Your browser does not seem to support JavaScript. As a result, your viewing experience will be diminished, and you may not be able to execute some actions.

Please download a browser that supports JavaScript, or enable it if it's disabled (i.e. NoScript).

How can I retrieve a lost login token for KubeApps?

A
Avante last edited by

How can I retrieve the root token from a KubeApps deployment?
Reply Quote 0
1 Reply Last reply

shizuka

When you set up a KubeApps deployment you must install a Kubernetes secret, https://kubeapps.dev/ detail it like this,


kubectl create clusterrolebinding kubeapps-operator --clusterrole=cluster-admin --serviceaccount=default:kubeapps-operator
cat <<EOF | kubectl apply -f -

apiVersion: v1

kind: Secret

metadata:

name: kubeapps-operator-token

namespace: default

annotations:

kubernetes.io/service-account.name: kubeapps-operator

type: kubernetes.io/service-account-token

EOF
kubectl get --namespace default secret kubeapps-operator-token -o jsonpath='{.data.token}' -o go-template='{{.data.token | base64decode}}' && echo

So basically it's a https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ installed in the default namespace. You can list these like this,

 kubectl get --namespace default secrets

You specifically want the kubeapps-operator-token and you can get it with the last line,

kubectl get --namespace default secret kubeapps-operator-token -o jsonpath='{.data.token}' -o go-template='{{.data.token | base64decode}}'

The -o go-template='{{.data.token | base64decode}}' is basically just piping it to base64 -d in Go (like this).

kubectl get --namespace default secret kubeapps-operator-token -o jsonpath='{.data.token}' | base64 -d

2
Posts

0
Views

Suggested Topics

Can I keep a container started with --rm option?
Continuous Integration and Delivery (CI, CD) • docker • • Mystic

2

0
Votes

2
Posts

1
Views

S

No, docker will delete the container when it stops, and there's no update option to change that behavior. You can see this in the help output: $ docker container update --help Usage: docker container update [OPTIONS] CONTAINER [CONTAINER...] Update configuration of one or more containers Options: --blkio-weight uint16 Block IO (relative weight), between 10 and 1000, or 0 to disable (default 0) --cpu-period int Limit CPU CFS (Completely Fair Scheduler) period --cpu-quota int Limit CPU CFS (Completely Fair Scheduler) quota --cpu-rt-period int Limit the CPU real-time period in microseconds --cpu-rt-runtime int Limit the CPU real-time runtime in microseconds -c, --cpu-shares int CPU shares (relative weight) --cpus decimal Number of CPUs --cpuset-cpus string CPUs in which to allow execution (0-3, 0,1) --cpuset-mems string MEMs in which to allow execution (0-3, 0,1) --kernel-memory bytes Kernel memory limit -m, --memory bytes Memory limit --memory-reservation bytes Memory soft limit --memory-swap bytes Swap limit equal to memory plus swap: '-1' to enable unlimited swap --pids-limit int Tune container pids limit (set -1 for unlimited) --restart string Restart policy to apply when a container exits Trying to change the restart policy will result in an error: $ docker run --rm --name test-rm -d busybox tail -f /dev/null 14a7d9bfebc3356652e3c3f060e92d9cebb9f3eb4490873540c9eb1c272f6612 $ docker update --restart=unless-stopped test-rm Error response from daemon: Cannot update container 14a7d9bfebc3356652e3c3f060e92d9cebb9f3eb4490873540c9eb1c272f6612: Restart policy cannot be updated because AutoRemove is enabled for the container You can try to copy your data out of the container with: docker container cp $container_name:/path/in/container /path/on/host If you don't know which files to save, list which files have changed in the container with: docker container diff $container_name
O

Sending non-expiring access token on each request vs using refresh tokens?
Security, Penetration Testing • authentication api rest token • • obi

2

0
Votes

2
Posts

0
Views

T

When working - for example - with JWT tokens, the tokens are self-signed. Which means that the resource service can verify the token's integrity without having to communicate with the authentication server. Which is fine to do with short-lived access tokens. But when the refresh token will be used to acquire a new access token from the authentication server, the authentication server could be performing more validation like checking if the session was revoked or if the user's account still exist, is still active and still has the rights to access the resource service for which it will issue a new access token. In that case, using refresh and access tokens can help you implement simpler validation mechanisms for short-lived access tokens, allowing faster response from your resource server.
T

