[next] [previous] [contents] [full-page]7.1 - Recommended Package Security
7.2 - Maintaining Package Security
7.3 - Independent Package and Local Resources
7.4 - Configuration
7.4.1 - Directory Listings
7.4.2 - Server Reports
7.4.3 - Scripting
7.4.4 - Server Side Includes
7.5 - Scripting
7.6 - Authorization
7.7 - Miscellaneous Issues
7.8 - Site Attacks
This section does not pretend to be a complete guide to keeping the "bad guys" out. It does provide a short guide to making a site more-or-less liberal in the way the server supplies information about the site and itself. The reader is also strongly recommended to a number of hard copy and Web based resources on this topic.
The WASD package had it's genesis in making the VMS operating system and associated resources, in a development environment, available via Web technology. For this reason configurations can be made fairly liberal, providing information of use in a technical environment, but that may be superfluous or less-than-desirable in other, possibly commercial environments. For instance, directory listings can contain VMS file system META information, error reports can be generated with similar references along with reporting source code module and line information.
The example configuration files contain a fairly restrictive set of directives. When relaxing these recommendations keep in mind that the more information available about the underlying structure of the site the more potential for subversion. Do not enable functionality that contributes nothing to the fundamental usefulness of the site, or that has the real potential to compromise any given site. This section refers to configuration directives discussed in more detail in later chapters.
It is established wisdom that the only secure computing system is one with no users and no access, that system security is inversely proportional to system usability, and that making something idiot-proof results in only idiots using it. So there are some trade-offs but ...
don't think it can't happen to you!
A systematic investigation of installed WASD packages by well-known IT professional Jean-loup Gailly during September 2002 revealed a couple of significant implementation flaws which compounded by notable instances of sloppy management practices on two public sites resulted in site compromise (one was mine).This research has resulted in these server flaws being closed and package security considerations being extensively reviewed. As a result WASD v8.1 is much more resistent to such penetration than previous releases (and slightly less easy to use, but that's one of those trade-offs). My assessment would be that if Gailly did not find it then it wasn't there to find!
Of course any given site's security is a function of the underlying package's security profile, with the site's implementation of that, AND other considerations such as local authorization and script implementations. Pay particular and ongoing attention to site security and integrity.
The following table provides recommended file protection settings for package top-level directories. Subdirectories share their parents' settings. The package tree is owned by the SYSTEM account. Directories with world READ access have no ACLs. Other directories, not accessable to the world, but sometimes having other degress of access to one or more accounts always have rights identifiers (see below) and associated ACLs to control directory access, and to propagate required access to files created beneath them. The server selectively enables SYSPRV to provide access to some of these areas (e.g. for log creation).
Some pre-version 8.1 directories are not included in this table. These are not significant in versions from 8.1 onwards and may be deleted. They can continue to exist however and the security procedures described below ensure that they comply to the general post-8.1 security model. The file access permissions indicated below are for directory contents. The directory files themselves have settings appropriate for content access.
|
It is recommended site-specific directories have settings applied appropriate to their function in comparison to similar package directories. See below for tools to assist in this.
Three rights identifiers provide selective access control to the directory tree. Identifiers were used to allow maximum flexibility for a site in allowing required accounts access to either execute the server or execute scripts. Non-default account names only need to be granted one of these identifiers to be provided with that role's access. Installation, update and/or security utilities create and maintain these identifiers appropriately.
|
These rights identifiers are applied to directories and files to provide
the required level of access. The following example shows the security setting
of the top-level CGI-BIN.DIR and one of it content files.
$ DIRECTORY /SECURITY CGI-BIN.DIR
Directory HT_ROOT:[000000]
CGI-BIN.DIR;1 [SYSTEM] (RWED,RWED,,)
(IDENTIFIER=WASD_HTTP_SERVER,ACCESS=EXECUTE)
(IDENTIFIER=WASD_HTTP_NOBODY,ACCESS=EXECUTE)
(IDENTIFIER=*,ACCESS=NONE)
(IDENTIFIER=WASD_HTTP_NOBODY,OPTIONS=DEFAULT,ACCESS=READ+EXECUTE)
(IDENTIFIER=*,OPTIONS=DEFAULT,ACCESS=NONE)
(DEFAULT_PROTECTION,SYSTEM:RWED,OWNER:RWED,GROUP:,WORLD:)
Total of 1 file.
