DOCSLIB.ORG

Advanced Openbsd Hardening

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Advanced Openbsd Hardening Advanced Hardening WrongunWrongun && DCDC JuneJune 20052005 ssh://root:[email protected] Lab Challenge JoinJoin thethe wifiwifi netnet andand sshssh intointo thethe boxbox usingusing thethe accountaccount specifiedspecified inin thethe footerfooter TryTry toto pwnpwn thethe boxbox byby addingadding anan accountaccount forfor yourselfyourself oror backdooringbackdooring sshdsshd ssh://root:[email protected] “Only one remote hole in the default install, in more than 8 years! “ ssh://root:[email protected] So OpenBSD is uber secure, right? Actually,Actually, nono …… TheThe defaultdefault installinstall hashas nothingnothing enabledenabled (except(except ssh)ssh) ““NoNo wonderwonder itit ’’ss secure,secure, itit ’’ss poweredpowered off!off! ”” SourceSource --onlyonly patchingpatching strategystrategy makesmakes itit difficultdifficult toto rollroll outout fixesfixes toto platformsplatforms w/ow/o compilerscompilers (i.e.(i.e. disklessdiskless firewalls,firewalls, etc.)etc.) ssh://root:[email protected] Brief History of OpenBSD Vulnerabilities 30 March 05: Bugs in the cp(4) stack can lead to memory exhaustion or processing of TCP segments with invalid SACK optio ns and cause a system crash. 14 Dec 04: On systems running sakmpd(8) it is possible for a local user to cause kernel memory corruption and system panic by setti ng psec(4) credentials on a socket 20 Sept 04: radius authentication, as implemented by ogin_radius(8) , was not checking the shared secret used for replies sent by the radius server. This could allow an attacker to spoof a reply granting access to the attacker. Note that OpenBSD does no t ship with radius authentication enabled ssh://root:[email protected] Brief History of OpenBSD Vulnerabilities JunJun 2002:2002: ApacheApache chunkedchunked encodingencoding vulnerabilityvulnerability (remote(remote uid=nobody)uid=nobody) (Apache(Apache -- nosejob.c)nosejob.c) ** YourYour highhigh pricedpriced securitysecurity consultant'sconsultant's planeplane ticket:ticket: $1500$1500 ** YourYour highhigh pricedpriced securitysecurity consultant'sconsultant's time:time: $200/hour$200/hour ** RealSecureRealSecure nodesnodes allall overover youryour company:company: $200,000$200,000 ** GettingGetting ownedowned byby 0day:0day: PricelessPriceless Gobbles June ‘02 ssh://root:[email protected] Proactive Approach to Security Source Code Audits strlcpy() and strlcat() Privilege separation size -bounded string copying and Privilege revocation concatenation Chroot jailing Memory protection New uids New uids W^X ProPolice .rodata segment Guard pages Randomized malloc() Randomized mmap() atexit() and stdio protection ssh://root:[email protected] ProPolice ModifiesModifies GCCGCC toto catchcatch manymany stackstack overflowoverflow issuesissues atat compilationcompilation timetime ReRe --ordersorders objectsobjects onon stackstack forfor safetysafety BetterBetter thanthan StackGuardStackGuard WorksWorks onon moremore thanthan justjust i386i386 ssh://root:[email protected] W ^ X MemoryMemory pagespages shouldnshouldn ’’tt bebe bothboth writablewritable andand executableexecutable w/ow/o hardwarehardware supportsupport (i.e.(i.e. 64bit64bit IntelsIntels oror variousvarious SPARC/RiSC)SPARC/RiSC) thisthis maymay havehave seriousserious performanceperformance considerationsconsiderations ssh://root:[email protected] Randomized Memory Management Malloc() When you need to allocate less than a page Mmap() A page or greater Result: each time you perform a memory allocation, you get a different address. Note: this breaks A LOT of apps, and the Obsd team blames app developers for writing rubbish code ssh://root:[email protected] Randomized Memory Management StackGapStackGap RandomRandom 88 bytebyte alignmentalignment