Can Terraform S3 remote state be kept in a different AWS account?
Continuous Integration and Delivery (CI, CD) • amazon web services terraform amazon s3 aws iam • • tahishae

2

0
Votes

2
Posts

1
Views

You can have two approaches: Assume the role that has access to the AWS bucket. Assume this role in every account (don't forget to set up trust relationship). This is your approach. I think the issue might be some objects (state files) were created in a different way. Other culprit can be an account-specific KMS key that is used to create the objects. Don't forget, KMS keys are region-specific. You grant access to other “users” via the S3 UI. (At the time of writing it is not supported by the Terraform AWS Provider.) Go to the S3 bucket -> Permissions -> Access Control List -> Access for other AWS accounts -> Add account Find the canonical ID for the account you want to give permission to. Set the bucket-level and object-level permissions. Beware, the Principal (owner) of the object will be different, so the account that actually hosts the bucket might not have access to it.
N

Multi-Single-Factor vs. Multi-Factor Authentication
Security, Penetration Testing • authentication multi fac languagetor • • nishika

2

0
Votes

2
Posts

0
Views

S

This definition you share for multi-factor authentication does not meet the commonly accepted industry definition. Multi-factor just means that two or more factors, typically from different categories of authenticators, are used to authenticate. It isn't specific regarding whether these factors unlock access to a local 'secret' that is used for further authentication or sent directly to the authentication server. Either scenario still involves multi-factor authentication. What these factors unlock as far as secrets, session tokens, or the like shouldn't really affect their name. I can't say I've ever heard the term "multiple single-factor-authenticator" before. I'd interpret this to mean you have a system that uses two factors from the same category, e.g. a password and a PIN. Multi-factor authentication is generally going to be more secure than single factor because it should be more difficult for an attacker to compromise multiple factors. They might be able to guess your password, but it is more difficult to both guess it and obtain a valid OTP tokencode.
M

Is an emailed PIN for 2FA worthwhile?
Security, Penetration Testing • authentication • • magpie

2

0
Votes

2
Posts

0
Views

K

What you are describing is 2 factor authentication, whether it's the most secure of 2 factor authentication is a question for a security expert though. Wikipedia does offer a great example of what 2FA is and i believe the step you mentioned would be classed as two 2FA. an automated teller machine (ATM) typically requires two-factor verification. To prove that users are who they claim to be, the system requires two items: an ATM smartcard (application of the possession factor) and the personal identification number (PIN) (application of the knowledge factor). In the case of a lost ATM card, the user's accounts are still safe; anyone who finds the card cannot withdraw money as they do not know the PIN. The same is true if the attacker has only knowledge of the PIN and does not have the card. From Wikipedia In fact what you're proposing is very similar to how Steam authenticate users on new machines. You login using your username and password A verification email is sent to an already verified email address to confirm you want to allow access to your account from that machine. Without access to both the knowledge factor (your username and password) and the possession factor (access to the email address) you cannot login on a new machine. 2FA isn't for everyone though so by default i think this should be turned off and you should encourage the user to activate the feature themselves. Some users may not want the extra friction which comes with 2FA and some users may simply not value the security of their account higher than ease of login. Edit: To answer your question... It's not a bad experience IF they're not forced into 2FA and it depends entirely on their value for security over ease of login.
J

Docker container can't reach host services
Continuous Integration and Delivery (CI, CD) • docker • • juvenalb

2

0
Votes

2
Posts

1
Views

Z

It happens that the problem comes from ufw not allowing connections from docker containers on host ports. Deactivating it helped for now, since it's only for dev purpose.
Hashing two passwords can produce the same hash. How to prevent this?
Security, Penetration Testing • authentication passwords hash • • carriann

