2e8934be40
This required moving files around in the repository and shifting from a master.adoc structure to _topic_map.yml, etc. README and Makefile modified slightly to reflect new build process
410 lines
No EOL
20 KiB
HTML
410 lines
No EOL
20 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta content="IE=edge" http-equiv="X-UA-Compatible">
|
|
<meta content="width=device-width, initial-scale=1.0" name="viewport">
|
|
<title>Defensive Coding Guide | Defensive Coding Guide | Implementing Security Features | Authentication and Authorization</title>
|
|
|
|
<!-- Bootstrap -->
|
|
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css">
|
|
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap-theme.min.css">
|
|
|
|
<!-- Overpass Font -->
|
|
<link rel="stylesheet" href="https://overpass-30e2.kxcdn.com/overpass.css">
|
|
|
|
<link href="../../../master/_stylesheets/asciibinder.css" rel="stylesheet" />
|
|
|
|
<!-- HTML5 shim and Respond.js for IE8 support of HTML5 elements and media queries -->
|
|
<!-- WARNING: Respond.js doesn't work if you view the page via file:// -->
|
|
<!--[if lt IE 9]>
|
|
<script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
|
|
<script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
|
|
<![endif]-->
|
|
|
|
<link href="../../../master/_images/favicon32x32.png" rel="shortcut icon" type="text/css">
|
|
<!--[if IE]><link rel="shortcut icon" href="../../../master/_images/favicon.ico"><![endif]-->
|
|
<meta content="AsciiBinder" name="application-name">
|
|
</head>
|
|
<body>
|
|
<div class="navbar navbar-default" role="navigation">
|
|
<div class="container-fluid">
|
|
<div class="navbar-header">
|
|
<a class="navbar-brand" href="https://docs.fedoraproject.org/"><img alt="Fedora Documentation" src="../../../master/_images/fedora.svg"></a>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="container">
|
|
<p class="toggle-nav visible-xs pull-left">
|
|
<button class="btn btn-default btn-sm" type="button" data-toggle="offcanvas">Toggle nav</button>
|
|
</p>
|
|
<ol class="breadcrumb">
|
|
<li class="sitename">
|
|
<a href="../../../index.html">Home</a>
|
|
</li>
|
|
<li class="hidden-xs active">
|
|
<a href="../../en-US/index.html">Defensive Coding Guide </a>
|
|
</li>
|
|
<li class="hidden-xs active">
|
|
<a href="../../en-US/index.html">Defensive Coding Guide</a>
|
|
</li>
|
|
<li class="hidden-xs active"><a href="../../en-US/features/Features-Authentication.html">Implementing Security Features</a></li>
|
|
<li class="hidden-xs active">
|
|
Authentication and Authorization
|
|
</li>
|
|
</ol>
|
|
<div class="row row-offcanvas row-offcanvas-left">
|
|
<div class="col-xs-8 col-sm-3 col-md-3 sidebar sidebar-offcanvas">
|
|
<ul class="nav nav-sidebar">
|
|
<li class="nav-header">
|
|
<a class="" href="#" data-toggle="collapse" data-target="#topicGroup0">
|
|
<span id="tgSpan0" class="fa fa-angle-down"></span>Defensive Coding Guide
|
|
</a>
|
|
<ul id="topicGroup0" class="collapse in list-unstyled">
|
|
<li><a class="" href="../../en-US/index.html">Book Information</a></li>
|
|
<li class="nav-header">
|
|
<a class="" href="#" data-toggle="collapse" data-target="#topicSubGroup-0-1">
|
|
<span id="sgSpan-0-1" class="fa fa-caret-right"></span> Programming Languages
|
|
</a>
|
|
<ul id="topicSubGroup-0-1" class="nav-tertiary list-unstyled collapse">
|
|
<li><a class="" href="../../en-US/programming-languages/C.html">The C Programming Language</a></li>
|
|
<li><a class="" href="../../en-US/programming-languages/CXX.html">The C++ Programming Language</a></li>
|
|
<li><a class="" href="../../en-US/programming-languages/Java.html">The Java Programming Language</a></li>
|
|
<li><a class="" href="../../en-US/programming-languages/Python.html">The Python Programming Language</a></li>
|
|
<li><a class="" href="../../en-US/programming-languages/Shell.html">Shell Programming and bash</a></li>
|
|
