Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door - The Something Awful Forums

Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door

invision: Mar 2, 2009; I DIDN'T GET ENOUGH RAPE LAST TIME, MAY I HAVE SOME MORE?

relevant:
CVE-2016-7545 -- SELinux sandbox escape
http://seclists.org/oss-sec/2016/q3/606

# ? Sep 27, 2016 00:14

Adbot: ADBOT LOVES YOU

# ? Apr 18, 2024 22:06

Shaggar: Apr 26, 2006

NAT-T Ice posted:

so whats uac

a system that prompts the user for system changes because they are running applications with a mix of privilege levels. access to items can be set for multiple users and groups each with separate privileges and auditing settings.

vs sudo which is a thing you have to type in before every command on your Linux server because Linux permissions are all or nothing so sudo creates a fake access control system where you basically have a text file of things a user can access when they do sudo. its the exact wrong way to do it.

# ? Sep 27, 2016 00:28

JewKiller 3000: Nov 28, 2006; by Lowtax

NAT-T Ice posted:

so whats uac

a thing you turn off because it's hella annoying and useless

# ? Sep 27, 2016 00:29

Shaggar: Apr 26, 2006

the posix permissions model only makes sense when you realize it was designed in the 60s for machines where 2 people can do everything and everyone else can only do the same things.

the windows permissions model was designed for the real world where different people need different access to the same and different items.

when posix users realized their mistake instead of fixing it they decided to do the most posix thing possible: create a text file whitelist with arcane syntax to handle complex access control

# ? Sep 27, 2016 00:36

CrazyLittle: Sep 11, 2001; Clapping Larry

NAT-T Ice posted:

so whats uac

uac'n nothin yet.

# ? Sep 27, 2016 00:45

FlapYoJacks: Feb 12, 2009

Lol if you setup a server that requires root permissions to do everything.

# ? Sep 27, 2016 01:01

JawnV6: Jul 4, 2004; So hot ...

ratbert90 posted:

Lol if you setup a server that requires root permissions to do everything.

This incident will be reported.

# ? Sep 27, 2016 01:08

Notorious b.s.d.: Jan 25, 2003; by Reene

invision posted:

but nopasswd is better?

yes

nopasswd means nobody imagines a layer of security that doesn't exist, and you don't leak passwords in the process table.

# ? Sep 27, 2016 01:09

Notorious b.s.d.: Jan 25, 2003; by Reene

Shaggar posted:

a system that prompts the user for system changes because they are running applications with a mix of privilege levels. access to items can be set for multiple users and groups each with separate privileges and auditing settings.

vs sudo which is a thing you have to type in before every command on your Linux server because Linux permissions are all or nothing so sudo creates a fake access control system where you basically have a text file of things a user can access when they do sudo. its the exact wrong way to do it.

the real solution is selinux, but only a few people use that

still, better than windows MIC, their equivalent to selinux

i have literally never seen MIC enabled in the wild, ever, not once

# ? Sep 27, 2016 01:12

Dex: May 26, 2006; Quintuple x!!!

Would not escrow again.

VERY MISLEADING!

Winkle-Daddy posted:

i am stupid and I should just use the -s to send the output of honggfuzz to stdin of netcat. whelp!

e: this is a pretty easy to read tool, I'm going to setup some long running fuzzing jobs, I think!
code:
------------------------------[ honggfuzz v0.8 ]------------------------------
      Iterations : 8,610 [8.61k]
        Run Time : 0 hrs 1 min 13 sec (since: 2016-09-26 10:27:24)
       Input Dir : 'header_inputs'
      Fuzzed Cmd : '/bin/nc 127.0.0.1 5000'
Remote cmd [1955]: '/home/deploy/code/checked_in/monitor/flask/bin/python ./run.py'
 Fuzzing Threads : 1, CPUs: 8, CPU: 346.0% (43.2%/CPU)
   Speed (Execs) : 78/sec (avg: 117)
         Crashes : 0 (unique: 0, blacklist: 0, verified: 0)
        Timeouts : 0 [10 sec.]
-----------------------------------[ LOGS ]-----------------------------------
[2016-09-26T10:28:37-0700][I][1970] main():181 Signal 2 (Interrupt) received, terminating
This is so much easier to use than Sully, I'll have to see if making sense of a crash when I find one is just as easy or if my only choice is to parse all of the info in the filename.

quoting for reference, also post more stuff like this please, thank you

# ? Sep 27, 2016 01:25

Rufus Ping: Dec 27, 2006; I'm a Friend of Rodney Nano

Shaggar posted:

Linux permissions are all or nothing

Powercrazy posted:

A permission model of everything or nothing is trash.

even linux DAC isn't all or nothing, it supports ACLs

and then youve got capabilities and whatever MAC you want to use (selinux, grsec rbac, apparmor)

people have a really antiquated view of linux

# ? Sep 27, 2016 03:12

invision: Mar 2, 2009; I DIDN'T GET ENOUGH RAPE LAST TIME, MAY I HAVE SOME MORE?

plz join trumps 400 lb nerd sitting on the bed cyber gestapo tia

# ? Sep 27, 2016 03:15

VikingofRock: Aug 24, 2008

YOSPOS � Security Fuckup Megathread - v12.1.6 - The security aspect of cyber is very, very tough

# ? Sep 27, 2016 03:41

Panty Saluter: Jan 17, 2004; Making learning fun!

