7:35 p.m.
On a default install of Fedora 14, and also the latest release candidate for 15, the user
is presented with:
An iptables rule that opens port 22 to the worldsshd service automatically
startedsshd_config with default option: PermitRootLogin yes
It's like every new install comes with the keys to the castle hanging on outside of
the door for anyone who comes knocking.
I find this situation a serious oversight in light of the fact that Fedora obviously
values security (like selinux, or how the installer forces a minimum password length,
etc)
Any experienced linux user will know to check iptables and disable unnecessary services,
but I wouldn't expect this from a new linux user (exactly the people the refreshed
GNOME experience is supposed to attract). I think the default configuration should be in
the name of security, and sshd should not be listening on a default port with an open rule
with root login enabled.
~Team Edward~
3:26 a.m.
On 19/05/11 01:35, dirk cummings wrote:
On a default install of Fedora 14, and also the latest release
candidate
for 15, the user is presented with:
* An iptables rule that opens port 22 to the world
* sshd service automatically started
* sshd_config with default option: PermitRootLogin yes
It's like every new install comes with the keys to the castle hanging on
outside of the door for anyone who comes knocking.
I find this situation a serious oversight in light of the fact that
Fedora obviously values security (like selinux, or how the installer
forces a minimum password length, etc)
Any experienced linux user will know to check iptables and disable
unnecessary services, but I wouldn't expect this from a new linux user
(exactly the people the refreshed GNOME experience is supposed to
attract). I think the default configuration should be in the name of
security, and sshd should not be listening on a default port with an
open rule with root login enabled.
Things have been like this since, well, forever. See discussions here:
https://bugzilla.redhat.com/show_bug.cgi?id=89216
https://bugzilla.redhat.com/show_bug.cgi?id=136289
Paul.
4:14 a.m.
On 05/19/2011 08:26 AM, Paul Howarth wrote:
On 19/05/11 01:35, dirk cummings wrote:
> On a default install of Fedora 14, and also the latest release candidate
> for 15, the user is presented with:
>
> * An iptables rule that opens port 22 to the world
> * sshd service automatically started
> * sshd_config with default option: PermitRootLogin yes
>
>
> It's like every new install comes with the keys to the castle hanging on
> outside of the door for anyone who comes knocking.
>
> I find this situation a serious oversight in light of the fact that
> Fedora obviously values security (like selinux, or how the installer
> forces a minimum password length, etc)
>
> Any experienced linux user will know to check iptables and disable
> unnecessary services, but I wouldn't expect this from a new linux user
> (exactly the people the refreshed GNOME experience is supposed to
> attract). I think the default configuration should be in the name of
> security, and sshd should not be listening on a default port with an
> open rule with root login enabled.
Things have been like this since, well, forever. See discussions here:
https://bugzilla.redhat.com/show_bug.cgi?id=89216
https://bugzilla.redhat.com/show_bug.cgi?id=136289
Note that saying that it has been like this for ever is not a valid point.
We have had incident reports here on the university network where a
novice end user both staff and students installed Fedora on their
laptop/workstation and to no surprise were instantly exposed to brute
force attacks without absolutely no idea about it heck those users did
not even know what ssh is in the first place.
There is no warning or option to disable sshd in Anaconda and the novice
end user receives no notifications about someone trying to connect to
ssh so he is absolutely clueless when that happens so even if he knows
how to react when that occurs he still has no idea if/when it's happening.
I think this only applies to install of the default dvd not the live
cd/usb images
And this is a valid concern.
JBG
8:56 a.m.
2011/5/19 "Jóhann B. Guðmundsson" <johannbg(a)gmail.com>:
On 05/19/2011 08:26 AM, Paul Howarth wrote:
> On 19/05/11 01:35, dirk cummings wrote:
>> On a default install of Fedora 14, and also the latest release candidate
>> for 15, the user is presented with:
>>
>> * An iptables rule that opens port 22 to the world
>> * sshd service automatically started
>> * sshd_config with default option: PermitRootLogin yes
>>
>>
>> It's like every new install comes with the keys to the castle hanging on
>> outside of the door for anyone who comes knocking.
>>
>> I find this situation a serious oversight in light of the fact that
>> Fedora obviously values security (like selinux, or how the installer
>> forces a minimum password length, etc)
>>
>> Any experienced linux user will know to check iptables and disable
>> unnecessary services, but I wouldn't expect this from a new linux user
>> (exactly the people the refreshed GNOME experience is supposed to
>> attract). I think the default configuration should be in the name of
>> security, and sshd should not be listening on a default port with an
>> open rule with root login enabled.
