3 ms·
I like this! It's tiny, simple, yet effective. 2019-03-22T19:54:06.303Z ACCEPT host=::ffff:196.52.43.xx port=50327 fd=4 n=1/4096
by LinuxBender 8y ago
I like this! It's tiny, simple, yet effective.
2019-03-22T19:54:06.303Z ACCEPT host=::ffff:196.52.43.xx port=50327 fd=4 n=1/4096
2019-03-22T19:54:38.838Z CLOSE host=::ffff:196.52.43.xx port=50327 fd=4 time=32.535 bytes=199
2019-03-22T19:57:12.008Z ACCEPT host=::ffff:141.98.81.xx port=53646 fd=4 n=1/4096
2019-03-22T19:57:21.118Z CLOSE host=::ffff:141.98.81.xx port=53646 fd=4 time=9.110 bytes=30
The 141 bot never stays longer than 5 seconds. I'm guessing they are using 'expect' and waiting 5 seconds for a particular string.
The only thing missing is setting some glibc hardening options
RELRO STACK CANARY NX PIE RPATH RUNPATH FORTIFY Fortified Fortifiable FILE
Partial RELRO No canary found NX enabled No PIE No RPATH No RUNPATH No 0 8 ./endlessh
I modified one line in the Makefile
CFLAGS = -std=c99 -Wall -Wextra -Wno-missing-field-initializers -D_FORTIFY_SOURCE=2 -O2 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -ftrapv -s -g -Wl,-z,relro,-z,now -Wl,-z,noexecstack -pipe -Wp,-D_GLIBCXX_ASSERTIONS -fstack-protector-strong -fstack-clash-protection --param ssp-buffer-size=4 -fPIE -pie -m64 -mtune=generic
It's better now
RELRO STACK CANARY NX PIE RPATH RUNPATH FORTIFY Fortified Fortifiable FILE
Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH Yes 3 4 ./endlessh
- velcrovan 8y agoYou should submit a pull request!
- LinuxBender 8y agoThe thought crossed my mind, but I am lazy and the proper change would be to write a configure script that checks for the availability of the various hardening options. There are decent examples in the Tor source code.
- LukeShu 8y agoThanks for introducing me to `checksec`!
- LinuxBender 8y agoMy pleasure!
- 1996 8y agoSuggestion for Debian: if you get error: unrecognized command line option ‘-fstack-clash-protection’; did you mean ‘-fstack-protector’, do: echo "deb http://ftp.us.debian.org/debian/ http://ftp.us.debian.org/debian/ testing main non-free contrib deb-src http://ftp.us.debian.org/debian/ http://ftp.us.debian.org/debian/ testing main non-free contrib" > /etc/apt/source.list.d/debian-testing.list apt-get update apt-get install gcc-8/testing The Makefile can then contain the above line: CFLAGS = -std=c99 -Wall -Wextra -Wno-missing-field-initializers -D_FORTIFY_SOURCE=2 -O2 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -ftrapv -s -g -Wl,-z,relro,-z,now -Wl,-z,noexecstack -pipe -Wp,-D_GLIBCXX_ASSERTIONS -fstack-protector-strong -fstack-clash-protection --param ssp-buffer-size=4 -fPIE -pie -m64 -mtune=generic and: CC = gcc-8 Replace -mtune=generic by your CPU, cf https://wiki.gentoo.org/wiki/Safe_CFLAGS https://wiki.gentoo.org/wiki/Safe_CFLAGS
- dfox 8y agoDo you realize that the thing does not process any attacker controlled input and thus all the hardening is completely pointless exercise?
- joh6nn 8y agoThe number of times in my life that I have seen "this should never happen" scroll by on STDOUT suggests that it's time well spent.
- dfox 8y agoIf you cannot trust that 725 line program without any mention of recv() nor read() will never call recv() or read() on network socket then you have much larger reliability (not security, because whether something that is broken to the point of being unusable is secure or not is completely irrelevant) issue in your system that is not going to go away by applying random hardening options to said program.
- LinuxBender 8y agoIf it opens a socket, it gets hardening. It's just a best practice I follow. Code can change. Subtle changes can lead to gaps, so I wrap that rascal regardless.
- LinuxBender 8y agoI've been running this for a couple days now. In summary, about 85% of the bots give up in 5 to 30 seconds. The remainder of them will remain stuck anywhere from 700 to 9000 seconds. It is at least interesting to see how bots have evolved.