VikingofRock posted:

YOSPOS � Security Fuckup Megathread - v12.1.6 - The security aspect of cyber is very, very tough

# ? Sep 27, 2016 04:03

cinci zoo sniper: Mar 15, 2013

VikingofRock posted:

YOSPOS › Security Fuckup Megathread - v12.1.6 - The security aspect of cyber is very, very tough

# ? Sep 27, 2016 04:20

hobbesmaster: Jan 28, 2008

VikingofRock posted:

YOSPOS � Security Fuckup Megathread - v12.1.6 - The security aspect of cyber is very, very tough

also something 400lb goon related

# ? Sep 27, 2016 04:24

Shaggar: Apr 26, 2006

VikingofRock posted:

YOSPOS � Security Fuckup Megathread - v12.1.6 - The security aspect of cyber is very, very tough

# ? Sep 27, 2016 04:24

duTrieux.: Oct 9, 2003

JewKiller 3000 posted:

a thing you turn off because it's hella annoying and useless

lol are you still using xp

# ? Sep 27, 2016 04:47

Acer Pilot: Feb 17, 2007; put the 'the' in therapist

VikingofRock posted:

YOSPOS � Security Fuckup Megathread - v12.1.6 - The security aspect of cyber is very, very tough

# ? Sep 27, 2016 05:19

burning swine: May 26, 2004

VikingofRock posted:

YOSPOS › Security Fuckup Megathread - v12.1.6 - The security aspect of cyber is very, very tough

# ? Sep 27, 2016 05:20

Qtotonibudinibudet: Nov 7, 2011; Omich poluyobok, skazhi ty narkoman? ya prosto tozhe gde to tam zhivu, mogli by vmeste uyobyvat' narkotiki

VikingofRock posted:

YOSPOS � Security Fuckup Megathread - v12.1.6 - The security aspect of the cyber is very, very tough

fixed

# ? Sep 27, 2016 05:19

FlapYoJacks: Feb 12, 2009

VikingofRock posted:

YOSPOS › Security Fuckup Megathread - v12.1.6 - The security aspect of cyber is very, very tough

# ? Sep 27, 2016 05:26

Notorious b.s.d.: Jan 25, 2003; by Reene

Rufus Ping posted:

even linux DAC isn't all or nothing, it supports ACLs

and then youve got capabilities and whatever MAC you want to use (selinux, grsec rbac, apparmor)

people have a really antiquated view of linux

again, this is a false equivalence. not just the false choice (selinux is the only one anyone uses) but the actual usage. selinux is a thing mere mortals can actually deploy on internet-facing services

nobody, nobody, uses microsoft's MAC framework. it is a purely theoretical construct. even their own educational material doesn't assume basic understanding of MAC on windows

# ? Sep 27, 2016 05:27

NyetscapeNavigator: Sep 22, 2003

CrazyLittle posted:

uac'n nothin yet.

# ? Sep 27, 2016 05:45

Heresiarch: Oct 6, 2005; Literature is not exhaustible, for the sufficient and simple reason that no single book is. A book is not an isolated being: it is a relationship, an axis of innumerable relationships.

opinions on this piece? by this person, seems like it might be useful to non-lawyers as well

also, has anybody used encryptr, which is spideroak's password manager?

# ? Sep 27, 2016 05:49

hackbunny: Jul 22, 2007; I haven't been on SA for years but the person who gave me my previous av as a joke felt guilty for doing so and decided to get me a non-shitty av

Notorious b.s.d. posted:

i have literally never seen MIC enabled in the wild, ever, not once

doesn't chrome use it a lot?

# ? Sep 27, 2016 08:06

Mr SuperAwesome: Apr 6, 2011; im from the bad post police, and i'm afraid i have bad news

CrazyLittle posted:

uac'n nothin yet.

# ? Sep 27, 2016 08:33

Wheany: Mar 17, 2006; Spinya^{ha^{ha^haha}ha}ha_{ha_{ha_haha}ha}ha!; Doctor Rope

i got an sms that told me that a package is waiting for me at a post office on the other side of the country.
i went to the post's web page and they have a customer service chat there, so i opened it and asked about it, because i was worried that the actual recipient will not be getting a package delivery notification
they wanted the tracking number (it was in the sms) and when i told it, they immediately told me the recipient's name and address. welp.
at least i was able to get their phone number with that (it had 1 different digit from my number) and forwarded the sms to them.

