tinc - Jan 2014 - Security: Best practices, apparmor, -L, -R, -U

Hey List, Hey Guus,

I would now like to secure my tinc installation. From the man page I see
the following.

-L
I put EXTRA="-L" in /etc/default/tinc and tinc still works.

-R
Do I have to put libraries and device files under /etc/tinc/NETNAME to
build a functional chroot jail ?
Currently lsof reports these open resources for tincd:
lsof -p $( pgrep tincd ) -n
COMMAND   PID USER   FD   TYPE             DEVICE SIZE/OFF    NODE NAME
tincd   15136 root  cwd    DIR              252,0     4096       2 /
tincd   15136 root  rtd    DIR              252,0     4096       2 /
tincd   15136 root  txt    REG              252,0   143256  552711
/usr/sbin/tincd
tincd   15136 root  mem    REG              252,0    97144   32279
/lib/x86_64-linux-gnu/libresolv-2.17.so
tincd   15136 root  mem    REG              252,0    27048   32283
/lib/x86_64-linux-gnu/libnss_dns-2.17.so
tincd   15136 root  mem    REG              252,0    52160   32289
/lib/x86_64-linux-gnu/libnss_files-2.17.so
tincd   15136 root  mem    REG              252,0  1853400   32295
/lib/x86_64-linux-gnu/libc-2.17.so
tincd   15136 root  mem    REG              252,0    14664   32296
/lib/x86_64-linux-gnu/libdl-2.17.so
tincd   15136 root  mem    REG              252,0   133160   30517
/lib/x86_64-linux-gnu/liblzo2.so.2.0.0
tincd   15136 root  mem    REG              252,0   100728   30619
/lib/x86_64-linux-gnu/libz.so.1.2.8
tincd   15136 root  mem    REG              252,0  1934816   30731
/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
tincd   15136 root  mem    REG              252,0   149312   32284
/lib/x86_64-linux-gnu/ld-2.17.so
tincd   15136 root    0u   CHR                1,3      0t0    1029 /dev/null
tincd   15136 root    1u   CHR                1,3      0t0    1029 /dev/null
tincd   15136 root    2u   CHR                1,3      0t0    1029 /dev/null
tincd   15136 root    3u  unix 0xffff8800c1d35180      0t0 1316446 socket
tincd   15136 root    4u   CHR             10,200      0t0    1170
/dev/net/tun
tincd   15136 root    5u  IPv4            1315534      0t0     TCP *:PPP
(LISTEN)
tincd   15136 root    6u  IPv4            1315535      0t0     UDP *:PPP
tincd   15136 root    7u  IPv6            1315536      0t0     TCP *:PPP
(LISTEN)
tincd   15136 root    8u  IPv6            1315537      0t0     UDP *:PPP
tincd   15136 root    9u  IPv4            1315541      0t0     TCP
XX.XX.XX.XX:PP->XX.XX.XX.XX:PP (ESTABLISHED)
tincd   15136 root   10u  IPv4            1315542      0t0     TCP
XX.XX.XX.XX:PP->XX.XX.XX.XX:PP (ESTABLISHED)
tincd   15136 root   11u  IPv4            1315543      0t0     TCP
XX.XX.XX.XX:PP->XX.XX.XX.XX:PP (ESTABLISHED)
tincd   15136 root   12u  IPv4            1315554      0t0     TCP
XX.XX.XX.XX:PP->XX.XX.XX.XX:PP (ESTABLISHED)

-U
Can I use user nobody or shall I better use an extra tincvpn user ?
Right now tinc is running as root

Apparmor ? Anybody got a profile ?

Or good ideas ?

BR
P.

On Tue, Jan 07, 2014 at 03:30:53PM +0100, Phooraalai wrote:
> I would now like to secure my tinc installation. From the man page I see
> the following.
> 
> -L
> I put EXTRA="-L" in /etc/default/tinc and tinc still works.
Note that if you use -L and -U together, then it might be that the maximum
amount of memory that tinc can use is too limited. You can change this by
adding this line to /etc/default/tinc:

ulimit -l 1024

(See the manpage of dash to find out more about the ulimit command.)
> -R
> Do I have to put libraries and device files under /etc/tinc/NETNAME to
> build a functional chroot jail ?
No, tinc loads the libraries it depends on, opens the tun/tap device and runs
tinc-up before it chroots itself. However, if you have any other scripts that
you want tinc to run, then you have to make sure everything necessary for those
scripts is in the chroot environment.
> -U
> Can I use user nobody or shall I better use an extra tincvpn user ?
> Right now tinc is running as root
Having an extra tincvpn user is safer.

-- 
Met vriendelijke groet / with kind regards,
     Guus Sliepen <guus at tinc-vpn.org>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL:
<http://www.tinc-vpn.org/pipermail/tinc/attachments/20140107/3f3fe091/attachment.sig>