2

0
Votes

2
Posts

0
Views

S

It is a mathematical certainty that any hash function with a fixed output size will have collisions. However, the chance of a collision can be reduced by using a hash function with a large output size. Using SHA-2 with the default output size of 256 bits, for example, means that you will need 2^128 users before there is a 50% chance that some pair of them will have the same password hash[*]. Ideally, you should apply a hash function to SALT+PASSWORD, where SALT is a unique value specific to the user account. If the salt values are chosen uniquely over accounts, this virtually ensures that both username and password must match with a specific account to allow logging in. Please note that the above is only intended to explain the concept. In practice, you should almost always delegate this task to a quality implementation of a standard password hashing function, such as PBKDF2 or bcrypt, rather than rolling your own. [*] - assuming no pair of them actually have the same password, which can happen with surprisingly few different users. In the case of Alice and Bob having the exact same password and Alice logging in as Bob accidentally, there is nothing you can reasonably be expected to do about this. In terms of unreasonable efforts, you could store the hash of PEPPER+PASSWORD for each user (where PEPPER is a site-wide constant), run a script to detect same-password cases, put the hash on a "bad list", and automatically send e-mail asking users to change their password if their password hash is in the "bad list". Note however that this opens your site up to a new kind of attack whereby an attacker repeatedly changes their password to a common password and waits to see if an e-mail is generated. If it is, they know another user has that password and they can try common usernames with it (or, the result of scraping any available public data for usernames, such a site forum). So you should rate-limit the script that sends e-mails (for example, to once per day) to reduce the efficacy of such an attack.
A

Remember Me vs Remember Email
Security, Penetration Testing • authentication passwords • • Anderson

2

0
Votes

2
Posts

0
Views

J

I can explain this to you by taking few examples First is that you have allowed "keep me signed in" on your website, so there are chances of unauthorized access if the user computer gets hijacked or is in hands of an unauthorized person. A malicious person will be able to get every information residing on the account. However, there are least chances that the the person will be able to do any malicious activity such doing a transaction or changing the password and or email. These require an user to enter the current password. Second case is that you have enabled 'Remember Email.' The user is comparatively more secure than in the previous case, chances are low that there will be an unauthorized access to the account. However, there is one little possibility of losing the account if there is any malware or say keylogger residing on the computer. The user will lose the control over the account, but it happens mostly in the case of targeted attacks. In my opinion allowing 'Remember Email' is a better option than allowing 'Keep me Signed In.'
T

How well can agile pair programming work in interdisciplinary DevOps contexts?
Continuous Integration and Delivery (CI, CD) • agile software engineering deployment culture • • Trenton

2

0
Votes

2
Posts

1
Views

E

Agile fits very well with a DevOps culture and pair programming is no exception. The following are some examples of "pair programming" principles applied in a DevOps context: A pair of individuals working together on a Dockerfile for their service. A pairing sits together to work on defining their infrastructure as code. A traditional developer and an IT administrator building a CI/CD pipeline together. A specialist and tester sit together to define what the testing environment should look like. A specialist and a customer sitting together and working on a deployment to the customers infrastructure.
S

mobile number authorization strategy using SMS, best pattern and practices
Security, Penetration Testing • authentication sms authorization • • Saumya

2

0
Votes

2
Posts

0
Views

A

Lets look at some different attacks and how they impact the two different systems, followed by some usability considerations. Control of phone (draw) If the attacker has full controll over the phone, it is game over no matter what. However, an attacker may have been able to get a trojan onto ther phone that only has limited permissions. At least on Android, reading and sending SMS is different permissions. However, this secnario feels rather contrived and I see no reason why it would be harder to get one permission than is is to get the other. Social engineering (#1 wins) To fool some users to read the code is easy if that is all the message contains. Call the user, say that you are from the cell phone company testing the reception or whatever, and that they will soon recieve a message to read back. (A competent attacker could come up with a way better lie than I just did.) However, this can be made hard if the SMS contains an explanation of what the code is (and perhaps an exlpicit warning against phising), thereby revealing all your social engineering lies. A user that has to send an SMS can get not such warning. That user could fall for tricks like "just send this code to this number to claim your free sport car". Not everybody would fall for this, but some would, especially if it is for a service they seldom use so they do not recognice the number. Eavesdropping on the phone network (#2 wins) As GSM encryption is famously weak, and fake cell phone towers to use for MitM can be bought on the internet, an attacker might try to eavesdropp on the SMS communication. This is not a theoretical threat, but something that is done in the wild. With system one, an eavesdropper has to read the passcode that is sent to the user when they try to login. The attacker then needs to use it before the user (should be easy if the process is automated). This requires the attacker to be in the physical proximity of the target when the user happens to login to the service. With system two, it doesn't matter if the attacker reads the SMS. The passcode is (or at least should be) unique to the users device, and the attacker can not authenticate on his device even if he knows the passcode the user sent. SMS spoofing (#1 wins, major issue) SMS spoofing is a very real thing that is used in the wild. If the attacker can spoof the users phone number in an SMS, he can overcome alternative two. This is a major weakness in that approach. I just googled "free SMS spoofing service" and came up with this site. Surely even your computer illierate uncle could do the same, thereby bypassing your authentication scheme. Usability (#1 wins) Alternative two has some downside when it comes to usability: The user has to enter a passcode and a number to send it to. This takes longer time. Two things to copy paste is twice as many as one. The user might enter the wrong phone number, resulting in a failed login. If the wrong passcode is entered in alternative one, it is easy to give appropriate feedback to the user. If an incorrect phone number is entered, it is hard for the server to know what happend and give the right feedback to the user. Sending a SMS might cost money for the user. Conclusion On security, it is 2-1 to alternative one. But how serious are the different vulnerabilities? I would argue that especially SMS spoofing but also social engineering are larger threats than eavesdropping. They can both be done from anywhere in the world, and require much less effort and technical knowledge. SMS spoofing could possibly be done automated on a large scale. So even leaving usability to the side, I would argue that alternative one is the safer alternative. TL;DR You can spoof the sender of an SMS, making them useless for identifying the sender. Use the first alternative.
J