# ? Sep 27, 2016 10:52

Blinkz0rz: May 27, 2001; MY CONTEMPT FOR MY OWN EMPLOYEES IS ONLY MATCHED BY MY LOVE FOR TOM BRADY'S SWEATY MAGA BALLS

VikingofRock posted:

YOSPOS � Security Fuckup Megathread - v12.1.6 - The security aspect of cyber is very, very tough

# ? Sep 27, 2016 14:20

Rufus Ping: Dec 27, 2006; I'm a Friend of Rodney Nano

Notorious b.s.d. posted:

again, this is a false equivalence. not just the false choice (selinux is the only one anyone uses) but the actual usage. selinux is a thing mere mortals can actually deploy on internet-facing services

nobody, nobody, uses microsoft's MAC framework. it is a purely theoretical construct. even their own educational material doesn't assume basic understanding of MAC on windows

yea i wasnt comparing it to the windows equivalent, just saying it not true to claim linux only has a crude permissions system or that admin access is all or nothing

# ? Sep 27, 2016 15:43

Shaggar: Apr 26, 2006

selinux is not a permissions system, its sudo taken to an extreme. instead of setting permissions on the objects you want to secure, you set policy at the kernel level for what processes can do what. its dumb as poo poo and the reason nobody uses selinux.

# ? Sep 27, 2016 16:22

Winkle-Daddy: Mar 10, 2007

So, this is my "please help me prevent a sec fuckup" at work question...and unlike the last one I don't have preconceived bad opinions!

We have a build automation process where we use Boxcutter + Packer + VMWare vSphere + VMWare VirtualBox to create Windows and Linux box files. The Windows box files are built to automatically be pointed at our internal MS KMS server. We also maintain boxes for each patch level of each OS as well as a rolling "latest" that is built weekly and re-imported into our cloud. This works great for all of our supported platforms (CentOS, Fedora, Ubuntu, Debian, Suse, Win* since XP) except for one: Red Hat. The way that we use the containers with Vagrant is that we just invoke Chef to cook up our node with recipes hosted on our internal Supermarket, some acceptance tests are run and the environment is destroyed to be run again the next day with a new build of our software.

How in the actual gently caress do we license these RH servers in such a way we can use package management with them and then destroy them when we're done? We can't reliably "un-register" them because we have some jobs that do automated cleanup in the vagrant cloud if something happens and a Jenkins job failed to properly vagrant destroy something. AFAIK, the old satellite server methodology still required you to manually remove registration of the machine, same with executing rhn_register.

What should I be looking at to help solve this problem??

# ? Sep 27, 2016 16:34

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Shaggar posted:

selinux is not a permissions system, its sudo taken to an extreme. instead of setting permissions on the objects you want to secure, you set policy at the kernel level for what processes can do what. its dumb as poo poo and the reason nobody uses selinux.

do you know if anyone's gotten selinux to work in windows 10

# ? Sep 27, 2016 16:36

Shaggar: Apr 26, 2006

call redhate and ask them. their support is the only reason you are paying for red hate.

otherwise if it works in centos call it good.

# ? Sep 27, 2016 16:36

Shame Boy: Mar 2, 2010

Winkle-Daddy posted:

VMWare VirtualBox

i assume you mean VMWare Workstation, or just VirtualBox, because they're two different products

Shaggar posted:

call redhate and ask them. their support is the only reason you are paying for red hate.

otherwise if it works in centos call it good.

this except their answer will probably be "you need to buy a $100,000 ~datacenter edition~ license" or something like that

# ? Sep 27, 2016 16:39

Shaggar: Apr 26, 2006

anthonypants posted:

do you know if anyone's gotten selinux to work in windows 10

i just tried to install it but the install failed.

# ? Sep 27, 2016 16:40

Winkle-Daddy: Mar 10, 2007

I'm waiting on someone giving me an RHN account

My old one was finally closed and I need a new one from my new company. I am hoping someone here has some suggestions in the meantime as I'd like to not have to include RHN credentials anywhere in our automation (even encrypted databags). This is like one thing Microsoft has super worked out. You win this round, Shaggar.

# ? Sep 27, 2016 16:41

Shaggar: Apr 26, 2006

linux is for hobbyists and not for the enterprise. this is reflected in its tools and support.

# ? Sep 27, 2016 16:43

Bhodi: Dec 9, 2007; Oh, it's just a cat.; Pillbug

Winkle-Daddy posted:

I'm waiting on someone giving me an RHN account My old one was finally closed and I need a new one from my new company. I am hoping someone here has some suggestions in the meantime as I'd like to not have to include RHN credentials anywhere in our automation (even encrypted databags). This is like one thing Microsoft has super worked out. You win this round, Shaggar.

I'm assuming satellite 6+? send a PM to evol262 or post in this thread, I could tell you how to do it in 5 but my knowledge seriously out of date at this point

# ? Sep 27, 2016 16:52

Adbot: ADBOT LOVES YOU

# ? Apr 18, 2024 22:06

MrMoo: Sep 14, 2000

Winkle-Daddy posted:

What should I be looking at to help solve this problem??

Why bother with the registration if you are using Chef? Use a local repo and it ends up the same as CentOS.

# ? Sep 27, 2016 16:54

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v12.2 - you have slammed your dick in the car door

Powered by: vBulletin Version 2.2.9 (SABB-v2.24.04)
Copyright ©2000, 2001, Jelsoft Enterprises Limited.
Copyright ©2024, Jeffrey of YOSPOS