{"action":"created","issue":{"url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1053","labels_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1053/labels{/name}","comments_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1053/comments","events_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1053/events","html_url":"https://github.com/freedomofpress/securedrop/pull/1053","id":87444989,"number":1053,"title":"Improvements for iptables","user":{"login":"dolanjs","id":1495205,"avatar_url":"https://avatars.githubusercontent.com/u/1495205?v=3","gravatar_id":"","url":"https://api.github.com/users/dolanjs","html_url":"https://github.com/dolanjs","followers_url":"https://api.github.com/users/dolanjs/followers","following_url":"https://api.github.com/users/dolanjs/following{/other_user}","gists_url":"https://api.github.com/users/dolanjs/gists{/gist_id}","starred_url":"https://api.github.com/users/dolanjs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dolanjs/subscriptions","organizations_url":"https://api.github.com/users/dolanjs/orgs","repos_url":"https://api.github.com/users/dolanjs/repos","events_url":"https://api.github.com/users/dolanjs/events{/privacy}","received_events_url":"https://api.github.com/users/dolanjs/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/freedomofpress/securedrop/milestones/10","html_url":"https://github.com/freedomofpress/securedrop/milestones/0.3.4","labels_url":"https://api.github.com/repos/freedomofpress/securedrop/milestones/10/labels","id":1157441,"number":10,"title":"0.3.4","description":"Issues for the next minor release of SecureDrop","creator":{"login":"dolanjs","id":1495205,"avatar_url":"https://avatars.githubusercontent.com/u/1495205?v=3","gravatar_id":"","url":"https://api.github.com/users/dolanjs","html_url":"https://github.com/dolanjs","followers_url":"https://api.github.com/users/dolanjs/followers","following_url":"https://api.github.com/users/dolanjs/following{/other_user}","gists_url":"https://api.github.com/users/dolanjs/gists{/gist_id}","starred_url":"https://api.github.com/users/dolanjs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dolanjs/subscriptions","organizations_url":"https://api.github.com/users/dolanjs/orgs","repos_url":"https://api.github.com/users/dolanjs/repos","events_url":"https://api.github.com/users/dolanjs/events{/privacy}","received_events_url":"https://api.github.com/users/dolanjs/received_events","type":"User","site_admin":false},"open_issues":8,"closed_issues":2,"state":"open","created_at":"2015-06-09T19:17:43Z","updated_at":"2015-06-17T23:58:00Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2015-06-11T18:48:07Z","updated_at":"2015-06-18T23:25:11Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1053","html_url":"https://github.com/freedomofpress/securedrop/pull/1053","diff_url":"https://github.com/freedomofpress/securedrop/pull/1053.diff","patch_url":"https://github.com/freedomofpress/securedrop/pull/1053.patch"},"body":"### Summary:\r\n 1) Adding IPv6 rules to change the behavior for the default chains to `DROP` Fixes #1046 iSEC-15FTC-3 reported by @isecpartners\r\n 2) Changing the IP v4 rules default action for chains to `DROP` Fixes #1046 iSEC-15FTC-3 reported by @isecpartners\r\n 3) Restricting the staging env specific allow direct access rule exemptions to make testing the ssh over tor rule easier.\r\n 4) Moving the ssh over tor IP v4 rules before the more generic tor rule. Fixes iSEC-15FTC-7 reported by @isecpartners\r\n 5) Adding a corresponding drop rule immediately after the ssh rate limiting rule, to ensure that all traffic over the rate-limit will be dropped.\r\n\r\nEach change is contained in its own commit.\r\n\r\n## Changing the default actions for IPv6 chains:\r\n\r\n* Added `rules_v6` file for ansible to copy to the servers.\r\n* Modified the load_iptables script to load the rules_v6 at same time as the rules_v4\r\n\r\nThe default Ubuntu chains/actions are:\r\n```\r\nroot@mon-staging:/home/vagrant# ip6tables -L\r\nChain INPUT (policy ACCEPT)\r\ntarget prot opt source destination\r\n\r\nChain FORWARD (policy ACCEPT)\r\ntarget prot opt source destination\r\n\r\nChain OUTPUT (policy ACCEPT)\r\ntarget prot opt source destination\r\n```\r\n\r\nWith the changes from this PR\r\n\r\n```\r\nroot@app-staging:/home/vagrant# ip6tables -L\r\nChain INPUT (policy DROP)\r\ntarget     prot opt source               destination\r\n\r\nChain FORWARD (policy DROP)\r\ntarget     prot opt source               destination\r\n\r\nChain OUTPUT (policy DROP)\r\ntarget     prot opt source               destination\r\n```\r\n\r\nEven though IPv6 is disabled via sysctl the default ip6table rules should also be changed for defense in depth reasons.\r\n\r\nThis adds the defualt: Input, Forward, Output chains default action to `drop`\r\n\r\n* A respective ansible task was created to place the `rules_v6` config file.\r\n\r\n* The load_iptables script was modified to also load the `rules_v6` config.\r\n\r\n## Changing the default action for IP v4 chains\r\n\r\n* modified rules_v4  for both servers\r\n\r\n```\r\nroot@app-staging:/home/vagrant# iptables -S\r\n-P INPUT DROP\r\n-P FORWARD DROP\r\n-P OUTPUT DROP\r\n-N LOGNDROP\r\n```\r\n## Restricting the allow direct access exemption rules\r\n\r\n* Added restrictions for the interface to the port 80,8080,22 rule that allow direct access. This removed the overlap with the prod ssh over tor iptables rule.