FOG security - Revision history

Fog: /* Securing NFS */

2025-02-07T00:03:33Z

‎Securing NFS

Fog: /* Securing your Images */

2025-02-07T00:03:23Z

‎Securing your Images

Fog: /* Secure MySQL */

2025-02-07T00:03:14Z

‎Secure MySQL

Wayne-workman.28155: /* FIREWALLD */

2018-08-17T19:46:55Z

‎FIREWALLD

Wayne-workman.28155: Changed terminology to use capture instead of upload.

2016-07-08T04:22:55Z

Changed terminology to use capture instead of upload.

Wayne-workman.28155: /* FIREWALLD */

2016-06-07T22:28:58Z

‎FIREWALLD

Wayne-workman.28155: /* FIREWALLD */

2016-06-07T22:26:22Z

‎FIREWALLD

Wayne-workman.28155: /* FIREWALLD */

2016-06-07T22:25:55Z

‎FIREWALLD

Wayne-workman.28155: /* FIREWALLD */

2016-06-07T22:04:36Z

‎FIREWALLD

Wayne-workman.28155: /* IPTABLES */

2016-05-06T12:46:05Z

‎IPTABLES

← Older revision		Revision as of 00:03, 7 February 2025
Line 103:		Line 103:

	''More to come on how to secure NFS soon!''		''More to come on how to secure NFS soon!''
−

	== Other issues ==		== Other issues ==

← Older revision		Revision as of 00:03, 7 February 2025
Line 96:		Line 96:

	In theory you could(should?) go with a more restrictive set of permissions however, in reality FOG usually complains if we do.		In theory you could(should?) go with a more restrictive set of permissions however, in reality FOG usually complains if we do.
−

	== Securing NFS ==		== Securing NFS ==

@@ Line 82: / Line 82: @@
 If your interested in further secure your MySQL you can go to the link below, however bear in mind that I have not tested those changes.
 [http://www.symantec.com/connect/articles/securing-mysql-step-step Securing MySQL: step-by-step]
 == Securing your Images ==

@@ Line 13: / Line 13: @@
 ===FIREWALLD===
-<pre>for service in http https tftp ftp mysql nfs mountd rpc-bind proxy-dhcp samba; do firewall-cmd --permanent --zone=public --add-service=$service; done
+<pre>yum install firewalld -y
-echo "Open UDP port 9000 and 9001, these are the default ports of udp-sender."
+echo "Open UDP port 49152 through 65532, the possible used ports for fog multicast"
-firewall-cmd --permanent --add-port=9000-9001/udp
+firewall-cmd --permanent --add-port=49152-65532/udp
 echo "Allow IGMP traffic for multicast"
 firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p igmp -j ACCEPT

@@ Line 82: / Line 82: @@
 == Securing your Images ==
-When FOG makes a backup(upload and image), it creates one or more image files for that computer. Depending on how your using FOG you may wanna secure your images directory. Since it's not necessary for other users to access this files we will restrict the access to root and to FOG.
+When FOG captures an image, it creates one or more image files for that computer. Depending on how your using FOG you may wanna secure your images directory. Since it's not necessary for other users to access this files we will restrict the access to root and to FOG.
 To fix Images folder ownership run (assuming /images/ is where you have your FOG images)
@@ Line 112: / Line 112: @@
 * '''No SSL Support on Web UI:''' (Tested on FOG 0.29 and 0.30) Tests performed in Apache and the use of ''RequireSSL'' option with FOG, showed that it cannot deal with the use of SSL, when server enforce SSL connections FOG fails to connect properly.''(Seems like next FOG version 0.33 will support SSL on its Web UI)''
-* '''NFS Shares'''. FOG design allows it to upload(write) images via nfs, this requires access to the nfs share from any computer you wanna upload images from. An attacker could fill your disk and/or erase all files in /images/dev since is mounted as read and write for any client.''(nfs share /images/ is read only)''
+* '''NFS Shares'''. FOG design allows it to capture(write) images via nfs, this requires access to the nfs share from any computer you want to capture images from. An attacker could fill your disk and/or erase all files in /images/dev since is mounted as read and write for any client.''(nfs share /images/ is read only)''
 * '''Public availability of files:''' Since FOG files are served via TFTP and PXE, this means any computer on your network can access those files (as longs as they can network boot). This includes the Linux kernel that FOG uses. So any password you set up in the FOG menu is not really relevant for a technical user or an attacker.
 * '''Installation advices:''' During installation FOG recommends to turn off SELinux because it can get in the way of the installation and the way FOG works. Although this certainly allows FOG to work, is not good practice to turn SELinux off. Is better to set SELinux in permissive mode, and then run a few test with FOG so we can allow only the things it needs, and then put it back on, this can take some time to configure properly but it's the safest way to work.

@@ Line 17: / Line 17: @@
 echo "Open UDP port 9000 and 9001, these are the default ports of udp-sender."
 firewall-cmd --permanent --add-port=9000-9001/udp
-echo "Allow ICMP traffic for multicast"
+echo "Allow IGMP traffic for multicast"
 firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p igmp -j ACCEPT
 systemctl restart firewalld.service
-echo "Done."</pre>
+echo "Done."
 ===IPTABLES===

@@ Line 14: / Line 14: @@
 <pre>for service in http https tftp ftp mysql nfs mountd rpc-bind proxy-dhcp samba; do firewall-cmd --permanent --zone=public --add-service=$service; done
-firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -m udp -p udp -m pkttype --pkt-type multicast -j ACCEPT
-systemctl restart firewalld.service</pre>
+echo "Open UDP port 9000, this is the default port of udp-sender."
 ===IPTABLES===

← Older revision		Revision as of 12:46, 6 May 2016
Line 18:		Line 18:

	===IPTABLES===		===IPTABLES===
		+
		+	Does not include multicast, if you know how to do it please let us know in the [https://forums.fogproject.org/ forums].

	<pre>echo "IPTABLES_MODULES=\"nf_conntract_tftp nf_conntrack_ftp nf_conntrack_netbios_ns\"" >> /etc/sysconfig/iptables-config		<pre>echo "IPTABLES_MODULES=\"nf_conntract_tftp nf_conntrack_ftp nf_conntrack_netbios_ns\"" >> /etc/sysconfig/iptables-config