openfaas/faas

Research: implement authentication recommendations

Open

#793 opened on Jul 29, 2018

View on GitHub
 (3 comments) (0 reactions) (0 assignees)Go (26,155 stars) (1,969 forks)batch import
design/reviewenhancementhelp wanted

Description

The IETF provides some guidance on implementing OAuth 2.0. Whilst basic auth (used for the gateway administrative endpoints) is less sophisticated than OAuth 2.0, but there are some improvements we could make to the current model.

Brute-force mitigation

The implementation of basic-auth authentication for the Gateway can be enhanced to migrate brute-force / dictionary attacks by locking out the given user after too many incorrect login attempts.

https://tools.ietf.org/html/rfc6819#section-5.1.4.2.3

Perhaps this could be done by reading Prometheus metrics - i.e. failed attempts over last 30 seconds and then create a configmap or allow the gateway to self-lock. This may even automatically expire.

Clear-text storage of passwords

Kubernetes (and possibly Swarm) appears to store credentials in plain-text, or makes them available in plain-text at runtime.

It's recommended to hash these.

https://tools.ietf.org/html/rfc6819#section-5.1.4.1.3

Policy for passwords

The authorization server may decide to enforce a complex user password policy in order to increase the user passwords' entropy to hinder online password attacks.

This seems like something we should absolutely do to protect the people that set admin/admin for their credentials and then expose the gateway endpoint on the public Internet. Since the credentials are created out of brand, the gateway could refuse to start if the credentials are weak in length/complexity.

https://tools.ietf.org/html/rfc6819#section-5.1.4.2.1

Other areas

There are several other recommendations which we could implement with little effort.

Multi-user / auditing

If we enable multi-users for basic auth then we can also use that username in logging/auditing.

Start here

Help wanted in starting to suggest and implement improvements. The basic auth package is within the faas repo. https://github.com/openfaas/faas/blob/master/gateway/handlers/basic_auth.go https://github.com/openfaas/faas/blob/master/gateway/handlers/basic_auth_test.go

Contributor guide

Tech stack
godockerkubernetesprometheus
Domain
backendsecuritydevops
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
3-5 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Go programmingBasic authenticationPrometheusKubernetes
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40
Research direction
Investigate and implement improvements to the basic authentication in the gateway. Focus on brute force mitigation using Prometheus metrics as suggested, hash storage of passwords, and enforce password policy. Start by examining the existing implementation in gateway/handlers/basic auth.go and the tests in basic auth test.go. Consider the IETF recommendations linked in the issue.