Attack Surface Reduction - lighttpd as non-root

[sol4r]

Hi

Due to all the vulnerabilities in $commercial_vendor_appliance lately I am thinking a lot about how we could reduce the attack surface in OpnSense.

One thing that bothers me is the Web Interface.. How can we reduce the harm if someone could exploit a vulnerability in it?
lightttpd runs as root currently so an attacker can do pretty much everything.
- write/modify files (backdooring php files for example)
- start new processes
- create network connections

I believe the harm would be greatly reduced if we would change lighttpd user to a different user that has very limited write permissions (not in webroot for example)

According to the documentation that should be doable:
https://redmine.lighttpd.net/projects/lighttpd/wiki/Server_usernameDetails

Before I dig too deep into it:
- Did someone already do/try that?
- Is there a reason why lighttpd needs to run as root?
- yes it's not only about lighttpd but also php-cgi .. but let's just start with lighttpd

[meyergru]

That would not help much, because most of the operations that the web UI does, need higher privileges.

So, in order to do that, you would need to identify all the spots where this is neccessary and allow the lighhttp user to sudo the commands (which is tedious work) and even then, there is a bunch of operations that could be exploited just because they actually will be executed as root.

The logical approach is to only allow access to your web UI from trusted sources - i.e. interfaces, networks or specific IPs. If you want to access the web UI from outside, use a VPN.

[sol4r]

Agreed. Thats a ton of work.

Reality is that according to shodan/censys around 30k systems worldwide have their webinterface exposed.
While some people deserve getting hacked I think that reducing the attack surface is a desirable goal for a 'network security solution' like opnsense. :-)

[Monviech (Cedrik)]

This is also an issue on FreeBSD

https://github.com/opnsense/core/issues/7419

[franco]

It's a long term goal since the start. The new MVC code should be capable of dropping privileges, but the old static PHP code is not. Every static page needs to be removed first. I think after a decade we are about 70% complete...


Cheers,
Franco

[gstrauss]

Yes, lighttpd can run as non-root.

For binding to privileged ports, lighttpd can be run from inetd/xinetd, or lighttpd can accept systemd socket activation (or something else privileged setting the simple environment variables and providing the listening ports on already-open file descriptors when starting lighttpd).  Another option is a small daemon I wrote over a decade ago: https://github.com/gstrauss/bsock which can run on just about any unix-like system which supports passing file descriptors over unix domain sockets.

PHP scripts are potentially more vulnerable than lighttpd, and the PHP would still need to be able to run privileged commands.  As an interim step, you could have lighttpd start up the PHP fastcgi server as root via a setuid script, but it would be better to have the PHP run as non-root, too, and be permitted to run specific commands with privileges by another set of scripts which checks the arguments before running the commands as root.

[Monviech (Cedrik)]

Using this would leverage existing subsystems of FreeBSD that allow binding to privileged ports with unprivileged users:

https://github.com/Freaky/portacl-rc

But I'm sure there is a different reason for it running as root.