How to firewall the actionrunner?

Hello,

I use stackstorm in an environment where many people can contribute to the python scripts that are being run. For security reasons, it is important that these scripts can only connect to a handful of servers inside our infrastructure.

Unfortunately, the scripts have dependencies which need to be pulled from github/bitbucket, forcing us to poke holes in our firewall to allow dependencies to be installed. This is an unacceptable risk to us, since it is possible for malware to setup command & control channels via github.

What is the best way to defend against this attack vector? The problem currently is that actionrunners are both responsible for fetching the dependencies, as well as running the code. If we could separate these responsibilities, we would be able to tightly firewall our execution environment and have a much more secure deployment.

Can someone give me pointers on how to achieve this best?

Hi @nschagen. Can you help me understand why action runners need to pull dependencies? This usually happens during pack install.

FWIW, either way you may wish to run some sort of pypi proxy like Artifactory.

I realize that what I am trying to do is a poor fit for a tool like stackstorm.

What I want to do is facilitate a data transformation process, where the transformations are pulled from different repositories. Since there is a small risk that these repositories import libraries that have malware in them that tries to connect to the outside world, we want to isolate them as much as we can.

Rather than letting these repositories provide stackstorm packs, we are now looking into a Docker based solution where the image is pre-built with a secure set of dependencies built in. By firewalling the container, we can this very secure without having to deal with stackstorm’s need to initiate outbound connections (e.g to install a pack).

Thanks!

Gotcha. I get it know. You could also use a proxy repo to pypi with a tool like artifactory that can fail on packages that have known license or security issues.

See the remote repository section on this page:
https://www.jfrog.com/confluence/display/JFROG/PyPI+Repositories