> Things have been like this since, well, forever. See discussions here:
>
> https://bugzilla.redhat.com/show_bug.cgi?id=89216
> https://bugzilla.redhat.com/show_bug.cgi?id=136289
Note that saying that it has been like this for ever is not a valid point.
We have had incident reports here on the university network where a
novice end user both staff and students installed Fedora on their
laptop/workstation and to no surprise were instantly exposed to brute
force attacks without absolutely no idea about it heck those users did
not even know what ssh is in the first place.
There is no warning or option to disable sshd in Anaconda and the novice
end user receives no notifications about someone trying to connect to
ssh so he is absolutely clueless when that happens so even if he knows
how to react when that occurs he still has no idea if/when it's happening.
This came up last year in my and a few other organizations and we
pushed back at RH for some change. We said that since the firewall
option in the kickstart has a --ssh option, if you don't put the
--ssh, it should not enable ssh. Seems fairly obvious. Unfortunately
grandfathered brokenness wins, but they did concede to the concept of
adding a --no-ssh option for disabling it. It would make sense to
expose this option inside the installer's security configuration
interface, but I don't believe that part has been done. I'd have
thought the code would be pushed into upstream Anaconda, and it may
have been, but it doesn't appear that its been documented anywhere.
https://bugzilla.redhat.com/show_bug.cgi?id=485086
https://bugzilla.redhat.com/show_bug.cgi?id=703081
https://bugzilla.redhat.com/show_bug.cgi?id=703082
-greg
8:18 a.m.
On Wed, 18 May 2011 17:35:38 -0700
dirk cummings <sexynaya2010(a)hotmail.com> wrote:
On a default install of Fedora 14, and also the latest release
candidate for 15, the user is presented with:
An iptables rule that opens port 22 to the worldsshd service
automatically startedsshd_config with default option: PermitRootLogin
yes It's like every new install comes with the keys to the castle
hanging on outside of the door for anyone who comes knocking.
I find this situation a serious oversight in light of the fact that
Fedora obviously values security (like selinux, or how the installer
forces a minimum password length, etc)
Any experienced linux user will know to check iptables and disable
unnecessary services, but I wouldn't expect this from a new linux
user (exactly the people the refreshed GNOME experience is supposed
to attract). I think the default configuration should be in the name
of security, and sshd should not be listening on a default port with
an open rule with root login enabled.
The reason for this has been headless installs. Ie, if you install via
vnc or the like, and finish the install and reboot and don't have
access to the physical console, ssh is your only way to access the
newly installed machine and setup accounts, etc.
If someone can come up with a solution that covers this case, we could
revisit this, but it's not an case thats easy to fix in any kind of
clean way. ;(
If it's brute force attacks that are the vector of concern, perhaps we
could look at a default hashlimit rule in front of the ssh. (ie, 1
attempt per minute or the like).
kevin
8:46 a.m.
On 05/19/2011 01:18 PM, Kevin Fenzi wrote:
The reason for this has been headless installs. Ie, if you install
via
vnc or the like, and finish the install and reboot and don't have
access to the physical console, ssh is your only way to access the
newly installed machine and setup accounts, etc.
If someone can come up with a solution that covers this case, we could
revisit this, but it's not an case thats easy to fix in any kind of
clean way. ;(
If it's brute force attacks that are the vector of concern, perhaps we
could look at a default hashlimit rule in front of the ssh. (ie, 1
attempt per minute or the like).
I would think admins that are doing headless install would be doing them
via PXE+Cobbler with .ks files not via the DVD
If they do they should create their own iso for that case or server sig
spin one for them since we hand out dvd to novice end users.
Anyway there came an interesting discussion out of this thread at work
on who was legally liable for any harm/financial damage that might be
caused from bad default options like this which I have now forwarded to
legal to clarify.
JBG
10:08 a.m.
* [2011-05-19 07:18:38 -0600] Kevin Fenzi wrote:
On Wed, 18 May 2011 17:35:38 -0700
dirk cummings <sexynaya2010(a)hotmail.com> wrote:
>
> On a default install of Fedora 14, and also the latest release
> candidate for 15, the user is presented with:
>
> An iptables rule that opens port 22 to the worldsshd service
> automatically startedsshd_config with default option: PermitRootLogin
> yes It's like every new install comes with the keys to the castle
> hanging on outside of the door for anyone who comes knocking.
