Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A capistrano 3 plugin that aids in rendering erb templates and uploads the content to the server if the file does not exists at the remote host or the content did change.
Add this line to your application's Gemfile:
gem 'capistrano-template'
And then execute:
$ bundle
Or install it yourself as:
$ gem install capistrano-template
In your Capfile:
require 'capistrano/capistrano_plugin_template'
In your task or stage file:
desc 'Upload a rendered erb-template'
task :setup do
on roles :all do
# searchs for template assets.host.site.erb in :templating_paths
# renders the template and upload it to "#{release_path}/assets.host.site" on all hosts
# when the new rendered content is changed or the remote file does not exists
template 'assets.host.site', locals: { 'local1' => 'value local 1'}
end
on roles :all do
# searchs for template other.template.name.erb in :templating_paths
# renders the template and upload it to "~/execute_some_thing.sh" on all hosts
# when the new rendered content is changed or the remote file does not exists
# after this the mode is changed to 0750
# owner is changed to "deployer:www-run"
# keep in mind chown and chgrp needs sudo privileges
template 'other.template.name', '~/execute_some_thing.sh', 0750, 'deployer', 'www-run' ,locals: { 'local1' => 'value local 1'}
end
end
In your config/deploy/templates/shared/assets.host.site.erb
# generated by capistrano
##########################
server {
listen 80;
client_max_body_size 4G;
keepalive_timeout 10;
error_page 500 502 504 /500.html;
error_page 503 @503;
server_name <%= host.properties.fetch(:host_server_name) %>;
root <%= remote_path_for(current_path) %>/public;
<%= render 'partial.conf', indent: 2, locals: { 'other_local' => 'other local value' } %>
location ^~ /assets/ {
gzip_static on;
expires max;
add_header Cache-Control public;
if ($request_filename ~* ^.*?\.(eot)|(ttf)|(woff)|(svg)|(otf)$){
add_header Access-Control-Allow-Origin *;
}
}
location = /50x.html {
root html;
}
location = /404.html {
root html;
}
if ($request_method !~ ^(GET|HEAD|PUT|POST|DELETE|OPTIONS)$ ){
return 405;
}
if (-f $document_root/system/maintenance.html) {
return 503;
}
location ~ \.(php|html)$ {
return 405;
}
}
This settings can be changed in your Capfile, deploy.rb or stage file.
Variable | Default | Description |
---|---|---|
templating_digster | ->(data){ OpenSSL::Digest::MD5.hexdigest(data)} | Checksum algorythmous for rendered template to check for remote diffs |
templating_digest_cmd | %Q{test "Z$(openssl md5 %<path>s | sed 's/^.*= *//')" = "Z%<digest>s" } | Remote command to validate a digest. Format placeholders path is replaces by full path to the remote file and digest with the digest calculated in capistrano. |
templating_mode_test_cmd | %Q{ [ "Z$(printf "%%.4o" 0$(stat -c "%%a" %<path>s 2>/dev/null || stat -f "%%A" %<path>s))" != "Z%<mode>s" ] } | Test command to check the remote file permissions. |
templating_user_test_cmd | %Q{ [ "Z$(stat -c "%%U" %<path>s 2>/dev/null)" != "Z%<user>s" ] } | Test command to check the remote file permissions. |
templating_paths | ["config/deploy/templates/#{fetch(:stage)}/%<host>s", "config/deploy/templates/#{fetch(:stage)}", "config/deploy/templates/shared/%<host>s", "config/deploy/templates/shared"] | Folder to look for a template to render. <host> is replaced by the actual host. |
git checkout -b my-new-feature
)git commit -am 'Add some feature'
)git push origin my-new-feature
)FAQs
Unknown package
We found that capistrano-template demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.