Hi, I teach a CS course, and I was wondering if there is a practical way in which to setup a server that would accept student’s tar files, run some tests, and show them the results.
I could go “full unix mode” and roll up some accounts let them ssh into a server, scp their their files… but I was wondering if there is a prepacked solution for this that is nicer to the eye. And I thought maybe you know some.
This is basically what CI/CD pipelines do.
Compile the code, run tests, run static analysis. If results pass, submit the code. If results fail, reject it with an explanation.
Idk the details of how you’d implement this for a class, without letting everyone see eachother’s completed work, but I’m sure it could be done.
Charles university uses and develops something called ReCodex, and it is available on GitHub. As a student, it was very nice to use.
Did a takehome for a company recently that did it well. They required that I make a docker file (you could give them one if you wanted) where when ran it would run tests. It was a neat use of docker IMO, it standardized that builds were just “build the docker file” and running was just “run the dockerfile”. You would t have to deal with tar or anything then.
Thousand ways to skin a cat there
Why give your students a way to get RCE on your institutions servers through anything less than perfect file upload implementation.
For a .tar? I wish you the best…
Instead of that, simplify.
Use unique salts for each assignment per student.
Align hashes with those salts to check the outcome for each students assignment.
Literally have them send you a CTF style sha256 string.
Do it step by step where each step doesn’t depend on the next, grade as a percentage of flags accurately procured.
Absolutely this. Even if you had fancy jails or docker setups for each submission, this will be a nightmare to properly handle. Students DOSing each other exactly before the submission deadline, too.
I mean just for the love of God don’t spin up something on your company’s infrastructure that accepts file uploads.
Just don’t.
If you’re reading this and going “well, it’s just internal,” or “well, it doesn’t do much it just accepts this exact file type.” My god. Ask your CISA. And if they’re okay with it, cool. That’s on them.
Unless your whole business is transferring files, don’t. And even then… Don’t.
And if you’re still confused, the answer is to use another company’s infrastructure for this. Use Azure. Use AWS. Use Google cloud or even g suites. Don’t accept that liability. Let the trillionaires do it.
I mean if you put up an Internet-facing unauthenticated file acceptor it will quickly become stuffed with all sorts of garbage and aspiring malware. You definitely don’t want to hook that up to an untar and exec loop, even with some notion of sandboxing. It will just start mining Bitcoins or sending spam or something.
But if it is built properly, with only authorized users being able to upload stuff, and a basic understanding of not dropping stuff where the web server will happily execute every PHP web shell someone sticks in the slot, and the leverage to threaten people into not uploading pictures of their own or others’ butts or Iron Man (2009), I don’t see why all but the file-uploading professionals should immediately give up.
Security noob here. Would it be sufficient (in addition to only local authorized access) to directly put the file in an unprivileged container, watching its log output? And of course limiting resource use and execution time of the container (don’t know if common container tools like docker or podman have a way to limit resources out of the box)
So lets say a simple interface for the file upload behind an authentication service, based on lets say python cgi, ramping up an unprivileged nonroot docker container, killing the container after a fixed time (a few seconds).
Probably.
