Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

Link zu dieser Vergleichsansicht

Beide Seiten der vorigen Revision Vorhergehende Überarbeitung
Nächste Überarbeitung
Vorhergehende Überarbeitung
Nächste ÜberarbeitungBeide Seiten der Revision
content:serverbasics [2023/02/19 08:21] – [What is the problem?] Danielcontent:serverbasics [2023/03/05 16:21] Daniel
Zeile 5: Zeile 5:
 ===== Mountpoints ===== ===== Mountpoints =====
  
-By default openSuSE will set some conservative mountoptions, that are save, but not best choice for homeoffice use and maybe could also improve company servers. Here are some proposals to think about chenging mount Options.+By default openSuSE will set some conservative mountoptions, that are save, but not best choice for homeoffice use and maybe could also improve company servers. Here are some proposals to think about.
  
 ==== LVM ==== ==== LVM ====
Zeile 23: Zeile 23:
  
 For **Databases** or files that need speed and __**are well backed up otherwise**__  : nodatacow,nodatasum,noatime,nodiratime For **Databases** or files that need speed and __**are well backed up otherwise**__  : nodatacow,nodatasum,noatime,nodiratime
- 
- 
 === Sources: === === Sources: ===
  
Zeile 48: Zeile 46:
  
 Quotas are complicated to manage by btrfs. As there are many situations, where the qoutas may get incorrect, they will often be invalidated and will need to be recalculated from scratch. Furthermore checking if they are correct is often needed - e.g. at startup or after some time. This process consumes a lot of cpu and disc utilisation and makes the hardware slow, sometimes rendering a computer useless for some time. Quotas are complicated to manage by btrfs. As there are many situations, where the qoutas may get incorrect, they will often be invalidated and will need to be recalculated from scratch. Furthermore checking if they are correct is often needed - e.g. at startup or after some time. This process consumes a lot of cpu and disc utilisation and makes the hardware slow, sometimes rendering a computer useless for some time.
- 
  
 ==== Solution ==== ==== Solution ====
Zeile 83: Zeile 80:
  
