farribeiro / wscef-docker Goto Github PK

Warsaw in docker container

License: MIT License

Shell 29.31% Dockerfile 70.69%

wscef-docker's Introduction

wscef-docker

Warsaw in docker container. Warsaw is a security module, a.k.a Guardião, for brazilian internet banking. This project is compatible of Banco do Brasil, Caixa Econômica Federal and Sicredi.

Pre-requisites

Docker and Docker-Compose of your distro.
Set BANKFILES variable (as export BANKFILES=/home/ff/Downloads/Bankfiles) to prevent volume creation error
For transparency, privacy and security NEVER USE ANY PRE-BUILT DOCKER IMAGE FROM THIS PROJECT.
Obtain a copy of the source code of this repository, check the content and build your own image.

Instructions

Use docker compose to build and run the docker container, rather than docker run, since environments and volumes are set on docker-compose.yml.

To build: docker-compose build wscef

To first run: docker-compose run --name wscef wscef

To other runs: docker start -i -a wscef

To purge everthing: docker-compose down --rmi all, thanks[1]

To force replace the container: docker-compose up --force-recreate, thanks[1]

PS: Reports that the warsaw daemon for CEF works for:

BB site: #9 (comment)
Sicredi ( #72 (comment))

PS: you must run Docker using a GNU/Linux distro running xorg. Be aware some installations may run another display server, such as Wayland.

The latest firefox release support wayland, not tested with xauth

[1] https://github.com/jsalatiel/wsbb-docker/commit/72e42bb5f04fbe8eb1f7f3e6226975aba137dcb5#diff-3254677a7917c6c01f55212f86c57fbf

wscef-docker's People

Contributors

Stargazers

Watchers

wscef-docker's Issues

32 bit

Does any warsaw docker sets up on a 32 bit operating system? If yes, can you help me? What happen to the token I saw 2 year back posts about it. Have a nice journey!

Docker for windows testing

It's really works this solution using Docker for Windows? The discussion is opened!

Link to Issue lichti/containers4docker#8

Funciona para Itau e Bradesco?

Hi,
This image is working to access Itau or Bradesco (banks from Brazil)?

Kind Regards,
Guilherme Filho

Is possible running only warsaw on docker?

In a long time ago, in this era, I suppose run only warsaw on container without browser...

Users is welcome to comment if the solution is good for the project

Não está funcionando

Alguma atualização prevista ?

Parou de funcionar nos 2 bancos

ps: obrigado pela iniciativa

Still working?

@farribeiro Have you been able to make this work recently ?

Shared folder between host and docker

Hi all,

when I use my internet banking, I need to save the receipt from my transactions, usually a downloaded PDF file.
It would be nice to have a shared folder between my OS and the running docker so I can get this PDF files.
Is this possible, how to implement it? (I really don't know how to approach this issue).

Tks! =)

Opened the issue functionalty

@diraol The issue feature is open!

various errors while following instructions from readme

I'm on arch linux. After issuing docker-compose pull and docker-compose run --name wscef wscef, I got this error:

wscef-docker $ docker-compose run --name wscef wscef
WARNING: The HOSTNAME variable is not set. Defaulting to a blank string.
Creating network "wscefdocker_default" with the default driver
No protocol specified
Failed to connect to Mir: Failed to connect to server socket: Arquivo ou diretório não encontrado
Unable to init server: Could not connect: Conexão recusada
Error: cannot open display: :0
/home/ff/startup.sh: linha 26: /usr/local/bin/warsaw/core: Arquivo ou diretório não encontrado
wscef-docker $

what can I do now?

Documentation Improvments

Link to Issue #15

I could not run it

Hi,

I have tried run the container on my machine, but it did not work.

$ docker-compose run --rm wscef
WARNING: The HOSTNAME variable is not set. Defaulting to a blank string.
WARNING: The XAUTHORITY variable is not set. Defaulting to a blank string.

ERROR: Cannot create container for service wscef: b'create .: volume name is too short, names should be at least two alphanumeric characters'

Am I supposed to configure variables referenced on docker-compose? (I mean DISPLAY, HOSTNAME and XAUTHORITY). Any hint on that?

I'm new on Docker, so I'm not sure if the variables referenced on docker-compose.yml should be host variables or container variables.

I'm running Gnome on Arch Linux.

Tks.

Docker image with firefox profile

@ekalin Before I pull requesting for your branch I creating a docker image for testing on farribeiro/wscef-docker:with-firefox-profile

Brecha de segurança no Xorg

Confirmei que a abordagem de compartilhamento de DISPLAY permite acesso a dados externos por processos rodando dentro do container.

