Ukuqinisekisa nge-PAM kusebenza ngesandla kodwa kwehluleka njengesevisi ye-OpenVPN

Ukuqinisekisa nge-PAM kungaphumelela uma usebenzisa iklayenti ngesandla futhi kuhluleke nge-AUTH_FAILED uma i-systemd iqalisa iphrofayela efanayo. Iphasiwedi ayishintshi phakathi kwaleyo misebenzi; okushintshayo yiqoqo lezingcindezi ezizungeze inqubo ebuza umbuzo ku-PAM. I-PAM iphendula ngomsizi okungamandla akhe okushintsha imininingwane yakhe yokungena okuyikho kanye lokho i-unit eqinisiwe okukususayo. Thola lowo msizi kanye nomngcele awudingayo ngaphambi kokuthinta uhlu lwamakhono.

i-unix_chkpwd iyibhinari ephendula umbuzo we-PAM

Ngokuqinisekisa ngephasiwedi yasendaweni, i-pam_unix ayivamisile ukufunda ifayela le-hash ngokwayo. Isebenzisa i-unix_chkpwd, izinhlobo zokusabalalisa eziyifaka njenge-setuid root noma setgid shadow ukuze iphasiwedi eyodwa ihlolwe egameni lenqubo okungafanele ukuthi ifunde i-/etc/shadow. Susa amandla okuthola lowo muntu, umsizi ngeke akwazi ukuqeda ukuhlola, ngakho imojuli ibuyisela iphutha elijwayelekile lokuqinisekisa.

Iphutha libe selibonakala njengenkinga yemininingwane yokungena kuwo wonke amarekhodi iklayenti eliwabonayo. Lowo umgibe: iklayenti libika lokho i-PAM eyitshele kona, kanti i-PAM ibika kuphela ukuthi isiteki sathi cha. Ukusebenzisa umsizi ngesandla njenge-root nakho akufakazeli lutho, ngoba kusebenzisa indlela yamalungelo isevisi engayisebenzisi neze. Funda i-unit i-systemd eyilayishe ngempela, bese ufunda ilogi yesistimu ngomzamo eyawenzayo. Lezi zimbono ezimbili zihlukanisa inkinga ye-sandbox enkingeni yephasiwedi engalungile.

Funda i-unit ngaphambi kokufunda ilogi yamaphasiwedi

I-unit epakishiwe ingaba ne-drop-in ongayibhalanga, futhi ukuhlelwa okusebenzayo umphumela wokuhlanganisa. Phrinta i-unit njengoba i-systemd iyibona, kanye nezilungiselelo ze-sandbox ezinquma ukuthi umsizi angazikhuphula yini. Ukuhlola ngokufunda kuphela kwanele kulesi sigaba.

systemctl cat [email protected]
systemctl show [email protected] -p User -p Group -p CapabilityBoundingSet -p AmbientCapabilities -p NoNewPrivileges
journalctl -u [email protected] -b

Umyalo wokuqala ukhombisa ukuthi i-unit kanye nama-drop-in ayo avelaphi, okubalulekile ngoba ukuchitshiyelwa okwengezwe ezinyangeni ezedlule kuphila isikhathi eside kunenkumbulo yokuthi kungani kukhona. Owesibili uphrinta amanani e-sandbox izigaba ezimbili ezilandelayo ezincike kuwo.

Qhathanisa lokho okubonayo nehhosti esebenzayo yokufanayo nenguqulo efanayo. Umehluko ku-User, i-CapabilityBoundingSet noma i-NoNewPrivileges wumkhondo oqondile; umehluko emazwini okuchaza awuwona. Bhala amanani ngaphambi kokushintsha noma yini, ngoba ukuqhathanisa kwakamuva nomgomo onyakazayo akufakazeli lutho. Uma isevisi isebenza njenge-akhawunti engenamalungelo neqoqo elingenalutho, umsizi akanakho cishe lutho angasebenza ngalo.

Ukushintshwa kwemininingwane, ukufinyelela amafayela kanye nenqubomgomo yimikhawulo emithathu

Qala ngalokho okwenzeka ngesikhathi se-exec. Ibhinari ye-setuid noma ifayela eliphethe amakhono efayela kubangela ukushintshwa kwemininingwane yokungena, ngakho ubunikazi obumphumela abukona ukuqhubeka komshayi. Iqoqo lomkhawulo likhawulela lokho ibhinari enjalo engakuthola, kanti i-NoNewPrivileges ivimba ngokuphelele ukutholwa kwe-setuid, setgid namakhono efayela. Noma yikuphi kwalokhu kuthathu kungamisa umsizi kuyilapho yonke eminye imisebenzi yesevisi isahleli.

