certificate externally and download.
    – ThoriumBR
    Oct 5, 2022 at 9:44

2 Answers 2

2

If you are thinking on the security of the container after an attacker compromised it somehow, it's already too late. If the attacker have a shell, he can bootstrap an entire development environment if he wants. A shell on a minimal possible installation is enough to use cat or echo and create a minimal TCP client that can be used to download other tools.

You said you want to troubleshoot, so we assume you are the user. Both curl and openssl aren't standalone servers, so it won't be used by a remote user. Installing them will not give any advantage to an attacker that aren't already inside the system. Installing a server component (FTP server, application server, web server) on the other hand would create an attack surface for a remote attack.

0
0

"Safe" is not an absolute, binary property. It is always gradual, and relative to a scenario.

Every tool you install on a system may help an attacker, just by supporting her activities, even if it does not introduce an actual vulnerability. curl may help her downloading some attack tool. openssl might help her creating a TLS connection or gathering information from a certificate. So it's always a good idea to omit tools that aren't required for the purpose of the system. But that doesn't mean your system isn't safe anymore because of the installation of those tools, just as it doesn't mean your system was safe before because of their absence. It is just a small increase in the attack surface which you should take into account in your general security assessment.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .