Security Hardening for Self-Hosted Runners

1
# Create isolated network for runners
2
sudo ip netns add runner-isolation
3
sudo ip link add veth0 type veth peer name veth1
4
sudo ip link set veth1 netns runner-isolation
5
6
# Configure firewall rules for runner traffic
7
sudo iptables -N RUNNER_CHAIN
8
sudo iptables -A INPUT -j RUNNER_CHAIN
9
sudo iptables -A RUNNER_CHAIN -p tcp --dport 443 -j ACCEPT  # HTTPS only
10
sudo iptables -A RUNNER_CHAIN -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT  # SSH from internal
11
sudo iptables -A RUNNER_CHAIN -j DROP  # Drop everything else

1
# Generate WireGuard configuration
2
wg genkey | tee /etc/wireguard/runner-private.key | wg pubkey > /etc/wireguard/runner-public.key
3
4
# Create WireGuard configuration
5
cat > /etc/wireguard/wg0.conf << EOF
6
[Interface]
7
PrivateKey = $(cat /etc/wireguard/runner-private.key)
8
Address = 10.200.200.2/24
9
DNS = 1.1.1.1
10
11
[Peer]
12
PublicKey = YOUR_SERVER_PUBLIC_KEY
13
Endpoint = vpn.assistance.bg:51820
14
AllowedIPs = 10.200.200.0/24, 192.168.1.0/24
15
PersistentKeepalive = 25
16
EOF
17
18
# Start WireGuard
19
sudo systemctl enable wg-quick@wg0
20
sudo systemctl start wg-quick@wg0

1
#!/bin/bash
2
# Runner firewall configuration
3
4
# Flush existing rules
5
iptables -F
6
iptables -X
7
iptables -t nat -F
8
iptables -t nat -X
9
10
# Default policies
11
iptables -P INPUT DROP
12
iptables -P FORWARD DROP
13
iptables -P OUTPUT ACCEPT
14
15
# Allow loopback
16
iptables -A INPUT -i lo -j ACCEPT
17
18
# Allow established connections
19
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
20
21
# SSH access (restricted)
22
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
23
24
# HTTPS for API calls
25
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
26
27
# DNS
28
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
29
30
# Save rules
31
iptables-save > /etc/iptables/rules.v4

1
# Create pf.conf for macOS runners
2
cat > /etc/pf.conf << EOF
3
# Default deny
4
block all
5
6
# Allow loopback
7
pass on lo0
8
9
# Allow established connections
10
pass in proto tcp from any to any port ssh flags S/SA keep state
11
pass out proto tcp from any to any port https keep state
12
pass out proto udp from any to any port domain keep state
13
14
# Block direct internet access except HTTPS
15
block out inet proto tcp from any to any port != https
16
EOF
17
18
# Load configuration
19
sudo pfctl -f /etc/pf.conf
20
sudo pfctl -e

1
# Istio service mesh configuration for Kubernetes runners
2
apiVersion: security.istio.io/v1beta1
3
kind: AuthorizationPolicy
4
metadata:
5
  name: runner-access-control
6
spec:
7
  selector:
8
    matchLabels:
9
      app: self-hosted-runner
10
  rules:
11
  - from:
12
    - source:
13
        principals: ["cluster.local/ns/runners/sa/runner-service-account"]
14
  - to:
15
    - operation:
16
        methods: ["GET", "POST"]
17
        paths: ["/api/v2/*"]
18
  - when:
19
    - key: source.ip
20
      values: ["10.200.200.0/24"]

1
# Configure runner with restricted group access
2
./config.sh --url https://github.com/your-org --token $RUNNER_TOKEN \
3
    --runnergroup "secure-runners" --labels "hardened,production" \
4
    --replace --disableupdate

1
#!/bin/bash
2
# GitHub runner token rotation script
3
4
GITHUB_ORG="your-organization"
5
GITHUB_TOKEN="$GITHUB_ADMIN_TOKEN"
6
7
# Generate new runner token
8
NEW_TOKEN=$(curl -X POST \
9
  -H "Authorization: token $GITHUB_TOKEN" \
10
  -H "Accept: application/vnd.github.v3+json" \
11
  https://api.github.com/orgs/$GITHUB_ORG/actions/runners/registration-token | \
12
  jq -r .token)
13
14
# Update runner configuration
15
./config.sh remove --token $OLD_TOKEN
16
./config.sh --url https://github.com/$GITHUB_ORG --token $NEW_TOKEN
17
18
echo "Runner token rotated successfully"