$ DIRECTORY /SECURITY [CGI-BIN]CGI_SYMBOLS.COM
Directory HT_ROOT:[CGI-BIN]
CGI_SYMBOLS.COM;1 [SYSTEM] (RWED,RWED,,)
(IDENTIFIER=WASD_HTTP_NOBODY,ACCESS=READ+EXECUTE)
(IDENTIFIER=*,ACCESS=NONE)
Total of 1 file.
7.2 - Maintaining Package Security
As noted above, WASD version 8.1 and later is much more conservative in what it makes generally available from the package tree, and a site administrator now has to take extraordinary measures to open up certain sections, making it a much more difficult and deliberate action. The package installation, update and security procedures and their associated utilities should always be used to ensure that the installed package continues to conform to it's security baseline.
Package security may be "refreshed" or reapplied at any time, and
this should be done periodically to ensure that an installed package has not
inadvertantly been opened to access where it shouldn't have. Of course this
is not a guarantee that any given site is secure. Site security is a function
of many factors; package vulnerabilities, site configuration, deployed scripts,
cracker determination and expertise, etc., etc. What refreshing the security
baseline does is provide a known secure (and WASD-community scrutinized)
starting point. It should be used as part of a well considered site security
maintenance program.
SECURE.COM
The following DCL procedure resets the package security baseline.
$ @HT_ROOT:[INSTALL]SECURE.COM
It guides the administrator through a number of stages
of which each one may be declined. After all of these steps it searches
for and executes if found the DCL procedure HT_ROOT:[INSTALL]SECURE.COM.
The intent of this file is to allow a site to automatically update any
site-specific security settings (and of course modify any set by the main
procedure).
SECHAN Utility
The SECHAN utility (pronounced "session") is used by SECURE.COM and its associated procedures to make file system security settings. It is also available for direct use by the site administrator (23.11 - SECHAN Utility).
One of the more useful functions of SECHAN is applied using the /IGNORE qualifier.
$ SECHAN /IGNORE HT_ROOT:[CGI-BIN]MY_SCRIPT.COM $ SECHAN /IGNORE HT_ROOT:[LOCAL]*.DAT $ SECHAN /IGNORE WEB:[DATA...]*.* $ SECHAN /IGNORE WEB:[000000]DATA.DIR
This ACE can be removed from a file (leaving other entries of any ACL
intact) using the /NOIGNORE qualifier. This returns the file(s) subject again
to the SECHAN utility.
$ SECHAN /NOIGNORE HT_ROOT:[CGI-BIN]MY_SCRIPT.COM
$ SECHAN /NOIGNORE HT_ROOT:[LOCAL]*.DAT
Other functionality may prove useful when applied to local parts of the package or web structure.
$ SECHAN /PACKAGE $ SECHAN /PACKAGE /ALL
$ SECHAN /ASIF=LOCAL WEB:[DATA...]*.* $ SECHAN /ASIF=LOCAL WEB:[000000]DATA.DIR $ SECHAN /ASIF=CGI-BIN WEB:[SCRIPTS]*.* $ SECHAN /ASIF=CGI-BIN WEB:[000000]SCRIPTS.DIR $ SECHAN /ASIF=DOC WEB:[HTML...]*.* $ SECHAN /ASIF=DOC WEB:[000000]HTML.DIR
$ SECHAN /PACKAGE /NOSCRIPT
This section provides only a basic description. More detail may be found
in the prologue to the source code.
7.3 - Independent Package and Local Resources
Not only does it make it easier to manage site content but is also good security practice to keep server package and site content completely separate (6.1 - Site Organisation).
This can also be applied to scripts, both source and build areas. Keep
your business logic out of the package source tree and potentially prying eyes.
The script executables themselves can be placed into the package
scripting directories but should be built independently from these and copied
using locally maintained DCL procedures from build into scripting areas (the
HT_ROOT:[INSTALL]SECURE.COM procedures described above may be useful here).
7.4 - Configuration
Various configuration and mapping directives can be used to make the site
environment more or less liberal in the information it implicitly can provide.
7.4.1 - Directory Listings
Published guidelines for securing a Web site generally advise against automatic directory listing generation. Where a home page is not available this may leak information on other directory contents, provide parent and child directory access, etc. Compounding this is the WASD facility to force a listing by providing a directory URL with file wildcards (not to decry it's usefulness in some environments).
The mapping rule "SET DIR=keyword" can be used to change this on a per-path basis (13.4.5 - SET Rule).