Okulandelayo, hlukanisa ukweqa okubanzi kokubona komuntu ukufinyelela kokufunda okuncane. I-CAP_DAC_OVERRIDE yeqa ukuhlola komuntu cishe kuyo yonke indawo, kuyilapho i-CAP_DAC_READ_SEARCH ihlanganisa ukufunda nokuhamba kwemikhombandlela ngamandla ayo engeziwe. Ngamathuluzi ahlukene anobubanzi obuhlukene, futhi alikho kokubili eliyindlela yokubhala vumela i-PAM ifunde ifayela le-shadow.

Ekugcineni, buza ukuthi inqubomgomo ephoqelekile iyayivumela yini leyo senzo. Ikhono le-Linux aliyegqi i-SELinux, futhi ukuba nalo akufakazeli lutho ngomthetho wokuphoqelela uhlobo. Thatha ukwenqatshwa kokufinyelela kwefayela nokwenqatshwa kwekhono njengobufakazi obuhlukene, ngoba zisho izilungiso ezihlukene futhi ngokuvamile abanikazi abahlukene. Funda yonke inkambu yerekhodi esikhundleni segama elilodwa denied. Iyiphi inkqubo esebenzayo eyenza isenzo, yayisebenza kusiphi isizinda, yathinta uhlobo luni lomgomo, yiluphi uhlobo lwento olwalukhona nokuthi iyiphi imvume inqubomgomo eyinqatshayo - ngakunye kwalokhu kunciphisa impendulo ngendlela ehlukene.

Khipha ukwenqatshwa kumkhondo wokuhlola

Kuhhosti esesimweni se-enforcing, umkhondo wokuhlola uyindawo kuphela eqopha ukwenqatshwa. Buza izehlakalo zakamuva futhi uzifunde ngokuvumelana nesigxivizo sesikhathi sokungena okuhlulekile, hhayi ngokuvumelana nesikhathi oqale ngaso uphenya.

ausearch -m AVC,USER_AVC -ts recent

Umphumela ongenalutho awubona ubufakazi bokungabi nacala. Kusho ukuthi noma ukuhlola akuqoqi, noma iwindi lakho lishaye umzamo, futhi womabili la mathuba kufanele akhishwe ngaphambi kokuthi unqume ukuthi inqubomgomo ayiyona.

Isiqondiso se-Red Hat sokuxazulula izinkinga ze-SELinux sibeka ukuhlola ilebula nokuhlelwa ngaphambi kokukhiqiza imithetho yokuvumela, okuyiyo futhi indlela elungile yale nkinga. Ibhinari yomsizi enelebula elingalungile kanye nesikhala senqubomgomo kukhiqiza ukwenqatshwa okufanayo kodwa kudinga izilungiso ezihlukene. Ukukhiqiza umthetho wokuvumela wephutha lelebula kufihla iphutha futhi kushiye isibuyekezo esilandelayo siphinda sikulethe. Qinisekisa ilebula kumsizi ofakiwe ngaphambi kokubhala noma iyiphi inqubomgomo.

Fakazela ushintsho ngokungena okwamukelwe nokunqatshiwe

Shintsha kuphela umngcele owukhombisile, bese uhlola yomibili imiphumela. I-akhawunti okufanele iqinisekise kufanele iphumelele, futhi i-akhawunti enephasiwedi engalungile kufanele isahluleka. Ushintsho olwenza wonke umzamo uphumelele lususile ukuqinisekisa esikhundleni sokukulungisa.

Yenza umzamo wangempela wokuxhuma bese ufunda ilogi ngokushesha ngemva kwalokho. Umugqa ofakazela isilungiso umugqa we-pam_unix(openvpn:auth) walowo mzamo: kufanele usho ukuphumelela kokuqinisekisa, futhi akukho rekhodi le-AVC okufanele libe nesekhondi elifanayo.

journalctl -u [email protected] -n 30 --no-pager
ss -tnp | grep openvpn

Ithambothi elisebenzayo lidinga nokuxhuma kabusha, ngoba izinguquko ze-sandbox zephula ukuxhuma kwesibili kaningi kunokokuqala. Hlola isokhethi esisunguliwe ngemva kokuxhuma kabusha futhi uqinisekise ukuthi i-unit efanayo isayisebenzela.