1
# .github/workflows/security-policy.yml
2
name: Security Policy Enforcement
3
on:
4
  workflow_run:
5
    workflows: ["*"]
6
    types: [requested]
7
8
jobs:
9
  security-check:
10
    runs-on: [self-hosted, hardened]
11
    steps:
12
      - name: Validate workflow permissions
13
        run: |
14
          # Check for dangerous permissions
15
          if echo "${{ toJson(github.event.workflow_run.head_commit.message) }}" | grep -E "(sudo|rm -rf|chmod 777)"; then
16
            echo "::error::Dangerous commands detected in workflow"
17
            exit 1
18
          fi

1
# Register GitLab runner with security constraints
2
gitlab-runner register \
3
  --url "https://gitlab.assistance.bg/" \
4
  --registration-token "$GITLAB_REGISTRATION_TOKEN" \
5
  --executor "docker" \
6
  --docker-image "alpine:latest" \
7
  --docker-privileged=false \
8
  --docker-disable-cache=true \
9
  --docker-volumes="/var/run/docker.sock:/var/run/docker.sock:ro" \
10
  --docker-security-opt="no-new-privileges:true" \
11
  --docker-security-opt="apparmor=docker-default" \
12
  --tag-list "secure,hardened" \
13
  --run-untagged=false \
14
  --locked=true

1
# /etc/gitlab-runner/config.toml
2
concurrent = 2
3
check_interval = 0
4
5
[session_server]
6
  session_timeout = 1800
7
8
[[runners]]
9
  name = "secure-docker-runner"
10
  url = "https://gitlab.assistance.bg/"
11
  token = "SECURE_TOKEN"
12
  executor = "docker"
13
  [runners.docker]
14
    tls_verify = false
15
    image = "alpine:latest"
16
    privileged = false
17
    disable_cache = true
18
    volumes = ["/cache", "/var/run/docker.sock:/var/run/docker.sock:ro"]
19
    security_opt = ["no-new-privileges:true", "apparmor=docker-default"]
20
    cap_drop = ["ALL"]
21
    cap_add = ["CHOWN", "SETUID", "SETGID"]
22
    devices = []
23
    network_mode = "bridge"
24
    dns = ["1.1.1.1", "8.8.8.8"]
25
    pull_policy = "always"

1
// Jenkins agent security configuration
2
import jenkins.model.*
3
import hudson.model.*
4
import hudson.slaves.*
5
import hudson.plugins.sshslaves.*
6
7
def jenkins = Jenkins.getInstance()
8
9
// Create secure node
10
def launcher = new SSHLauncher(
11
    "runner.assistance.bg",  // host
12
    22,                      // port
13
    "jenkins-ssh-key",       // credentials ID
14
    "",                      // JVM options
15
    "",                      // Java path
16
    "",                      // prefix start slave command
17
    "",                      // suffix start slave command
18
    60,                      // launch timeout
19
    3,                       // max retries
20
    15                       // retry wait time
21
)
22
23
def node = new DumbSlave(
24
    "secure-agent",          // node name
25
    "Hardened Jenkins agent", // description
26
    "/home/jenkins",         // remote FS root
27
    "2",                     // executors
28
    Node.Mode.EXCLUSIVE,     // usage mode
29
    "hardened production",   // labels
30
    launcher,
31
    new RetentionStrategy.Always(),
32
    new LinkedList<NodeProperty<?>>()
33
)
34
35
jenkins.addNode(node)
36
jenkins.save()

1
// Jenkinsfile with security constraints
2
pipeline {
3
    agent { label 'hardened' }
4
5
    options {
6
        skipDefaultCheckout()
7
        timeout(time: 30, unit: 'MINUTES')
8
        timestamps()
9
    }
10
11
    environment {
12
        // Restrict environment variables
13
        PATH = "/usr/local/bin:/usr/bin:/bin"
14
        JAVA_OPTS = "-Xmx1g -Djava.awt.headless=true"
15
    }
16
17
    stages {
18
        stage('Security Check') {
19
            steps {
20
                script {
21
                    // Validate build parameters
22
                    if (params.containsKey('DANGEROUS_PARAM')) {
23
                        error("Dangerous parameter detected")
24
                    }
25
                }
26
            }
27
        }
28
    }
29
}

1
# Start Bazel Remote Execution with TLS
2
bazel run //server:remote_execution_server -- \
3
  --port=8980 \
4
  --tls_certificate=/etc/ssl/certs/server.crt \
5
  --tls_private_key=/etc/ssl/private/server.key \
6
  --tls_ca_certificate=/etc/ssl/certs/ca.crt \
7
  --require_client_certificates=true \
8
  --auth_tokens_file=/etc/bazel/auth_tokens.json

1
{
2
  "tokens": {
3
    "worker-pool-1": {
4
      "token": "secure-worker-token-1",
5
      "permissions": ["execute", "read_cache"],
6
      "allowed_actions": [".*\\.compile", ".*\\.test"],
7
      "resource_limits": {
8
        "cpu": "4",
9
        "memory": "8GB",
10
        "disk": "100GB"
11
      }
12
    }
13
  }
14
}

