Security

1. Security

2. FreeBSD Security Advisories – (1) • http://www.freebsd.org/security/advisories.html

3. FreeBSD Security Advisories – (2)

4. FreeBSD Security Advisories – (3) • freebsd-security-notifications Mailing list • http://lists.freebsd.org/mailman/listinfo/freebsd-security-notifications

5. FreeBSD Security Advisories – (4) • Example • compress

6. FreeBSD Security Advisories – (5) • CVE-2011-2895 • http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2895

7. FreeBSD Security Advisories – (6) • Example • Problem Description

8. FreeBSD Security Advisories – (7) • Example • Workaround

9. FreeBSD Security Advisories – (8) • Example • Solution

10. Common Security Problems • Unreliable wetware • Phishing site • Software bugs • FreeBSD security advisor • portaudit (ports-mgmt/portaudit) • Open doors • Accounts’ password • Disk share with the world

11. portaudit (1) • portaudit • Checks installed ports against a list of security vulnerabilities • portaudit –Fda • -F: Fetch the current database from the FreeBSD servers. • -d: Print the creation date of the database. • -a: Print a vulnerability report for all installed packages. • Security Output

12. portaudit (2) • portaudit -Fda • http://www.freshports.org/<category>/<portname> auditfile.tbz 100% of 71 kB 92 kBps New database installed. Database created: Mon Dec 12 02:10:00 CST 2011 Affected package: gnutls-2.12.7 Type of problem: gnutls -- client session resumption vulnerability. Reference: http://portaudit.FreeBSD.org/bdec8dc2-0b3b-11e1-b722-001cc0476564.html Affected package: apache-worker-2.2.19 Type of problem: apache -- Range header DoS vulnerability. Reference: http://portaudit.FreeBSD.org/7f6108d2-cea8-11e0-9d58-0800279895ea.html 2 problem(s) in your installed packages found. You are advised to update or deinstall the affected package(s) immediately.

13. Common trick • Tricks • ssh scan and hack • ssh guard • sshit • … • smtp-auth / pop3 / imap • Phishing • XSS & sql injection • … • Objective • Spam • Jump gateway • File sharing • …

14. Process file system - procfs • Procfs • A view of the system process table # mount –t procfs proc /proc

15. Simple SQL injection example • User/pass authentication • No input validation SELECT * FROM usrTable WHERE user = AND pass = ; SELECT * FROM usrTable WHERE user = ‘test’ AND pass = ‘a’ OR ‘a’ = ‘a’

16. setuid programs • passwd • /etc/master.passwd is of mode 600 (-rw-------) ! • setuid executables are especially apt to cause security holes • Minimize the number of setuid programs • /etc/periodic/security/100.chksetuid • Disable the setuid execution on individual filesystems • -o nosuid zfs[~] -chiahung- ls -al /usr/bin/passwd -r-sr-xr-x 2 root wheel 8224 Dec 5 22:00 /usr/bin/passwd

17. rlogin – (1) • sudo • Trusted remote host and user name database • /etc/hosts.equiv and ~/.rhosts • Allow user to execute shell (rsh), login (rlogin) and copy files (rcp) between machines without passwords • Format: • Simple: hostname [username] • Complex: [+-][hostname|@netgroup] [[+-][username|@netgorup]] • Example • bar.com foo (trust user “foo” from host “bar.com”) • +@adm_cs_cc (trust all from amd_cs_cc group) • +@adm_cs_cc -@chwong ---s--x--x 2 root wheel /usr/local/bin/sudo

18. rlogin – (2) • Becoming other users • A pseudo-user for services, sometimes shared by multiple users • sudo –u wwwadm –s (?) • /etc/inetd.conf • login stream tcp nowait root /usr/libexec/rlogind rlogind • ~wwwadm/.rhosts • localhost pyhsu • rlogin -l wwwadm localhost User_AliaswwwTA=pyhsu Runas_Alias WWWADM=wwwadm wwwTA ALL=(WWWADM) ALL Too dirty!

