mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-11-06 17:16:12 +00:00
981984d414
references to runtests.sh in docs, checksetup.pl, and other fine places. r=LpSolit, a=my snapple peach iced tea
411 lines
15 KiB
XML
411 lines
15 KiB
XML
<!-- <!DOCTYPE chapter PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN"> -->
|
|
<!-- $Id: security.xml,v 1.6 2005/06/29 23:43:33 zach%zachlipton.com Exp $ -->
|
|
|
|
<chapter id="security">
|
|
<title>Bugzilla Security</title>
|
|
|
|
<para>While some of the items in this chapter are related to the operating
|
|
system Bugzilla is running on or some of the support software required to
|
|
run Bugzilla, it is all related to protecting your data. This is not
|
|
intended to be a comprehensive guide to securing Linux, Apache, MySQL, or
|
|
any other piece of software mentioned. There is no substitute for active
|
|
administration and monitoring of a machine. The key to good security is
|
|
actually right in the middle of the word: <emphasis>U R It</emphasis>.
|
|
</para>
|
|
|
|
<para>While programmers in general always strive to write secure code,
|
|
accidents can and do happen. The best approach to security is to always
|
|
assume that the program you are working with isn't 100% secure and restrict
|
|
its access to other parts of your machine as much as possible.
|
|
</para>
|
|
|
|
<section id="security-os">
|
|
<title>Operating System</title>
|
|
|
|
<section id="security-os-ports">
|
|
<title>TCP/IP Ports</title>
|
|
|
|
<!-- TODO: Get exact number of ports -->
|
|
<para>The TCP/IP standard defines more than 65,000 ports for sending
|
|
and receiving traffic. Of those, Bugzilla needs exactly one to operate
|
|
(different configurations and options may require up to 3). You should
|
|
audit your server and make sure that you aren't listening on any ports
|
|
you don't need to be. It's also highly recommended that the server
|
|
Bugzilla resides on, along with any other machines you administer, be
|
|
placed behind some kind of firewall.
|
|
</para>
|
|
|
|
</section>
|
|
|
|
<section id="security-os-accounts">
|
|
<title>System User Accounts</title>
|
|
|
|
<para>Many <glossterm linkend="gloss-daemon">daemons</glossterm>, such
|
|
as Apache's <filename>httpd</filename> or MySQL's
|
|
<filename>mysqld</filename>, run as either <quote>root</quote> or
|
|
<quote>nobody</quote>. This is even worse on Windows machines where the
|
|
majority of <glossterm linkend="gloss-service">services</glossterm>
|
|
run as <quote>SYSTEM</quote>. While running as <quote>root</quote> or
|
|
<quote>SYSTEM</quote> introduces obvious security concerns, the
|
|
problems introduced by running everything as <quote>nobody</quote> may
|
|
not be so obvious. Basically, if you run every daemon as
|
|
<quote>nobody</quote> and one of them gets comprimised it can
|
|
comprimise every other daemon running as <quote>nobody</quote> on your
|
|
machine. For this reason, it is recommended that you create a user
|
|
account for each daemon.
|
|
</para>
|
|
|
|
<note>
|
|
<para>You will need to set the <option>webservergroup</option> option
|
|
in <filename>localconfig</filename> to the group your webserver runs
|
|
as. This will allow <filename>./checksetup.pl</filename> to set file
|
|
permissions on Unix systems so that nothing is world-writable.
|
|
</para>
|
|
</note>
|
|
|
|
</section>
|
|
|
|
<section id="security-os-chroot">
|
|
<title>The <filename>chroot</filename> Jail</title>
|
|
|
|
<para>
|
|
If your system supports it, you may wish to consider running
|
|
Bugzilla inside of a <filename>chroot</filename> jail. This option
|
|
provides unprecedented security by restricting anything running
|
|
inside the jail from accessing any information outside of it. If you
|
|
wish to use this option, please consult the documentation that came
|
|
with your system.
