"Read-only", monitoring agent

Larry O'Leary loleary at redhat.com
Thu Mar 1 17:07:54 UTC 2012


On Thu, 2012-03-01 at 07:59 -0800, Costel Cosman wrote: 
> I know that maybe is exaggerated, but what if an attacker finds out
> the password of the rhqadmin or any other user that has rights to
> upload plugins ?
> In that case SSL security doesn't help as long the attacker can upload
> any plugin.

That is correct. An industry trend and practice that has been in place
for the past 10 years is to secure applications and their components
with some kind of signing and trust mechanism. Who cares if SSL is in
use if social engineering is at work. The majority of security attacks
occur via social engineering and not by the means of someone actually
gaining direct access to a system. 

The most common example of this is that I call you and tell you that
plug-in XYZ has a security vulnerability and must be updated
immediately. I then proceed to tell you that the update can be retrieved
from our secure support portal. What I have not told you is that via DNS
injections or a man-in-the-middle attack leveraging your vendor's
website, the plug-in update you will be downloading is my custom one to
turn all machines in your organization running RHQ agents into zombies.
By the time anyone realizes what has happened, it is too late.

So, not only should we have an option to enforce two-way SSL between
client and server but we should also have a mechanism to only trust
plug-ins from s pre-defined list of vendors based on the signature and
verify the plug-in has not been tampered with. Perhaps this could be
system wide or per agent -- baring in mind that some hosts could be more
restrictive then others. 
But, this would be a completely separate request from
https://bugzilla.redhat.com/show_bug.cgi?id=783911 as this deals with
plug-in trust and Bug 783911 is about limiting agent capabilities on the
host machine. 

-- 
Larry O'Leary
https://plus.google.com/u/0/112645929986009801513



More information about the rhq-devel mailing list