4

I'm thinking to start making apparmor profiles for my server, but before I start, I want to make sure that I'm doing in a right way.

So, I'm thinking to begin with apache2 profiling. Right now I'm running couple of websites and some of non-default apache modules like modsecurity.

After checking aa-status, there are already some of default profiles:

   /usr/sbin/clamd
   /usr/sbin/mysqld
   /usr/sbin/named
   /usr/sbin/tcpdump

So if I fire aa-genprof apache2, it will return:

Profiling: /usr/sbin/apache2

[(S)can system log for AppArmor events] / (F)inish

What should I do after that, restart apache, browse on my sites in order to catch apache movement?

  • Is your goal to create walls between each site, minimize the access allowed to each site? Are you looking at using mod_apparmor? – wowest Dec 17 '16 at 5:06
2

apparmor is to protect services... for example if "something" tries to change configuration files of a protected service... Look at this.

To test it you must try to change any service... Not sure about how to test it with apache, but if the point is test if apparmor is working, you can doit with another service I know how it works:

If you install isc-dhcp-server package, by default I think ubuntu is protecting this service... then you can try to launch the dhcpd command setting a config file directly in the command (something like dhcpd -d -cf <yourPathToConfigFile> <yourInterface>)... you will see it doesn't work, even if your configuration file is good. It only works if the file is in /etc/dhcpd/.

  • 1
    This doesn't really answer my question, but anyways thanks. – Mirsad Dec 16 '16 at 22:33
0

The biggest problem (after understanding how your os, webserver and apparmour work) is being able to thouroughly regression test your server. Cataloging all the places where it interacts with files on your server is a start, but its never going to reveal the whole story. And running an automated profile doesn't tell you anything until you read what it captured.

Having opyimized the profile against your catalog and what else you know of the design, I would suggest running a crawler against your site and also using http::recorder / www::mechanize or similar to record test interactions in complain mode before enforcing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.