Conservative recommendation: Set "[DirAccess]
selective" allowing listing for directories containing a file named
".WWW_BROWSABLE", disable [DirMetaInfo] and [DirWildcard].
7.4.2 - Server Reports
Reports are pages generated by the server, usually to indicate an error or other non-success condition, but sometimes to indicate success (e.g. after a successful file upload). Reports provide either basic or detailed information about the situation. Sometimes the detailed information includes VMS file system details, system status codes etc. To limit this information to a minimum indication adjust the following directives.
The mapping rule "SET REPORT=keyword" can be used to change some of these on a per-path basis (13.4.5 - SET Rule).
Conservative recommendation: Provide minimal error
information by enabling [ReportBasicOnly] and disabling [ReportMetaInfo].
Enable [ServerSignature] to provide a slightly more friendly report (server
software can easily be obtained from the response header anyway).
7.4.3 - Scripting
If a static site is all that's required this source of compromise can simply be avoided.
Conservative recommendation: Only deploy scripts your site will actually be using. Remove all the files associated with any other scripts. Do not allow obsolete script environments to remain active. Be proactive.
Also see 7.5 - Scripting.
7.4.4 - Server Side Includes
SSI documents are pages containing special markup directives interpreted by the server and replaced with dynamic content. This can include detail about the server, the file or files making up the document, and can even include DCL commands and procedure activation for supplying content into the page. All this by anyone who can author on the site.
The mapping rule "SET SSI=keyword" can be used to change some of this on a per-path basis (13.4.5 - SET Rule).
Conservative recommendation: Disable [SsiExec].
7.5 - Scripting
Scripting has been a notorious source of server compromise, particularly within Unix environments where script process shell command-line issues require special attention. The WASD CGI scripting interface does not pass any arguments on the command line, and is careful not to allow substitution when constructing it's CGI environment. Never-the-less, script behaviours cannot be guaranteed and care should be exercised in their deployment (ask me!)
It is strongly recommended to execute scripts in an account distinct from that executing the server. This should also mean that the accounts are not members of the same group nor should it be a member of any other group. This minimises the risk of both unintentional and malicious interference with server operation through either Inter-Process Communication (IPC) or scripts manipulating files used by the server. The PERSONA facility can be used to further differentiate script activities. See "Scripting Overview" for further detail.
The default WASD installation creates two such accounts, with distinct UICs, usernames and home directory space. Nothing should be assumed or read into the scripting account username - it's just a username.
|
During startup the server checks for the existence of the default scripting
account and automatically configures itself to use this for scripting. If it
is not present it falls-back to using the server account. Other account names
can be used if the startup procedures are modified accordingly. The default
scripting username may be overridden using the /SCRIPT=AS=<username>
qualifier (also see the "Scripting Overview").
7.6 - Authorization
Authorization issues imply controlling access to various resources and actions and therefore require careful planning and implementation if compromise is to be avoided. WASD has a quite capable and versatile authorization and authentication environment, with a significant number of considerations. The reader refered to the chapter on this topic, 15 - Authentication and Authorization.
WASD authorization cannot be enabled without the administrator configuring at least three resources, and so therefore cannot easily be "accidentally" activated. One of these is the addition of a startup qualifier controlling where authentication information may be sourced. Another the server configuration file. The third, mapping paths against authorization configuration.
For sites that may be particularly sensitive about inadvertant access to
some resources it is possible to use the authorization configuration file as a
type of cross-check on the mapping configuration file. The server
/AUTHORIZATION=ALL startup qualifier forces all access to be authorized (even
if some are marked "none"). This means that if something
"escapes" via the mapping file it will very likely be "caught" by
an absence in the authorization file.
7.7 - Miscellaneous Issues
Although it is of limited usefulness because server identity may be deduced from behaviour and other indicators the exact server and version may be obscured by using the otherwise undocumented /SOFTWARE= qualifier to change the server identification string to (basically) whatever the administrator desires. This identification is included as part of all HTTP response headers.
Historically and by default server configuration and authorization sources
are contained within the server package tree. There is no reason why they
cannot be located anywhere the site prefers. Generally all that is required is
a change to logical name definition and server startup.
Package Tree
Version 8.1 and later is much more conservative in what it makes available of the package tree via the server. The package installation, update and security procedures and their associated utilities should always be used to ensure that the installed package continues to conform to it's security baseline. See 7.2 - Maintaining Package Security.