|
|
</para>
|
|
|
|
</section>
|
|
|
|
</section>
|
|
|
|
|
|
|
|
<section id="security-mysql">
|
|
<title>MySQL</title>
|
|
|
|
<section id="security-mysql-account">
|
|
<title>The MySQL System Account</title>
|
|
|
|
<para>As mentioned in <xref linkend="security-os-accounts"/>, the MySQL
|
|
daemon should run as a non-privleged, unique user. Be sure to consult
|
|
the MySQL documentation or the documentation that came with your system
|
|
for instructions.
|
|
</para>
|
|
</section>
|
|
|
|
<section id="security-mysql-root">
|
|
<title>The MySQL <quote>root</quote> and <quote>anonymous</quote> Users</title>
|
|
|
|
<para>By default, MySQL comes with a <quote>root</quote> user with a
|
|
blank password and an <quote>anonymous</quote> user, also with a blank
|
|
password. In order to protect your data, the <quote>root</quote> user
|
|
should be given a password and the anonymous user should be disabled.
|
|
</para>
|
|
|
|
<example id="security-mysql-account-root">
|
|
<title>Assigning the MySQL <quote>root</quote> User a Password</title>
|
|
|
|
<screen>
|
|
<prompt>bash$</prompt> mysql mysql
|
|
<prompt>mysql></prompt> UPDATE user SET password = password('<replaceable>new_password</replaceable>') WHERE user = 'root';
|
|
<prompt>mysql></prompt> FLUSH PRIVILEGES;
|
|
</screen>
|
|
</example>
|
|
|
|
<example id="security-mysql-account-anonymous">
|
|
<title>Disabling the MySQL <quote>anonymous</quote> User</title>
|
|
<screen>
|
|
<prompt>bash$</prompt> mysql -u root -p mysql <co id="security-mysql-account-anonymous-mysql"/>
|
|
<prompt>Enter Password:</prompt> <replaceable>new_password</replaceable>
|
|
<prompt>mysql></prompt> DELETE FROM user WHERE user = '';
|
|
<prompt>mysql></prompt> FLUSH PRIVILEGES;
|
|
</screen>
|
|
<calloutlist>
|
|
<callout arearefs="security-mysql-account-anonymous-mysql">
|
|
<para>This command assumes that you have already completed
|
|
<xref linkend="security-mysql-account-root"/>.
|
|
</para>
|
|
</callout>
|
|
</calloutlist>
|
|
</example>
|
|
|
|
</section>
|
|
|
|
<section id="security-mysql-network">
|
|
<title>Network Access</title>
|
|
|
|
<para>If MySQL and your webserver both run on the same machine and you
|
|
have no other reason to access MySQL remotely, then you should disable
|
|
the network access. This, along with the suggestion in
|
|
<xref linkend="security-os-ports"/>, will help protect your system from
|
|
any remote vulnerabilites in MySQL.
|
|
</para>
|
|
|
|
<example id="security-mysql-network-ex">
|
|
<title>Disabling Networking in MySQL</title>
|
|
|
|
<para>Simply enter the following in <filename>/etc/my.conf</filename>:
|
|
<screen>
|
|
[myslqd]
|
|
# Prevent network access to MySQL.
|
|
skip-networking
|
|
</screen>
|
|
</para>
|
|
</example>
|
|
|
|
</section>
|
|
|
|
|
|
<!-- For possible addition in the future: How to better control the bugs user
|
|
<section id="security-mysql-bugs">
|
|
<title>The bugs User</title>
|
|
|
|
</section>
|
|
-->
|
|
|
|
</section>
|
|
|
|
|
|
|
|
<section id="security-webserver">
|
|
<title>Webserver</title>
|
|
|
|
<section id="security-webserver-access">
|
|
<title>Disabling Remote Access to Bugzilla Configuration Files</title>
|
|
|
|
<para>There are many files that are placed in the Bugzilla directory
|
|
area that should not be accessable from the web. Because of the way
|
|
Bugzilla is currently layed out, the list of what should and should not
|
|
be accessible is rather complicated. A new installation method is
|
|
currently in the works which should solve this by allowing files that
|
|
shouldn't be accessible from the web to be placed in a directory outside
|
|
the webroot. See
|
|
<ulink url="http://bugzilla.mozilla.org/show_bug.cgi?id=44659">bug 44659</ulink>
|
|
for more information.