1
# DevOps Hub API key rotation
2
CURRENT_KEY="$DEVOPS_API_KEY"
3
PROJECT_ID="your-project-id"
4
5
# Generate new API key
6
NEW_KEY=$(curl -X POST "https://console.assistance.bg/api/v2/auth/rotate-key" \
7
  -H "Authorization: Bearer $CURRENT_KEY" \
8
  -H "Content-Type: application/json" \
9
  --data '{"project_id": "'$PROJECT_ID'"}' | \
10
  jq -r '.key')
11
12
# Update runners with new key
13
echo "DEVOPS_API_KEY=$NEW_KEY" > /etc/runner/environment
14
sudo systemctl restart runner-service
15
16
echo "API key rotated successfully"

1
#!/bin/bash
2
# Monitor DevOps Hub API usage
3
4
API_KEY="$DEVOPS_API_KEY"
5
6
# Check current usage
7
USAGE=$(curl -s -X GET "https://console.assistance.bg/api/v2/auth/usage" \
8
  -H "Authorization: Bearer $API_KEY" | \
9
  jq '{requests_used: .requests_used, requests_limit: .requests_limit, reset_time: .reset_time}')
10
11
echo "Current API usage: $USAGE"
12
13
# Alert if approaching limit
14
USED=$(echo $USAGE | jq '.requests_used')
15
LIMIT=$(echo $USAGE | jq '.requests_limit')
16
THRESHOLD=$(($LIMIT * 80 / 100))  # 80% threshold
17
18
if [ "$USED" -gt "$THRESHOLD" ]; then
19
    echo "WARNING: API usage at 80% of limit"
20
    # Send alert to monitoring system
21
    curl -X POST "$SLACK_WEBHOOK" \
22
      -d "{\"text\": \"DevOps Hub API usage high: $USED/$LIMIT requests\"}"
23
fi

1
# Secure API request function
2
make_secure_api_call() {
3
    local endpoint="$1"
4
    local method="$2"
5
    local data="$3"
6
7
    curl -X "$method" \
8
        -H "Authorization: Bearer $DEVOPS_API_KEY" \
9
        -H "Content-Type: application/json" \
10
        -H "User-Agent: SecureRunner/1.0" \
11
        -H "X-Request-ID: $(uuidgen)" \
12
        --max-time 30 \
13
        --retry 3 \
14
        --retry-delay 1 \
15
        --fail \
16
        --silent \
17
        --show-error \
18
        "https://console.assistance.bg/api/v2/$endpoint" \
19
        --data "$data"
20
}
21
22
# Usage example
23
make_secure_api_call "projects" "GET"

1
# Validate DevOps Hub API TLS certificate
2
check_api_security() {
3
    local api_host="console.assistance.bg"
4
5
    # Check TLS version
6
    tls_version=$(openssl s_client -connect $api_host:443 -servername $api_host 2>/dev/null | \
7
                  grep -E "Protocol|Cipher" | head -2)
8
9
    echo "TLS Security Check for $api_host:"
10
    echo "$tls_version"
11
12
    # Verify certificate
13
    cert_check=$(openssl s_client -connect $api_host:443 -servername $api_host -verify_return_error 2>&1)
14
15
    if echo "$cert_check" | grep -q "Verify return code: 0"; then
16
        echo "✓ Certificate validation passed"
17
    else
18
        echo "✗ Certificate validation failed"
19
        exit 1
20
    fi
21
}
22
23
check_api_security

1
# Install and configure Vault agent
2
vault auth -method=aws role=runner-role
3
4
# Configure Vault agent for secret retrieval
5
cat > /etc/vault/agent.hcl << EOF
6
pid_file = "/var/run/vault-agent.pid"
7
8
vault {
9
  address = "https://vault.assistance.bg:8200"
10
  retry {
11
    num_retries = 5
12
  }
13
}
14
15
auto_auth {
16
  method "aws" {
17
    mount_path = "auth/aws"
18
    config = {
19
      type = "iam"
20
      role = "runner-role"
21
    }
22
  }
23
24
  sink "file" {
25
    config = {
26
      path = "/etc/vault/token"
27
      mode = 0600
28
    }
29
  }
30
}
31
32
template {
33
  source      = "/etc/vault/templates/runner-secrets.tpl"
34
  destination = "/etc/runner/secrets"
35
  perms       = 0600
36
  command     = "systemctl reload runner-service"
37
}
38
EOF
39
40
# Start Vault agent
41
systemctl enable vault-agent
42
systemctl start vault-agent

