Securing a webapp - Am I missing something?

Recently in an interview I was asked an open ended question "How do you secure a web app". I think this is fairly simple, and because it was an interview I kept it somewhat brief skimming a lot of detail. However it seemed to me that they wanted more then what I was giving. Not so much that they wanted more details but that they were looking for me to touch on some point I missed. In the interest of expanding my skills, let me give you a list of what I covered, and you can tell me what I am missing.

I. Secure the server

A. Make sure your using a secure OS - Personally I am a RedHat Enterprise Linux Fan

B. Secure the Server

i. Install Tripwire

ii. Monitor Everything

iii. Use a firewall

iv. Eliminate unused services

v. Run all services as non-privileged users

vi. Use SELinux

vii. Restrict file permissions

1. Particularly on things like the uploadable content directory!

2. Use ACL's not standard linux permissions

II. Secure the aplication service (I like Apache/Tomcat)

A. Clean your configs

i. Do not load modules you don't use - see services above

ii. Turn off indexing services (directory browsing)

iii. If you can turn off SSI (Server Side Includes)

iv. If you can turn off follow symlinks

v. If you can turn off old school CGI execution

- Get the point if you don't use it turn it off

vi. When in doubt

Order Deny, Allow

Deny from All

vii. Use mod_security when possible

viii. Use SSL whenever possible (Always) and use mod rewrite to direct users to the secure site.

ix. Turn off listening on ports you don't use (80) - and firewall them too.

x. Do not use .htaccess files

1. If you must use .htaccess files for distributed administration read them in to the appropriate conf.d config as an include.

xi. Cut the default time out in half (or more) to reduce DoS effectiveness.

xii. Eliminate unsolicited information

1. Set server signature to off

2. Set server tokens to prod

B. Actually look at your logs - that is what logwatch is all about

C. Create custom error files - Indeed this is as much a security thing as it is a branding thing. Standard pages are just cheep, like your company does not take the effort or even care about your experience and any issues you may be having.

D. If you can try out mod evasion, or if you only server a specific geographic region, try mod geoip to server specific content, including thank you but we have nothing for you static content. - OK I may have forgotten to mention this one in the interview.

E. Eliminate cross site scripting (xss and csrf are handled similarly)

III. Secure the application level

A. PHP

i. If possible set globles to off (I think is the php.ini line is reisterglobles) - there is (usually) no need for this and end users should not be able to set your variables!

ii. Initialize your variables - see above

iii. Set safe mode to on

iv. Set disclosure to off (expose_php I think)

v. Set display errors to off

vi. Turn on log errors (this may be the default already)

vii. Turn off or restrict administration pages

B. Tomcat - This is just a repeat of securing Apache

i. Run as a restricted user

ii. Make sure your tomcat user (and group) own the catalina_home directory.

iii. Don't allow access to contexts you don't use

iv. Don't serve directory indexs

v. Don't tell people what kind of application server your running - let alone the version!

vi. Use custom error pages

vii. Use ssl

viii. Log and read those logs

ix. Don't allow communication to anything but YOUR webservers

IV. Secure the database - There are so many DB's I am not going to go into to detail but

A. Use good passwords

B. Use restricted users

C. Make sure those users can only connect from YOUR app servers

i. And restrict who can see this server at all!! If it is closed to everyone not on your DB server VPN then you are less likely to have to deal with a direct attack!)

V. Secure the application

A. When possible use separate restricted DB users for each task. If you need to insert then do so with a user that can only insert, same with update, delete, and query.

B. Clean user inputs and guard against SQL injections.

C. Don't let users see your errors! - Capture errors and report them!

D. And don't write inherently insecure applications

Summery

- Close your ports

o Protect your system against EVERYONE and then open some ports for some peoplE. The front end web servers need to be a bit more flexible on port 443.

- Turn off stuff you don't use

- Restrict permissions

o And use ACL's there is no need for a top level directory to be more permissive then a bottom level directory or to be limited to just one user/group

- Don't let your users see anything behind the Curtain - obfuscate everything your can.

- Check your logs

o Use monitoring applications

- Update and patch

So oh great community of mine - what am I missing?

My geek joy for the day - Using public records for on the fly identity check

Those of you who know me already understand my record keeping paradox. At the office I am freak for record keeping. Truth is it almost borders on a nazi-esk insanity. However, at home I am much more.. well.. lax. Somewhere in my garage is an unmarked folder in an unmarked box that contains my birth certificate, a spare driver’s license, and my social security card. The problem is that I can not find these things and, I am hoping, that at some point here I will get a job and need to use such papers to prove my identity.

