[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <f9ddbfc2-0d8b-039b-9a49-b4fd05b1784b@c7f.de>
Date: Tue, 7 Nov 2017 07:20:02 +0100
From: Matthias Luft <uchimata@....de>
To: oss-security@...ts.openwall.com
Subject: Re: Security risk of vim swap files
On 31.10.2017 15:46, Simon Waters (Surevine) wrote:
>
>
>> On 31 Oct 2017, at 12:23, Hanno Böck <hanno@...eck.de> wrote:
>>
>> I was wondering how to best avoid this on my own servers and I first
>> thought about saving the swap files to tmp ( with "set directory”).
>
> The specific website issue, the web server config can exclude dot files.
>
> Apache ships with
>
> <Files ~ "^\.ht">
> Order allow,deny
> Deny from all
> </Files>
>
> The obvious generalisations of this work. Although some sources also recommend blocking in “Location” to prevent requests with “*/.*stuff” which are parsed by templating libraries or other directives.
>
> To rub salt in most distros ship Apache with
>
> IndexIgnore .??* *~ *# RCS CVS *,v *,t
>
> Which means that if you use the Apache directory indexing approach these files will be hidden but not blocked.
>
> I now realise the Alexa top 1 million will now be searched for remaining uses of RCS and CVS ;)
>
> In a previous role the roll out scripts cleaned this sort of junk and told you if any new files had been added to the web application, this approach has much to recommend it if you have the time to perfect your applications, and your roll out procedures.
>
Another approach would be to actually whitelist the file types/patterns
that are delivered by your web servers. We have seen various file types
during testing since a long time that should not have been web served
and compiled a list [1] of those:
.dot files in general. In particular:
.ht*
.DS_Store
.git*
.svn*
.pkcs12 .pfx .p12, .pem, .key, .der, .crt
*.log
*.swp
*.bp/*.bak
/^~/ or /~$/
*.dmp/*.core
thumbs.db/*.db
*.raw
*.sqlite
*.conf/*.ini
*.txt/*.csv
However, I also fully agree with the comments later in the thread that
this issue should mainly be addressed by strict operating standards for
production systems as well as deployment procedures.
Best,
Matthias
[1] https://insinuator.net/2016/09/files-your-webserver-shouldnt-deliver/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