1
# /etc/vault/templates/runner-secrets.tpl
2
{{- with secret "kv/data/runner-secrets" }}
3
export DEVOPS_API_KEY="{{ .Data.data.api_key }}"
4
export DATABASE_PASSWORD="{{ .Data.data.db_password }}"
5
export SIGNING_KEY="{{ .Data.data.signing_key }}"
6
{{- end }}
7
8
{{- with secret "database/creds/runner-role" }}
9
export DB_USERNAME="{{ .Data.username }}"
10
export DB_PASSWORD="{{ .Data.password }}"
11
{{- end }}

1
#!/usr/bin/env python3
2
# Runner secret management with AWS Secrets Manager
3
4
import boto3
5
import json
6
import os
7
from botocore.exceptions import ClientError
8
9
class RunnerSecretsManager:
10
    def __init__(self, region_name='us-east-1'):
11
        self.secrets_client = boto3.client('secretsmanager', region_name=region_name)
12
13
    def get_secret(self, secret_name):
14
        """Retrieve secret from AWS Secrets Manager"""
15
        try:
16
            response = self.secrets_client.get_secret_value(SecretId=secret_name)
17
            return json.loads(response['SecretString'])
18
        except ClientError as e:
19
            print(f"Failed to retrieve secret {secret_name}: {e}")
20
            return None
21
22
    def update_runner_env(self, secret_name, env_file_path):
23
        """Update runner environment with secrets"""
24
        secrets = self.get_secret(secret_name)
25
        if not secrets:
26
            return False
27
28
        env_lines = []
29
        for key, value in secrets.items():
30
            env_lines.append(f"export {key}='{value}'")
31
32
        with open(env_file_path, 'w') as f:
33
            f.write('\n'.join(env_lines))
34
35
        os.chmod(env_file_path, 0o600)
36
        return True
37
38
# Usage
39
secrets_manager = RunnerSecretsManager()
40
secrets_manager.update_runner_env('runner-secrets', '/etc/runner/environment')

1
{
2
  "Version": "2012-10-17",
3
  "Statement": [
4
    {
5
      "Effect": "Allow",
6
      "Action": [
7
        "secretsmanager:GetSecretValue"
8
      ],
9
      "Resource": [
10
        "arn:aws:secretsmanager:us-east-1:account:secret:runner-secrets/*"
11
      ],
12
      "Condition": {
13
        "StringEquals": {
14
          "secretsmanager:VersionStage": "AWSCURRENT"
15
        },
16
        "DateLessThan": {
17
          "aws:CurrentTime": "2025-12-31T23:59:59Z"
18
        }
19
      }
20
    },
21
    {
22
      "Effect": "Allow",
23
      "Action": [
24
        "kms:Decrypt"
25
      ],
26
      "Resource": [
27
        "arn:aws:kms:us-east-1:account:key/key-id"
28
      ]
29
    }
30
  ]
31
}

1
# Azure Key Vault integration for runners
2
az login --service-principal \
3
  --username $AZURE_CLIENT_ID \
4
  --password $AZURE_CLIENT_SECRET \
5
  --tenant $AZURE_TENANT_ID
6
7
# Retrieve secrets
8
get_keyvault_secret() {
9
    local vault_name="$1"
10
    local secret_name="$2"
11
12
    az keyvault secret show \
13
        --vault-name "$vault_name" \
14
        --name "$secret_name" \
15
        --query "value" \
16
        --output tsv
17
}
18
19
# Update runner configuration
20
DEVOPS_API_KEY=$(get_keyvault_secret "runner-vault" "devops-api-key")
21
echo "export DEVOPS_API_KEY='$DEVOPS_API_KEY'" > /etc/runner/secrets
22
chmod 600 /etc/runner/secrets

1
# Authenticate with service account
2
export GOOGLE_APPLICATION_CREDENTIALS="/etc/runner/service-account.json"
3
4
# Install Google Cloud SDK
5
curl https://sdk.cloud.google.com | bash
6
source ~/.bashrc
7
8
# Retrieve secrets
9
get_gcp_secret() {
10
    local project_id="$1"
11
    local secret_name="$2"
12
    local version="${3:-latest}"
13
14
    gcloud secrets versions access "$version" \
15
        --secret="$secret_name" \
16
        --project="$project_id"
17
}
18
19
# Update runner environment
20
DEVOPS_API_KEY=$(get_gcp_secret "your-project" "devops-api-key")
21
echo "DEVOPS_API_KEY=$DEVOPS_API_KEY" >> /etc/runner/environment

