Skip to content

Tutorial Course

This section introduces a sequence of assignments to learn to use SCONE and in particular, the scone CLI (Command Line Interface). Our focus is on infrastructure as code: We should avoid manual steps. Instead, we need to automate all steps to ensure reproducible deployments of confidential applications.

We should always expect that there are failures during the deployment of applications. Hence, we need a fault-tolerant deployment process. The approach followed in our assignment is to create idempotent code! This means that if the execution of a script fails, we can rerun it without needing first to do some manual cleanup. The issue that stopped the previous execution disappears during re-execution. In other words, we can tolerate transient failures - like timeouts and resource depletion - with the help of temporal redundancy (a.k.a., re-execution). Note that after successful executions, we must be able to re-execute the script: the effect of multiple successful executions should be the same as a single successful execution.

Assignments

For each assignment, we introduce some background that should help to solve this task. We also provide a reference solution. Since the first assignments are intended to be executed on DevOps hosts, we use bash for automation - and not tools like Ansible. Therefore, the reference solution might be a little overwhelming, especially for those who have not used bash yet. Anyhow, the reference solution should only give you an idea of how to solve the assignments. You might select a different scripting language like xonsh. If you solve the tasks in a different scripting language, please share with us and we will publish as an alternative solution. In later assignments, we use Rust and rust-script for the reference solutions.

Each assignment includes a description that

  • motivates one or more tasks that you should try to solve,
  • describes some background information, including links to some more information that help to solve the task,
  • describes the task in some more detail,
  • provides some screencast which shows a solution and a link to a git repo with a reference solution, and
  • some hints for troubleshooting.

Outline

Section 1: Basic Security Policy Handling

The first section includes the following assignments:

  • Assignment 0: create an alias to run the scone command line without needing to install software on your computer
  • Assignment 1: attest a SCONE CAS instance, retrieve the certificate of the instance and establish a secure channel to the CAS instance.
  • Assignment 2: create a unique CAS namespace and ensure nobody else has access to this namespace.
  • Assignment 3: determine the hash value of a policy.
  • Assignment 4: Update a session by a new session.
  • Assignment 5: Create a policy defining a secret and a public value.

Section 2: Access Control with OTPs

This section focuses on the usage of OTPs (One Time Passwords) to protect access to confidential applications: only by providing a valid and unique OTP a user can start a confidential application:

  • OTPs are valid in a 30 seconds interval only, and
  • SCONE accepts the OTP only once in the time interval.

This section focuses on the following tasks:

  • How to execute a command at most once?
  • How to create a transparently encrypted volume?
  • How to ensure that only an authorized user can run a given confidential program?
  • How to add a new authenticator?
  • How to deal with a lost authenticator?

We assume that we can run the code to set up the authenticator on a trusted host. We will show in a later section how to relax this assumption.

Please have a look at the assignments. Our reference solution is written in Rust and rust-script: This code can more easily be reused than the bash. In particular, we provide reusable Rust crates that you can use to automate your workflows programs.

Next Steps

Note that there are a few more open questions that we want to address in the context of this tutorial. We will add more assignments during the next weeks to address some of them.