 </code> </code>
 +
 +===== Filesystem and User rights in Linux =====
 +
 +While linux itself is a very secure system (when set up the right way), the rights given to files by default are not secure at all. Setting good rights is not an intuive process and is mostly not well done. So it needs some attention.
 +
 +==== Why care about rights ====
 +
 +If you are the only user on your pc, or your linux pc is a machine for the net, then you maybe fine. But if your pc is shared between some users e.g. in your family and used by some other persons, then you may wish, that personal informations of the one user is not accessible to the other one.
 +
 +Even if your pc is not used by others, there maybe other users on your pc by services running in different accounts, so maybe you want Data not to be visible to any user.
 +
 +==== Test the rights ====
 +
 +Lets start with a simple new file, let's say "~\securedata.txt" with text "secure data" in it. Let say we are user named testuser:
 +
 +New File ~\securedata.txt :
 +
 +<file>
 +testuser@xubuntu-stick:~$ echo secure data> ~/securedata.txt
 +
 +</file>
 +
 +Then become someone else, maybe user testuser2 and read that file:
 +
 +<code>
 +testuser@xubuntu-stick:~$ su -l testuser2
 +Passwort:
 +testuser2@xubuntu-stick:~$
 +
 +</code>
 +
 +Now lets see what the other user has written in its secure file:
 +
 +<code>
 +testuser2@xubuntu-stick:~$ cat ../testuser/securedata.txt
 +cat: ../testuser/securedata.txt: Keine Berechtigung
 +
 +</code>
 +
 +So everything right? No - not quite. Lets say horst decides to store is secure data in another location and do it again:
 +
 +<code>
 +testuser@xubuntu-stick:~$ mv securedata.txt /tmp
 +testuser@xubuntu-stick:~$ su -l testuser2
 +Passwort:
 +testuser2@xubuntu-stick:~$ cat /tmp/securedata.txt
 +secure data
 +
 +</code>
 +
 +So now the data the one user created is not secure any more. Well ok this sounds fine, because the data was moved to an insecure directory.
 +
 +But: Can you make sure that everybody knows which directories are secure and which aren't? Can you be really sure, that no personal information saved by any user-context-program is written only to secure directories and not visible to the other? I guess not.
 +
 +So it may be a better approach to not make the files created by someone readable by other user by default.
 +
 +==== UMask- Approach ====
 +
 +There ist a tool for this called umask. This tool defines the permission for new created files.
 +
 +By default the umask is 0002 or 0022. Those values are substracted from 0777, which would mean full access for everyone. You can check out the docs in the net how they work. I won't explain here, cause there is a big problem with umask: The value can only be changed on process level or user or systemwide. This means you cannot set them per directory - which would be intentional to the user.
 +
 +So forget about umask.
 +
 +==== FACLs ====
 +
 +F… what??? Yes: facl is the tool to do so. with that tool you can very much expand the rights per directory an on every file in detail. It ist also possible to have multiple group- access definitions, which are not possible otherwise.
 +
 +So lets do some facl- work:
 +
 +<code>
 +testuser@xubuntu-stick:~$ mkdir temp
 +testuser@xubuntu-stick:~$ getfacl temp
 +# file: temp
 +# owner: testuser
 +# group: testuser
 +user::rwx
 +group::rwx
 +other::r-x
 +
 +</code>
 +
 +As you can see, that directory has been created quite insecure. There is only the above permission preventing everyone to read the informations in it. Creating a new file in it, would make it the same way insecure, as it would have been before.
 +
 +But now lets set the mode to better fit our needs:
 +
 +<code>
 +testuser@xubuntu-stick:~$ setfacl -m d:o::--- temp
 +testuser@xubuntu-stick:~$ getfacl temp
 +# file: temp
 +# owner: testuser
 +# group: testuser
 +user::rwx
 +group::rwx
 +other::r-x
 +default:user::rwx
 +default:group::rwx
 +default:other::---
 +
 +</code>
 +
 +Note, that we only changed the DEFAULT permissions to be more secure (d:).
 +
 +Now lets again create a file there as we did before just in that - safe - directory. Also we can use getfacl on that file to check if it works:
 +
 +<code>
 +testuser@xubuntu-stick:~$ echo secure data> ~/temp/securedata.txt
 +testuser@xubuntu-stick:~$ getfacl temp/securedata.txt
 +# file: temp/securedata.txt
 +# owner: testuser
 +# group: testuser
 +user::rw-
 +group::rw-
 +other::---
 +
 +</code>
 +
 +As you can see, that file is more secure than before. So lets check, what happens now if we move that file as before.
 +
 +<code>
 +testuser@xubuntu-stick:~$ rm /tmp/securedata.txt
 +testuser@xubuntu-stick:~$ mv temp/securedata.txt /tmp
 +
 +</code>
 +
 +And check if it is accessible by another one:
 +
 +<code>
 +testuser@xubuntu-stick:~$ su -l testuser2
 +Passwort:
 +testuser2@xubuntu-stick:~$ cat /tmp/securedata.txt
 +cat: /tmp/securedata.txt: Keine Berechtigung
 +
 +</code>
 +
 +You can also check the rights now:
 +
 +<code>
 +testuser2@xubuntu-stick:~$ getfacl /tmp/securedata.txt
 +getfacl: Entferne führende '/' von absoluten Pfadnamen
 +# file: tmp/securedata.txt
 +# owner: testuser
 +# group: testuser
 +user::rw-
 +group::rw-
 +other::---
 +
 +</code>
 +
 +Now "Testuser2" knows, that he has to ask "Testuser" to tell him the secret he wrote in that file.
 +
 +That way you can also have one or more default group(s) assigned and to give only those groups access to the file(s), which is very powerful. As for the user perspective i would rate that approach more secure, than the default one.
 +
 +Its up to you to decide if this is more usable or not.
 +
 +==== Last words ====
 +
 +Some other intersting aspects:
 +
 +  * There are some interesting usages of the sticky bits for a. the user and group- bit and b. to files and directories in seperate
 +  * Mind, that only the user of the file can change its ownership. Per default all files created by the user are owned by the user.
 +  * That means: If you don't want a user be able to change the ownership of a file into insecure permissions, it may be a good way to set the default user of files in the directory to root and only allow group- access to it. That way directories can be read and written, but not the content will not be opened to everyone by some hacky user (or virus in the last mail of that user?)
 +
 +All in all thinking about permissions is a basic one whenever there is personal data that needs to be secured somehow. One cannot rely on the defaults and hope its all fine.
 +
 +And with FACLs there are powerful tools that should cover everything an administrator needs.
  
  
  • content/serverbasics.txt
  • Zuletzt geändert: 2024/01/08 18:59
  • von Daniel