19. Security tools • nmap • john, crack • PGP • CA • … • Firewall • TCP Wrapper • …

20. TCP Wrapper – (1) • TCP Wrapper • Provide support for every server daemon under its control • libwrap implements the actual functionality • Before: inetd + tcpd with libwrap

21. TCP Wrapper – (2) • Now… $ ldd `which inetd` /usr/sbin/inetd: libutil.so.8 => /lib/libutil.so.8 (0x800651000) libwrap.so.6 => /usr/lib/libwrap.so.6 (0x800761000) libipsec.so.4 => /lib/libipsec.so.4 (0x80086a000) libc.so.7 => /lib/libc.so.7 (0x800971000) $ ldd `which sshd` /usr/sbin/sshd: libssh.so.5 => /usr/lib/libssh.so.5 (0x800681000) libutil.so.8 => /lib/libutil.so.8 (0x8007cb000) libz.so.5 => /lib/libz.so.5 (0x8008db000) libwrap.so.6 => /usr/lib/libwrap.so.6 (0x8009f0000) libpam.so.5 => /usr/lib/libpam.so.5 (0x800af9000) .....

22. TCP Wrapper – (3) • libwrap – hosts_access(3) • In sshd source code

23. TCP Wrapper – (4) • There are something that a firewall will not handle • Sending text back to the source • TCP wrapper • Provide support for every server daemon under its control • Logging support • Return message • Permit a daemon to only accept internal connections • Configuration files • /etc/hosts.allow, /etc/hosts.deny(optional)

24. Super Server – inetd • To see what daemons are controlled by inetd, see /etc/inetd.conf • In /etc/rc.conf • inetd_enable="YES" #ftp stream tcp nowait root /usr/libexec/ftpd ftpd -l #ftp stream tcp6 nowait root /usr/libexec/ftpd ftpd -l #telnet stream tcp nowait root /usr/libexec/telnetd telnetd #telnet stream tcp6 nowait root /usr/libexec/telnetd telnetd shell stream tcp nowait root /usr/libexec/rshd rshd #shell stream tcp6 nowait root /usr/libexec/rshd rshd login stream tcp nowait root /usr/libexec/rlogind rlogind #login stream tcp6 nowait root /usr/libexec/rlogind rlogind

25. /etc/hosts.allow – (1) • In /etc/hosts.allow • Format: daemon : address : action • daemon is the daemon name which inetd started • address can be hostname, IPv4 addr, IPv6 addr, net/prefixlen • action can be “allow” or “deny” • Keyword “ALL” can be used in daemon and address fields to means everything • First rule match semantic • Meaning that the configuration file is scanned in ascending order for a matching rule • When a match is found, the rule is applied and the search process will stop

26. /etc/hosts.allow – (2) • Example • TCP wrapper should not be considered a replacement of a good firewall • Instead, it should be used in conjunction with a firewall or other security tools • Good at rpc based services ALL : localhost, loghost @adm_cc_cs : allow ptelnetd pftpd sshd: @sun_cc_cs, @bsd_cc_cs, @linux_cc_cs : allow ptelnetd pftpd sshd: zeiss, chbsd, sabsd : allow identd : ALL : allow portmap : 140.113.17. ALL : allow sendmail : ALL : allow rpc.rstatd : @all_cc_cs 140.113.17.203: allow rpc.rusersd : @all_cc_cs 140.113.17.203: allow ALL : ALL : deny

27. /etc/hosts.allow – (3) • Advance configuration • External commands (twist option) • twist will be called to execute a shell command or script (exec) • External commands (spawn option) • spawn is like twist, but it will not send a reply back to the client (fork/exec) # The rest of the daemons are protected. telnet : ALL \ : severity auth.info \ : twist /bin/echo "You are not welcome to use %d from %h." # We do not allow connections from example.com: ALL : .example.com \ : spawn (/bin/echo %a from %h attempted to access %d >> \ /var/log/connections.log) \ : deny

28. /etc/hosts.allow – (4) • Wildcard (PARANOID option) • Match any connection that is made from an IP address that differs from its hostname • See • hosts_access(5) • hosts_options(5) # Block possibly spoofed requests to sendmail: sendmail : PARANOID : deny

29. tcpdmatch • In /etc/hosts.allow • tcpdmatch(8) example ALL : localhost 127.0.0.1 [::1] : allow ALL : cshome2 : allow sshd : csduty linuxhome cshome : allow rpc.lockd : 140.113.235.0/255.255.255.0 : allow rpc.statd : 140.113.235.0/255.255.255.0 : allow rpcbind : 140.113.235.0/255.255.255.0 : allow ALL : ALL : deny $ tcpdmatch ssh 140.113.12.34 warning: ssh: no such process name in /etc/inetd.conf client: address 140.113.12.34 server: process ssh matched: /etc/hosts.allow line 12 option: deny access: denied

30. When you perform any change. • Philosophy of SA • Know how things really work • Plan it before you do it • Make it reversible • Make changes incrementally • Test before you unleash it