forfor toptop ofof stackstack RandomizeRandomize sharedshared librarylibrary orderorder MayMay breakbreak stuffstuff ifif loadingloading lotslots ofof librarieslibraries NotNot insurmountableinsurmountable forfor attacker,attacker, butbut makesmakes itit difficultdifficult enoughenough thatthat manymany wonwon ’’tt botherbother ssh://root:[email protected] Privilege Revocation ManyMany progsprogs runrun w/w/ ‘‘revokedrevoked ’’ privs:privs: Ping,Ping, portmap,portmap, traceroute,traceroute, rwalld,rwalld, pppd,pppd, spamd,spamd, httpd,httpd, named,named, authpf,authpf, etc.etc. OnceOnce processprocess kickskicks off,off, itit runsruns asas unprivilegedunprivileged user.user. AttacksAttacks againstagainst setuidsetuid binariesbinaries runningrunning w/w/ privilegeprivilege revocationrevocation wonwon ’’tt succeedsucceed (unless(unless theythey dodo priorprior toto revocation!)revocation!) ssh://root:[email protected] Privilege Separation ManyMany progsprogs runrun w/w/ ‘‘separatedseparated ’’ privs:privs: Ftpd, Sshd, syslogd, pflogd, isakmpd, bgpd, tcpdump, etc. Once process kicks off, it forks. Most work is done by larger unprivileged process. Priv ’d work is done by smaller process that retains privileges. Inter -process communication accomplished by socketpair() Non -trivial to code, however even Linux has adopted this (for sshd, and maybe some other tasks) ssh://root:[email protected] Hardening Basics KillKill ftpftp --proxyproxy KillKill identdidentd KillKill daytime,daytime, timetime Hell,Hell, justjust killkill inetdinetd ssh://root:[email protected] Hardening Basics (cont) DisableDisable rootroot loginlogin viavia sshssh DisableDisable SSHSSH protprot verver 11 pfpf (makes(makes iptablesiptables looklook likelike aa kludge)kludge) EgressEgress filteringfiltering isis aa pain,pain, butbut willwill stopstop 99%99% ofof remoteremote shellsshells PFPF AUTHAUTH cancan grantgrant outboundoutbound permsperms toto specificspecific usersusers SetupSetup offoff --boxbox logginglogging w/w/ syslogsyslog --ngng ssh://root:[email protected] Hardening Advanced Topics (chflags) sappnd set the system append -only flag (superuser only) schg set the system immutable flag (superuser only) uappnd set the user append -only flag (owner or superuser only) uchg set the user immutable flag (owner or superuser only) Best practices: Flag binaries immutable w/ Schg Flag log files append only w/ sappend Note this breaks newsyslog … deal w/ it ☺ Note system must be in single user mode to unset these flags ssh://root:[email protected] Hardening Advanced Topics (Stephanie) EnableEnable TrustedTrusted PathPath ExecutionExecution (TPE)(TPE) based on code Mike Schiffman wrote for OpenBSD 2.4) Only files owned by root are executable Only users in trusted group can execute arbitrary non -root 0wned binaries kern.security.trust_gid=666 Root can turn function on/off via sysctl kern.security.tpe=1 NoteNote daemondaemon usersusers needsneeds toto bebe addedadded toto trustedtrusted groupgroup ifif theirtheir binariesbinaries areare ownedowned byby !root!root ssh://root:[email protected] Hardening Advanced Topics (Stephanie) Enable VEXEC Integrity verification of executed programs, memory mapped objec ts, and opened files. Uses hash tables. Supports MD5, SHA1, SHA256, SHA384, SHA512, and RMD160. Creates the Vexec pseudo -device Creates a fingerprint list of binaries listed in /etc/vexec.conf (using desired hash) Turn on via sysctl kern.security.vexec.op=1 kern.security.vexec.verbose=1 kern.security.vexec.strict=0 (set this to 1 for extra fun!) ssh://root:[email protected] Hardening Advanced Topics (Stephanie) VEXEC is essentially *realtime* TRIPWIRE ssh://root:[email protected] Hardening Advanced Topics (Stephanie) EnablesEnables userlanduserland privacyprivacy FingerFinger LastLast NetstatNetstat WW WhoWho LastLast versionversion (for(for 3.6)3.6) atat