|
|
</para>
|
|
|
|
<tip>
|
|
<para>Bugzilla ships with the ability to create
|
|
<glossterm linkend="gloss-htaccess"><filename>.htaccess</filename></glossterm>
|
|
files that enforce these rules. Instructions for enabling these
|
|
directives in Apache can be found in <xref linkend="http-apache"/>
|
|
</para>
|
|
</tip>
|
|
|
|
<itemizedlist spacing="compact">
|
|
<listitem>
|
|
<para>In the main Bugzilla directory, you should:</para>
|
|
<itemizedlist spacing="compact">
|
|
<listitem>
|
|
<para>Block:
|
|
<simplelist type="inline">
|
|
<member><filename>*.pl</filename></member>
|
|
<member><filename>*localconfig*</filename></member>
|
|
</simplelist>
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>But allow:
|
|
<simplelist type="inline">
|
|
<member><filename>localconfig.js</filename></member>
|
|
<member><filename>localconfig.rdf</filename></member>
|
|
</simplelist>
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>In <filename class="directory">data</filename>:</para>
|
|
<itemizedlist spacing="compact">
|
|
<listitem>
|
|
<para>Block everything</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>But allow:
|
|
<simplelist type="inline">
|
|
<member><filename>duplicates.rdf</filename></member>
|
|
</simplelist>
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>In <filename class="directory">data/webdot</filename>:</para>
|
|
<itemizedlist spacing="compact">
|
|
<listitem>
|
|
<para>If you use a remote webdot server:</para>
|
|
<itemizedlist spacing="compact">
|
|
<listitem>
|
|
<para>Block everything</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>But allow
|
|
<simplelist type="inline">
|
|
<member><filename>*.dot</filename></member>
|
|
</simplelist>
|
|
only for the remote webdot server</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</listitem>
|
|
<listitem>
|
|
<para>Otherwise, if you use a local GraphViz:</para>
|
|
<itemizedlist spacing="compact">
|
|
<listitem>
|
|
<para>Block everything</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>But allow:
|
|
<simplelist type="inline">
|
|
<member><filename>*.png</filename></member>
|
|
<member><filename>*.gif</filename></member>
|
|
<member><filename>*.jpg</filename></member>
|
|
<member><filename>*.map</filename></member>
|
|
</simplelist>
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</listitem>
|
|
<listitem>
|
|
<para>And if you don't use any dot:</para>
|
|
<itemizedlist spacing="compact">
|
|
<listitem>
|
|
<para>Block everything</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>In <filename class="directory">Bugzilla</filename>:</para>
|
|
<itemizedlist spacing="compact">
|
|
<listitem>
|
|
<para>Block everything</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>In <filename class="directory">template</filename>:</para>
|
|
<itemizedlist spacing="compact">
|
|
<listitem>
|
|
<para>Block everything</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
<para>Be sure to test that data that should not be accessed remotely is
|
|
properly blocked. Of particular intrest is the localconfig file which
|
|
contains your database password. Also, be aware that many editors
|
|
create temporary and backup files in the working directory and that
|
|
those should also not be accessable. For more information, see
|
|
<ulink url="http://bugzilla.mozilla.org/show_bug.cgi?id=186383">bug 186383</ulink>
|
|
or
|
|
<ulink url="http://online.securityfocus.com/bid/6501">Bugtraq ID 6501</ulink>.