<li><a class="" href="../../en-US/programming-languages/Go.html">The Go Programming Language</a></li>
|
|
<li><a class="" href="../../en-US/programming-languages/Vala.html">The Vala Programming Language</a></li>
|
|
</ul>
|
|
</li>
|
|
<li class="nav-header">
|
|
<a class="" href="#" data-toggle="collapse" data-target="#topicSubGroup-0-2">
|
|
<span id="sgSpan-0-2" class="fa fa-caret-right"></span> Specific Programming Tasks
|
|
</a>
|
|
<ul id="topicSubGroup-0-2" class="nav-tertiary list-unstyled collapse">
|
|
<li><a class="" href="../../en-US/tasks/Tasks-Library_Design.html">Library Design</a></li>
|
|
<li><a class="" href="../../en-US/tasks/Tasks-Descriptors.html">File Descriptor Management</a></li>
|
|
<li><a class="" href="../../en-US/tasks/Tasks-File_System.html">File System Manipulation</a></li>
|
|
<li><a class="" href="../../en-US/tasks/Tasks-Temporary_Files.html">Temporary Files</a></li>
|
|
<li><a class="" href="../../en-US/tasks/Tasks-Processes.html">Processes</a></li>
|
|
<li><a class="" href="../../en-US/tasks/Tasks-Serialization.html">Serialization and Deserialization</a></li>
|
|
<li><a class="" href="../../en-US/tasks/Tasks-Cryptography.html">Cryptography</a></li>
|
|
<li><a class="" href="../../en-US/tasks/Tasks-Packaging.html">RPM Packaging</a></li>
|
|
</ul>
|
|
</li>
|
|
<li class="nav-header">
|
|
<a class="" href="#" data-toggle="collapse" data-target="#topicSubGroup-0-3">
|
|
<span id="sgSpan-0-3" class="fa fa-caret-down"></span> Implementing Security Features
|
|
</a>
|
|
<ul id="topicSubGroup-0-3" class="nav-tertiary list-unstyled collapse in">
|
|
<li><a class=" active" href="../../en-US/features/Features-Authentication.html">Authentication and Authorization</a></li>
|
|
<li><a class="" href="../../en-US/features/Features-TLS.html">Transport Layer Security (TLS)</a></li>
|
|
<li><a class="" href="../../en-US/features/Features-HSM.html">Hardware Security Modules and Smart Cards</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="" href="../../en-US/Revision_History.html">Revision History</a></li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
</div>
|
|
<div class="col-xs-12 col-sm-9 col-md-9 main">
|
|
<div class="page-header">
|
|
<h2>Authentication and Authorization</h2>
|
|
</div>
|
|
<div class="sect1">
|
|
<h2 id="sect-Defensive_Coding-Authentication-Server"><a class="anchor" href="#sect-Defensive_Coding-Authentication-Server"></a>Authenticating Servers</h2>
|
|
<div class="sectionbody">
|
|
<div class="paragraph">
|
|
<p>When connecting to a server, a client has to make sure that it
|
|
is actually talking to the server it expects. There are two
|
|
different aspects, securing the network path, and making sure
|
|
that the expected user runs the process on the target host.
|
|
There are several ways to ensure that:</p>
|
|
</div>
|
|
<div class="ulist">
|
|
<ul>
|
|
<li>
|
|
<p>The server uses a TLS certificate which is valid according
|
|
to the web browser public key infrastructure, and the client
|
|
verifies the certificate and the host name.</p>
|
|
</li>
|
|
<li>
|
|
<p>The server uses a TLS certificate which is expected by the
|
|
client (perhaps it is stored in a configuration file read by
|
|
the client). In this case, no host name checking is
|
|
required.</p>
|
|
</li>
|
|
<li>
|
|
<p>On Linux, UNIX domain sockets (of the
|
|
<code>PF_UNIX</code> protocol family, sometimes called
|
|
<code>PF_LOCAL</code>) are restricted by file system
|
|
permissions. If the server socket path is not
|
|
world-writable, the server identity cannot be spoofed by
|
|
local users.</p>
|
|
</li>
|
|
<li>
|
|
<p>Port numbers less than 1024 (<strong>trusted
|
|
ports</strong>) can only be used by
|
|
<code>root</code>, so if a UDP or TCP server is
|
|
running on the local host and it uses a trusted port, its
|
|
identity is assured. (Not all operating systems enforce the
|
|
trusted ports concept, and the network might not be trusted,
|
|
