Extreme security in web servers

Extreme security in
web servers

Daniel García García a.k.a cr0hn (@ggdaniel) http://es.linkedin.com/in/garciagarciadaniel 1

Creative Commons License

The art of disguise - Anti-fingerprinting techniques
by Daniel García García a.k.a. cr0hn is licensed under a:

Creative Commons Reconocimiento-NoComercial-SinObraDerivada 3.0 Unported License.

Permissions beyond the scope of this license may be available at: dani@iniqua.com.


Acknowledgments
• Manuel Trujillo <TooManySecrets>

• Francisco Jesus Gomez Rodriguez (@ffranz)

• @capi_x <capi_x@haibane.org>

• Maikel Mayán <@AloneInTheShell>


About what is this talk?
1. Infrastructure: virtualization vs physical.

2. Choosing OS base: FreeBSD.

3. Brief intro to configuration of FreeBSD.

4. Isolating process.


1 - Infrastructure:
Virtualization vs physical


1 – Infrastructure: Virtualization vs physical

a) Virtualization advantages.

b) Virtualization’s solutions.

c) Why use server virtualization system?

d) Organizing the virtual machines: approaches.


1.a - Virtualization advantages
• Less physical space.

• Less energy costs.

• More use of resources.

• Scalability.

• Simplicity of administration.


1.b - Virtualization solutions


1.c - Why use server virtualization system?
• Scalability

• Centralized storage system.

• Hot cloning.

• Hot migrating of machines.

• Modular architecture.

• Simplicity management.


1.c - Why use server virtualization system?
Examples:

• VMWare ESXi

• Xen

• Proxmox

1.d - Organizing the virtual machines: approaches

I. One machine for all.



II. Two machines: frontend and backend.



III. Multilevel:


2 – Choosing OS base:


2 – Choosing OS base: FreeBSD

a) Why use FreeBSD?

b) Who use FreeBSD?


2.a – Why use FreeBSD?
• Simplicity of kernel.

• Simplicity of re-compile all system.

• Build-in security features.

• Isolating features, like jails.

• Administration simplicity.

• Can run Linux binaries


2.b – Who use FreeBSD?
• JunOS
• Citrix
• Nokia’s firewalls
• PlayStation 3
• Netflix
• Netcraft
• Some parts of Apple OS X
• …


3 – Configuration of system


3 – Configuration of system.

a) Adjust system binaries.

b) Configuration files.

c) Kernel and “user-land”.


3.a – Adjust system binaries


I. Install LLVM/clang
Q: Why use LLVM/clang?
A: Generate more optimized code than gcc.
See a comparison:
http://blog.buguroo.com/?tag=compilador-gcc-llvm-clang-benchmark&lang=en


II. Patch and reinstall OpenSSH
Q: Why path openSSH?
A: Patch to evade fingerprinting techniques.
See how to path it in:
http://www.slideshare.net/cr0hn/the-art-of-disguise-antifingerprinting-techniques


3.b – Configuration files.


I. /etc/src.conf


II. /etc/auth.conf


III. /etc/login.conf


IV. /etc/sysctl.conf


V. /etc/make.conf
Difficult the of
execution
exploits

Prevent
hooking


VI. /etc/rc.conf


3.c – Kernel and “user-land”


I. Update system source
• First, we need cvsup tool.

• Configure our repository config file:

• Update system source (also include kernel).


II. Configure kernel
• Configuration file:

• Adjust some basic parameters:

Only if you don’t need fat/vfat support!

III. Compile the kernel
Our kernel
configuration file

Enable LLVM static
analyzer


IIII. The “user-land”
Q: What’s “user-land”?
A: The user-land is a way to naming all basic
binaries and programs of system, like: syslog,
common commands (sed, awk, sort…), gcc,
clang…

Q: How configure the “user-land”?
A: You can customize what include the user-land
with the file: “/etc/src.conf”

IIII. Recompile the user-land
Delete old compiled objects

Make erasable all files

Enable static
optimizations of LLVM


4 – Isolating processes


4 – Isolating process
a) Concept of jail.

b) How to create basic a jail?.

c) Maintainable jail system.

d) Jail deploy: Approaches.

e) How deploy a web site using jails.