>
> I find this situation a serious oversight in light of the fact that
> Fedora obviously values security (like selinux, or how the installer
> forces a minimum password length, etc)
>
> Any experienced linux user will know to check iptables and disable
> unnecessary services, but I wouldn't expect this from a new linux
> user (exactly the people the refreshed GNOME experience is supposed
> to attract). I think the default configuration should be in the name
> of security, and sshd should not be listening on a default port with
> an open rule with root login enabled.
The reason for this has been headless installs. Ie, if you install via
vnc or the like, and finish the install and reboot and don't have
access to the physical console, ssh is your only way to access the
newly installed machine and setup accounts, etc.
If someone can come up with a solution that covers this case, we could
revisit this, but it's not an case thats easy to fix in any kind of
clean way. ;(
If it's brute force attacks that are the vector of concern, perhaps we
could look at a default hashlimit rule in front of the ssh. (ie, 1
attempt per minute or the like).
Or simply have a page asking the user whether or not to enable ssh? I
can't recall off the top of my head, but I believe there is a screen
where you ask if you want the firewall enabled, right? Why not have a
very obvious checkbox: "[ ] Enable ssh at boot" and if the user checks
it off, set the firewall to allow ssh and turn ssh on. If the user does
_not_ check it off (aka they are sitting back and saying "what is this
ssh thing they speak of?") then have the firewall block port 22 and
chkconfig ssh off.
It's not difficult. Those who need ssh will know what it is and will
turn it on. Those who don't (probably the majority) will leave it off
and be protected.
I think that would cover all areas of concern without
unnecessary/needless rate-limiting or changing sshd_config, etc. And
it's one more UI element during install (and presumably something that
could set in a kickstart file as well as a result).
--
Vincent Danen / Red Hat Security Response Team
11:13 a.m.
Simple, almost obvious, easy to implement solution. Love it.
On Thu, May 19, 2011 at 10:08 AM, Vincent Danen <vdanen(a)redhat.com> wrote:
* [2011-05-19 07:18:38 -0600] Kevin Fenzi wrote:
>On Wed, 18 May 2011 17:35:38 -0700
>dirk cummings <sexynaya2010(a)hotmail.com> wrote:
>
>>
>> On a default install of Fedora 14, and also the latest release
>> candidate for 15, the user is presented with:
>>
>> An iptables rule that opens port 22 to the worldsshd service
>> automatically startedsshd_config with default option: PermitRootLogin
>> yes It's like every new install comes with the keys to the castle
>> hanging on outside of the door for anyone who comes knocking.
>>
>> I find this situation a serious oversight in light of the fact that
>> Fedora obviously values security (like selinux, or how the installer
>> forces a minimum password length, etc)
>>
>> Any experienced linux user will know to check iptables and disable
>> unnecessary services, but I wouldn't expect this from a new linux
>> user (exactly the people the refreshed GNOME experience is supposed
>> to attract). I think the default configuration should be in the name
>> of security, and sshd should not be listening on a default port with
>> an open rule with root login enabled.
>
>The reason for this has been headless installs. Ie, if you install via
>vnc or the like, and finish the install and reboot and don't have
>access to the physical console, ssh is your only way to access the
>newly installed machine and setup accounts, etc.
>
>If someone can come up with a solution that covers this case, we could
>revisit this, but it's not an case thats easy to fix in any kind of
>clean way. ;(
>
>If it's brute force attacks that are the vector of concern, perhaps we
>could look at a default hashlimit rule in front of the ssh. (ie, 1
>attempt per minute or the like).
Or simply have a page asking the user whether or not to enable ssh? I
can't recall off the top of my head, but I believe there is a screen
where you ask if you want the firewall enabled, right? Why not have a
very obvious checkbox: "[ ] Enable ssh at boot" and if the user checks
it off, set the firewall to allow ssh and turn ssh on. If the user does
_not_ check it off (aka they are sitting back and saying "what is this
ssh thing they speak of?") then have the firewall block port 22 and
chkconfig ssh off.
It's not difficult. Those who need ssh will know what it is and will
turn it on. Those who don't (probably the majority) will leave it off
and be protected.
I think that would cover all areas of concern without
unnecessary/needless rate-limiting or changing sshd_config, etc. And
it's one more UI element during install (and presumably something that
could set in a kickstart file as well as a result).
--
Vincent Danen / Red Hat Security Response Team
--
security mailing list
security(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/security
11:42 a.m.
On Thu, 19 May 2011 09:08:06 -0600
Vincent Danen <vdanen(a)redhat.com> wrote:
* [2011-05-19 07:18:38 -0600] Kevin Fenzi wrote:
...snip...
>If it's brute force attacks that are the vector of concern,
perhaps
>we could look at a default hashlimit rule in front of the ssh. (ie, 1
>attempt per minute or the like).