http://www.innu.org/~brian/Stephanie/http://www.innu.org/~brian/Stephanie/ ssh://root:[email protected] Hardening Advanced Topics (Securelevel) TheThe OpenBSDOpenBSD kernelkernel providesprovides fourfour levelslevels ofof systemsystem security:security: --1:1: PermanentlyPermanently insecureinsecure modemode init(8)init(8) willwill notnot attemptattempt toto raiseraise thethe securelevelsecurelevel maymay onlyonly bebe setset withwith sysctl(8)sysctl(8) whilewhile thethe systemsystem isis insecureinsecure ssh://root:[email protected] Hardening Advanced Topics (Securelevel) 0:0: InsecureInsecure modemode usedused duringduring bootstrappingbootstrapping andand whilewhile thethe systemsystem isis singlesingle --useruser allall devicesdevices maymay bebe readread oror writtenwritten subjectsubject toto theirtheir permissionspermissions systemsystem filefile flagsflags maymay bebe clearedcleared ssh://root:[email protected] Hardening Advanced Topics (Securelevel) 1: Secure mode default mode when system is multi -user securelevel may no longer be lowered except by init /dev/mem and /dev/kmem may not be written to raw disk devices of mounted file systems are read -only system immutable and append -only file flags may not be removed kernel modules may not be loaded or unloaded the fs.posix.setuid sysctl variable may not be raised the net.inet.ip.sourceroute sysctl variable may not be raised ssh://root:[email protected] Hardening Advanced Topics (Securelevel) 2:2: HighlyHighly securesecure modemode all effects of securelevel 1 raw disk devices are always read -only whether mounted or not settimeofday and clock_settime may not set the time backwards or close to overflow pfctl may no longer alter filter or nat rules the ddb.console and ddb.panic sysctl variables may not be raised ssh://root:[email protected] Breaking
Load more

Recommended publications
  • OPENBSD HARDWARE SENSORS FRAMEWORK a Unified and Ready-To-Use System for Hassle-Ee Hardware Monitoring
    OPENBSD HARDWARE SENSORS FRAMEWORK A unified and ready-to-use system for hassle-ee hardware monitoring. Constantine A. Murenin and Raouf Boutaba University of Waterloo AsiaBSDCon 2009 — 12–15 March 2009 — Tokyo, Japan Abstract In this paper, we will discuss the origin, history, design guidelines, API and the device drivers of the hardware sensors framework available in OpenBSD. The framework spans multiple utilities in the base system and the ports tree, is utilised by over 70 drivers, and is considered to be a distinctive and ready-to-use feature that sets OpenBSD apart from many other operating systems, and in its root is inseparable from the OpenBSD experience. 1. Introduction Another trend that has been particularly common in the recent years is the availability of defined inter- We will start by investigating into the matter of what faces for software-based temperature readout from hardware monitoring sensors represent, how common individual components of personal computers, such as is it for them to appear in the general-purpose com- the CPU, or the add-on cards, such as those imple- puter hardware that has been available on the market menting the 802.11 wireless functionality or 10 Giga- in the last decade or so, and what benefits can we gain bit Ethernet. Popular examples include recent Intel by having a unified, simple and straightforward inter- Xeon and Core series of processors (as well as budget face for getting the data out of these sensors. models that are marketed under different brands) Although it may come as a surprise to some users, the [admtemp.4] [cpu.4]; all AMD64 processors from majority of personal computers that have been avail- AMD (Families 0Fh, 10h, 11h) [kate.4] [km.4]; Intel able on the market in the last decade have an inte- WiFi Link 4965/5100/5300 wireless network devices grated hardware monitoring circuitry whose main [iwn.4].