4.a – Concept of jail
Jail ≠ chroot

Jail
chroot rules Resources

Network tools


4.a – Concept of jail.

Jail: Operating system level virtualization


4.b – How to create a basic jail
Hand to work!


I. – Compilation variables
When can you use compilation variables?

• When compiling a port.

• When compiling the kernel.

• When compiling the user-land.


I. – Compilation variables
• FORCE_PKG_REGISTER: Force reinstallation, if binary
is already installed.

• PORT_DBDIR: location of database that manager
what’s binaries are installed.

• PREFIX: destination of compiled binaries.

• DESTDIR: makes a chroot to indicated path, and
install binaries in it.


II. – Create a jail
1. Creating root folder for our jail:

2. Copying common system binaries:

3. Copying system source code: Special command
that copy files,
permissions,
4. Installing port system into jail: hadlinks, softlinks,
etc

5. Copying missing system configuration files:


• Add to host /etc/rc.conf:

To allow to jail to access to outside of jail network,
each jail must have an alias and the same IP of alias.
• Manually start jail system:


• Add to jail /home/j/test_jail/etc/rc.conf:

This line allow to the jail outside connectivity


III. – Installation of programs
Installing nginx server into jail:


4.c – Maintainable Jail system


4.c – Maintainable Jail system
I. Separating roles

II. Block diagram

III. Advantages

IV. Real example: role separated web server


I. – Separating roles

Isolated
system

Shared base Shared
Skeletons
binaries programs


Q: What’s shared base binaries?
A: The user-land binaries. All jails have this in common.

Q: What’s Skeletons?
A: Collection of configuration files tuned for an specific
task. We have one skel for each role: webservers,
database servers, php, java… Also mush be called
templates

Q: What’s shared programs?
A: Any program you want to run: apache, mysql, etc


In other words… Shared base binaries

Common commands: Resulting jail. E.g. ->
ls, sed, awk, sort, an jailed apache
uniq… web server.

Custom config files:
- /etc/rc.conf Shared programs:
-/etc/make.conf Apache, mysql,
-/etc/pf.conf php…
-….

Shared programs
Skeletons

II. – Block diagram


III. – Advantages
Q: Why is maintainable jail system?
A: Because all binaries are shared between all virtual
machines and jails in a shared storage.

Q: Why use skel templates?
A: Then you can deploy new jail only copying a template.
i.e: copying skel of a web server.

Q: How can I update the system and/or any binary?
A: You only must update shared binaries folder and/or
shared binaries folder. Updates will spread to all jails.

IV. – Role separated web server
a) Create folders for each type of role

b) Create shared base binaries container

c) Create base skeleton

d) Create shared web server

e) Mount the jail

f) Start the jail


a) Create folders for each type of role
• Skeletons:

• Shared base binaries:

• Shared binaries:

• Mounted jails:
Working directory for a
concrete jail.


b) Create shared base binaries container



Move configuration and
non-shared info
to skel


Copy missing configuration files Not necessary for a template

Make relative links to
essential directories



Copy hardened configuration files, following
steps of point 3.b, at jail:
• src.conf
• auth.conf
• login.conf
• make.conf
• sysctl.conf


d) Create shared web server
1. Create directory for binary:

2. Install nginx, and all dependences, into folder:


e) Mount the jail Concrete skeleton of web server

• Create mounting folder for our web server:
Common and
shared binaries

• Like a puzzle, join roles in /etc/fstab:

• Add jail to /etc/rc.conf of host:
Shared of
web
server
binaries


f) Start the jail
And the end, we start the jail system typing:

Or, if is already started…


4.d – Jail deploys:
Approaches


4.d – Jail deploys: Approaches

a) Simple architecture I

b) Simple architecture II

c) Equilibrated architecture.

d) Complex architecture.


Deploy approaches
Maintainability Security level

a) Simple architecture II

b) Simple architecture II

c) Equilibrated architecture

d) Complex architecture:


• One machine for all services.
• Shared programs: nginx, php, MySQL,
pureFTPd…
• Separated type of storages: DB/web content.
• Isolated communications between jails.
• Isolated php runtime environment for each
web site.
• Shared web and ftp servers for all web sites.