Para reproduzir:

Substituir o comando firefox pelo bash, por conveniência;
Instalar x11-utils;
Executar xwininfo e clicar em uma janela no host;
Executar xev -id WINDOWID, onde WINDOWID pode ser encontrado na saída do processo anterior;
Focar e digitar algo na janela externa.

O resultado esperado é que nenhum evento do X seja encaminhado para o container. O resultado obtido é toda a sequencia de eventos do X.

Possíveis soluções:

Gerar um cookie untrusted específico para o container (a confirmar);
Rodar um outro servidor X (Xephyr, xpra) em display separado.
Substituir X por VNC no container, i.e. https://github.com/juliohm1978/dockerbb

Outro detalhe, idealmente deve-se usar um /etc/machine-id distinto do host, gerando por exemplo um hmac-sha256 com uma key aleatória fixa. systemd-id128 pode ser usado para a geração.

ERROR: libcurl4 and python-gpg

I'm getting this error while docker-compose build wscef

...
Reading package lists...
Building dependency tree...
Reading state information...
E: Unable to locate package libcurl4
E: Unable to locate package python-gpg
ERROR: Service 'wscef' failed to build: The command '/bin/sh -c apt-get update  && apt-get upgrade -y   && apt-get install -y   language-pack-pt        openssl         libnss3-tools   libcurl4        python-gpg      firefox         firefox-locale-pt       xauth   --no-install-recommends && groupadd -g 1000 -r ff       && useradd -u 1000 -r -g ff -G audio,video ff -d /home/ff      && chmod 744 /home/ff/startup.sh         && chown -R ff:ff /home/ff      && echo root:wscef | chpasswd   && apt-get purge --auto-remove -y       && rm -rf /var/lib/apt/lists/*' returned a non-zero code: 100

sudo: apt update: comando não encontrado

Pra mim deu esse erro ao tentar rodar agora.

$ docker-compose run --name wscef wscef
WARNING: The HOSTNAME variable is not set. Defaulting to a blank string.
Creating network "wscefdocker_default" with the default driver
Gtk-Message: 00:08:08.521: Failed to load module "canberra-gtk-module"
Gtk-Message: 00:08:08.523: Failed to load module "canberra-gtk-module"
Success: created profile 'default' at '/home/ff/.mozilla/firefox/7ewtf7lo.default/prefs.js'
sudo: apt update: comando não encontrado
/home/ff/startup.sh: linha 28: /usr/local/bin/warsaw/core: Arquivo ou diretório inexistente
$

O problema eram as aspas no comando sudo, dentro do startup.sh. Troquei todos os

sudo "comando argumentos"

por

sudo comando argumentos

e daí ele rodou o contêiner.

Corrigir e aprimorar a criação de usuário

Necessita revisão na criação de usuário pois gera os problemas relatados na #31

Similar project (based on Debian)

I've just found this project in a brazilian Telegram group about Docker. It may be useful for you:

https://github.com/lichti/containers4docker/tree/master/warsaw-browser
https://hub.docker.com/r/lichti/warsaw-browser/

Password authentication fails for `su`

The su -c commands for installing warsaw and starting the service fail (Authentication Error) because the root password has not been set in Ubuntu, so inputting an empty password or any password at all fails. I had to set the password on the Dockerfile through adding this line to the RUN command (substituting by the desired password):

&& echo root:<password> | chpasswd \

and also remove this line that unsets the password:

&& passwd -d root \

After doing that, it all worked like a charm for BB.

Thanks for the great work, man.

failed to GET warsaw-setup-ubuntu_64.deb with status 403

URL de donwload do warsaw não funciona mais.

Outra dúvida básica, esse docker funciona num host windows?

C:\Users\Usuario\wscef>docker-compose build wscef
WARNING: The DISPLAY variable is not set. Defaulting to a blank string.
WARNING: The HOSTNAME variable is not set. Defaulting to a blank string.
WARNING: The XAUTHORITY variable is not set. Defaulting to a blank string.
Building wscef
Step 1/8 : FROM ubuntu:latest
 ---> 735f80812f90
Step 2/8 : LABEL maintainer "Fabio Rodrigues Ribeiro <[email protected]>"
 ---> Using cache
 ---> 2db6ab31ead0
Step 3/8 : ADD https://cloud.gastecnologia.com.br/gas/diagnostico/warsaw-setup-ubuntu_64.deb /src/warsaw.deb
ERROR: Service 'wscef' failed to build: ADD failed: failed to GET https://cloud.gastecnologia.com.br/gas/diagnostico/warsaw-setup-ubuntu_64.deb with status 403 Forbidden: <?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>17EEFF5EB22CAC36</RequestId><HostId>zwjxZjhY5pn7yoQP+pTDxlAH1WBMs+QKVAK0Gbgg/BfTGXPxjHpIlyATuL21b90eB78+VF8+7lE=</HostId></Error>

Unix sockets support

Mentions

@lbssousa

Initial commit to feature

d74fc63

Link to Issue

#15

'Desktop shortcut' or 'Gnome Application'

Lot's of linux users are not used to work on the CLI, thus starting docker is not an trivial task for them.