Or simply have a page asking the user whether or not to enable ssh? I
can't recall off the top of my head, but I believe there is a screen
where you ask if you want the firewall enabled, right? Why not have a
very obvious checkbox: "[ ] Enable ssh at boot" and if the user checks
it off, set the firewall to allow ssh and turn ssh on. If the user
does _not_ check it off (aka they are sitting back and saying "what
is this ssh thing they speak of?") then have the firewall block port
22 and chkconfig ssh off.
It's not difficult. Those who need ssh will know what it is and will
turn it on. Those who don't (probably the majority) will leave it off
and be protected.
I think that would cover all areas of concern without
unnecessary/needless rate-limiting or changing sshd_config, etc. And
it's one more UI element during install (and presumably something that
could set in a kickstart file as well as a result).
Sure. Feel free to suggest it/provide patches to the anaconda folks.
There may well be cases this doesn't handle, but they would know more
than I what those might be.
kevin
12:02 p.m.
+1 vote for the solution you recommended, Vincent.
----- Original Message ----
From: Vincent Danen <vdanen(a)redhat.com>
To: Kevin Fenzi <kevin(a)scrye.com>
Cc: security(a)lists.fedoraproject.org
Sent: Thu, May 19, 2011 11:08:06 AM
Subject: Re: Default Fedora installation suffers from egregious configuration
flaw
* [2011-05-19 07:18:38 -0600] Kevin Fenzi wrote:
>On Wed, 18 May 2011 17:35:38 -0700
>dirk cummings <sexynaya2010(a)hotmail.com> wrote:
>
>>
>> On a default install of Fedora 14, and also the latest release
>> candidate for 15, the user is presented with:
>>
>> An iptables rule that opens port 22 to the worldsshd service
>> automatically startedsshd_config with default option: PermitRootLogin
>> yes It's like every new install comes with the keys to the castle
>> hanging on outside of the door for anyone who comes knocking.
>>
>> I find this situation a serious oversight in light of the fact that
>> Fedora obviously values security (like selinux, or how the installer
>> forces a minimum password length, etc)
>>
>> Any experienced linux user will know to check iptables and disable
>> unnecessary services, but I wouldn't expect this from a new linux
>> user (exactly the people the refreshed GNOME experience is supposed
>> to attract). I think the default configuration should be in the name
>> of security, and sshd should not be listening on a default port with
>> an open rule with root login enabled.
>
>The reason for this has been headless installs. Ie, if you install via
>vnc or the like, and finish the install and reboot and don't have
>access to the physical console, ssh is your only way to access the
>newly installed machine and setup accounts, etc.
>
>If someone can come up with a solution that covers this case, we could
>revisit this, but it's not an case thats easy to fix in any kind of
>clean way. ;(
>
>If it's brute force attacks that are the vector of concern, perhaps we
>could look at a default hashlimit rule in front of the ssh. (ie, 1
>attempt per minute or the like).
Or simply have a page asking the user whether or not to enable ssh? I
can't recall off the top of my head, but I believe there is a screen
where you ask if you want the firewall enabled, right? Why not have a
very obvious checkbox: "[ ] Enable ssh at boot" and if the user checks
it off, set the firewall to allow ssh and turn ssh on. If the user does
_not_ check it off (aka they are sitting back and saying "what is this
ssh thing they speak of?") then have the firewall block port 22 and
chkconfig ssh off.
It's not difficult. Those who need ssh will know what it is and will
turn it on. Those who don't (probably the majority) will leave it off
and be protected.
I think that would cover all areas of concern without
unnecessary/needless rate-limiting or changing sshd_config, etc. And
it's one more UI element during install (and presumably something that
could set in a kickstart file as well as a result).
--
Vincent Danen / Red Hat Security Response Team
--
security mailing list
security(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/security
12:40 p.m.
New subject: Default Fedora installation suffers from egregious configuration flaw
Or simply have a page asking the user whether or not to enable ssh?
I
can't recall off the top of my head, but I believe there is a
screen
where you ask if you want the firewall enabled, right?
Why not
have a
very obvious checkbox: "[ ] Enable ssh at
boot" and
if the user checks
it off, set the firewall to
allow ssh and turn ssh on. If the
user does
_not_ check it off
(aka they are sitting back and saying
"what is this
ssh
thing they speak of?") then have the firewall block
port 22 and
chkconfig ssh off.
Isn't that only part of the
solution? Why would we ever need to have PermitRootLogin to
true? My memory is a little rusty but I'm pretty sure the install
forces the creation of a user account.