    [Show full text]
  • Cryptanalysis of the Random Number Generator of the Windows Operating System
    Cryptanalysis of the Random Number Generator of the Windows Operating System Leo Dorrendorf School of Engineering and Computer Science The Hebrew University of Jerusalem 91904 Jerusalem, Israel [email protected] Zvi Gutterman Benny Pinkas¤ School of Engineering and Computer Science Department of Computer Science The Hebrew University of Jerusalem University of Haifa 91904 Jerusalem, Israel 31905 Haifa, Israel [email protected] [email protected] November 4, 2007 Abstract The pseudo-random number generator (PRNG) used by the Windows operating system is the most commonly used PRNG. The pseudo-randomness of the output of this generator is crucial for the security of almost any application running in Windows. Nevertheless, its exact algorithm was never published. We examined the binary code of a distribution of Windows 2000, which is still the second most popular operating system after Windows XP. (This investigation was done without any help from Microsoft.) We reconstructed, for the ¯rst time, the algorithm used by the pseudo- random number generator (namely, the function CryptGenRandom). We analyzed the security of the algorithm and found a non-trivial attack: given the internal state of the generator, the previous state can be computed in O(223) work (this is an attack on the forward-security of the generator, an O(1) attack on backward security is trivial). The attack on forward-security demonstrates that the design of the generator is flawed, since it is well known how to prevent such attacks. We also analyzed the way in which the generator is run by the operating system, and found that it ampli¯es the e®ect of the attacks: The generator is run in user mode rather than in kernel mode, and therefore it is easy to access its state even without administrator privileges.
    [Show full text]
  • BSD Projects IV – BSD Certification • Main Features • Community • Future Directions a (Very) Brief History of BSD
    BSD Overview Jim Brown May 24, 2012 BSD Overview - 5/24/2012 - Jim Brown, ISD BSD Overview I – A Brief History of BSD III – Cool Hot Stuff • ATT UCB Partnership • Batteries Included • ATT(USL) Lawsuit • ZFS , Hammer • BSD Family Tree • pf Firewall, pfSense • BSD License • Capsicum • Virtualization Topics • Jails, Xen, etc. • Desktop PC-BSD II – The Core BSD Projects IV – BSD Certification • Main Features • Community • Future Directions A (Very) Brief History of BSD 1971 – ATT cheaply licenses Unix source code to many organizations, including UCB as educational material 1975 – Ken Thompson takes a sabbatical from ATT, brings the latest Unix source on tape to UCB his alma mater to run on a PDP 11 which UCB provided. (Industry/academic partnerships were much more common back then.) Computer Science students (notably Bill Joy and Chuck Haley) at UCB begin to make numerous improvements to Unix and make them available on tape as the “Berkeley Software Distribution” - BSD A (Very) Brief History of BSD Some notable CSRG • 1980 – Computer Science Research Group members (CSRG) forms at UCB with DARPA funding to make many more improvements to Unix - job control, autoreboot, fast filesystem, gigabit address space, Lisp, IPC, sockets, TCP/IP stack + applications, r* utils, machine independence, rewriting almost all ATT code with UCB/CSRG code, including many ports • 1991 – The Networking Release 2 tape is released on the Internet via anon FTP. A 386 port quickly follows by Bill and Lynne Jolitz. The NetBSD group is formed- the first Open Source community entirely on the Internet • 1992 – A commercial version, BSDI (sold for $995, 1-800-ITS-UNIX) draws the ire of USL/ATT.