\r\n\r\n## Changes to the iptable order.\r\n\r\n* Moved the ssh over tor rules above the more generic tor rule.\r\n* limit-burst is set to 3 which mean that iptables will allow the first 3 new tcp packets and then the rate limit of 3/min kicks in.\r\n* To test the rate limiting you will need to generate over 6 connections in a minute.\r\n\r\n## Add corresponding drop rule after the ssh over tor rate limiting rule\r\n\r\n* Since the more generic OUTPUT tor accept iptables rules would match all traffic over the rate limit, added a specific drop rule immediately after the rate limiting rule that match the interface `lo` destination port `22` that it is from the tor user `debian-tor` and its state is `NEW`.\r\n\r\n### Steps used to generate the required traffic to test iptable rules\r\nSteps used in testing:\r\n\r\n* put updated rules in place\r\n* perform the following function test to generate the needed traffic:\r\n  * ssh using allow direct access exemption\r\n  * ssh over tor using ATHS\r\n  * run apt-get update\r\n  * remove ntp exemption and modify the prod ntp rule for virtual environment to test ntp rule\r\n  * restart servers to register the OSSEC agent to test the traffic.\r\n  * hit the source and doc interface over the allowed direct access exemption\r\n  * hit the source and doc interface over the respective THS\r\n  * generate reddis traffic\r\n  * attempt to create over 6 ssh connections that are proxied over the tor authenticated hidden service in a minute. Verify by looking at the counters for the iptables. `iptables-save -c`\r\n\r\nVerified by looking at the iptables rules counters that this change worked.\r\n\r\n```\r\n[6:360] -A OUTPUT -o lo -p tcp -m tcp --dport 22 -m owner --uid-owner 109 -m state --state NEW -m limit --limit 3/min --limit-burst 3 -m comment --comment \"Rate limit traffic from tor to the ssh server\" -j ACCEPT\r\n[28:1680] -A OUTPUT -o lo -p tcp -m tcp --dport 22 -m owner --uid-owner 109 -m state --state NEW -m comment --comment \"Drop all other new connections from tor to ssh server\" -j LOGNDROP\r\n[1138:91786] -A OUTPUT -o lo -p tcp -m tcp --dport 22 -m owner --uid-owner 109 -m state --state RELATED,ESTABLISHED -m comment --comment \"Allow the established traffic from tor to ssh server\" -j ACCEPT\r\n[777:674290] -A OUTPUT -p tcp -m owner --uid-owner 109 -m state --state NEW,RELATED,ESTABLISHED -m comment --comment \"tor instance that provides ssh access\" -j ACCEPT\r\n[0:0] -A OUTPUT -m owner --uid-owner 109 -m comment --comment \"Drop all other traffic for the tor instance used for ssh\" -j LOGNDROP\r\n```\r\n\r\nDirectly ssh'ing into the servers only matches the allow direct access exemption rule's user ID and interface\r\nSSH'ing over tor only triggers the ssh throttling rule's based on the protocol, port, user id, state\r\nAll other tor traffic matches the generic tor outbound rule based on user ID.\r\n\r\nTo further restrict the generic tor rule we could add the interface using an ansible fact `{{ansible_default_ipv4.interface}}` in the iptable's rule_v4 templates. This is a bigger change that would require more testing and should be a different issue/pr."},"comment":{"url":"https://api.github.com/repos/freedomofpress/securedrop/issues/comments/113317344","html_url":"https://github.com/freedomofpress/securedrop/pull/1053#issuecomment-113317344","issue_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1053","id":113317344,"user":{"login":"conorsch","id":657862,"avatar_url":"https://avatars.githubusercontent.com/u/657862?v=3","gravatar_id":"","url":"https://api.github.com/users/conorsch","html_url":"https://github.com/conorsch","followers_url":"https://api.github.com/users/conorsch/followers","following_url":"https://api.github.com/users/conorsch/following{/other_user}","gists_url":"https://api.github.com/users/conorsch/gists{/gist_id}","starred_url":"https://api.github.com/users/conorsch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/conorsch/subscriptions","organizations_url":"https://api.github.com/users/conorsch/orgs","repos_url":"https://api.github.com/users/conorsch/repos","events_url":"https://api.github.com/users/conorsch/events{/privacy}","received_events_url":"https://api.github.com/users/conorsch/received_events","type":"User","site_admin":false},"created_at":"2015-06-18T23:25:11Z","updated_at":"2015-06-18T23:25:11Z","body":"You can validate the `--limit 3/min --limit-burst 3` options like so:\r\n```\r\n#!/bin/bash\r\nset -u\r\nhost_url=$1\r\n\r\necho \"Sleeping for 90 seconds...\"\r\nsleep 90 # allow iptables limits to reset\r\n\r\necho \"Attempting parallel SSH connections...\"\r\nfor i in $(seq 1 15); do \r\n    (ssh \\\r\n     -l vagrant \\\r\n     -i ~/.vagrant.d/insecure_private_key \\\r\n     $host_url 'echo hello' 2>&1 >/dev/null && \\\r\n    echo SUCCESS || echo FAIL ) & \\\r\ndone | grep -P '(SUCCESS|FAIL)' | sort | uniq -c \r\n```\r\n\r\nYou should see output like this:\r\n\r\n```\r\nSleeping for 90 seconds...\r\nAttempting parallel SSH connections...\r\n      9 FAIL\r\n      6 SUCCESS\r\n```\r\n\r\nThe `6 SUCCESS` matches the `--limit 3/min --limit-burst 3` iptables rules."}}