Furthermore, with many sites there may be little need to access the full, or any of the WASD package tree. A combination of mapping and/or authorization rules can relatively simply block or control access to it. These examples can be easily tailored to suit a site's specific requirements.
This example shows blocking all access to the /ht_root/ tree, except for
documentation, source code, examples and exercise (performance results) areas.
# HTTPD$MAP
pass /ht_root/doc/*
pass /ht_root/src/*
pass /ht_root/example/*
pass /ht_root/exercise/*
fail /ht_root/*
The next example forbids all access to the package tree unless authorized
(the authorization detail would vary according to the site). It also allows
modify access for the Server Administration page and to the /ht_root/local/
area.
# HTTPD$MAP
pass /ht_root/*
# HTTPD$AUTH
[WASD_WEB_ADMIN=id]
/httpd/-/admin/* r+w
/ht_root/local/* r+w
/ht_root/* r
Be careful!
There are often multiple paths to a single resource. For instance, it is of little significance blocking access to say /ht_root/doc/ if it's also possible to access it via /doc/.
The following example shows how this might occur.
# HTTPD$MAP
fail /ht_root/doc/*
pass /* /ht_root/*
Authorization rules can be used to effectively block access to any VMS file
specification (it cannot be done during mapping because the translation from
path to file system is not performed until mapping is complete).
# HTTPD$AUTH
if (path-translated:HT_ROOT:[DOC]*) * none
or to selectively allow access
# HTTPD$AUTH
[[WASD_VMS_RW=id]]
if (path-translated:HT_ROOT:[DOC]*) * read
7.8 - Site Attacks
This is not a treatise on Web security and the author is not a security
specialist. This is some general advice based on observation. There is little
one can do at the server itself to reduce a concerted attack against a site.
Common objectives of such attacks include the following (not an exhaustive
list).
Platform Vulnerabilities
Where a general attack is launched directed against a specific platform (a combination of operating system and Web server software). Often these can be due to wide-spread infection of systems, meaning many attacks are being launched from a large number of systems (often without the system owners' knowlege or cooperation).
WASD, and OpenVMS in particular, are generally immune to such attacks
because they are not Microsoft or Unix based. The impact of the attack
becomes one of the nuisance-value traffic as the site is probed by the
(sometimes very large number of) source systems.
Site Vulnerabilities
Where a specific attack is made against a site in an attempt to exploit a known vulnerability associated with that platform or environment.
These are perhaps the most worrying, although the
security-by-obscurity element works in favour of WASD and OpenVMS
in this case. Neither are as common as other platforms and therefore do not
receive as much attention.
Denial of Service
(DOS) Usually comprise flooding a site with requests in an effort to consume all available network or server resources making it unavailable for legitimate use.
These can be insidious, flooding network equipment as well as systems.
Attempts at control are best undertaken at the periphery of the network
(routers) although concerted attacks can succeed against the best prepared
network.
Password Cracking
Where a systematic attempt to break into one or more accounts is undertaken. These are often repeated, dictionary-based password-guessing attacks.
WASD's authentication functionality notes successive password validation
failures and after a reasonable number disables all access via the username for
a constantly extended period. Passwords stop being checked and so a
dictionary-based attack cannot succeed. Password validation failures can be
recorded via OPCOM.
Authorization Holes
Knowing of or searching for resources that should be controlled by authorization but are not.
WASD's /AUTHORIZATION=ALL functionality may assist here
(7.6 - Authorization).
Strategies
There are a few strategies for reducing the load on a server experiencing a generalized attack or probing. These can also be used to "discourage" the source from considering the site an easy target. Unfortunately most require request acceptance and at least some processing before taking action. The general idea is to identify either the source site or some characteristic of the request that indicates it could not possibly be legitimate. Most platform-specific attacks have such a signature. For instance attacks against Microsoft platforms often involve probes for backdoors into non-server executables. These can be identified by the path containing strings such as "/winnt/", "/system32/", "/cmd.exe" or variations on them. This style will be used in examples below.
[Reject] 131.185.250.* the.host.name
if (remote-host:the.host.name)
redirect * http://the.host.name/*
endif
redirect **/winnt/** http://does.not.exist/
if (remote-addr:131.185.250.*)
pass * "000 just drop it!"
endif
pass **/system32/** "000 just drop it!"
if (remote-addr:131.185.250.*) map * /hiss/* script /hiss/* /hiss/* map **/cmd.exe** /hiss/*/cmd.exe* script /hiss/* /hiss/*