    [Show full text]
  • IOMMU-Resistant DMA Attacks
    IOMMU-resistant DMA attacks Gil Kupfer Technion - Computer Science Department - M.Sc. Thesis MSC-2018-21 - 2018 Technion - Computer Science Department - M.Sc. Thesis MSC-2018-21 - 2018 IOMMU-resistant DMA attacks Research Thesis Submitted in partial fulfillment of the requirements for the degree of Master of Science in Computer Science Gil Kupfer Submitted to the Senate of the Technion | Israel Institute of Technology Sivan 5778 Haifa May 2018 Technion - Computer Science Department - M.Sc. Thesis MSC-2018-21 - 2018 Technion - Computer Science Department - M.Sc. Thesis MSC-2018-21 - 2018 This research was carried out under the supervision of Prof. Dan Tsafrir and Dr. Nadav Amit, in the Faculty of Computer Science. Acknowledgements who passed ,ז"ל This work is dedicated to my grandfather, Tuvia Kupfer away during the writing of this work. I would like to thank my wife, Odeya, for helping and supporting when needed. Also, I would like to thank all the friends who have been there. Finally, thanks to my advisors, Prof. Dan Tsafrir and Dr. Nadav Amit, for their help and guidance along the way. The generous financial help of the Technion is gratefully acknowledged. Technion - Computer Science Department - M.Sc. Thesis MSC-2018-21 - 2018 Technion - Computer Science Department - M.Sc. Thesis MSC-2018-21 - 2018 Contents List of Figures Abstract 1 Abbreviations and Notations3 1 Introduction5 2 Background9 2.1 DMA Attacks.................................9 2.1.1 Classic DMA Attacks........................9 2.1.2 IOMMU Protection......................... 10 2.1.3 Circumventing the IOMMU..................... 11 2.2 FireWire.................................... 12 3 Attack Mechanics 15 3.1 Sub-Page Granularity Vulnerability....................
    [Show full text]
  • Mengenal Sistim Operasi *BSD
    Mengenal Sistim Operasi *BSD Ada banyak sekali tulisan-tulisan yang membahas tentang BSD, baik tulisan mengenai sejarah, system administrasi, sampai penggunaan BSD kepada end-user sebagai desktop. Tulisan ini memperkenalkan BSD sebagai alternatif lain dari Linux untuk memenuhi kebutuhan akan UNIX-like operating system di Indonesia. Dalam tulisan ini pula, dibahas mengenai beberapa hal yang membedakan antara Linux dan BSD, namun tidak memutuskan mana yang paling baik, karena untuk menentukan mana operating system yang paling baik digunakan adalah Anda sendiri. Daftar Isi 1. Sejarah 2. Distribusi Varian BSD 3. Model Pengembangan 4. Integrasi System 5. Software-software di BSD 6. System Administrasi 7. File System 8. Lain-lain 9. Kesimpulan Sejarah Hampir semua orang telah mendengar Linux saat ini. Namun apa itu BSD? BSD adalah singkatan dari Berkeley Software Distribution. BSD pertama kali dibangun dan dikembangkan oleh Computer System Research Group (CSRG) di University of California at Berkeley (UCB), BSD pertama kali keluar pada akhir 1977 sebagai paket tambahan dan patch dari AT&T UNIX version 6, yang mana waktu itu beroperasi pada mesin PDP-11 minicomputer. BSD pada akhirnya banyak memberikan kontribusi berharga pada pengembangan UNIX secara umum. Ada banyak fitur yang pertama kali diperkenalkan oleh BSD dan beberapa diadopsi dari AT&T dan vendor-vendor lainnya. BSD dibuat, dikembangkan, dan digunakan secara BEBAS sebagai perlawanan terhadap lisensi UNIX yang dimiliki oleh AT&T dan oleh karena itu BSD mempunyai lisensi tersendiri yang memungkinkan setiap orang bebas melakukan pengembangan, dan menggunakan source code BSD. Pada tahun 1993, 4.4BSD dirilis sebagai sebuah Operating System yang utuh. Untuk sejarah lengkap BSD di CSRG, mulai sejarah dari jaman kuda, motivasi orang-orang yang pertama kali mengerjakannya, sampai perseteruan lisensi dan hak cipta dengan AT&T, saya mereferensikan Anda untuk membaca tulisan yang dibuat oleh Kirk McKusick, “Twenty Years of Berkeley Unix“.