To this end I decided to get a copy of my birth certificate (At a cost of $50.00 BTW) so I can get a copy of my social security card (Which also requires I get a copy of my drivers license since I need to have one in my pocket and send one to the SS office, who insists on having an original mailed to them.) But this is all mundane personal life bookkeeping that no one, not even me, finds particularly interesting. So why am I blogging? Well at check out the service state uses to provide copies of your birth certificate, VitalChek, asked my four interesting questions.

In addition to the standard, what is your name, birthdates, social security number, father’s full name, mothers full maiden name, place you were born, etc. I received four security questions that were rather interesting.

• Which of the following cities have you PREVIOUSLY OR CURRENTLY used as your address?
• In what county do you currently live?
• Which of the following people have resided with you or used the same address as you?
• Which of the following streets have you PREVIOUSLY OR CURRENTLY used as your address?

Supposedly the questions are random and each has a dropdown box for multiple choice answers. The last one actually had two correct answers from two different states in the pool. My initial reaction was “Wow that is cool!” and then it went to “This is all public record information that is not difficult to obtain.” Which lead me back to my first reaction as I realized that this service takes the information you entered, name, birthdate, shipping address, etc. and pulls the “security” information from other public databases on the net. Being a data freak who believes in the liberal use of public API’s and automation I thought that was way fun and easily represented several weeks of work to find the systems with the info, figure out their api’s and then hunt down the information, and generate questions and answers from that information on the fly! Then again, they could also just take a part of my $15 fee and subscribe to a central information clearing hose, but that is not nearly as much fun.

For a bit of a thrill check out
http://govsearchrecords.com/
http://www.searchsystems.net/
https://www.knowx.com/

I just read the “Does the Distro Matter” post and immediately felt compelled to relay some of my experiences, not with distributions, but with recruiters. What is the deal with these people? Does it matter if a company is looking for experience with RHEL5 and you have experience with CentOS5? No! From a technical point of view they are almost identical! I would personally say that if you have 5-10 years experience with almost any distribution you should be able to move into a new one easily. But core skills do not matter to recruiters, only how well you match the buzz words. I helped a friend install a distributed MySQl environment for a small company once, but since it was not my company it apparently does not count as real experience. I may be a Java programmer with experience with several IDE’s but since Microsoft Visual Studio’s is not one of them it is the same as if I answered “What’s Java?” Why is this? What is wrong with these people?

I blame three things:

1) The recruiters, or even the companies central HR, are not in the field and thus do not understand the buzz words on their sheet. Most of them would not know the difference between one distribution of Linux and another. They also would not understand KRB/AD cross platform integration if it hit them in the face. They only know what is on the list in front of them. To them the difference between FC10 and FC11 may as well be the difference between speaking Bask and Thai. The people who would understand never get to see your resume.

2) The people who are looking for employees are too specific – mostly due to the fact the screeners don’t know anything. Do you ask for some one who understands the differences between Exchange Server 2003 and Server 2003 with Exchange? No, but they will ask for some one with RHEL5 (Even if they are using CentOS5) because that is what they are using. They could just ask for 15 years Linux experience but they don’t. In addition it would seem most people write the job requests so specific that only an internal candidate could possibly fill them. For example “Must have 5 years experience with Joseph ERP” Is not valid when Joseph ERP has less then 2000 outstanding user licenses across the globe and has only produced a commercial product for the last 6 years! Just because they guy your replacing had 5 years experience with it does not mean you need to be looking for some one with the exact same experience. Some times this is done so they can higher the internal candidate they had in mind before HR told them they had to post the job publicly, or sometimes this is done so they can decline any candidate they don’t feel is a good personal fit without filling out a ton of paperwork with HR, and sometimes it is because the person writing the job description was not thinking; i.e. the Joseph ERP example above.

3) The current applicant pool is so great they can get away with it. When I am loosing out to people with masters degrees, $100K worth of certifications, and 15 years experience, for a $20/hour job on a 3 Mo. contract you know there is a problem. That is too much experience for that job. On the other hand, if you have reached upper management, you have been apparently poisoned from playing in the field. No on wants to higher a former Director to manage their system migrations, so I should be grateful that they have the good sense to realize the over qualified person is a barging and buy. But this does mean that almost no mater how strict you write your requirements and how literal the recruiters follow them, eventually you will find a person who fits your requirements, or at least lies well enough to get in the door.