|
|
To test, simply point your web browser at the file; for example, to
|
|
test mozilla.org's installation, we'd try to access
|
|
<ulink url="http://bugzilla.mozilla.org/localconfig"/>. You should get
|
|
a <quote><errorcode>403</errorcode> <errorname>Forbidden</errorname></quote>
|
|
error.
|
|
</para>
|
|
|
|
<tip>
|
|
<para>Be sure to check <xref linkend="http"/> for instructions
|
|
specific to the webserver you use.
|
|
</para>
|
|
</tip>
|
|
|
|
</section>
|
|
|
|
|
|
<section id="security-webserver-mod-throttle">
|
|
<title>Using <filename>mod_throttle</filename> to Prevent a DOS</title>
|
|
|
|
<note>
|
|
<para>This section only applies to people who have chosen the Apache
|
|
webserver. It may be possible to do similar things with other
|
|
webservers. Consult the documentation that came with your webserver
|
|
to find out.
|
|
</para>
|
|
</note>
|
|
|
|
<para>It is possible for a user, by mistake or on purpose, to access
|
|
the database many times in a row which can result in very slow access
|
|
speeds for other users (effectively, a
|
|
<glossterm linkend="gloss-dos">DOS</glossterm> attack). If your
|
|
Bugzilla installation is experiencing this problem, you may install
|
|
the Apache module <filename>mod_throttle</filename> which can limit
|
|
connections by IP address. You may download this module at
|
|
<ulink url="http://www.snert.com/Software/mod_throttle/"/>.
|
|
Follow the instructions to install into your Apache install.
|
|
The command you need is
|
|
<command>ThrottleClientIP</command>. See the
|
|
<ulink url="http://www.snert.com/Software/mod_throttle/">documentation</ulink>
|
|
for more information.</para>
|
|
</section>
|
|
|
|
|
|
</section>
|
|
|
|
|
|
<section id="security-bugzilla">
|
|
<title>Bugzilla</title>
|
|
|
|
<section id="security-bugzilla-charset">
|
|
<title>Prevent users injecting malicious Javascript</title>
|
|
|
|
<para>It is possible for a Bugzilla user to take advantage of character
|
|
set encoding ambiguities to inject HTML into Bugzilla comments. This
|
|
could include malicious scripts.
|
|
Due to internationalization concerns, we are unable to
|
|
incorporate by default the code changes suggested by
|
|
<ulink
|
|
url="http://www.cert.org/tech_tips/malicious_code_mitigation.html#3">the
|
|
CERT advisory</ulink> on this issue.
|
|
Making the change in <xref linkend="security-bugzilla-charset-ex"/> will
|
|
prevent this problem.
|
|
</para>
|
|
|
|
<example id="security-bugzilla-charset-ex">
|
|
<title>Forcing Bugzilla to output a charset</title>
|
|
|
|
<para>Locate the following line in
|
|
<filename>Bugzilla/CGI.pm</filename>:
|
|
<programlisting>$self->charset('');</programlisting>
|
|
and change it to:
|
|
<programlisting>$self->charset('UTF-8');</programlisting>
|
|
</para>
|
|
</example>
|
|
</section>
|
|
|
|
</section>
|
|
|
|
</chapter>
|
|
|
|
<!-- Keep this comment at the end of the file
|
|
Local variables:
|
|
mode: sgml
|
|
sgml-always-quote-attributes:t
|
|
sgml-auto-insert-required-elements:t
|
|
sgml-balanced-tag-edit:t
|
|
sgml-exposed-tags:nil
|
|
sgml-general-insert-case:lower
|
|
sgml-indent-data:t
|
|
sgml-indent-step:2
|
|
sgml-local-catalogs:nil
|
|
sgml-local-ecat-files:nil
|
|
sgml-minimize-attributes:nil
|
|
sgml-namecase-general:t
|
|
sgml-omittag:t
|
|
sgml-parent-document:("Bugzilla-Guide.xml" "book" "chapter")
|
|
sgml-shorttag:t
|
|
sgml-tag-region-if-active:t
|
|
End: -->
|
|
|