-5

I may have a tough one for you.

I have a machine in the wild that is and will probably continue to be compromised. The machine is owned by a user who will be unable to keep it secure.

I must have this machine pull from git. It must also automatically install all pulls without restart (no startup solutions).

I would prefer a platform agnostic solution.

I have a few objectives: 1). Email remote admin with logs of all pulls, making sure this process cannot be subverted or altered 2). Authenticate all git pulls in some manner without the auth being able to be cracked by an adversary

I hope you all can help.

closed as off-topic by l0b0, Jörg W Mittag, gnat, Bart van Ingen Schenau, BobDalgleish Jan 7 at 18:22

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to find or recommend tools, libraries, programming languages, resources (including books, blogs, tutorials, and examples), or projects to undertake are off-topic here as they attract opinionated answers that won't have lasting value to others. You may be able to get help in The Whiteboard, our chat room." – l0b0, Jörg W Mittag, gnat, BobDalgleish
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    This sounds shady – whatsisname Jan 5 at 1:22
  • @whatisname . I understand your concern. I have deployed several machines to users, and their network security practices are lacking - I have been told this is not something I am allowed to address, as we have no purview over client environments and limited manpower. – Kabala Krduchiwaba Jan 5 at 2:10
3

In general, once a machine is compromised the layer at which it has been compromised must be replaced to achieve any guarantees of authenticity from that layer. Say for example a user's home directory is compromised - you can no longer trust that the tools on that level (installed in ~/bin, for example) do what you expect, or that the files contain the same information they used to (unless you have hashes of those files elsewhere, and check those hashes with tools outside of that level). It follows that if the OS is compromised, a reinstall is in order.

In short, any "making sure this process cannot be subverted or altered" is off the table, and any "Authenticate all git pulls" could be easily subverted by tools changing the contents after authentication or reporting that everything is honky dory when they aren't.

0

Just because you can't secure against everything doesn't mean you should secure against nothing. Git has some useful features that can help ensure integrity of commits.

The first is just using https or ssh to do the pull. This provides a certain degree of confidence the pull came from the source you intended.

The second is using git-fsck to check that a commit matches the SHA-1 hash and wasn't corrupted somehow. Partial verifications of this kind are run occasionally during normal operation, but this command allows you to run a full check.

The third is signing your commits, and verifying the signature using git verify-commit or verify-tag. This is another layer of security that helps ensure the commits were created or verified by who you think they were.

Obviously, if someone has local control of a computer, they can bypass these checks, but that doesn't mean it isn't useful to guard against your update process becoming another vector for compromising a machine.

Not the answer you're looking for? Browse other questions tagged or ask your own question.