As an abstract complain, why do they ask what other jobs you have applied for and then disparage where you have applied? And why would they say they know some one at company X but when it is not the person you know at company X they believe you are lying about knowing any one at company X? And finally you do not have the technical experience to understand what I am telling you so why are you interrogating me regarding my technical experience. When I say that I believe DR is dead because of the reduced cost of CDP w/ FO why do you conclude I have no DR experience? I have many other complaints but I think most of them have been covered in prior posts.

Host Identity Protocol

This is going to be an uncherictersticaly short post; however I am woundering what is up with the Host Identity Protocol? For those who do not know the HIP allows for the implemntation of the HIT or Host Identity Tag. This is designed to solve the issue of moblie people losing thier sessions and streams when moving between networks. The assumption is that all, or atleast the majority, of services identify a client based upon there IP address. Acording to the abstract this will also make setting up servers behind NAT fierwalls easyer and increase security by uniqly identifying each host similer to an ssh finger print.

However I have three questins that leasd me to ask why this is a real projects:

1) Session ID's - When an application server needs to indentify a client they issue a session id to the client. For example when you hit my tomcat server and start a particuler session I don't care what network the client is on or what physical server the client may be hitting, I need to identify the client for the life of his session. Session ID's are already in place - so what what portion of session ID's fails so badly that it needs to be replaced with an entierly seporate project?

2) Existing Identifyers - Why not use existing identifiers such as the MAC address of the clients network interface? While it is true that ones IP can change all to frequently during the cource of a normal mobile operation, the MAC does not.

3a) Security Vs. Privacy - The answer to the above question leads to my final concern. Mac addresses can change when one user changes network interfaces. However the protocol sugested, as I understand it, sits between the Addressing and Transport layers. This is tradtionaly tied to a network interface thus changing interfaces would also change your HIT. The other one would be that MAC addresses can be esaly changed and this breaks it from being a consistant and secure identifyer. But HIP suffers from this as well.

3b) Security Vs. Privacy - There was a way to solve this security issue introduced back in the 90's; it was called CPU ID. This was a hardware based ID that was easy for all applications to read but very difficult to change or mask. The problem soon became that everyone screamed PRIVACY! It turns out people do not want to be uniquely identified with all of there activities on line at all times. As such manufactures quickly included the option to volunteerly turn off CPUID, and that was so popular it started to come turned off by default. This, of course, made it a completely invalid identifier.

So, unless you planning on replacing an entirely server side expiration based session ID I do not see how this will work. However, at the same time, I can not see why you want to replace session ID's. This leaves me to ask - Why is this a real project?

This is an actually question I am hoping some one can answer so please feel free to comment to this via the blog comments, or like most of you do, via twitter or facebook.

Open Source PDF Printing in Windows

Configuring broad application PDF and TIFF printing using Ghost Script and Red Mon port redirection.

If you have ever wanted to produce PDFs without having to pay for Adobes PDF writer please read on. If you have no need to create pdfs for free, then this is not the article for you.

Setting up Ghost Script
Down load the latest version of ghost script.

• Download from http://www.cs.wisc.edu/~ghost/
• (AFPL is the Always Free Version, and the GPL is the OK for commercial version, other wise they are nearly identical.)

Install into C:\gs

• Run the installer and accept all the defaults except the location. Change that to C:\gs. At this time there are still some issues with directory names that include spaces.

Setting up RedMon port redirection Download and install the latest version of RedMon

• Download from http://www.cs.wisc.edu/~ghost/redmon/index.htm
• Expand the zip file and copy into C:\gstool
• Run installer

Setting up printer

Since ghost script is a command line tool that uses it’s own environment, each printer will either be used at the ghost script command prompt, or via a pre written script. Obviously a script is better. We then must configure the port redirector to use this script

Printer Script

A script is just a test file that contains the required commands and settings. We will be creating one called “tif.rsp” and we will be placing it in the C:\gstools directory.

1. Create a text file
2. Cut and past the following lines.

-Ic:\gs\gs8.54\lib;c:\gs\fonts

-sDEVICE=tiffg4

-sOutputFile=c:\print.tif

-dNOPAUSE

-dSAFER

-dBATCH

-r600

-sPAPERSIZE=a4

3. Save this as tif.rsp
4. Copy tif.rsp to C:\gstools

Script items explained

If you want to change some of the variables inorder to make more printers that do difrent things, here is a list of each and wht they do.

