Securing Internet Information Servers

CIAC-2308 R.3
UCRL-MA-118453
by the Members of the CIAC Team
December, 1994 (Revised August, 2000)

DISCLAIMER

This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes.

Reference to any specific commercial product does not necessarily constitute or imply its endorsement, recommendation or favoring by CIAC, the University of California, the United States Department of Energy, or the United States Government.

Work performed under the auspices of the U. S. Department of Energy by Lawrence Livermore National Laboratory under Contract W-7405-Eng-48.

Securing Internet Information Servers
- Introduction
  - Overview
  - Need for Security
- General Guidelines for Establishing Information Servers
  - Recommendations
Securing Anonymous FTP Servers
Securing Gopher Servers
- Overview
  - Advantages and Disadvantages of Gopher Servers
  - Gopher Server Vulnerabilities
- How to Configure a Gopher Server
  - Using Configuration Options
Securing World Wide Web Servers
- Overview
- How to Configure a WWW Server
  - General Guidelines
  - Using Configuration Options
References
Appendix A: Publicly Available Server Software
Appendix B: Contacting CIAC

SECURING INTERNET INFORMATION SERVERS

Introduction

Overview

As the Internet rapidly becomes populated with increasingly easy-to-use information servers (such as FTP, Gopher, and the World Wide Web (WWW)), users around the world are distributing a staggering amount of data. The information servers make it easy for users to provide information to colleagues, friends, and the general public. Organizations, businesses, and individuals are creating access to information that has never before been available.

Need for Security

Information server technology certainly benefits users; however, information providers should address several aspects of information sharing to assure the security of the information they distribute. The need to secure information servers is very real. For example:

The bulk of server software in use today, especially for newer services such as Gopher and the WWW, was rapidly developed in a research or university environment and has not undergone rigorous security testing. These programs exhibit significant vulnerabilities that will most likely continue.
Several of the server packages do not require privileged system access for installation, thus allowing users to establish their own information servers. While desirable, user installation may place systems at risk if users do not establish proper server configuration.
The growth in both the size of the Internet and the number of information servers has translated into a corresponding expansion in the number of attacks on information servers.
As organizations and businesses begin to use the Internet to advertise their capabilities and distribute their products, sensitive data will increasingly become vulnerable to compromise and corruption.

Organizations have reported significant damage. In one case, an intruder compromised the primary distribution server for a popular network software package and installed a "back door" in the package. The back door allowed intruders to easily compromise any site that installed the modified package. Fortunately, the system administrators were carefully monitoring the integrity of the distribution and the incident was discovered in less than 24 hours. Even so, users around the world had retrieved hundreds of copies, and administrators had to notify each user of the problem.

General Guidelines for Establishing Information Servers

Recommendations

Specific configuration recommendations for FTP, Gopher, and WWW servers are presented in subsequent sections of this document. However, CIAC recommends these general guidelines for establishing any type of information server:

The information server should reside on a system dedicated solely to information distribution, and only information to be distributed should reside on this system. You should assume that any information placed on the system will be available to the Internet public, should your server software be compromised.
Servers should run with as little privilege as necessary. If at all possible, server software should NOT run as "root," thus limiting possible damage if an intruder discovers a vulnerability.
Whenever possible, server software should be executed in a restricted file space ('chroot' environment in Unix), thus restricting files to which the server has access and making it more difficult for users to access unintended information.
System administrators should closely monitor the integrity of the system and the information to be distributed. Cryptographic "checksum" utilities, such as SPI and Tripwire, can create system snapshots and notify administrators of unauthorized modifications. Appendix A contains further information about obtaining these packages.

SECURING ANONYMOUS FTP SERVERS

Overview

Use of FTP Servers

The File Transfer Protocol, or FTP, is the basis for the oldest and most common type of information server on the Internet, the anonymous FTP server. Anonymous FTP servers allow unauthenticated access to a portion of a host's file system. The server software allows remote users to retrieve files and occasionally it allows file uploads or even more advanced operations, such as index searches and file compression.

These servers are often used to distribute software packages and documents. For example, this document is available from the anonymous FTP server "ciac.llnl.gov".

FTP Server Vulnerabilities

Anonymous FTP servers exhibit several vulnerabilities. These are:

People on the Internet may use writable areas of an FTP file system to exchange files. This is a common technique used by people to trade copyrighted software and pornographic pictures.
Users may alter or delete information or software.
In the past, FTP software vulnerabilities have been found that permitted complete access to the system's files. (CIAC Bulletin E-17 discusses some of these.) These vulnerabilities have been corrected; however, the possibility of new vulnerabilities in the software, especially as new features are added, is very real.
Configuration errors may permit unintended access to sensitive files. For example, a common mistake when setting up an anonymous FTP server is to make a copy of the system password file in the area available to remote users. If any local users have chosen weak passwords, intruders may then use this password file to break into the system.

FTP Server Configuration Issues

CIAC recommends users consider the following guidelines when setting up an FTP configuration:

No files or directories in the anonymous FTP area should be "owned" by the user "ftp". This is the user ID of anonymous users, and anything owned by it can be modified, replaced, or deleted by any remote user on the Internet.
No encrypted passwords from the system password file '/etc/passwd' should be present in the password file in the anonymous FTP area '~ftp/etc/passwd'. Anyone on the Internet can retrieve these encrypted passwords, and unauthorized users can make attempts to decrypt them.
If at all possible, no directories or files should be writable by anonymous users. On some systems, remote users find it helpful to have an "incoming" directory available for depositing files. Frequently, network intruders use these areas to store and exchange illicit files, including copyrighted software and pornographic pictures. If system administrators require this type of directory, they should secure it as much as possible by using the methods described in the following sections.

How to Secure an Anonymous FTP Server

Procedure

Follow these steps to create a new FTP server:

1. Create the FTP "user".

To create a new "ftp" user and group, you add entries to the system password and group files '/etc/passwd' and '/etc/group', respectively. The following guidelines are important:

The 'uid' and 'gid' numbers should be previously unused.
The password entry should specify a locked password (*) and have no login shell '/bin/false'. This prevents unauthorized logins by the FTP user.
The home directory specified in '/etc/passwd' will become the root of the file system that is available to anonymous users.

Examples of system password file and system group file additions are:

         --------------------------------------------------------
        | System password file:
        | 
        | prompt% cat /etc/passwd
        | :
        | ftp:*:300:300:Anonymous FTP:/home/ftp:/bin/false
        | :
        | 
        | System group file:
        | 
        | prompt% cat /etc/group
        | :
        | ftp::300:
        | :
         --------------------------------------------------------

2. Create the anonymous FTP file area.

The FTP home directory '~ftp' and all lower-level information will be available to anonymous users. The following guidelines are important:

The owner of the directory should be "root" and group should be "ftp".
The user "ftp" must NOT be the owner of '~ftp'; this configuration prevents anonymous users from adding or removing files.
The permissions of '~ftp' should be set to 555; this allows read and execute access to all files but disallows writing to files.