I've never done a
headless install so I know nothing about how that works. However, we
shouldn't let a minority of installations compromise the security of the
majority. As someone has already pointed out, can't they have a
different spin to allow whatever they might need?
Are there any
other services that are listening by default and allowed through the
firewall? I believe there should be none of either. However, I
have been called paranoid in the past. :)
---
Will
Y>
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
12:49 p.m.
New subject: Default Fedora installation suffers from egregious configuration flaw
On Thu, 19 May 2011 13:40:47 -0400
aragonx(a)dcsnow.com wrote:
Isn't that only part of the
solution? Why would we ever need to have PermitRootLogin to
true? My memory is a little rusty but I'm pretty sure the install
forces the creation of a user account.
No, it does at firstboot.
If you install a headless machine, you have no way to make a user
without logging in as root and making one.
I've never done a
headless install so I know nothing about how that works. However, we
shouldn't let a minority of installations compromise the security of
the majority. As someone has already pointed out, can't they have a
different spin to allow whatever they might need?
I think there are solutions to this, but they should be worked with the
anaconda folks, rather than here. ;)
Are there any
other services that are listening by default and allowed through the
firewall? I believe there should be none of either. However, I
have been called paranoid in the past. :)
Nope. Not on a default install anymore I don't think...
kevin
12:59 p.m.
The default Fedora 14 includes a rule to except all multicast dns:
ACCEPT udp -- 0.0.0.0/0 224.0.0.251 state NEW
udp dpt:5353
-Joe
On Thu, May 19, 2011 at 1:49 PM, Kevin Fenzi <kevin(a)scrye.com> wrote:
On Thu, 19 May 2011 13:40:47 -0400
aragonx(a)dcsnow.com wrote:
> Isn't that only part of the
> solution? Why would we ever need to have PermitRootLogin to
> true? My memory is a little rusty but I'm pretty sure the install
> forces the creation of a user account.
No, it does at firstboot.
If you install a headless machine, you have no way to make a user
without logging in as root and making one.
> I've never done a
> headless install so I know nothing about how that works. However, we
> shouldn't let a minority of installations compromise the security of
> the majority. As someone has already pointed out, can't they have a
> different spin to allow whatever they might need?
I think there are solutions to this, but they should be worked with the
anaconda folks, rather than here. ;)
> Are there any
> other services that are listening by default and allowed through the
> firewall? I believe there should be none of either. However, I
> have been called paranoid in the past. :)
Nope. Not on a default install anymore I don't think...
kevin
--
security mailing list
security(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/security
8:27 p.m.
Ya but everyone has to physically pop the dvd or usb drive into their computer and start
anaconda right? So surely they can just "useradd whoever" from the command line
or start sshd on their own when it comes to that. It doesn't make sense to me to have
a widely agreed upon unsafe sshd setting on by default just to accommodate the convenience
of a likely minority amount of users installing a headless server... especially
considering those advanced users are best able to start sshd on their own and configure
the firewall etc for their needs. At least when logging into gnome for the first time
they could popup a message saying "by the way you should probably change your
firewall unless you want to be hacked", if they really want to keep that option
Date: Thu, 19 May 2011 11:49:02 -0600
From: kevin(a)scrye.com
To: aragonx(a)dcsnow.com
Subject: Re: Default Fedora installation suffers from egregious configuration flaw
CC: security(a)lists.fedoraproject.org
On Thu, 19 May 2011 13:40:47 -0400
aragonx(a)dcsnow.com wrote:
Isn't that only part of the
solution? Why would we ever need to have PermitRootLogin to
true? My memory is a little rusty but I'm pretty sure the install
forces the creation of a user account.
No, it does at firstboot.
If you install a headless machine, you have no way to make a user
without logging in as root and making one.
I've never done a
headless install so I know nothing about how that works. However, we
shouldn't let a minority of installations compromise the security of
the majority. As someone has already pointed out, can't they have a
different spin to allow whatever they might need?
I think there are solutions to this, but they should be worked with the
anaconda folks, rather than here. ;)
Are there any
other services that are listening by default and allowed through the
firewall? I believe there should be none of either. However, I
have been called paranoid in the past. :)
Nope. Not on a default install anymore I don't think...
kevin
--
security mailing list
security(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/security
4716
days inactive
4719
days old
security@lists.fedoraproject.org
13 comments
10 participants
participants (10)
-
dirk cummings -
Ed Spoon - CSS, Inc. -
Greg Swift -
Joe McManus -
Joe Wulf -
Jóhann B. Guðmundsson -
Kevin Fenzi -
Paul Howarth -
Vincent Danen -
Will Yonker