René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"RFC: Add Scanner Capability Flag to enhance Scanner Worker Selection","articleBody":"## Is your feature request related to a problem? Please describe.\r\n\r\nWhen it comes to Multi Tenancy there are two main axis we'd like two support with the secureCodeBox Engine:\r\n\r\n### Team Separation\r\n\r\nThis allows the association of scanners operated by the teams with that team. The scanners will then only work on scan jobs created by that team. This was implemented in #79.\r\n\r\n\r\n## Capability Separation\r\n\r\nNot every worker deployment in a team has to be the same. \r\n\r\nSome scanners might...\r\n\r\n  - be deployed in certain network situation which enable different scans.\r\n  - have files mounted onto their filesystem which are required to perform certain scans.\r\n  - have certain configuration / deployment requirements by the scanner to run certain kinds of scans. E.g. nmap requiring root rights / linux capabilities to run OS detection scans (See: https://github.com/secureCodeBox/scanner-infrastructure-nmap/issues/2)\r\n\r\nThis problem can be solved by using the team separation feature by creating a new team for every team / capability combination, but that is quite tedious. These teams could look something like this:\r\n\r\n- team42\r\n- team42_nmap_privileged\r\n- team42_zap_behindwaf\r\n\r\nCreating new teams requires to assign all team members to every of their related teams, which is a big organisational overhead. \r\n\r\n![scb-multi-tenancy](https://user-images.githubusercontent.com/13718901/60582903-ff405f80-9d89-11e9-97b4-ba1fc35fa062.png)\r\n\r\n## Describe the solution you'd like\r\n\r\nI'd like to introduce capabilities into the `StartSecurityTest` and the `LockScanJob` APIs. \r\n\r\nThe addition to the startSecurity Test API would be a new optional `requiredCapabilities` attribute which allows the user to express which capabilities are required for the scan job. \r\n\r\nThe addition to the `LockScanJob` API would allow the scanners to communicate to the engine which capabilities the have.\r\n\r\n`POST https://engine.securecodebox.demo/box/securityTests`\r\n\r\n```json\r\n[\r\n  {\r\n    \"context\": \"Feature Team 1\",\r\n    \"metaData\": {},\r\n    \"name\": \"nmap\",\r\n    \"target\": {\r\n      \"attributes\": {\r\n        \"NMAP_PARAMETER\": \"-Pn\"\r\n      },\r\n      \"location\": \"127.0.0.1\",\r\n      \"name\": \"SecureCodeBox Demo Website\"\r\n    },\r\n    \"tenant\": \"team-1\",\r\n\t\"requiredCapabilities\": [\r\n\t\t\"behind-firewall\",\r\n  \t\t\"privileged-deployment\"\r\n\t]\r\n  }\r\n]\r\n```\r\n\r\nThe relevant new attribute here is `requiredCapabilities`.\r\n\r\nFor a scanner to be able to work on this task it would need to be configured that:\r\n\r\n- The engine user of the scanner worker, set by the env vars: `ENGINE_SCANNERSERVICES_USER` and `ENGINE_BASIC_AUTH_PASSWORD` need to be a member of `team-1`\r\n- The worker need to have the (new) environment var `SCANNER_CAPABILITIES` to be set to: `behind-firewall,privileged-deployment` (or `privileged-deployment,behind-firewall`, the order should not matter)\r\n\r\nScanner without the `SCANNER_CAPABILITIES` env var will only be able to work on scan jobs without requiredCapabilities.\r\n\r\nExample deployment (`docker-compose` for readability):\r\n\r\n```yml\r\nnmap-team42:\r\n    image: securecodebox/nmap:latest\r\n    environment:\r\n      - ENGINE_ADDRESS=http://engine:8080\r\n      - ENGINE_BASIC_AUTH_USER=team42-tu-nmap\r\n      - ENGINE_BASIC_AUTH_PASSWORD=foobar\r\n      - SCANNER_CAPABILITIES=behind-firewall,privileged-deployment\r\n```\r\n\r\n## Describe alternatives you've considered\r\n\r\n- Multiple teams (see problem descriptions)\r\n- Using camunda custom permissions, to prevent scanner without capabilities to access scan jobs.","author":{"url":"https://github.com/J12934","@type":"Person","name":"J12934"},"datePublished":"2019-07-03T10:10:21.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/89/engine/issues/89"}