so it is only useful on the local system.)</p>
|
|
</li>
|
|
</ul>
|
|
</div>
|
|
<div class="paragraph">
|
|
<p>TLS (<a href="#chap-Defensive_Coding-TLS">[chap-Defensive_Coding-TLS]</a>) is the
|
|
recommended way for securing connections over untrusted
|
|
networks.</p>
|
|
</div>
|
|
<div class="paragraph">
|
|
<p>If the server port number is 1024 is higher, a local user can
|
|
impersonate the process by binding to this socket, perhaps after
|
|
crashing the real server by exploiting a denial-of-service
|
|
vulnerability.</p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="sect1">
|
|
<h2 id="sect-Defensive_Coding-Authentication-Host_based"><a class="anchor" href="#sect-Defensive_Coding-Authentication-Host_based"></a>Host-based Authentication</h2>
|
|
<div class="sectionbody">
|
|
<div class="paragraph">
|
|
<p>Host-based authentication uses access control lists (ACLs) to
|
|
accept or deny requests from clients. This authentication
|
|
method comes in two flavors: IP-based (or, more generally,
|
|
address-based) and name-based (with the name coming from DNS or
|
|
<code>/etc/hosts</code>). IP-based ACLs often use
|
|
prefix notation to extend access to entire subnets. Name-based
|
|
ACLs sometimes use wildcards for adding groups of hosts (from
|
|
entire DNS subtrees). (In the SSH context, host-based
|
|
authentication means something completely different and is not
|
|
covered in this section.)</p>
|
|
</div>
|
|
<div class="paragraph">
|
|
<p>Host-based authentication trust the network and may not offer
|
|
sufficient granularity, so it has to be considered a weak form
|
|
of authentication. On the other hand, IP-based authentication
|
|
can be made extremely robust and can be applied very early in
|
|
input processing, so it offers an opportunity for significantly
|
|
reducing the number of potential attackers for many services.</p>
|
|
</div>
|
|
<div class="paragraph">
|
|
<p>The names returned by <code>gethostbyaddr</code> and
|
|
<code>getnameinfo</code> functions cannot be trusted.
|
|
(DNS PTR records can be set to arbitrary values, not just names
|
|
belong to the address owner.) If these names are used for ACL
|
|
matching, a forward lookup using
|
|
<code>gethostbyaddr</code> or
|
|
<code>getaddrinfo</code> has to be performed. The name
|
|
is only valid if the original address is found among the results
|
|
of the forward lookup (<strong>double-reverse
|
|
lookup</strong>).</p>
|
|
</div>
|
|
<div class="paragraph">
|
|
<p>An empty ACL should deny all access (deny-by-default). If empty
|
|
ACLs permits all access, configuring any access list must switch
|
|
to deny-by-default for all unconfigured protocols, in both
|
|
name-based and address-based variants.</p>
|
|
</div>
|
|
<div class="paragraph">
|
|
<p>Similarly, if an address or name is not matched by the list, it
|
|
should be denied. However, many implementations behave
|
|
differently, so the actual behavior must be documented properly.</p>
|
|
</div>
|
|
<div class="paragraph">
|
|
<p>IPv6 addresses can embed IPv4 addresses. There is no
|
|
universally correct way to deal with this ambiguity. The
|
|
behavior of the ACL implementation should be documented.</p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="sect1">
|
|
<h2 id="sect-Defensive_Coding-Authentication-UNIX_Domain"><a class="anchor" href="#sect-Defensive_Coding-Authentication-UNIX_Domain"></a>UNIX Domain Socket Authentication</h2>
|
|
<div class="sectionbody">
|
|
<div class="paragraph">
|
|
<p>UNIX domain sockets (with address family
|
|
<code>AF_UNIX</code> or <code>AF_LOCAL</code>) are
|
|
restricted to the local host and offer a special authentication
|
|
mechanism: credentials passing.</p>
|
|
</div>
|
|
<div class="paragraph">
|
|
<p>Nowadays, most systems support the
|
|
<code>SO_PEERCRED</code> (Linux) or
|
|
<code>LOCAL_PEERCRED</code> (FreeBSD) socket options, or
|
|
the <code>getpeereid</code> (other BSDs, OS X).
