Scan Ruby-based apps for security issues with Dawnscanner

https://www.helpnetsecurity.com/2016/10/12/scan-ruby-based-apps-dawnscanner

Dawnscanner is an open source static analysis scanner designed to review the security of web applications written in Ruby.

Dawnscanner’s genesis

Its developer, Paolo Perego, says that he was motivated to create it back in spring 2013, when he needed a tool to review a number of Sinatra-powered security apps, but couldn’t use the Brakeman Scanner as it supports only the testing of Ruby on Rails applications.
“Dawnscanner is not tied to a particular MVC (Model View Controller) framework. It is able to review code of Sinatra, Padrino and Ruby on Rails applications, and we plan to add support for Hanami (formerly Lotus for Ruby) in the future,” he told Help Net Security.
The tool is currently able to perform 230 security checks, covering issues from CVE/OSVDB bulletins and the OWASP Ruby on Rails security cheatsheet. It is also able to spot security issues related to the Ruby interpreter version developers are using for their projects.
Dawnscanner has no GUI, but has command line flags to help people using it in their own application security pipeline. It provides several formatting options for reporting, and can store scan results in a designated folder so developers can keep a history of security findings. Scan results list found vulnerabilities, and and offer mitigation options for them.

Short- and long-term plans

Paolo’s plans for the tool are many. He wants to add support for the Hanami framework and pure Rack applications, make Dawnscanner able to parse custom code to spot OWASP Top 10 security issues, and achieve a tight GitHub integration, so that the tool is able to consume a GitHub URL as an input parameter, download the report, bundle-install dependencies, and start analyzing the code.
If you notice that these plans contrast with the provided Dawnscanner development roadmap, be aware that the roadmap is also in need of an update.
Paolo is currently working on changing the way Dawnscanner manages its knowledge base, so that the knowledge base can be updated automatically, and a change in it does not lead to a new Dawnscanner gem release.

Development challenges

“With a full time job, 2 kids and, well, life, it’s really hard to be always on, pushing new code, fixing bugs and so on. There are periods of time in which I had to put energies on different topics,” he notes.
He’s aware that Dawnscanner is no longer a side project “just for fun”, and that people rely on it for their code production.
“Working on a tool designed to be consumed by a community trained to implement agile software development and to release often is really challenging,” he points out.
“They don’t have much time to spend over security issues not strictly related to their business/product. Dawnscanner (and other security tools) must be proactive, always on the move and they must talk in the developers’ language in order to give pointers and instructions that are easy to consume.”
Another problem he encountered while working on the tool is the general lack of awareness of the importance of signing Ruby gems.
“Dawnscanner is digitally signed, and I believe it’s very important to provide people a means to be sure that they’re using a software version that has not been tampered with by a third party. Some of Dawnscanner’s dependencies are, however, not signed, or have an expired signing certificate, and this makes the Dawnscanner installation (with signature verification) fail,” he explains. Users complain to him about third-party expired certificates, but there’s not much he can do about it.
Paolo is proud of his creation, but knows its limitations – he knows that a code review tool can’t be guaranteed to spot all security issues. He advises developers to manually inspect sensitive code, and follow up static analysis with a full application penetration test, to ensure the detection of security issues at runtime.

Useful Vim editor plugins for software developers - part 1

https://www.howtoforge.com/tutorial/vim-editor-plugins-for-software-developers

An improved version of Vi, Vim is unarguably one of the most popular command line-based text editors in Linux. Besides being a feature-rich text editor, Vim is also used as an IDE (Integrated Development Environment) by software developers around the world.
What makes Vim really powerful is the fact that it's functionality can be extended through plugins. And needless to say, there exist several Vim plugins that are aimed at enhancing users' programming experience.
Especially for software developers who are new to Vim, and are using the editor for development purposes, we'll be discussing some useful Vim plugins - along with examples - in this tutorial.

Please note that all the examples, commands, and instructions mentioned in this tutorial have been tested on Ubuntu 16.04, and the Vim version we've used is 7.4.

Plugin installation setup

Given that the tutorial is aimed at new users, it would be reasonable to assume that they don't know how Vim plugins are installed. So, first up, here are the steps required to complete the installation setup:

• Create a directory dubbed .vim in your home directory, and then create two sub-directories named autoload and bundle.
• Then, inside the autoload directory, you need to place a file named pathogen.vim, which you can download from here.
• Finally, create a file named .vimrc in your home directory and add the following two lines to it:

call pathogen#infect() 

call pathogen#helptags()

That's it. You are now ready to install Vim plugins.
Note: Here we've discussed Vim plugin management using Pathogen. There are other plugin managers available as well - to get started, visit this thread.
Now that we are all set, let's discuss a couple of useful Vim plugins.

Vim Tagbar plugin

First up is the Tagbar plugin. This plugin gives you an overview of the structure of a source file by letting you browse the tags it contains. "It does this by creating a sidebar that displays the ctags-generated tags of the current file, ordered by their scope," the plug-in's official website says. "This means that for example methods in C++ are displayed under the class they are defined in."
Sounds cool, right? Now, lets see how you can install it.
Tagbar's installation is pretty easy - all you have to do is to run the following two commands:

cd ~/.vim/bundle/

git clone git://github.com/majutsushi/tagbar

After the plugin is installed, it's ready for use. You can test it out by opening a .cpp file in Vim, entering the command mode, and running the :TagbarOpen command. Following is an example screenshot showing the sidebar (towards right) that comes up when the :TagbarOpen Vim command was executed:

To close the sidebar, use the :TagbarClose command. What's worth mentioning here is that you can use the :TagbarOpen fj command to open the sidebar as well as shift control to it. This way, you can easily browse the tags it contains - pressing the Enter key on a tag brings up (and shifts control to) the corresponding function in the source code window on the left.

