From: Uwe Doering (geminigeminix.org)
Date: Mon Jul 14 2003 - 15:17:37 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Pawel Jakub Dawidek wrote:
> On Sun, Jul 13, 2003 at 08:56:16AM +0200, Uwe Doering wrote:
> +> >I'm setting up a server where I plan to use Jails to improve security
> +> >I also have installed and am configuring ipfilter. Here are my
> +> >questions:
> +> >
> +> >Because I'm using Jails, I will have to have multiple ip aliases on the
> +> >network interface. I will use ipfilter to specify what can go to each
> +> >of the addresses. (e.g., allow only incoming to port 80 on the jail
> +> >running apache).
> +>
> +> You don't have to have multiple IP aliases for multiple jails. Or at
> +> least there is no technical necessity for this (in FreeBSD 4.x, that is,
> +> don't kown about 5.x). If it's just about running server processes in
> +> their own jail (no port number conflicts) you can have all jails on the
> +> same IP address and do the IP filtering (if necessary at all in this
> +> scenario) based on port numbers.
>
> No, no, no!
>
> You first need to realize how kernel will choose listen socket.
> If you bind to port 22 on main host with INADDR_ANY, you get this
> INADDR_ANY, but if you bind to 22 port in jail even with INADDR_ANY
> it will be translated to jail's ip. Now if there is open port outside
> jail and inside some jail it is opened as well, guess which socket will
> be chosen. Socket in jail, because it isn't INADDR_ANY (as I said kernel
> translate them to jail's ip). So from security point of view if someone
> will break into your jail, he is able to spoof your sshd (let's forget
> for a moment about server keys), your mail server or anything else
> and get your password for example.

Good point. I forgot to mention that you should bind daemons running
outside the jails explicitly to the server's IP address. This
circumvents the problem you've pointed out. But I agree with you that
people would be less likely to shoot themselves in the foot if the
kernel took care of things in this situation.

> You can check my patch for multiple ips in jails which also fix
> sockets ordering behaviour.
>
> For FreeBSD 4.x:
> http://garage.freebsd.pl/mijail.tbz
> http://garage.freebsd.pl/mijail.README
> For FreeBSD 5.1-CURRENT:
> http://garage.freebsd.pl/mijail5.tbz
> http://garage.freebsd.pl/mijail5.README
> http://garage.freebsd.pl/patches/mijail5.patch

Thanks for the patches. Did you try to contribute them to the FreeBSD
project? If so, any reaction so far?

> +> >Another jailed server will run mail services (pop, smtp, imap). If
> +> >I want to allow users to use web based email(over ssl of course), the
> +> >web server will have to communicate with the mail server. Is there
> +> >a chance of "information leakage" in this type of setup?
> +>
> +> Only the information you transmit will leak. That is, you define the
> +> information interchange between the jails, so pondering over the
> +> consequences is on your plate, too. Just assume that each jail has been
> +> broken into by an intruder with evil intentions and ask yourself what
> +> damage he can do with the data he can gather from the other jails.
> +> Paranoia in action, as it were. ;-)
>
> If www pages don't have dynamic elements you can mount them as read-only
> with mount_null(8) for example. Only logs should be writable, but you
> need only one directory with 'schg' flag and touch(1)'ed log files
> inside with 'sappnd' flag. Note, that 'schg' and 'sappnd' can't be removed
> in jail even if securelevel is <= 0.

Just be careful with mount_null(8). You might get away with it
unscathed if you use it read-only, but you shouldn't try anything else
with it. Last time I checked I managed to panic the kernel with it even
faster than with mount_union(8), which is badly broken as well (look at
the comment at the end of the man pages). I wouldn't recommend using
either in a production system.

My two cents.

    Uwe
--
Uwe Doering | EscapeBox - Managed On-Demand UNIX Servers
geminigeminix.org | http://www.escapebox.net

_______________________________________________
freebsd-securityfreebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribefreebsd.org"

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]