    [Show full text]
  • UNIX History Page 1 Tuesday, December 10, 2002 7:02 PM
    UNIX History Page 1 Tuesday, December 10, 2002 7:02 PM CHAPTER 1 UNIX Evolution and Standardization This chapter introduces UNIX from a historical perspective, showing how the various UNIX versions have evolved over the years since the very first implementation in 1969 to the present day. The chapter also traces the history of the different attempts at standardization that have produced widely adopted standards such as POSIX and the Single UNIX Specification. The material presented here is not intended to document all of the UNIX variants, but rather describes the early UNIX implementations along with those companies and bodies that have had a major impact on the direction and evolution of UNIX. A Brief Walk through Time There are numerous events in the computer industry that have occurred since UNIX started life as a small project in Bell Labs in 1969. UNIX history has been largely influenced by Bell Labs’ Research Editions of UNIX, AT&T’s System V UNIX, Berkeley’s Software Distribution (BSD), and Sun Microsystems’ SunOS and Solaris operating systems. The following list shows the major events that have happened throughout the history of UNIX. Later sections describe some of these events in more detail. 1 UNIX History Page 2 Tuesday, December 10, 2002 7:02 PM 2 UNIX Filesystems—Evolution, Design, and Implementation 1969. Development on UNIX starts in AT&T’s Bell Labs. 1971. 1st Edition UNIX is released. 1973. 4th Edition UNIX is released. This is the first version of UNIX that had the kernel written in C. 1974. Ken Thompson and Dennis Ritchie publish their classic paper, “The UNIX Timesharing System” [RITC74].
    [Show full text]
  • Open Source Software Notice
    OPEN SOURCE SOFTWARE NOTICE This product incorporates various open source software packages that are distributed under license terms as described further below. 1. Linux Kernel, GNU C library and Toolchain, Busybox, dsnmasq, ethtool, iproute, iptables, sftpd, smcroute, mtdutils, gdb, uboot, cgi-c, jQuery Library, bootloader are licensed under the GNU General Public License, V2.0, which may be viewed at http://www.gnu.org/licenses/gpl-2.0.html. Copies of the source code for the above may be obtained at the following URLs: https://www.kernel.org https://gcc.gnu.org/ http://www.busybox.net/ http://www.thekelleys.org.uk/dnsmasq/doc.html https://www.kernel.org/pub/software/network/ethtool/) http://developer.osdl.org/dev/iproute2 (now- http://www.linuxfoundation.org/) http://www.cschill.de/smcroute/ http://git.infradead.org/mtd-utils.git http://www.gnu.org/software/gdb/ http://www.denx.de/wiki/U-Boot/SourceCode http://sourceforge.net/projects/cgi-c/ http://jquery.com/ Wolfgang Denk, DENX Software Engineering, [email protected]. Copies of the modified source code for BusyBox, cgi-c, boot loader, and Linux may be requested in writing by contacting: ViaSat, Inc., attn: General Counsel / Source Code Request, 6155 El Camino Real, Carlsbad CA 92009 USA. Your request should clearly identify the product and open source software component(s) to which your request relates. Your request must be sent within three (3) years of the date you received the Viasat product that included the binary that is the subject of your request. 2. OpenNTPD This is a summary of the licences for the files that make up Portable OpenNTPD.