1
# /etc/docker/daemon.json
2
{
3
  "log-driver": "json-file",
4
  "log-opts": {
5
    "max-size": "100m",
6
    "max-file": "3"
7
  },
8
  "userns-remap": "dockeruser",
9
  "no-new-privileges": true,
10
  "seccomp-profile": "/etc/docker/seccomp.json",
11
  "selinux-enabled": true,
12
  "storage-driver": "overlay2",
13
  "storage-opts": [
14
    "overlay2.override_kernel_check=true"
15
  ],
16
  "default-ulimits": {
17
    "nproc": {
18
      "Hard": 1024,
19
      "Name": "nproc",
20
      "Soft": 1024
21
    },
22
    "nofile": {
23
      "Hard": 65536,
24
      "Name": "nofile",
25
      "Soft": 65536
26
    }
27
  },
28
  "live-restore": true,
29
  "userland-proxy": false,
30
  "experimental": false
31
}

1
# Install rootless Docker
2
curl -fsSL https://get.docker.com/rootless | sh
3
4
# Configure rootless environment
5
echo 'export PATH=/home/$USER/bin:$PATH' >> ~/.bashrc
6
echo 'export DOCKER_HOST=unix:///run/user/$(id -u)/docker.sock' >> ~/.bashrc
7
8
# Start rootless Docker service
9
systemctl --user enable docker
10
systemctl --user start docker
11
12
# Verify rootless installation
13
docker context use rootless
14
docker run --rm hello-world

1
#!/bin/bash
2
# Secure container execution for runners
3
4
run_secure_container() {
5
    local image="$1"
6
    local command="$2"
7
8
    docker run --rm \
9
        --security-opt=no-new-privileges:true \
10
        --security-opt=apparmor:docker-default \
11
        --cap-drop=ALL \
12
        --cap-add=CHOWN \
13
        --cap-add=SETUID \
14
        --cap-add=SETGID \
15
        --read-only \
16
        --tmpfs /tmp \
17
        --tmpfs /var/tmp \
18
        --network=bridge \
19
        --memory=1g \
20
        --cpus=1.0 \
21
        --ulimit nproc=1024:1024 \
22
        --ulimit nofile=1024:1024 \
23
        --user 1000:1000 \
24
        "$image" \
25
        "$command"
26
}
27
28
# Usage
29
run_secure_container "alpine:latest" "sh -c 'echo Hello World'"

1
#!/bin/bash
2
# Container image vulnerability scanning
3
4
scan_runner_images() {
5
    local images=("$@")
6
7
    for image in "${images[@]}"; do
8
        echo "Scanning $image..."
9
10
        # Scan for vulnerabilities
11
        trivy image --format json --output "${image//\//_}-scan.json" "$image"
12
13
        # Check for critical vulnerabilities
14
        critical_count=$(jq '.Results[].Vulnerabilities | map(select(.Severity == "CRITICAL")) | length' "${image//\//_}-scan.json" 2>/dev/null || echo "0")
15
16
        if [ "$critical_count" -gt 0 ]; then
17
            echo "❌ CRITICAL: $image has $critical_count critical vulnerabilities"
18
            exit 1
19
        else
20
            echo "✅ PASSED: $image has no critical vulnerabilities"
21
        fi
22
    done
23
}
24
25
# Scan common runner images
26
scan_runner_images \
27
    "ubuntu:22.04" \
28
    "node:18-alpine" \
29
    "python:3.11-slim"

1
# Generate signing keys
2
cosign generate-key-pair
3
4
# Sign container image
5
cosign sign --key cosign.key runner-image:latest
6
7
# Verify signed image
8
cosign verify --key cosign.pub runner-image:latest
9
10
# Policy enforcement in admission controller
11
cat > image-policy.yaml << EOF
12
apiVersion: kyverno.io/v1
13
kind: ClusterPolicy
14
metadata:
15
  name: require-signed-images
16
spec:
17
  validationFailureAction: enforce
18
  background: false
19
  rules:
20
  - name: check-signature
21
    match:
22
      any:
23
      - resources:
24
          kinds:
25
          - Pod
26
    validate:
27
      message: "Images must be signed with cosign"
28
      pattern:
29
        spec:
30
          containers:
31
          - name: "*"
32
            image: "*/runner-*:*"
33
EOF

1
# /etc/falco/falco_rules.local.yaml
2
- rule: Suspicious Runner Activity
3
  desc: Detect suspicious activities in runner containers
4
  condition: >
5
    container and
6
    (proc.name in (wget, curl, nc, ncat, netcat) and
7
     proc.args contains "reverse" or
8
     proc.args contains "shell") or
9
    (spawned_process and
10
     proc.name in (bash, sh, zsh) and
11
     proc.args contains "-c" and
12
     proc.args contains "eval")
13
  output: >
14
    Suspicious activity in runner container
15
    (user=%user.name command=%proc.cmdline container=%container.name
16
     image=%container.image.repository)
17
  priority: WARNING
18
  tags: [runner, security, malware]
19
20
- rule: Runner Container Escape Attempt
21
  desc: Detect container escape attempts
22
  condition: >
23
    container and
24
    (proc.name in (runc, docker, kubectl) or
25
     fd.name startswith /var/run/docker.sock or
26
     fd.name startswith /proc/*/root)
27
  output: >
28
    Container escape attempt detected
29
    (user=%user.name command=%proc.cmdline container=%container.name)
30
  priority: CRITICAL
31
  tags: [runner, escape, security]

