CODEWITHSUNDEEP
securitynexuspackagingchainnexus3
swaechter
swaechter

Reputation: 1439

Secure Nexus against supply chain attacks

We switched from a publicly accessible reprepro Debian package repository (which was powered by an Apache web server) to the Sonatype Nexus Repository OSS, which is great piece of software. But we ran into one problem: When someone uploads a Debian package it's signed on the Nexus server, which we expose to our customers/the internet. In addition, the GPG key and passphrase is known to Nexus for package signing.

Or in other words: I am afraid of a similar situation like the SolarWinds supply chain attack. Scenario: Person attacks the publicly accessible Nexus server/Nexus itself, takes over Nexus, changes existing packages and resigns them with the GPG key/GPG passphrase. Then, malicious code is served to our customers.

I thought about exposing the file blob store directory as read only target to a publicly exposed web server and keep Nexus company internal. Sadly the internal file blob store layout is different, so that's not possible.

So my questions:

But maybe there is already such a feature/another way and I just missed it in the documentation?

Upvotes: 0

Views: 522

Answers (1)

swaechter
swaechter

Reputation: 1439

In the end we came up with several steps to minimize the risk:

  • Use a proxy that filters via GeoIP (Repository access is only possible from the countries our customers reside)
  • Block all URIs except the following (Replace with name of your repo):
    • /service/rest/repository/browse/REPONAME/*>
    • /repository/REPONAME/*>
    • /static/css/nexus-content.css*>
    • /favicon.ico*>
    • /favicon-*.png>

Upvotes: 1

Related Questions