    [Show full text]
  • The Design of the Openbsd Cryptographic Framework
    The Design of the OpenBSD Cryptographic Framework Angelos D. Keromytis Jason L. Wright Theo de Raadt Columbia University OpenBSD Project OpenBSD Project [email protected] [email protected] [email protected] Abstract the design of these systems is intended to impede sim- ple, brute-force, computational attacks. This complexity drives the belief that strong security is fundamentally in- Cryptographic transformations are a fundamental build- imical to good performance. ing block in many security applications and protocols. To improve performance, several vendors market hard- This belief has led to the common predilection to avoid ware accelerator cards. However, until now no operating cryptography in favor of performance [22]. However, system provided a mechanism that allowed both uniform the foundation for this belief is often software imple- and efficient use of this new type of resource. mentation [8] of algorithms intended for efficient hard- ware implementation. To address this issue, vendors We present the OpenBSD Cryptographic Framework have been marketing hardware cryptographic acceler- (OCF), a service virtualization layer implemented in- ators that implement several cryptographic algorithms side the kernel, that provides uniform access to accel- used by security protocols and applications. However, erator functionality by hiding card-specific details be- modern operating systems lack the necessary support hind a carefully-designed API. We evaluate the impact to provide efficient access to such functionality to ap- of the OCF in a variety of benchmarks, measuring over- plications and the operating system itself through a all system performance, application throughput and la- uniform API that abstracts away device details. As tency, and aggregate throughput when multiple applica- a result, accelerators are often used directly through tions make use of it.
    [Show full text]
  • Open Source Software: a History David Bretthauer University of Connecticut, [email protected]
    University of Connecticut OpenCommons@UConn Published Works UConn Library 12-26-2001 Open Source Software: A History David Bretthauer University of Connecticut, [email protected] Follow this and additional works at: https://opencommons.uconn.edu/libr_pubs Part of the OS and Networks Commons Recommended Citation Bretthauer, David, "Open Source Software: A History" (2001). Published Works. 7. https://opencommons.uconn.edu/libr_pubs/7 Open Source Software: A History —page 1 Open Source Software: A History by David Bretthauer Network Services Librarian, University of Connecticut Open Source Software: A History —page 2 Abstract: In the 30 years from 1970 -2000, open source software began as an assumption without a name or a clear alternative. It has evolved into a s ophisticated movement which has produced some of the most stable and widely used software packages ever produced. This paper traces the evolution of three operating systems: GNU, BSD, and Linux, as well as the communities which have evolved with these syst ems and some of the commonly -used software packages developed using the open source model. It also discusses some of the major figures in open source software, and defines both “free software” and “open source software.” Open Source Software: A History —page 1 Since 1998, the open source softw are movement has become a revolution in software development. However, the “revolution” in this rapidly changing field can actually trace its roots back at least 30 years. Open source software represents a different model of software distribution that wi th which many are familiar. Typically in the PC era, computer software has been sold only as a finished product, otherwise called a “pre - compiled binary” which is installed on a user’s computer by copying files to appropriate directories or folders.
    [Show full text]
  • The Book of PF Covers the Most • Stay in Control of Your Traffic with Monitoring and Up-To-Date Developments in PF, Including New Content PETER N.M
    EDITION3RD BUILD A Covers OpenBSD 5.6, MORE SECURE FreeBSD 10.x, and NETWORK EDITION NETWORK 3RD NetBSD 6.x WITH PF THETHE BOOKBOOK THE BOOK OF PF OF THE BOOK THE BOOK OF PF OF THE BOOK OFOF PFPF OpenBSD’s stateful packet filter, PF, is the heart of • Build adaptive firewalls to proactively defend against A GUIDE TO THE the OpenBSD firewall. With more and more services attackers and spammers NO-NONSENSE placing high demands on bandwidth and an increas- OPENBSD FIREWALL • Harness OpenBSD’s latest traffic-shaping system ingly hostile Internet environment, no sysadmin can to keep your network responsive, and convert your afford to be without PF expertise. existing ALTQ configurations to the new system The third edition of The Book of PF covers the most • Stay in control of your traffic with monitoring and up-to-date developments in PF, including new content PETER N.M. HANSTEEN visualization tools (including NetFlow) on IPv6, dual stack configurations, the “queues and priorities” traffic-shaping system, NAT and redirection, The Book of PF is the essential guide to building a secure wireless networking, spam fighting, failover provision- network with PF. With a little effort and this book, you’ll ing, logging, and more. be well prepared to unlock PF’s full potential. You’ll also learn how to: ABOUT THE AUTHOR • Create rule sets for all kinds of network traffic, whether Peter N.M. Hansteen is a consultant, writer, and crossing a simple LAN, hiding behind NAT, traversing sysadmin based in Bergen, Norway. A longtime DMZs, or spanning bridges or wider networks Freenix advocate, Hansteen is a frequent lecturer on OpenBSD and FreeBSD topics, an occasional • Set up wireless networks with access points, and contributor to BSD Magazine, and the author of an lock them down using authpf and special access often-slashdotted blog (http://bsdly.blogspot.com/ ).