1
# Kubernetes NetworkPolicy for runner pods
2
apiVersion: networking.k8s.io/v1
3
kind: NetworkPolicy
4
metadata:
5
  name: runner-network-policy
6
  namespace: runners
7
spec:
8
  podSelector:
9
    matchLabels:
10
      app: self-hosted-runner
11
  policyTypes:
12
  - Ingress
13
  - Egress
14
  ingress:
15
  - from:
16
    - namespaceSelector:
17
        matchLabels:
18
          name: monitoring
19
    ports:
20
    - protocol: TCP
21
      port: 8080
22
  egress:
23
  - to: []
24
    ports:
25
    - protocol: TCP
26
      port: 443  # HTTPS only
27
    - protocol: UDP
28
      port: 53   # DNS
29
  - to:
30
    - namespaceSelector:
31
        matchLabels:
32
          name: kube-system

1
#!/bin/bash
2
# CIS Level 1 hardening for Ubuntu runner hosts
3
4
# Disable unused filesystems
5
cat > /etc/modprobe.d/blacklist-runner.conf << EOF
6
install cramfs /bin/true
7
install freevxfs /bin/true
8
install jffs2 /bin/true
9
install hfs /bin/true
10
install hfsplus /bin/true
11
install squashfs /bin/true
12
install udf /bin/true
13
install vfat /bin/true
14
EOF
15
16
# Configure secure boot parameters
17
echo 'GRUB_CMDLINE_LINUX="audit=1 audit_backlog_limit=8192"' >> /etc/default/grub
18
update-grub
19
20
# Harden kernel parameters
21
cat > /etc/sysctl.d/99-runner-security.conf << EOF
22
# IP Spoofing protection
23
net.ipv4.conf.all.rp_filter = 1
24
net.ipv4.conf.default.rp_filter = 1
25
26
# Ignore ICMP ping requests
27
net.ipv4.icmp_echo_ignore_all = 1
28
29
# Ignore send redirects
30
net.ipv4.conf.all.send_redirects = 0
31
net.ipv4.conf.default.send_redirects = 0
32
33
# Disable source packet routing
34
net.ipv4.conf.all.accept_source_route = 0
35
net.ipv6.conf.all.accept_source_route = 0
36
37
# Ignore ICMP redirects
38
net.ipv4.conf.all.accept_redirects = 0
39
net.ipv6.conf.all.accept_redirects = 0
40
41
# Ignore secure ICMP redirects
42
net.ipv4.conf.all.secure_redirects = 0
43
44
# Log Martians
45
net.ipv4.conf.all.log_martians = 1
46
47
# Enable TCP SYN Cookies
48
net.ipv4.tcp_syncookies = 1
49
50
# Disable IPv6 if not needed
51
net.ipv6.conf.all.disable_ipv6 = 1
52
net.ipv6.conf.default.disable_ipv6 = 1
53
EOF
54
55
sysctl -p /etc/sysctl.d/99-runner-security.conf

1
#!/bin/bash
2
# User security for runner hosts
3
4
# Create dedicated runner user
5
useradd -r -m -s /bin/bash -d /home/runner runner
6
usermod -aG docker runner
7
8
# Set secure umask
9
echo 'umask 027' >> /home/runner/.bashrc
10
echo 'umask 027' >> /etc/profile
11
12
# Configure sudo access
13
cat > /etc/sudoers.d/runner << EOF
14
runner ALL=(ALL) NOPASSWD: /usr/bin/docker, /usr/bin/systemctl restart runner-service
15
Defaults:runner !visiblepw
16
Defaults:runner always_set_home
17
Defaults:runner match_group_by_gid
18
Defaults:runner env_reset
19
Defaults:runner env_keep += "SSH_AUTH_SOCK"
20
EOF
21
22
# Set file permissions
23
chmod 755 /home/runner
24
chmod 700 /home/runner/.ssh
25
chmod 600 /home/runner/.ssh/authorized_keys
26
chmod 600 /home/runner/.bashrc
27
28
# Remove unnecessary packages
29
apt-get remove --purge -y \
30
    telnet \
31
    rsh-client \
32
    rsh-server \
33
    ypbind \
34
    ypserv \
35
    tftp \
36
    tftp-server \
37
    talk \
38
    talk-server
39
40
apt-get autoremove -y