In case you want to repeatedly open and close the sidebar, you can use the :TagbarToggle command instead of using :TagbarOpen and :TagbarClose, respectively.
If typing these commands seems time consuming to you, then you can create a shortcut for the :TagbarToggle command. For example, if you put the following line in your .vimrc file:

nmap  :TagbarToggle

then you can use the F8 key to toggle the Tagbar plugin window.
Moving on, sometimes you'll observe that certain tags are pre-fixed with a +, -, or # symbol. For example, the following screenshot (taken from the plugin's official website) shows some tags prefixed with a + symbol.

These symbols basically depict the visibility information for a particular tag. Specifically, + indicates that the member is public, while - indicates a private member. The # symbol, on the other hand, indicates that the member is protected.
Following are some of the important points related to Tagbar:

• The plugin website makes it clear that "Tagbar is not a general-purpose tool for managing tags files. It only creates the tags it needs on-the-fly in-memory without creating any files. tags file management is provided by other plugins."
• Vim versions < 7.0.167 have a compatibility issue with Tagbar. "If you are affected by this use this alternate Tagbar download instead: zip," the website says. "It is on par with version 2.2 but probably won't be updated after that due to the amount of changes required."
• If you encounter the error Tagbar: Exuberant ctags not found! while launching the plugin, then you can fix it by downloading and installing ctags from here.
• For more information on Tagbar, head here.

Vim delimitMate Plugin

The next plugin we'll be discussing here is delimitMate. The plugin basically provides insert mode auto-completion for quotes, parens, brackets, and more.
It also offers "some other related features that should make your time in insert mode a little bit easier, like syntax awareness (will not insert the closing delimiter in comments and other configurable regions), and expansions (off by default), and some more," the plugin's official github page says.
Installation of this plugin is similar to the way we installed the previous one:

cd ~/.vim/bundle/

git clone git://github.com/Raimondi/delimitMate.git

Once the plugin is installed successfully (meaning the above commands are successful), you don't have to do anything else - it loads automatically when the Vim editor is launched.
Now, whenever - while in Vim - you type a double quote, single quote, brace, parentheses, or bracket, they'll be automatically completed. 
The delimitMate plugin is configurable. For example, you can extend the list of supported symbols, prevent the plugin from loading automatically, turns off the plugin for certain file types, and more. To learn how to configure delimitMate to do all this (and much more), go through the plugin's detailed documentation, which you can access by running the :help delimitMate command.
The aforementioned command will split your Vim window horizontally into two, with the upper part containing the said documentation.

Conclusion

Of the two plugins mentioned in this article, Tagbar - you'll likely agree - requires comparatively more time to get used to. But once it's setup properly (meaning you have things like shortcut launch keys in place), it's a breeze to use. delimitMate, on the other hand, doesn't require you to remember anything.
The tutorial would have given you an idea how useful Vim plugins can be. Apart from the ones discussed here, there are many more plugins available for software developers. We'll discuss a selected bunch in the next part. Meanwhile, drop in a comment if you use a cool development-related Vim plugin and want others to know about it.
In part 2 of this tutorial series I will cover the Syntax highlighting plugin Syntastic.

How to use Cloud Explorer with Scality S3 server

https://www.linux-toys.com/?p=945

I spent a few weeks searching for an open-source S3 server that I can run at home to test Cloud Explorer. I first came across Minio which is an open-source S3 server but I could not get it to work with Cloud Explorer because it had issues resolving bucket names via DNS which is a requirement using the AWS SDK. I then read an article about Scality releasing an open-source S3 server that you can run inside a Docker image. I was able to get Scality up and running quickly with little effort. In this post, I will explain how I got the Scality S3 server setup and how to use it with Cloud Explorer.

First, I needed to run the Scality Docker image which was a simple one-liner:

docker run -d --name s3server -p 8000:8000 scality/s3server

view raw cloud explorer hosted with by GitHub

Next, I needed to modify /etc/hosts on my laptop to resolve buckets properly with Cloud Explorer. By default, the Scality Docker image resolves to localhost which can be changed. I appended the bucket names that I will use for this test (test and test2) to the localhost entry in /etc/hosts.

127.0.0.1 localhost test.localhost test2.localhost

view raw hosts hosted with by GitHub

Now I can configure the Scality S3 credentials in Cloud Explorer as shown below. I used the default Access and Secret keys by the Docker image.


Now Let’s create a bucket:


And there it is!


Let’s upload a file to make sure it works:


The file is there!


Now let’s run a performance test just for fun:

It was really cool that Scality released this as open-source. Not all of the Amazon S3 features are supported by Scality such as file versioning and others but I hope that this project continues to be worked on and gains community involvement.  After using this for a while, I put the S3 server into production for this site. All of the images that you see for this post are hosted by the S3 server inside a Docker image. Please check it out and let me know how you like Cloud Explorer. Please file any bugs on the GitHub issue tracker.