|
Size: 1526
Comment:
|
Size: 3425
Comment: a few tweaks to bring it up to date
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 1: | Line 1: |
| = Rationale = | |
| Line 3: | Line 4: |
| One way we enforce this is by disallowing all network traffic that isn't covered by a specific "whitelist" rule in our `ferm` firewall configuration, rooted at `/etc/firewall/closed.conf`. The file `/etc/firewall/users.conf` defines user-specific rules, granting users permission to listen on particular ports or connect to particular ports on other servers. We try to limit connections to particular IP addresses, as well, whenever feasible. | One way we enforce this is by disallowing all network traffic that isn't covered by a specific "whitelist" rule in our {{{ferm}}} firewall configuration, rooted at {{{/etc/firewall/closed.conf}}}. The file {{{/etc/firewall/users.conf}}} defines user-specific rules, granting users permission to listen on particular ports or connect to particular ports on other servers. We try to limit connections to particular IP addresses, as well, whenever feasible.<<FootNote(Why do this? As an example, we can look at a successful attack performed on our old server. A member's buggy PHP script allowed anyone to run arbitrary code as the PHP user. An attacker used this to obtain shell access, by running a shell server on a nonstandard port; and to connect to an IRC network and serve large media files, costing us hundreds of dollars in transfer fees. The first problem can be prevented by simply not allowing users to listen on ports that they don't have specific permission for. The second one can be prevented by authorizing IRC client connections to particular server IP addresses only. Sure, most of the time no harm will come from allowing unrestricted IRC client connections, but, when it matters, it can be very helpful to block actions that we haven't specifically authorized.)>> |
| Line 5: | Line 6: |
| Why do this? As an example, we can look at a successful attack performed on our old server. A member's buggy PHP script allowed anyone to run arbitrary code as the PHP user. An attacker used this to obtain shell access, by running a shell server on a nonstandard port; and to connect to an IRC network and serve large media files, costing us hundreds of dollars in transfer fees. The first problem can be prevented by simply not allowing users to listen on ports that they don't have specific permission for. The second one can be prevented by authorizing IRC client connections to particular server IP addresses only. Sure, most of the time no harm will come from allowing unrestricted IRC client connections, but, when it matters, it can be very helpful to block actions that we haven't specifically authorized. | = fwtool = To make it easy for us to manage these per-user tools, we've developed an administrative tool called {{{fwtool}}}. It generates the appropriate {{{ferm}}} configuration using input from the file {{{/afs/hcoop.net/common/etc/domtool/firewall/users.rules}}}. The portal has [[https://members.hcoop.net/portal/sec|an interface for requesting modifications to this file]] on your behalf. You should also be able to view this file directly, if curious. At the moment, {{{fwtool}}} supports these directives<<FootNote(Implicit in each is a `host` argument where the firewall rules are created, but the portal hides this)>>: * {{{user Client ports [hosts]}}}: Allow {{{user}}} to connect to remote hosts on any of the given {{{ports}}}, which are specified as a comma-separated list of single port numbers and/or ranges of the form {{{low:high}}}. The space-separated list {{{hosts}}} is optional. If omitted, connections are allowed to any remote IP addresses. If included, {{{hosts}}} provides an exhaustive list of the IP addresses and/or hostnames to which to allow connections. * {{{user Server ports [hosts]}}}: The analogue of the above, for the privileges of listening and accepting connections. * {{{user ProxiedServer ports}}}: Allow {{{user}}} to listen and accept connections on the {{{ports}}}, but only for connections from the public Apache servers. This is useful for things like running your own web server/application that Apache proxies, which you can configure using `mod_proxy`. * {{{user LocalServer ports}}}: Allow {{{user}}} to listen and accept connections on the {{{ports}}}, but only for connections from the local server to itself. This is useful if you have software that needs to locally communicate using the network, but does not need to be visible to the Internet. ---- CategorySystemAdministration |
1. Rationale
Since we primarily provide "Internet hosting" and not "shell servers," our primary concern is keeping our services up and reliable. To this end, we try to limit user actions as much as possible without stopping those users from doing reasonable things.
One way we enforce this is by disallowing all network traffic that isn't covered by a specific "whitelist" rule in our ferm firewall configuration, rooted at /etc/firewall/closed.conf. The file /etc/firewall/users.conf defines user-specific rules, granting users permission to listen on particular ports or connect to particular ports on other servers. We try to limit connections to particular IP addresses, as well, whenever feasible.1
2. fwtool
To make it easy for us to manage these per-user tools, we've developed an administrative tool called fwtool. It generates the appropriate ferm configuration using input from the file /afs/hcoop.net/common/etc/domtool/firewall/users.rules. The portal has an interface for requesting modifications to this file on your behalf. You should also be able to view this file directly, if curious.
At the moment, fwtool supports these directives2:
user Client ports [hosts]: Allow user to connect to remote hosts on any of the given ports, which are specified as a comma-separated list of single port numbers and/or ranges of the form low:high. The space-separated list hosts is optional. If omitted, connections are allowed to any remote IP addresses. If included, hosts provides an exhaustive list of the IP addresses and/or hostnames to which to allow connections.
user Server ports [hosts]: The analogue of the above, for the privileges of listening and accepting connections.
user ProxiedServer ports: Allow user to listen and accept connections on the ports, but only for connections from the public Apache servers. This is useful for things like running your own web server/application that Apache proxies, which you can configure using mod_proxy.
user LocalServer ports: Allow user to listen and accept connections on the ports, but only for connections from the local server to itself. This is useful if you have software that needs to locally communicate using the network, but does not need to be visible to the Internet.
Why do this? As an example, we can look at a successful attack performed on our old server. A member's buggy PHP script allowed anyone to run arbitrary code as the PHP user. An attacker used this to obtain shell access, by running a shell server on a nonstandard port; and to connect to an IRC network and serve large media files, costing us hundreds of dollars in transfer fees. The first problem can be prevented by simply not allowing users to listen on ports that they don't have specific permission for. The second one can be prevented by authorizing IRC client connections to particular server IP addresses only. Sure, most of the time no harm will come from allowing unrestricted IRC client connections, but, when it matters, it can be very helpful to block actions that we haven't specifically authorized. (1)
Implicit in each is a host argument where the firewall rules are created, but the portal hides this (2)