Code review and security audit in private cloud - Arief Karfianto
Download as PPTX, PDF0 likes1,495 views
This document discusses implementing code review and security in a private cloud environment. It outlines some common problems that occur during app development like bugs, errors, and lack of version control. The document then proposes hosting source code in a private cloud repository for improved security, availability, and compliance. It describes using tools like Git, Gitweb and VPN access to implement a flexible source code management system in the cloud with role-based access control and snapshot capabilities.
![Creating a Repository
root@revision-control ~# ./addrepo.sh
Please enter repository name and description
Name :sample-app2
Description :Sample application 2.0
Creating a repository...
Initialized empty Git repository in /srv/repos/git/sample-app2/.git/
# On branch master
#
# Initial commit
#
nothing to commit (create/copy files and use "git add" to track)
Cloning into bare repository repositories/sample-app2.git...
done.
warning: You appear to have cloned an empty repository.
[Done]](https://image.slidesharecdn.com/codereviewandsecurityauditinprivatecloud-141103224958-conversion-gate02/85/Code-review-and-security-audit-in-private-cloud-Arief-Karfianto-18-320.jpg)
![Gitosis Config
Copy the public key to server
Then edit gitosis.conf..
[group sample-app2]
writable = sample-app2
members = intruder@LENOVOY460
John@Doe.PC](https://image.slidesharecdn.com/codereviewandsecurityauditinprivatecloud-141103224958-conversion-gate02/85/Code-review-and-security-audit-in-private-cloud-Arief-Karfianto-19-320.jpg)
Code review and security audit in private cloud - Arief Karfianto
- 1. Code Review and Security Audit in Private Cloud @karfianto UKP4
- 2. About Me • UPN alumnus • civil cervant • sysadmin • system analyst • app tester
- 3. Things I Like • foss • website optimization • system security • wireframing
- 5. Problems in App Development • design • functionality test • security test • maintenance
- 6. Problem: Maintenance From: sysadmin Hi Developers, There’s a bug in your app From: postmaster Error User not found [email protected]
- 7. Security Test • Blackbox • Greybox • Whitebox (Code Review)
- 8. Problem: Access to Source Code From: Developers Hi sysadmin, We found some bugs in the app, we will patch soon From: Sysadmin Hi developer, Username: root Password: 123456
- 9. Problem: No Changes History From: Developers Hi sysadmin, We found some bugs in the app, we will patch soon From: Sysadmin Hi developer, Please send me the changed php files..
- 10. 500 Internal Server Error From: Sysadmin Hi developer, There’s another error after patching. Please roll them back ..!!
- 11. Let’s Make Our Job Easier • Create source code repository • Use versioning • Control user access to the code • No access to production servers
- 12. Free Source Code Hosting
- 13. Make It Private • security • availability • policy compliance (e.g. iso27001)
- 14. ...and Flexible Using Cloud Infrastructure • Flexible Resource • Cloning • High Availability • Snapshot and Restore
- 15. Model
- 16. How These Stuffs Work • VPN Tunneling
- 17. Related Tools • Git : a version control system • Gitweb : the git web interface • Gitosis : repository access control • VPN & SSH : tunneled access
- 18. Creating a Repository root@revision-control ~# ./addrepo.sh Please enter repository name and description Name :sample-app2 Description :Sample application 2.0 Creating a repository... Initialized empty Git repository in /srv/repos/git/sample-app2/.git/ # On branch master # # Initial commit # nothing to commit (create/copy files and use "git add" to track) Cloning into bare repository repositories/sample-app2.git... done. warning: You appear to have cloned an empty repository. [Done]
- 19. Gitosis Config Copy the public key to server Then edit gitosis.conf.. [group sample-app2] writable = sample-app2 members = intruder@LENOVOY460 [email protected]
- 20. Clone and Review
- 21. Thank You