Penetration Test Report (RadicallyOpenSecurity): 2018 ConfigTest ASL19 proxy services v1.0

Confidential
PENETRATION TEST REPORT
for
ASL19
V1.0
Amsterdam
June 6th, 2018
1/27 Radically Open Security B.V. - Chamber of Commerce 60628081
Confidential
Document Properties
Client ASL19
Title PENETRATION TEST REPORT
Targets ASL19 Twitter Proxy
ASL19 Telegram Proxy
ASL19 HAProxy
Version 1.0
Pentesters Marcus Bointon, Stefan Grönke
Author Marcus Bointon
Reviewed by Marcus Bointon
Approved by Melanie Rieback
Version control
Version Date Author Description
0.1 April 20th, 2018 Marcus Bointon Initial draft
0.2 June 5th, 2018 Marcus Bointon Main report
1.0 June 6th, 2018 Marcus Bointon Final version
Contact
For more information about this Document and its contents please contact Radically Open Security B.V.
Name Melanie Rieback
Address Overdiemerweg 28
1111 PP Diemen
The Netherlands
Phone +31 (0)20 2621 255
Email info@radicallyopensecurity.com
2/27 Radically Open Security B.V. - Chamber of Commerce 60628081
Confidential
Table of Contents
1 Executive Summary ................................................................................................................................... 4
1.1 Introduction .............................................................................................................................................. 4
1.2 Scope of work ......................................................................................................................................... 4
1.3 Project objectives .................................................................................................................................... 4
1.4 Timeline ................................................................................................................................................... 4
1.5 Results In A Nutshell .............................................................................................................................. 4
1.6 Summary of Findings .............................................................................................................................. 5
1.6.1 Findings by Threat Level ..................................................................................................................... 6
1.6.2 Findings by Type .................................................................................................................................. 6
1.7 Summary of Recommendations .............................................................................................................. 6
2 Methodology ............................................................................................................................................... 8
2.1 Planning .................................................................................................................................................. 8
2.2 Risk Classification ................................................................................................................................... 8
3 Reconnaissance and Fingerprinting .......................................................................................................... 9
3.1 Automated Scans .................................................................................................................................... 9
4 Pentest Technical Summary ...................................................................................................................... 9
4.1 Findings ................................................................................................................................................... 9
4.1.1 ASL-001 — Older HAProxy major version in use ............................................................................... 9
4.1.2 ASL-002 — Outdated Version of Haproxy Installed ............................................................................ 10
4.1.3 ASL-003 — HAProxy Stats Interface Does Not Use Encryption ......................................................... 11
4.1.4 ASL-004 — It's Possible for the Stats Service to Be Starved of Connections ..................................... 11
4.1.5 ASL-005 — Use Realistic Maxconn Values ......................................................................................... 12
4.1.6 ASL-006 — Amend Sysctl Values to Support Limits Set in HAProxy Config ...................................... 13
4.1.7 ASL-007 — Chroot Permissions Not Set as Recommended .............................................................. 14
4.1.8 ASL-008 — Stats Service Has Unnecessary Privileges ...................................................................... 15
4.1.9 ASL-009 — Excess Firewall Rules, Too Many Open Ports ................................................................. 16
4.1.10 ASL-010 — Dante - Destination Address Logging ............................................................................ 17
4.1.11 ASL-011 — Squid - User Password .................................................................................................. 19
4.1.12 ASL-012 — Squid - Caching Enabled ............................................................................................... 19
4.1.13 ASL-013 — Dante - Ubuntu Has No Auto-updates Enabled ............................................................. 20
4.1.14 ASL-014 — Dante - IP Logging Enabled .......................................................................................... 21
4.1.15 ASL-015 — Squid - IP Logging Enabled ........................................................................................... 21
4.1.16 ASL-016 — HAProxy - IP Logging Enabled ...................................................................................... 22
4.2 Non-Findings ........................................................................................................................................... 23
4.2.1 NF-001 — Duplicate fail2ban ssh config ............................................................................................. 23
4.2.2 NF-002 — HTTPS Config Not Hardened ............................................................................................ 24
4.2.3 NF-003 — Unclear why the HAProxy stats interface is not global ...................................................... 24
4.2.4 NF-004 — Dante - Debugging Disabled .............................................................................................. 24
4.2.5 NF-005 — Dante - Connection Logging .............................................................................................. 24
5 Future Work ............................................................................................................................................... 25
6 Conclusion .................................................................................................................................................. 26
Appendix 1 Testing team ............................................................................................................................. 27
3/27 Radically Open Security B.V. - Chamber of Commerce 60628081
Confidential
1 Executive Summary
1.1 Introduction
Between April 25, 2018 and May 25, 2018, Radically Open Security B.V. carried out a penetration test for
ASL19
This report contains our findings as well as detailed explanations of exactly how ROS performed the
penetration test.
1.2 Scope of work
The scope of the penetration test was limited to the following target:
• ASL19 Twitter Proxy
• ASL19 Telegram Proxy
• ASL19 HAProxy
1.3 Project objectives
Evaluate and test the configuration of HAProxy, Dante, and Squid proxy services (used for proxying Telegram,
Twitter and TCP connections) for security, privacy, and practical concerns.
1.4 Timeline
The Security Audit took place between April 25th and May 25th, 2018.
1.5 Results In A Nutshell
A number of configuration problems were found, raising security, privacy, and practical issues.
None of the findings were especially severe. ASL19 was very responsive a