Attack Surface Reduction - lighttpd as non-root

[sol4r]

Hi

Due to all the vulnerabilities in $commercial_vendor_appliance lately I am thinking a lot about how we could reduce the attack surface in OpnSense.

One thing that bothers me is the Web Interface.. How can we reduce the harm if someone could exploit a vulnerability in it?
lightttpd runs as root currently so an attacker can do pretty much everything.
- write/modify files (backdooring php files for example)
- start new processes
- create network connections

I believe the harm would be greatly reduced if we would change lighttpd user to a different user that has very limited write permissions (not in webroot for example)

According to the documentation that should be doable:
https://redmine.lighttpd.net/projects/lighttpd/wiki/Server_usernameDetails

Before I dig too deep into it:
- Did someone already do/try that?
- Is there a reason why lighttpd needs to run as root?
- yes it's not only about lighttpd but also php-cgi .. but let's just start with lighttpd

[meyergru]

That would not help much, because most of the operations that the web UI does, need higher privileges.

So, in order to do that, you would need to identify all the spots where this is neccessary and allow the lighhttp user to sudo the commands (which is tedious work) and even then, there is a bunch of operations that could be exploited just because they actually will be executed as root.

The logical approach is to only allow access to your web UI from trusted sources - i.e. interfaces, networks or specific IPs. If you want to access the web UI from outside, use a VPN.

[sol4r]

Agreed. Thats a ton of work.

Reality is that according to shodan/censys around 30k systems worldwide have their webinterface exposed.
While some people deserve getting hacked I think that reducing the attack surface is a desirable goal for a 'network security solution' like opnsense. :-)

[Monviech (Cedrik)]

This is also an issue on FreeBSD

https://github.com/opnsense/core/issues/7419

[franco]

It's a long term goal since the start. The new MVC code should be capable of dropping privileges, but the old static PHP code is not. Every static page needs to be removed first. I think after a decade we are about 70% complete...


Cheers,
Franco