Thus, it would be nice if we could deploy some kind of shortcuts for the users to start the docker by clicking on it.

If it is a Gnome user, for example, we could add a '.desktop' application that will enable the shortcut to be found from the 'Gnome Dash'.

BANFILE variable inside Instructions

Hi.

I know that this is a requisite - as shown in the repo README.
But, people (like myself :)) tend to go directly to Instructions and miss it.

Add Set BANKFILES variable to Instructions

Thanks.

Wayland support

Hybrid solution for switching xorg to wayland X server

Link to #13

Erro com o setup locale

Olá, tentei instalar e o módulo não funcionou. Aparece o seguinte erro:

  File "/usr/bin/warsaw", line 570, in <module>
    ret = main(sys.argv)
  File "/usr/bin/warsaw", line 565, in main
    locale.setlocale(locale.LC_ALL, '')
  File "/usr/lib/python3.7/locale.py", line 604, in setlocale
    return _setlocale(category, locale)
locale.Error: unsupported locale setting

Acredito que tenha relação com o #61.

Env variable for different banks

The link for Banco do Brasil warsaw is different from CEF.

Which make me think that they can be different from each other. Or that they can become different in the future.

So, is it possible to add a 'environment variable' (or CLI arg) to choose between banks? (This would change the warsaw download link, the bank url, etc).

English

The xauth will broke the container if you restart or poweroff the system, else in the same session will run ok, and not erase it.

Eu realmente não entendi o "else in the same session will run ok".

Você poderia, por favor, escrever aqui em português a frase toda, por favor? Daí eu mando um pull request melhorando o inglês.

Tks.

Execução de processo como root no container

A execução de um processo warsaw se passa como root no container. Sabendo que o kernel do host é compartilhado com o hospedeiro (ao menos no Linux), e não tendo ciência de qualquer relato positivo sobre uso de root em container, principalmente um processo untrusted, eu avalio que isto coloca em xeque a viabilidade da solução. São duas possibilidades (a confirmar): o processo escapa do container e será root no host, ou pode manipular o host pelo próprio container via kernel compartilhado. Eu só terei confiança na solução se qualquer warsaw executasse como usuário não-privilegiado, ou com privilégios mínimos. @farribeiro é possível proceder com o warsaw executando como não-root ou ao menos tais possibilidades não se aplicam à solução tal como está?

wscef-docker/startup.sh

Line 25 in ace0251

sudo /etc/init.d/warsaw start

Não consegue instalar o firefox

$docker-compose run --name wscef wscef
...
dpkg: error processing archive /tmp/apt-dpkg-install-W0CiDB/09-firefox-esr_60.4.0esr-1~deb9u1_amd64.deb (--unpack):
 unable to move aside './usr/share/icons/hicolor/symbolic/apps/firefox-esr-symbolic.svg' to install new version: Invalid cross-device link
Preparing to unpack .../10-libtiff5_4.0.8-2+deb9u4_amd64.deb ...
Unpacking libtiff5:amd64 (4.0.8-2+deb9u4) over (4.0.8-2+deb9u2) ...
Preparing to unpack .../11-libxcursor1_1%3a1.1.14-1+deb9u2_amd64.deb ...
Unpacking libxcursor1:amd64 (1:1.1.14-1+deb9u2) over (1:1.1.14-1+deb9u1) ...
Preparing to unpack .../12-openssl_1.1.0j-1~deb9u1_amd64.deb ...
Unpacking openssl (1.1.0j-1~deb9u1) over (1.1.0f-3+deb9u2) ...
Errors were encountered while processing:
 /tmp/apt-dpkg-install-W0CiDB/09-firefox-esr_60.4.0esr-1~deb9u1_amd64.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)
/home/ff/startup.sh: line 29: /usr/local/bin/warsaw/core: No such file or directory

Ambiente: Ubuntu 18.04.1 LTS

$ uname -a
Linux leonardo-Vostro-14-5480 4.15.0-43-generic #46-Ubuntu SMP Thu Dec 6 14:45:28 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

Obs: primeiro eu tentei fazer o build da imagem, mas deu algum outro problema, aí eu fiz o pull da imagem da Internet (docker-compose pull).

$ docker image list 
REPOSITORY                TAG                 IMAGE ID            CREATED             SIZE
hello-world               latest              fce289e99eb9        9 days ago          1.84kB
debian                    stretch-slim        bd04d03c4529        12 days ago         55.3MB
farribeiro/wscef-docker   latest              428cfdaf016c        2 months ago        518MB