1

I wasn't sure on the title, so please edit it if you think it can be improved.


I run a multiplayer gaming network (the backend system that handles accounts and player lists, and I want to expand my service to include a web-based control panel. This control panel will allow users to rent game-servers which are fully compatible with my network.

The gameservers will run on a separate dedicated server. This therefore means that users will have access to the executable files their server and are able to change them.

That presents the obvious problem malicious executable files and actions. By that, I mean:

  • The game the service supports has an autoexec.cfg file which can be populated with Windows commandline (which can be executed by the server);
  • The game has server modifications which mostly require a custom DLL (yet another executable) in order to function properly;
  • A certain server modification even requires the gameserver's own executable to be changed.

It should be noted that the only access that the user will have is via the web control panel and FTP (which will be their user directory such as user1 > server1). They will not have remote desktop access.

How can I prevent damage from malicious software/server modifications that users upload? Note that this is different to a web server since the attack surface is smaller (only limited to the gameservers that run on the machine, and that there are a maximum of 20 gameservers per machine).

Here's what I can think of, but is there anything else I can do?

  • A user account for each user- will allow separation of the gameserver processes for each user (easy to track a problem process down to a user);
  • Limiting the amount of PIDs each user can run- each gameserver should have just one PID, so logically we can limit the amount of PIDs to the amount of gameservers the user has. Obviously this doesn't fix the 'replace with malicious copy' issue;
  • Allow the user to only access the files in their folder;
  • Require manual approval of all executables before they are applied;
  • Virus/Malware scan on every file uploaded by the user

The operating system will be Windows Server 2008 (or 2012), each gameserver will have its own IP address, no other applications will run on the machine.

  • There are thousands possible scenarios they would be able to pwn you. The thing is that you have to assume that they will be able to run code and how to manage that. Preventing them from running code would be very ineffective, including your web-panel which is another story. You need to be able to monitor and respond to breaches, some may be of criminal nature. – Aria Sep 22 '16 at 17:21
1

There is potentially books-worth of information out there about this; it's not a small topic. I'll give you a brain-dump of ideas to get started with.

Make sure you've got Windows Update actually working and applying updates.

Ensure that your firewall is switched on and configured properly. You don't want to be exposing SMB and RDP over the internet; consider having RDP port accessible only from fixed addresses.

Remove all software you're not actually using. This includes proprietary drivers that you can safely swap out for generic Microsoft ones; often these are full of security holes.

If you're running a fairly homogeneous application ecosystem, I recommend looking into Software Restriction Policy (SRP) and sandboxing solutions.

You can also install EMET to gain some general protection against exploits. Make sure that you actually configure it.

Ensure that your local security policy is configured to harden against cross-user attacks (particularly hardening the default DACLs of system objects).

Ensure that directories have appropriate access controls. Essentially you want to remove all cases of directory permissions allowing the Everyone or Authenticated Users groups to have write access.

Configure auditing on process creation, so you have better tracking of what users are up to and when. Apply file auditing (create, write) to shared directories and critical system paths like C:\Windows. Audit logon attempts and successes, particularly over RDP.

Crank the UAC enforcement level up to maximum. There are a lot of bypasses on UAC, and you don't want to get tricked into running something a user uploaded and ending up getting pwned unexpectedly. Most of the bypasses require the UAC enforcement level to be default.

Make sure your system %PATH% environment variable isn't including any path that is writable by users.

Ensure that the users don't have RDP access. There are multiple ways to harden this.

Follow a guide for locking down workstations. In the unlikely event that someone does get onto the server (e.g. RDP in) you want their user accounts to be as nerfed as possible, with no access to command prompt, registry editor, task manager, services list, etc. - this can also be solved to an extent with SRP.

Shift your FTP logs and system event logs (incl. audit logs) off-system, in realtime if possible. You want to have backups if someone somehow gets local admin and clears all the logs out.

Consider a host-based intrusion detection system (HIDS) such as OSSEC.

Look through Windows privilege escalation tutorials, and implement defense measures to help protect yourself against the tricks they use.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.