From: szabo_p@maths.su.oz.au (Paul Szabo)
Subject: Securing SR10.4
Keywords: security permission ACL break-in node_data
Reply-To: szabo_p@maths.su.oz.au (Paul Szabo)
Organization: Mathematics, University of Sydney
Date: Wed, 19 Aug 1992 03:50:15 GMT

Now I have installed SR10.4 on a couple of nodes. Here are some random
thoughts on security and 10.4.

One very bad security hole seems to be patched (thanks HP!); the crp problem
has also been solved satisfactorily. I urge everyone to upgrade to SR10.4.

Still, the out-of-the-box permissions on SR10.4 are an invitation for a
break-in. If you wish to improve the security of your Apollos, I have some
scripts which set sensible permissions on all system files. They are
available by anonymous ftp from maths.su.oz.au (129.78.68.2) in directory
protect, and mirror sites (notably ftp.eb.ele.tue.nl, thanks Willem Jan).

There have been problems reported with /bsd4.3/usr/lib/sendmail (maybe only
a problem of configuration files), /sys/harcopy/prmgr and prsvr, and
/bsd4.3/bin/test; I have found some problems with /sys/mbx/mbx_helper (will
die unless it can run as user.server.none). It seems that for all these you
can simply use the SR10.3 versions. In the case of prmgr/prsvr, I found that
the SR10.4 versions worked for me (maybe because I have some other prmgr's
on the network?); in fact, the SR10.3 version of my printer driver seems to
work fine with the SR10.4 prsvr. (Still, I am working on a new version.)

Below is the README file for these scripts.

Paul Szabo - System Manager   //        School of Mathematics and Statistics
szabo_p@maths.su.oz.au        //   University of Sydney, NSW 2006, Australia


---


-------------------------- DISCLAIMER - WARNING --------------------------
The use of these scripts may make your nodes more secure than what they are
at present, or they may in fact open up any number of holes or render your
system un-useable. These scripts come with no warranty of any kind. Use them
at your own risk only: YOU are responsible for what YOU run on YOUR nodes.
-------------------------- DISCLAIMER - WARNING --------------------------

HOW TO USE

Unpack the archive scripts.tar.Z, using something like
  zcat scripts.tar.Z | tar xvf -

Create the following person entries in your registry:
  d3m dial dpcc ftp netmain ns_helper prfd sbp sf_helper spm writed
and the following groups:
  d3m dial dpcc ftp netmain ns_helper prfd sbp sf_helper spm writed postman

Execute the protect_software script, using something like
  protect_software //nodename SR10.X

Copy the other files to appropriate places.

If you run netman (have any diskless nodes), then execute
  /sys/net/netman.rc template any
before running protect_software (or maybe run it again: it cannot hurt).


NOTES

protect_software will happily change ACLs on trees pointed to by links, e.g.
if you installed /domain_examples by a link
  /domain_examples -> //master_node/domain_examples
This will of course take quite a long time, besides being wasteful (as the
directory will be protected, again, when running on //master_node). We have
all such links pointing to /master instead, e.g.
  /domain_examples -> /master/domain_examples
  /bsd4.3/usr/man -> /master/bsd4.3/usr/man
where /master is a link pointing to some appropriate place. (When install++
asks for a //nodename, just enter /master.) The protect_software script will
first rename the /master link, so that none of the linked directories are
found while changing ACLs, and renames it back when finished.

These scripts work together. Maybe you can use the new /etc/rc with the
default Apollo permissions, or the original /etc/rc after protect_software,
but more likely you cannot. You need to replace /sys/net/netman.rc (this is
a link to netman_bin.sh or netman_com.sh) otherwise your protection would be
quite useless.

Do not change permissions in arbitrary ways. Opening things up may allow
seemingly unrelated attacks, while tightening things might make the node
unuseable.


REQUEST

If you can make your nodes more secure please let me know, I would love to
hear from you. On the other hand, if these scripts cause you some trouble,
just drop me a line and I will try my best to help you.


Paul Szabo - System Manager   //        School of Mathematics and Statistics
                              //   University of Sydney, NSW 2006, Australia
szabo_p@maths.su.oz.au        //        Phone (+61 2) 692-3806, FAX 692-4534

Newsgroups: comp.sys.apollo