• -Ic:\gs\gs8.64\lib;c:\gs\fonts: Tells they system were to find Ghost Script and its fonts. It is highly likely you will need to change the version number to match your particular set up.
• -sDEVICE=Device Name: Instruct GS to use a particular virtual encoder. Some acceptable encoders are

jpeg (several additional options are required to control quality with JPEG)

pdfwrite (sounds like this prints pdf’s to me)

tiffg4 (four bit black and white)

tiffgray (eight bit grey scale))

tiff12nc (12 bit RGB color)

tiff24nc (24 bit RGB color)

tiff32nc (32 bit CMYK color)

tiffsep (Creates one 32bit CMYK and a 8 bit grey for each separation)

There are also devices for fax, BMP, PCX, Photoshop PSD, Adobe PDF, PS, EPS, PXL, and many more.

• -sOutputFile=Directory\file.ext: This is where you want the output file to be placed and what you want it to be called.
• -r#: This is the resolution in DPI. If nothing is selected 75dpi is the default.
• -sPAPERSIZE=ISO Standard Size: This is the default paper size. A small list of sizes can be faund at, http://www.cs.wisc.edu/~ghost/doc/cvs/Use.htm#Known_paper_sizes

Create a virtual printer

1. Go to Printers and Faxes (Off of the start menu or in the control panel)
2. Add a printer
3. Choose Local
4. Set the port to RPT1 (created by the RedMon installer.)
• If this port does not exist, add it.
• Select the Create a New Port option and choose Redirected Port.
• Name it RPT1: -or- RPT2:, or RPT3:, etc.
5. Choose the Generic manufacturer and MS Publishing Imagesetter for the type.
6. Open the printer just created
7. Go to properties
8. Go to the Ports Tab
9. Set the configuration options for the port to:
10. Redirect this port to the program: C:\gs\gs8.xx\bin\gswin32c.exe (obviously you will need to change these to your particular location for each)
11. Arguments for this program are: @c:\gstools\tif.rsp -

(See window snapshot below for example) Pay attention that there is a hyphen at the end of the Arguments for this program field.

Prompt for filename

When output is set to Prompt for filename, the redirection program should write its output to a file. The name of the file is obtained from a Save as dialog, can be obtained by inserting %1 in the program arguments. If you wish to place %1 in the program arguments and do not want it substituted with the filename, you must instead use %%1.

For example, the program arguments might include:

 -sOutputFile="%1"

This method is recommended for use with Ghostscript, and is commonly used with a PostScript printer driver and the Ghostscript pdfwrite device to create a PDF writer.

Do not share a printer which uses RedMon with Prompt for filename. RedMon will not allow this because the Save as dialog box would appear on the server computer, not the client which submitted the print job.

Fine Tuning

After you install the printer, you may want to fine-tune its properties. To do so, open again the Printers setting folder, and right click on the printer; select `Properties`.

1. Under `Device Settings`, set very low values (e.g. 5) to the following two parameters:
1. Minimum font size to download as outline
2. Maximum font size to download as bitmap
2. Next, go to the `Advanced` tab, and from there, select `Printing Defaults…`. In the window that opens, select `Document options`, then `Postscript options`. Set the following two options:
1. PostScript Output Option: Optimize for Portability
2. TrueType Font Download Option: Outline

For large format color printing: I recommend using the Xerox Document Center CS50 PS. Just make sure you tell the driver the paper sizes you want to use are loaded. To do this just go back to the properties window, click on the Device Settings Tab and under the Tray Assignment menu select a few paper sizes. Personally I believe, in addition to Letter, Legal and Tabloid are musts.

Appendix: We pages to know for this application set:

http://www.cs.biu.ac.il/~herzbea/makeP.htm#_Creating_PDF_using_Windows_Office_A

http://www.cs.wisc.edu/~ghost/doc/cvs/Devices.htm

http://server3.nethost.co.il/set_tif.html

http://www.noliturbare.com/

http://server3.nethost.co.il/set_tif.html

http://www.cs.wisc.edu/~ghost/doc/cvs/Use.htm#Known_paper_sizes

Installing VMServer 2 on Ubuntu 9.04

I just installed VMServer 2 on Ubuntu 9.04, and like most linux VM installs, there is a trick. Below you will find the cheet sheet version in a hope that it saves some of you some time when you go to install VMServer 2 on your Ubuntu machine. I make the assumption that you have installed things before, and maybe used VM ware in the past, but if that is not the case and you would like a more detailed guide just let me know.

0) Prep the system
Find out what kernel your running with uname -r
Install the headers with sudo apt-get install linux-headers-`uname -r` build-essential xinetd where uname is the name of your kernel.