|
|
These interfaces provide direct access to the (effective) user
|
|
ID on the other end of a domain socket connect, without
|
|
cooperation from the other end.</p>
|
|
</div>
|
|
<div class="paragraph">
|
|
<p>Historically, credentials passing was implemented using
|
|
ancillary data in the <code>sendmsg</code> and
|
|
<code>recvmsg</code> functions. On some systems, only
|
|
credentials data that the peer has explicitly sent can be
|
|
received, and the kernel checks the data for correctness on the
|
|
sending side. This means that both peers need to deal with
|
|
ancillary data. Compared to that, the modern interfaces are
|
|
easier to use. Both sets of interfaces vary considerably among
|
|
UNIX-like systems, unfortunately.</p>
|
|
</div>
|
|
<div class="paragraph">
|
|
<p>If you want to authenticate based on supplementary groups, you
|
|
should obtain the user ID using one of these methods, and look
|
|
up the list of supplementary groups using
|
|
<code>getpwuid</code> (or
|
|
<code>getpwuid_r</code>) and
|
|
<code>getgrouplist</code>. Using the PID and
|
|
information from <code>/proc/PID/status</code> is prone
|
|
to race conditions and insecure.</p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="sect1">
|
|
<h2 id="sect-Defensive_Coding-Authentication-Netlink"><a class="anchor" href="#sect-Defensive_Coding-Authentication-Netlink"></a><code>AF_NETLINK</code> Authentication of Origin</h2>
|
|
<div class="sectionbody">
|
|
<div class="paragraph">
|
|
<p>Netlink messages are used as a high-performance data transfer
|
|
mechanism between the kernel and the user space. Traditionally,
|
|
they are used to exchange information related to the network
|
|
stack, such as routing table entries.</p>
|
|
</div>
|
|
<div class="paragraph">
|
|
<p>When processing Netlink messages from the kernel, it is
|
|
important to check that these messages actually originate from
|
|
the kernel, by checking that the port ID (or PID) field
|
|
<code>nl_pid</code> in the <code>sockaddr_nl</code>
|
|
structure is <code>0</code>. (This structure can be
|
|
obtained using <code>recvfrom</code> or
|
|
<code>recvmsg</code>, it is different from the
|
|
<code>nlmsghdr</code> structure.) The kernel does not
|
|
prevent other processes from sending unicast Netlink messages,
|
|
but the <code>nl_pid</code> field in the sender’s socket
|
|
address will be non-zero in such cases.</p>
|
|
</div>
|
|
<div class="paragraph">
|
|
<p>Applications should not use <code>AF_NETLINK</code>
|
|
sockets as an IPC mechanism among processes, but prefer UNIX
|
|
domain sockets for this tasks.</p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div id="bottom" class="text-muted py-3" >
|
|
<div class="foot">
|
|
<div class="container">
|
|
<div class="row footerlinks">
|
|
<div class="col-sm-3 col-xs-6 widget">
|
|
<h3 class="widget-title">About</h3>
|
|
<div class="widget-body">
|
|
<dl>
|
|
<dd><a href="https://fedoraproject.org/wiki/Overview">About Fedora</a></dd>
|
|
<dd><a href="https://getfedora.org/en/sponsors">Sponsors</a></dd>
|
|
<dd><a href="https://fedoramagazine.org">Fedora Magazine</a></dd>
|
|
<dd><a href="https://fedoraproject.org/wiki/Legal:Main#Legal">Legal</a></dd>
|
|
</dl>
|
|
<ul class="list-inline">
|
|
<li>
|
|
<a href="https://www.facebook.com/TheFedoraProject" class="btn-social btn-outline"><i class="fa fa-fw fa-facebook"></i></a>
|
|
</li>
|
|
<li>
|
|
<a href="https://plus.google.com/112917221531140868607" class="btn-social btn-outline"><i class="fa fa-fw fa-google-plus"></i></a>
|
|
</li>
|
|
<li>
|
|
<a href="https://twitter.com/fedora" class="btn-social btn-outline"><i class="fa fa-fw fa-twitter"></i></a>
|
|
</li>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="col-sm-3 col-xs-6 widget">
|
|
<h3 class="widget-title uppercase">Download</h3>
|
|
<div class="widget-body">
|
|
<dl>
|
|
<dd><a href="https://getfedora.org/en/workstation/download">Get Fedora Workstation</a></dd>
