custodian-enqueue
-----------------

  We open named files from the user to parse tests.  The configuration file(s)
 are currently opened by root, via /etc/service/custodian-enqueue.  This should
 be changed to run as a lower-privileged user.



custodian-dequeue
-----------------

Two tests pass arguments from the configuration file to the shell:

    ping
    http/https

The hostname used to ping, and the URL for web-tests, are both passed directly to the shell assuming they match the following regular expression:

^([^\s]+)\s+

So the following configuration file potentially allows a command to be executed by our worker:

    $(/home/steve/hg/custodian/exploit.sh) must ping otherwise "Owned".

    http://$(/tmp/exploit.sh)/ must run http with status 200 otherwise "Owned".

Given that anybody who can talk to the beanstalkd server can submit JSON-encoded-jobs we cannot rely on catching this solely in the parser.

For the moment we've solved the case of the ping-exploitation, because the
valid hostnames passed there are [a-z0-9.-].  We've not yet sanitized URLs
because that is a harder job.

In the case of the ping-test we've done both levels of testing:

  * Test the hostname is valid priorer to executing the shell.

  * Ensure the hostname is valid before adding the job to the queue.



General
-------

We decode arbitrary JSON from the queue.  We should sign it, or validate it to  will prevent trojan malformed
JSON from being added.

At the moment we ensure that the job-body we retrieve looks JSON-like, and decodes to a non-empty hash.

Problem: We cannot sign the body without giving away our key details.

Solution: Read /etc/custodian/salt, and store the checksum of all keys + values with that salt?


TODO
----

  Anything else?  DoS attacks?



Steve
--