[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20171031142034.GJ31388@io.lakedaemon.net>
Date: Tue, 31 Oct 2017 14:20:34 +0000
From: Jason Cooper <osssecurity@...edaemon.net>
To: oss-security@...ts.openwall.com
Subject: Re: Fw: Security risk of vim swap files
Hi Hanno,
On Tue, Oct 31, 2017 at 01:23:52PM +0100, Hanno Böck wrote:
> I think vim should change the behavior of swap files:
> 1. they should be stored in /tmp by default
This opens up a host of other issues, which others have highlighted.
> 2. they should have secure permissions (tmp file security is
> a tricky thing and needs careful consideration to avoid symlink attacks
> and the like, but there are dedicated functions for this like mkstemp).
This is only if you move to /tmp.
> 3. Ideally they also shouldn't leak currently edited filenames (e.g.
> they shouldn't be called /tmp/.test.txt.swp, but more something
> like /tmp/.vim_swap.123782173)
Adding this requirement begs for a Rube Goldberg solution. :-) Since
vim needs a deterministic name to search for when it opens the file the
next time. And next time could be after a reboot.
Maybe we just need to change the default backup pattern to something
that isn't hidden by default? e.g. wp-config.php.swp (no leading
period), or wp-config.php~ ? Thus, it's more likely to be caught by the
developer.
Honestly, The real problem is just webserver design in general. In
order to have automatic reboot/restart, you need to grossly compromise
security in several ways.
a) store the server ssl key on disk without a password.
b) store passwords in the clear in config files, readable by the
running server user.
The real answer is "Don't do that." Which, years ago, was really
infeasible since most servers were physically hosted and redundancy was
expensive.
But we're not there anymore. Wether you use a caching provider like
cloudflare, or a hosting service using VMs, there's plenty of cheap
redundancy. Having an individual box down doesn't mean your site is
down. So, this gives us some wiggle room to ask for a password to
decrypt the key (or, load from remote), and provide credentials for the
server to access other resources.
But, I digress. Yes, vim swap files are a problem. But only because
we've built stupid decisions (necessary at one time) into the design.
thx,
Jason.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