1
#!/bin/bash
2
# macOS security configuration for runners
3
4
# Enable firewall
5
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
6
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setloggingmode on
7
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on
8
9
# Disable remote services
10
sudo launchctl disable system/com.openssh.sshd
11
sudo launchctl disable system/com.apple.screensharing
12
13
# Configure automatic updates
14
sudo softwareupdate --schedule on
15
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -bool true
16
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates -bool true
17
18
# Secure system preferences
19
sudo spctl --master-enable
20
sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 1
21
22
# Create runner user
23
sudo dscl . -create /Users/runner
24
sudo dscl . -create /Users/runner UserShell /bin/bash
25
sudo dscl . -create /Users/runner RealName "Runner Service Account"
26
sudo dscl . -create /Users/runner UniqueID 503
27
sudo dscl . -create /Users/runner PrimaryGroupID 20
28
sudo dscl . -create /Users/runner NFSHomeDirectory /Users/runner
29
sudo dscl . -passwd /Users/runner $(openssl rand -base64 32)
30
31
# Configure runner environment
32
sudo mkdir -p /Users/runner
33
sudo chown runner:staff /Users/runner
34
sudo chmod 700 /Users/runner

1
# Windows security hardening for runners
2
# Run as Administrator
3
4
# Enable Windows Defender
5
Set-MpPreference -DisableRealtimeMonitoring $false
6
Set-MpPreference -SubmitSamplesConsent SendAllSamples
7
Set-MpPreference -MAPSReporting Advanced
8
9
# Configure Windows Firewall
10
netsh advfirewall set allprofiles state on
11
netsh advfirewall firewall add rule name="Allow HTTPS Outbound" dir=out action=allow protocol=TCP localport=443
12
netsh advfirewall firewall add rule name="Block All Inbound" dir=in action=block
13
14
# Disable unnecessary services
15
$services = @(
16
    "Fax",
17
    "TelnetServer",
18
    "RemoteRegistry",
19
    "RemoteAccess",
20
    "SharedAccess"
21
)
22
23
foreach ($service in $services) {
24
    Stop-Service -Name $service -Force -ErrorAction SilentlyContinue
25
    Set-Service -Name $service -StartupType Disabled -ErrorAction SilentlyContinue
26
}
27
28
# Create runner service account
29
$runnerPassword = ConvertTo-SecureString -AsPlainText (New-Guid).Guid -Force
30
New-LocalUser -Name "RunnerService" -Password $runnerPassword -FullName "CI/CD Runner Service"
31
Add-LocalGroupMember -Group "Administrators" -Member "RunnerService"
32
33
# Configure audit policies
34
auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
35
auditpol /set /category:"Object Access" /success:enable /failure:enable
36
auditpol /set /category:"Process Tracking" /success:enable /failure:enable
37
auditpol /set /category:"System" /success:enable /failure:enable
38
39
# Harden registry settings
40
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v LmCompatibilityLevel /t REG_DWORD /d 5 /f
41
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v NoLMHash /t REG_DWORD /d 1 /f
42
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v DisableDomainCreds /t REG_DWORD /d 1 /f
43
44
Write-Host "Windows hardening completed"

1
# /etc/rsyslog.d/50-runner-audit.conf
2
# Runner audit logging configuration
3
4
# Load modules
5
module(load="imfile" PollingInterval="10")
6
7
# Runner service logs
8
input(type="imfile"
9
      File="/var/log/runner/service.log"
10
      Tag="runner-service"
11
      StateFile="runner-service-state")
12
13
# Docker audit logs
14
input(type="imfile"
15
      File="/var/log/docker-audit.log"
16
      Tag="docker-audit"
17
      StateFile="docker-audit-state")
18
19
# API access logs
20
input(type="imfile"
21
      File="/var/log/runner/api-access.log"
22
      Tag="api-access"
23
      StateFile="api-access-state")
24
25
# Forward to central logging
26
*.* @@logs.assistance.bg:514
27
28
# Local file backup
29
if $programname == 'runner-service' then /var/log/runner/audit.log
30
if $programname == 'docker-audit' then /var/log/security/docker.log
31
if $programname == 'api-access' then /var/log/security/api.log
32
33
# Rotate logs
34
$WorkDirectory /var/spool/rsyslog
35
$ActionQueueFileName runner-audit
36
$ActionQueueMaxDiskSpace 1g
37
$ActionQueueSaveOnShutdown on
38
$ActionQueueType LinkedList
39
$ActionResumeRetryCount -1