|
|
<dd><a href="https://getfedora.org/en/server/download">Get Fedora Server</a></dd>
|
|
<dd><a href="https://getfedora.org/en/atomic/download">Get Fedora Atomic</a></dd>
|
|
<dd><a href="https://spins.fedoraproject.org">Fedora Spins</a></dd>
|
|
<dd><a href="https://labs.fedoraproject.org">Fedora Labs</a></dd>
|
|
<dd><a href="https://arm.fedoraproject.org">Fedora ARM<span class="sup">®</span></a></dd>
|
|
<dd><a href="https://alt.fedoraproject.org/">Alternative Downloads</a></dd>
|
|
|
|
</dl>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="col-sm-3 col-xs-6 widget">
|
|
<h3 class="widget-title">Support</h3>
|
|
<div class="widget-body">
|
|
<dl>
|
|
<dd><a href="https://fedoraproject.org/wiki/Communicating_and_getting_help">Get Help</a></dd>
|
|
<dd><a href="https://ask.fedoraproject.org/">Ask Fedora</a></dd>
|
|
<dd><a href="https://fedoraproject.org/wiki/Common_F27_bugs">Common Bugs</a></dd>
|
|
<dd><a href="https://developer.fedoraproject.org/">Fedora Developer Portal</a></dd>
|
|
<dd><a href="https://docs.fedoraproject.org/f27/install-guide/index.html">Installation Guide</a></dd>
|
|
</dl>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="col-sm-3 col-xs-6 widget">
|
|
<h3 class="widget-title">Join</h3>
|
|
<div class="widget-body">
|
|
<dl>
|
|
<dd><a href="https://fedoraproject.org/wiki/Join">Join Fedora</a></dd>
|
|
<dd><a href="http://fedoraplanet.org">Planet Fedora</a></dd>
|
|
<dd><a href="https://fedoraproject.org/wiki/SIGs">Fedora SIGs</a></dd>
|
|
<dd><a href="https://admin.fedoraproject.org/accounts/">Fedora Account System</a></dd>
|
|
<dd><a href="https://fedoracommunity.org/">Fedora Community</a></dd>
|
|
</dl>
|
|
</div>
|
|
</div>
|
|
</div> <!-- /row of widgets -->
|
|
|
|
<div class="row">
|
|
<div class="col-md-2">
|
|
<div class="widget-body">
|
|
<a href="https://www.redhat.com/"><img class="rh-logo" src="../../../master/_images/redhat-logo.png" alt="Red Hat Logo" /></a>
|
|
</div>
|
|
</div>
|
|
<div class="col-md-7">
|
|
<div class="widget-body">
|
|
<p class="sponsor">Fedora is sponsored by Red Hat.</p>
|
|
<p class="sponsor"><a href="https://www.redhat.com/en/technologies/linux-platforms/articles/relationship-between-fedora-and-rhel">Learn more about the relationship between Red Hat and Fedora »</a></p>
|
|
<p class="copy">© 2017 Red Hat, Inc. and others. Please send any comments or corrections to the <a href="https://pagure.io/fedora-docs/docs-fp-o">documentation team</a></p>
|
|
</div>
|
|
</div>
|
|
</div> <!-- /row of widgets -->
|
|
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<!-- jQuery (necessary for Bootstrap's JavaScript plugins) -->
|
|
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js"></script>
|
|
<!-- Latest compiled and minified JavaScript -->
|
|
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/bootstrap.min.js"></script>
|
|
<script src="../../../master/_javascripts/bootstrap-offcanvas.js" type="text/javascript"></script>
|
|
<script type="text/javascript">
|
|
/*<![CDATA[*/
|
|
$(document).ready(function() {
|
|
$("[id^='topicGroup']").on('show.bs.collapse', function (event) {
|
|
if (!($(event.target).attr('id').match(/^topicSubGroup/))) {
|
|
$(this).parent().find("[id^='tgSpan']").toggleClass("fa-angle-right fa-angle-down");
|
|
}
|
|
});
|
|
$("[id^='topicGroup']").on('hide.bs.collapse', function (event) {
|
|
if (!($(event.target).attr('id').match(/^topicSubGroup/))) {
|
|
$(this).parent().find("[id^='tgSpan']").toggleClass("fa-angle-right fa-angle-down");
|
|
}
|
|
});
|
|
$("[id^='topicSubGroup']").on('show.bs.collapse', function () {
|
|
$(this).parent().find("[id^='sgSpan']").toggleClass("fa-caret-right fa-caret-down");
|
|
});
|
|
$("[id^='topicSubGroup']").on('hide.bs.collapse', function () {
|
|
$(this).parent().find("[id^='sgSpan']").toggleClass("fa-caret-right fa-caret-down");
|
|
});
|
|
});
|
|
/*]]>*/
|
|
</script>
|
|
</body>
|
|
</html> |