    [Show full text]
  • Writing Exploit-Resistant Code with Openbsd Lawrence Teo Lteo Openbsd.Org @Lteo
    Writing Exploit-Resistant Code with OpenBSD Lawrence Teo lteo openbsd.org @lteo Slides and references at: https://lteo.net/carolinacon15 CarolinaCon 15 - Charlotte, NC - April 27, 2019 A question Innovation’s Black Hole Security vulnerabilities Image Credit: EHT Collaboration https://www.eso.org/public/images/eso1907a/ What is OpenBSD? • Free, multi-platform UNIX-liKe operating system • Founded by Theo de Raadt in 1995 • Secure by default • A research operating system • Two releases per year • You’re very liKely using OpenBSD code everyday • OpenSSH • LibreSSL • tmux • More: openbsd.org/innovations.html • Coolest mascot ever whoami • OpenBSD developer since 2012 • Primarily areas related to networking • PF, networK stacK, libpcap, tcpdump, etc. • Userland stuff, ports, man pages, etc • Co-founder, Calyptix Security • Shipping thousands of OpenBSD-based firewalls from Charlotte since 2006! • Ph.D. from UNC Charlotte (2006) • Research area: Info sharing for intrusion detection Auditing Software vulnerabilities How OpenBSD attacks the software vulnerability problem (my view) Auditing Exploit Software Mitigation vulnerabilities Techniques How OpenBSD attacks the software vulnerability problem (my view) Auditing Exploit Software Mitigation vulnerabilities Techniques Rigorous Development Process How OpenBSD attacks the software vulnerability problem (my view) Licensing Auditing Exploit Software Mitigation vulnerabilities Techniques Rigorous Development Process How OpenBSD attacks the software vulnerability problem (my view) Licensing Education
    [Show full text]
  • Getting Started with Openbsd Device Driver Development
    Getting started with OpenBSD device driver development Stefan Sperling <[email protected]> EuroBSDcon 2017 Clarifications (1/2) Courtesy of Jonathan Gray (jsg@): We don't want source code to firmware We want to be able to redistribute firmware freely Vendor drivers are often poorly written, we need to be able to write our own We want documentation on the hardware interfaces Source code is not documentation OpenBSD Device Drivers 2/46 Clarifications (2/2) I would like to add: Device driver code runs in our kernel Firmware code runs on a peripheral device, not in our kernel When we say \Binary Blobs" we are talking about closed-source device drivers, not firmware Firmware often runs with high privileges; use at your own risk If you do not want closed-source firmware, then don't buy and use hardware which needs it We are software developers, we do not build hardware We will not sign NDAs Please talk to hardware vendors and advocate for change; the current situation is very bad for free software OpenBSD Device Drivers 3/46 This talk is for ... somewhat competent C programmers who use OpenBSD and would like to use a device which lacks support so have an itch to scratch (enhance or write a driver) but are not sure where to start perhaps are not sure how the development process works and will research all further details themselves The idea for this talk came about during conversations I had at EuroBSDcon 2016. Common question: "How do I add support for my laptop's wifi device?" OpenBSD Device Drivers 4/46 Itches I have scratched..
    [Show full text]