1
#!/bin/bash
2
# Configure Linux audit framework for runners
3
4
# Install auditd
5
apt-get install -y auditd audispd-plugins
6
7
# Configure audit rules
8
cat > /etc/audit/rules.d/runner-audit.rules << EOF
9
# Delete all existing rules
10
-D
11
12
# Set buffer size
13
-b 8192
14
15
# Set failure mode
16
-f 1
17
18
# Audit file access in runner directories
19
-w /home/runner -p wa -k runner-files
20
-w /etc/runner -p wa -k runner-config
21
-w /var/lib/runner -p wa -k runner-data
22
23
# Audit Docker socket access
24
-w /var/run/docker.sock -p wa -k docker-access
25
26
# Audit system calls for privilege escalation
27
-a always,exit -F arch=b64 -S execve -k exec-monitoring
28
-a always,exit -F arch=b64 -S setuid -S setgid -S setreuid -S setregid -k privilege-escalation
29
30
# Audit network connections
31
-a always,exit -F arch=b64 -S socket -S bind -S connect -k network-access
32
33
# Audit file modifications
34
-a always,exit -F arch=b64 -S openat -S open -S creat -S truncate -S ftruncate -k file-access
35
36
# Audit authentication events
37
-w /var/log/auth.log -p wa -k authentication
38
-w /etc/passwd -p wa -k passwd-changes
39
-w /etc/group -p wa -k group-changes
40
-w /etc/shadow -p wa -k shadow-changes
41
42
# Lock configuration
43
-e 2
44
EOF
45
46
# Restart auditd
47
systemctl enable auditd
48
systemctl restart auditd
49
50
echo "Audit configuration completed"

1
#!/usr/bin/env python3
2
# Runner audit logging implementation
3
4
import json
5
import logging
6
import logging.handlers
7
import time
8
from datetime import datetime
9
from typing import Dict, Any
10
11
class RunnerAuditLogger:
12
    def __init__(self, log_file="/var/log/runner/audit.log"):
13
        self.logger = logging.getLogger("runner-audit")
14
        self.logger.setLevel(logging.INFO)
15
16
        # File handler with rotation
17
        handler = logging.handlers.RotatingFileHandler(
18
            log_file, maxBytes=100*1024*1024, backupCount=10
19
        )
20
21
        # JSON formatter
22
        formatter = logging.Formatter('%(message)s')
23
        handler.setFormatter(formatter)
24
        self.logger.addHandler(handler)
25
26
        # Syslog handler for centralized logging
27
        syslog_handler = logging.handlers.SysLogHandler(address='/dev/log')
28
        syslog_handler.setFormatter(formatter)
29
        self.logger.addHandler(syslog_handler)
30
31
    def log_event(self, event_type: str, details: Dict[str, Any],
32
                  user_id: str = None, session_id: str = None):
33
        """Log structured audit events"""
34
        audit_entry = {
35
            "timestamp": datetime.utcnow().isoformat(),
36
            "event_type": event_type,
37
            "user_id": user_id,
38
            "session_id": session_id,
39
            "details": details,
40
            "hostname": "runner-host",
41
            "version": "1.0"
42
        }
43
44
        self.logger.info(json.dumps(audit_entry))
45
46
    def log_api_access(self, method: str, endpoint: str, status_code: int,
47
                      response_time: float, user_agent: str = None):
48
        """Log API access events"""
49
        self.log_event("api_access", {
50
            "method": method,
51
            "endpoint": endpoint,
52
            "status_code": status_code,
53
            "response_time_ms": response_time * 1000,
54
            "user_agent": user_agent
55
        })
56
57
    def log_workflow_execution(self, workflow_id: str, repository: str,
58
                              branch: str, commit_sha: str, status: str):
59
        """Log workflow execution events"""
60
        self.log_event("workflow_execution", {
61
            "workflow_id": workflow_id,
62
            "repository": repository,
63
            "branch": branch,
64
            "commit_sha": commit_sha,
65
            "status": status
66
        })
67
68
    def log_security_event(self, event_description: str, severity: str,
69
                          source_ip: str = None):
70
        """Log security-related events"""
71
        self.log_event("security_event", {
72
            "description": event_description,
73
            "severity": severity,
74
            "source_ip": source_ip
75
        })
76
77
# Usage example
78
if __name__ == "__main__":
79
    logger = RunnerAuditLogger()
80
81
    # Log API access
82
    logger.log_api_access("POST", "/api/v2/projects", 201, 0.245)
83
84
    # Log workflow execution
85
    logger.log_workflow_execution(
86
        "workflow-123", "org/repo", "main", "abc123", "completed"
87
    )
88
89
    # Log security event
90
    logger.log_security_event(
91
        "Failed authentication attempt", "HIGH", "192.168.1.100"
92
    )