OpenBSD Journal

Privsep for syslogd

Contributed by jose on from the split-logging dept.

OpenBSD now has privsep for syslogd , meaning networked syslog connections now have some risk mitigation built in. Check this out in -current if you have the chance and start using it on your syslog servers.

(Comments are closed)

Comments

  1. By willb () on

    This is another great step for OpenBSD. More systems need to be developed assuming mistakes will be made. Priv Sep is a good way to reduce the risks of mistakes. Just like a ship, compartmentalization helps. The OpenBSD team should be commended for working in this direction. There is a lot of pressure to add new functionality, but the team is sticking to security design first. Sure, OpenBSD does not like a 4-way machine, but that only gets hacked faster if things are not done right.

  2. By Anonymous Coward () on

    This sounds like a step forward, let's just clarify.

    Instead of remote root if there is a remote bug in syslogd, the attacker could become a non-root user on the system.

    Why not just vpn all system services and block all ports except for the VPN. That way your much safer. And then focus all security efforts, code audits on the VPN software.

    Comments

    1. By Anonymous Coward () on

      So one bug in the VPN can make the entire system vulnerable? Make everything compartmentalized, so if it is comprimised, you have some protection. Why not systrace everything, rather than VPN it. That'll give you better security (over VPN), while still keeping the single point of failure, that you desire. ;-)

    2. By Anil () avsm@ on mailto:avsm@

      Instead of remote root if there is a remote bug in syslogd, the attacker could become a non-root user on the system.

      Well, they would become the _syslogd user, but trapped inside a /var/empty chroot with no privilege except that granted by the priv parent (they can open logfiles for appending only, write to terminals, read utmp). If the priv parent smells any dodgy requests coming from the child, it'll kill itself, leaving the child with no privilege at all.

      Why not just vpn all system services and block all ports except for the VPN.

      Err... what?

    3. By pogi na si psyg mabait pa () on

      "Why not just vpn all system services and block all ports except for the VPN."

      this is a joke. isn't it? but thanks. you made me laugh :D

      "That way your much safer."

      more jokes. rotflmao

    4. By Anonymous Coward () on

      This sounds very close to the argument for writing all network services in Java. Single point of failure...

    5. By Henrik Holmboe () on

      How would you build in vpn capabilities (ipsec I presume?) into closed boxed appliances? Many networked systems such as printers, routers etc has the possibility to use a remote syslog server, but it would be cumbersome to vpn-enable them.

  3. By hurm () on

    e.g. make all logs sourcing from a specific remote host go to /var/log/REMOTEHOST instead of the main logs

    syslog-ng does this

    Comments

    1. By Anonymous Coward () on

      Then install syslog-ng. What's the problem?

  4. By Jeffrey () on

    Yes, this is certainly good to have privsep addition. OTOH, don't listen for and accept network input if you don't need it. Granted, OpenBSD is not using the '-u' flag by default; I guess this has the same effect as the '-s' flag in NetBSD's syslogd.

    Yes, looks like the effect is the same on both.

    Anyway, yay for privsep! =)

Latest Articles

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]