How can I set up Deployment to run at least one pod on each node?
Continuous Integration and Delivery (CI, CD) • kubernetes high availability deployment • • juvenalb

2

0
Votes

2
Posts

0
Views

T

You can use topologySpreadConstaints for spreading Deployment pods evenly across nodes, regardless of the number of pods. Kubernetes documentation contains https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ , as well as following article - https://medium.com/geekculture/kubernetes-distributing-pods-evenly-across-cluster-c6bdc9b49699#:%7E:text=In%20order%20to%20distribute%20pods,in%20its%20own%20topology%20domain. . The .spec.teplate.spec would look something like: spec: topologySpreadConstraints: - maxSkew: 1 topologyKey: kubernetes.io/hostname whenUnsatisfiable: ScheduleAnyway labelSelector: matchLabels: type: dummy
J

Can we talk about "reproducible builds" when working with interpreted languages?
Continuous Integration and Delivery (CI, CD) • terminology term disambiguation • • jules

2

0
Votes

2
Posts

1
Views

A "build" does not have though to be a compilation step. ".. the term build is similar to that of any other field. That is, the construction of something that has an observable and tangible result." https://en.wikipedia.org/wiki/Software_build More important in this context is to be able to reuse results of your build in other contexts to build new things. That is, also in PHP and Javascript you could produce some packaged artefacts, be it a zip file or language specific archive linkable to a dependency manager: NPM in Javascript and Composer in PHP for example.
R

Running SQL job: The login is from an untrusted domain and cannot be used with Windows authentication
SQL, Database Testing • sql server authentication linked server jobs logins • • rosemadder

2

0
Votes

2
Posts

0
Views

R

The job is executed as the SQL Agent account, unless you have configured a proxy. The owner of the job is irrelevant as long as the SQL Agent account can verify that the owner is valid (still exists in AD/SQL). Verify which account is running the job, either the SQL Agent account or the Proxy account. Then verify that account has permissions into the linked server. Or create a proxy account for this job.
D

How can I build a Linux VM that I can use to test Rest API calls in a lab?
Continuous Integration and Delivery (CI, CD) • api • • Duquan

2

0
Votes

2
Posts

1
Views

J

You can test basically any rest api call from postman, a free app that runs perfectly well in windows or Linux (or Mac I’m sure). You don’t need anything special. If you want to use Linux specific tools, you can sign up for AWS free tier and make a Linux box in minutes following any of their tutorials (it will be free for 1 year). You can also use docker on your computer (including on windows). Docker will be suitable for running most non GUI based or web GUI based Linux apps. I see a locust image here for example - https://docs.locust.io/en/stable/running-locust-docker.html.
B

Can use a private IP address as the puppet certname?
Continuous Integration and Delivery (CI, CD) • puppet • • Burma

2

0
Votes

2
Posts

1
Views

T

You can indeed use IP address in the "certname" directive of puppet.conf file. In addition, you can create a private hosted zone in AWS Route53 that is called for example lab.local and then create an A record for your puppet server such as for example puppetmaster.lab.local and then use this address in the certname directive. Opening a hosted zone in Route 53 doesn't cost much... around 0.50$ per month for your first 25 zones. The full Route53 pricing can be found here.

