This section introduces a sequence of assignments to learn to use SCONE and in particular, the
scone CLI (Command Line Interface). Our focus is on infrastructure as code: We should avoid manual steps. Instead, we need to automate all steps to ensure reproducible deployments of confidential applications.
We should always expect that there are failures during the deployment of applications. Hence, we need a fault-tolerant deployment process. The approach followed in our assignment is to create idempotent code! This means that if the execution of a script fails, we can rerun without needing first to do some manual cleanup. The issue that stopped the previous execution disappears during re-execution. In other words, we can tolerate transient failures - like timeouts and resource depletion - with the help of temporal redundancy (a.k.a., re-execution). Note that after successful executions, we must be able to re-execute the script: the effect of multiple successful executions should be the same as a single successful execution.
For each assignment, we introduce some background that should help to solve this task. We also provide a reference solution. Since the first assignments are intended to be executed on DevOps hosts, we use
bash for automation - and not tools like Ansible. Therefore, the reference solution might be a little overwhelming, especially for those who have not used
bash yet. Anyhow, the reference solution should only give you an idea of how to solve the assignments. You might select a different scripting language like
xonsh. If you solve the tasks in a different scripting language, please share with us and we will publish as an alternative solution. In later assignments, we use
rust-script for the reference solutions.
Each assignment includes a description that
- motivates one or more tasks that you should try to solve,
- describes some background information, including links to some more information which help to solve the task,
- describes the task in some more detail,
- provides some screencast which shows a solution and a link to a
gitrepo with a reference solution, and
- some hints for troubleshooting.
Section 1: Basic Security Policy Handling
The first section includes the following assignments:
- Assignment 0: create an
aliasto run the
sconecommand line without needing to install software on your computer
- Assignment 1: attest a SCONE CAS instance, retrieve the certificate of the instance, and establish a secure channel to the CAS instance.
- Assignment 2: create a unique CAS namespace and ensure nobody else has access to this namespace.
- Assignment 3: determine the hash value of a policy.
- Assignment 4: Update a session by a new session.
- Assignment 5: Create a policy defining a secret and a public value.
Section 2: Access Control with OTPs
This section focuses on the usage of OTPs (One Time Passwords) to protect access to confidential applications: only by providing a valid and unique OTP a user can start a confidential application:
- OTPs are valid in a 30 seconds interval only, and
- SCONE accepts the OTP only once in the time interval.
This section focuses on the following tasks:
- How to execute a command at most once?
- How to create a transparently encrypted volume?
- How to ensure that only an authorized user can run a given confidential program?
- How to add a new authenticator?
- How to deal with a lost authenticator?
We assume that we can run the code to set up the authenticator on a trusted host. We will show in a later section how to relax this assumption.
Please have a look at the assignments. Our reference solution is written in
rust-script: This code can more easily be reused than the
bash. In particular, we provide reusable
Rust crates that you can use to automate your workflows programs.
Note that there are a few more open questions that we want to address in the context of this tutorial. We will add more assignments during the next weeks to address some of them.