1) Get VMWare server. http://www.vmware.com/products/server/

2) Sign up or login & don't forget to make note of your serial number

3) Download the Linux tar file, not the rpm

4) Expand the tar file
tar xvfz VMare-server-*.tar.gz

5) cd into the folder

6) Fix the installer (Otherwise you will have trouble compiling vsock)
Either - install the patch
get the patch (created by delgurth @ http://blog.delgurth.com) from http://ubuntuforums.org/attachment.php?attachmentid=94477&d=1227872015

• If you have not done the install (and assuming your still inside the expanded VMServer install folder)

patch bin/vmware-config.pl /path/to/vmware-config.pl.patch

• If you have already installed

sudo patch /usr/bin/vmware-config.pl /path/to/vmware-config.pl.patch

Or - Fix it manually (Finish install first)
tar xvf /usr/lib/vmware/modules/source/vsock.tar
cd vsock-only
sed -i 's/^\#include //' autoconf/*.c
include
make
sudo cp vsock.o /lib/modules/$(uname -r)/misc
sudo ln -s vsock.o /lib/modules/$(uname -r)/misc/vsock.ko
sudo depmod -a
sudo /etc/init.d/vmware restart

7) Install / reconfigure

• If you have not installed

sudo ./vmware-install.pl

• If you have already installed but skipped the vsock install,

sudo /usr/bin/vmware-config.pl

8) Preparing a user
During the configuration, when prompted for the admin user you can enter your user name, or, if you accepted the default, your can use root

• If your using root you will need to set a root password, since by default root on ubuntu is locked without a password (make it very strong)

sudo passwd root

9) Fixing permissions
Login by opining a web browser and going to https://server:8333
Enter root, or if you set the admin, the admins user name
Enter your password
Go to Permissions
Click on New Permission
Enter your user name
Choose the Admin role
Remove root, if root was set as the default admin user

RSync and SSH Keys - A Presentation on backups

Recently I did a presentation on RSync and RSnapshot focusing on using it for backups. You can down load the presentation from http://www.theonealandassociates.com/files/rsyncPortable.zip or if you do not have Open Office yet (a free and powerful Office suite comparable and compatible with MS Office and Word Perfect) or another application that can handle the ultra efficient open document formats, you can get the power point version (at twice the total download size) at http://www.theonealandassociates.com/files/rsyncPortable1_with_ppt.zip
The presentation is narrated and is easy to follow, but for you looking for the cliff's note version

1. You do not need to set up an rsync server to use rsync. The server function handles file browsing and other functions and set up is not required for transfers.
2. If your going to automate your backups going from one computer to another, you should implement some basic security. Moving your files over SSH for example is easy, but you need to set up a pair of ssh keys so that you don't have to enter a password to shh from one server to another. Simply perform the flowing commands from the production server (now known as Server A) and just use remote execution to perform your work on the backup server (hence forth know as Server B)
2.i) backupuser@ServerA:~> ssh-keygen -t rsa

a) Do not enter a passphrase (just hit enter)

2.ii) backupuser@ServerA:~> ssh backupuser@ServerB mkdir -p .ssh

a) This creates an ssh directory for the backup user on server B

2.iii) backupuser@ServerA:~> cat .ssh/id_rsa.pub | ssh b@B 'cat >> .ssh/authorized_keys'

a) This moves the contents of your public key to the remote servers authorized keys file
b) You can just as esaly open a second terminal window, log into server B, vi the .ssh/authorized keys file, and cut and past from the vi window of your .ssh/id_rsa.pub file on server A

2.iv) backupuser@ServerA:~> ssh b@B chmod 0700 .ssh/
2.v) backupuser@ServerA:~> ssh b@B chmod 0600 .ssh/authorized_keys

a)If you don't restrict the permission SSH will ignore the file by default and the whole thing will fail to function.

3. Set up an automates script containing a command like
3.i) rsync -a -r -v -t -z --stats --progress -e ssh /dir/for/destination/files/ backupuser@ServerB.MyDomain.com:/dir/for/source/files/
3.ii) there are more detailed instructions for windows and Linux inside the presentation.

You can verify the whole thing is working, and trouble shoot problems, by ssh'ing witht he verbose option -vvv and looking at the recipiants logs /var/log/secure

backupuser@ServerA:~> ssh -vvv b@B

b@B sudo -tail -f /var/log/secure

Your basically done. Though the presentation fills a nice half hour time slot and provides more detail; as such I highly recommend downloading it from the links at the top of the post ;)