4 ms·
Encapsulating parts in their jails is a good security measure. But this is not anything related to securing the SSL. It's about securing your system. But giving
by fsniper 17y ago
Encapsulating parts in their jails is a good security measure. But this is not anything related to securing the SSL. It's about securing your system. But giving a "my cgi's are secure but I can't believe in Apache's security" thought to your customers is not a correct way I think.
I can't find any statistics right now but AFAIK security breach sources are mostly not the servers but user applications running over them.
- cperciva 17y agoBut this is not anything related to securing the SSL. It's about securing your system. Nonsense. This configuration both keeps other parts of my system safe from bugs in OpenSSL and keeps the SSL certificate safe from bugs in Apache. I can't find any statistics right now but AFAIK security breach sources are mostly not the servers but user applications running over them. Quite true, in general. But in my particular case I have far more confidence in my (very simple) CGI scripts than I have in Apache.
- fsniper 17y agoI'm not talking about securing the certificate. I'm talking about SSL protocol implementation. But what you are telling about securing both parts are true.
- Davertron 17y agoI would add that there are more than likely far more people trying to exploit Apache than are trying to exploit your particular CGI scripts :)
- tptacek 17y agoThe opposite is true.
- briansmith 17y agoOpenSSL is the part of the stack least likely to have an exploit. Additionally, most interesting attacks on OpenSSL aren't done to root the system, but to subvert the level of authentication/privacy afforded by TLS.
- cperciva 17y agoOpenSSL is the part of the stack least likely to have an exploit. I've had to write or be involved in writing 7 FreeBSD security advisories related to OpenSSL in the past six years. History indicates that OpenSSL is the most likely part of the stack to have a vulnerability.
- fsniper 17y ago7 advisory for 6 years? is it 1 advisory for year?
- briansmith 17y agoThat's ~1.16 advisories per year. Show me an operating system, web server, and web application platform (Java, RoR, PHP, whatever) that average less than ~1.16 per year each. Further, out of all of the advisories for OpenSSL, how many would be mitigated using the technique from the article? Few or none, because most security issues in OpenSSL are about the way it implements the protocols (problems in the PRNG, problems parsing X.509, etc.).
- tptacek 17y agoOpenSSL is somewhat notorious for being a high-maintenance codebase. I personally think jailing it is overkill, but this argument (about whether the code is perfectly safe for a pre-auth attack surface) is a rathole.
- tptacek 17y agoAnd, being intimately familiar with what those advisories implied, I know how many of those had any impact on your system, and how many of them were well-addressed by FreeBSD jails. You're overstating your case, Colin.
- cperciva 17y agoMy case wasn't that this would have protected me from past vulnerabilities in OpenSSL; my case was that OpenSSL is demonstrably crappy code. If code has a history of security vulnerabilities, odds are that it will have more in the future.