0

dear security experts: we would like to create a very safe webserver. we are in awe at the sophistication and complexity of many solutions, but they don't apply to us. we are a small shop.

by safe, we mean a php or perl based internet-open website that limits the intrusion vulnerability with respect to remote sophisticated hacker in another country. it does not mean protection against people stealing the computer physically. it does not mean keeping my clients safe.

like many small shops, we don't have the manpower and attention to constantly monitor everything. we need to do assume our server employees make mistakes all the time. we also need to assume that we will miss security fixes, or even that we wrote sloppy code ourselves. we need this to be simple and foolproof. and fools we got. well, call them unsophisticated and naive.

first, we want the internet server to boot a distro from a read-only device. the cheapest way to do this is via CD. the hard disk will probably be removed. I have yet to find a modern SSD that has a true read-only switch. (some USB flash drives have it.) this means that there will be no root-kit installation on the root device. when I reboot, all temporary storage will be wiped out. I will be pristinely clean.

second, we wonder whether we can or should add more security. on rare occasion, we need to log into the computer that is running the webserver via ssh, bash, or execute something sudo---but this is rare. I want to install a hardware button on the computer that allows or disallows this. I can write a linkable function or shell script that returns 0 if the button is disengaged or 1 if it is engaged. so, I think I need to modify the code that executes ssh, bash, sudo, etc. they just need to be wrapped to check for 0 or 1 on the button first. or, I could modify the ext4 file system driver to let only certain programs through if the button is pressed, but this seems overkill.

I would think that if one of our fools gave a remote hacker the root account and password, but the button is off and the drive is read-only, there is even less harm that they could do.

I don't see an easy way to prevent a hacker from locating something into RAM, at least until the next reboot.

my key question now is: is there a common way to wrap a list of shell and other remote access programs to work only when my button is pressed?

advice appreciated.

regards,

/iaw

PS: and if anyone knows of an SSD with read-only switch, please let me know.

  • For a SSD flash drive with a physical write only switch - have a look at this. If your computer has enough ram, you can then load operating system entirely into memory when booting into read-only mode. – LateralFractal Oct 13 '14 at 6:39
  • As a comment but not an answer: You could simply tighten the SSH server to only work with a two-factor hardware dongle like YubiKey. As long as your colleagues do not physically post the hardware dongle to the attacker then you should have remote access nicely protected from accidental disclosure of credentials. – LateralFractal Oct 13 '14 at 7:03
  • @LateralFractal I'd suggest that should be an answer, not a comment - this is the way to do this. No that I am in any sense condoning Ivpo's bizarre threat model, I hasten to add. ;-) – Graham Hill Oct 13 '14 at 10:17
  • I completely trust friends to have good intents. I don't trust anyone, incl myself, not to make mistakes, such as leave sidewindows open. – ivo Welch Oct 13 '14 at 14:17
1

The first truth of Information Security is that there are some people you have to trust. Without that truth the whole discipline of Information Security turns into paranoid free-fall. May I suggest trusting your colleagues?

In lieu of that, the best way to protect your "attack surfaces" is to

  • Backup to multiple sources; some of which are write-once audit servers.
  • Lockdown employee access with two-factor authentication
  • Turn the web server into a virtual instance booted from a recoverable ghost image. Our peers at Server Fault can explain how.
  • Full disk encryption if you want the data unavailable if someone physically steals your server.
  • Install Panopticon-style video camera surveillance.
  • dear lateralfractal: pls don't misunderstand...I don't trust myself. I make mistakes. these are good solutions for trusting yourself and friends. if something is read-only, it limits the mistakes we can make locally accidentally. I absolutely do not trust anyone coming in from a network. – ivo Welch Oct 13 '14 at 14:14
  • Then robust and frequent backups will be your best friend; and perhaps source control if you do any scripting or coding work. Hackers are rather a distant concern unless your business is a bank or 4chan's pet hate of the week. – LateralFractal Oct 13 '14 at 14:21
  • we have customers, too...credit card etc info – ivo Welch Oct 13 '14 at 20:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.