How can I retrieve a lost login token for KubeApps?

Suggested Topics

Can I keep a container started with --rm option? Continuous Integration and Delivery (CI, CD) • docker • • Mystic

Sending non-expiring access token on each request vs using refresh tokens? Security, Penetration Testing • authentication api rest token • • obi

Can Terraform S3 remote state be kept in a different AWS account? Continuous Integration and Delivery (CI, CD) • amazon web services terraform amazon s3 aws iam • • tahishae

Multi-Single-Factor vs. Multi-Factor Authentication Security, Penetration Testing • authentication multi fac languagetor • • nishika

Is an emailed PIN for 2FA worthwhile? Security, Penetration Testing • authentication • • magpie

Docker container can't reach host services Continuous Integration and Delivery (CI, CD) • docker • • juvenalb

Hashing two passwords can produce the same hash. How to prevent this? Security, Penetration Testing • authentication passwords hash • • carriann

Remember Me vs Remember Email Security, Penetration Testing • authentication passwords • • Anderson

How well can agile pair programming work in interdisciplinary DevOps contexts? Continuous Integration and Delivery (CI, CD) • agile software engineering deployment culture • • Trenton

mobile number authorization strategy using SMS, best pattern and practices Security, Penetration Testing • authentication sms authorization • • Saumya

How can I set up Deployment to run at least one pod on each node? Continuous Integration and Delivery (CI, CD) • kubernetes high availability deployment • • juvenalb

Can we talk about "reproducible builds" when working with interpreted languages? Continuous Integration and Delivery (CI, CD) • terminology term disambiguation • • jules

Running SQL job: The login is from an untrusted domain and cannot be used with Windows authentication SQL, Database Testing • sql server authentication linked server jobs logins • • rosemadder

How can I build a Linux VM that I can use to test Rest API calls in a lab? Continuous Integration and Delivery (CI, CD) • api • • Duquan

Can use a private IP address as the puppet certname? Continuous Integration and Delivery (CI, CD) • puppet • • Burma

Can I keep a container started with --rm option?
Continuous Integration and Delivery (CI, CD) • docker • • Mystic

Sending non-expiring access token on each request vs using refresh tokens?
Security, Penetration Testing • authentication api rest token • • obi

Can Terraform S3 remote state be kept in a different AWS account?
Continuous Integration and Delivery (CI, CD) • amazon web services terraform amazon s3 aws iam • • tahishae

Multi-Single-Factor vs. Multi-Factor Authentication
Security, Penetration Testing • authentication multi fac languagetor • • nishika

Is an emailed PIN for 2FA worthwhile?
Security, Penetration Testing • authentication • • magpie

Docker container can't reach host services
Continuous Integration and Delivery (CI, CD) • docker • • juvenalb

Hashing two passwords can produce the same hash. How to prevent this?
Security, Penetration Testing • authentication passwords hash • • carriann

Remember Me vs Remember Email
Security, Penetration Testing • authentication passwords • • Anderson

How well can agile pair programming work in interdisciplinary DevOps contexts?
Continuous Integration and Delivery (CI, CD) • agile software engineering deployment culture • • Trenton

mobile number authorization strategy using SMS, best pattern and practices
Security, Penetration Testing • authentication sms authorization • • Saumya

How can I set up Deployment to run at least one pod on each node?
Continuous Integration and Delivery (CI, CD) • kubernetes high availability deployment • • juvenalb

Can we talk about "reproducible builds" when working with interpreted languages?
Continuous Integration and Delivery (CI, CD) • terminology term disambiguation • • jules

Running SQL job: The login is from an untrusted domain and cannot be used with Windows authentication
SQL, Database Testing • sql server authentication linked server jobs logins • • rosemadder

How can I build a Linux VM that I can use to test Rest API calls in a lab?
Continuous Integration and Delivery (CI, CD) • api • • Duquan

Can use a private IP address as the puppet certname?
Continuous Integration and Delivery (CI, CD) • puppet • • Burma