• One machine for all services.
• Shared programs: nginx, php, MySQL, pureFTPd…
• Separated type of storages: DB/web content.
• Isolated php runtime environment for each web site.
• Shared ftp servers for all web sites.
• Isolated web server for each web site.

Like Simple architecture I


b) Equilibrated architecture


b) Equilibrated architecture
• Separated backend and frontend in two virtual
machines.
• Shared programs in network storage: nginx,
php, MySQL, pureFTPd…
web site.


c) Complex architecture


c) Complex architecture
• 3 level in 3 virtual machines: load balancer,
business layer and backend.
• Separated storage out ouf virtualization
server.
web site.
• Isolated web server for each web site.


4.d – Deploying a web site using jails
Example: Deploy the WordPress Site
www.mytestsite.com


4.d – Deploy a web site using jails
I. Select a deploy model
II. Create system binaries
III. Create binaries
IV. Create user content info
V. Create mounting folder
VI. Configure PHP
VII. Configure web server
VIII. Create PHP for site
IX. Create web server for site
X. Create FTP server
XI. Create web balancer
XII. Create MySQL server
XIII. Install WordPress
XIV. Configure jail and enable jail.


I. – Select deploy model
This example follows mentioned model:
Simple architecture II


II. – Create system binaries

System binaries folder. Shared
for all jails


III. – Create binaries
• Install php Don’t forget
compile it
without CLI
option!
(for security)

• Install mysql

• Install nginx

• Install ftp


IV. – Create user content info
Directories that will contain site info.

For future
use


V. – Create mounting folder
1. Create mount point directory:

2. Create root directories:


VI. – Configure php
• Modifying: /php/mytestsite.com/conf/php-fpm.ini


VI. – Configure php
• Modifying:
/home/js/mytestsite.com-php/usr/local/etc/php-fpm.conf


VII. – Configure web server
• Configuring: /home/j/mytestsite.com/usr/local/etc/nginx/nginx.conf


VIII. – Create PHP for site
• Create base folder and copy skeleton (or profile) for
web server

• Create mount point for each site of isolated php server.

• Create mount point web content.


VIII. – Create PHP for site

• Configuration of init script for web server jail:
/home/j/mytestsite.com-php/etc/rc.conf


IX. – Create web server for site
web server

• Create mount point for each site of isolated web server.

• Create mount point web content.


IX. – Create web server for site

/home/j/mytestsite.com-wserver/etc/rc.conf


X. – Create FTP server
• Create base folder and copy skeleton (or profile) for FTP
server

• Create mount point of FTP isolated server.

• Create mount point for web content.



• Configuration of init script for FTP server jail:
/home/j/ftpserver/etc/rc.conf



• Configuring: /home/j/ftpserver/usr/local/etc/pure-ftpd.conf

There is more configuration parameters, but this is the
most important.


XI. – Create web balancer
web balancer:

• Create mount point of web balancer isolated server.



• Configuration of init script for web balancer jail:
/home/j/webbalancer/etc/rc.conf



• Configuring: /home/j/webbalancer/usr/local/etc/nginx/nginx.conf

Redirect to web server of isolated web site.


XII. – Create MySQL server
mysql server:

• Create mount point of mysql isolated server.


XII. – Create MySQL server
/home/j/mysql/etc/rc.conf

Change listen address.


XIII. – Install WordPress
• Install WordPress from FreeBSD sources, into host
system.

This method allows us to
easily install our own
patches.

• Copy sources to our site:


XIII. – Install wordpress

• Configure our WordPress installation defining location
of MySQL.

IP of our jail
with MySQL


XIV. – Configure and enable de jail
Configure /etc/fstab.


Configure /etc/fstab (cont).


Enable jail in the system /etc/rc.conf:


Enable jail in the system /etc/rc.conf (cont):


Questions?


Extreme security in web servers

Recommandé

Recommandé

Contenu connexe

En vedette

En vedette (20)

Similaire à Extreme security in web servers

Similaire à Extreme security in web servers (20)

Plus de Daniel Garcia (a.k.a cr0hn)

Plus de Daniel Garcia (a.k.a cr0hn) (11)

Dernier

Dernier (20)

Extreme security in web servers