De acordo com as Leis 12.965/2014 e 13.709/2018, que regulam o uso da Internet e o tratamento de dados pessoais no Brasil, ao me inscrever na newsletter do portal DICAS-L, autorizo o envio de notificações por e-mail ou outros meios e declaro estar ciente e concordar com seus Termos de Uso e Política de Privacidade.

Segurança de NIS

Colaboração: Marcos Aguinaldo Forquesato

Data de Publicação: 23 de Agosto de 1997

Aproveitando a discussão sobre segurança de NIS, o Aguinaldo me enviou estes texto bastante abrangente sobre medidas a serem tomadas para se aumentar a segurança de redes que utilizam o NIS.

O documento original se encontra em http://www.eng.auburn.edu/users/doug/nis.html.

Securing NIS (formerly YP)

The following is a brief compendium of what we at Auburn Univeristy College
of Engineering use to secure our NIS networks. We have a mix of about 65%
NIS, 35% NIS+ network that is seeded from NIS -> NIS+ via periodic cron
jobs. The following is our implementation of securing NIS using various
vendor patches and free utilities from around the world.

NIS has a reputation of being extremely insecure. If you implement these
steps it will lose most if not all of the reasons for this, and you will
retain all the administrative advantages of NIS without any of the security
risks. We only have experience implementing this with SunOS4.1.X, since we
use NIS+ on Solaris 2.X machines and since we are a predominantly Sun shop.
All other machines may have slightly different results and implementations.
Hopefully others will find this useful, though. Here's a list of reasons why
you should follow these steps.

1. People can grab your password map from any machine in the world and
crack on it remotely.
2. It disables several of the holes found by Satan.
3. Local people can use ypcat to grab all the encrypted passwords and
crack on them.
4. Remote people can grab any map in your NIS domain. Some of these may
have confidential information.

--------------------

* Router Modifications

Most sites have a router connecting themselves with the outside world.
If you have control of this router make sure you do the following to
things, or everything else below could be completely useless. (Note,
implementation details and configuration is router specific, and we
can't help configure your particular brand of router.)
1. Turn off source routing
2. Apply a filter that makes sure that packets coming in from the
outside network do not have source IP address that match the
inside network. (IP spoofing) see the following CIAC announcement
on IP spoofing attacks
3. If practical install a router filter that blocks ALL RPC packets.
and everything on port 111 (and 2049 if you don't export NFS
outside your LAN(s))

Replacing Daemons

* Wietse Venema has written 2 excellent utilities that are absolutely
essential for securing NIS. They are replacements for the sun shipped
portmap and rpcbind (SunOS4.1.X, Solaris2.X) respectively. These tools
work much the same way as tcp_wrappers by defining access lists for
hosts that are and are not allowed to access your portmap. Without
these tools in place a remote user can effectively use your own portmap
as a way to circumvent security by accessing your NIS services through
the portmap and appearing to be coming from a machine inside your
domain. Click here to download portmap from ftp.win.tue.nl. Click here
for rpcbind 1.1 (Solaris2.X). Both of these require that you have
libwrap.a compiled from tcp_wrappers. Click here to get tcp_wrappers7.2

Installing Vendor Patches

* For SunOS4.1.3_U1B and below get the NIS patch for securenets and
install it on your system. On SunOS 4.1.3_U1 and U1_B this is patch
101435-03. On SunOS 4.1.[0-3] this is patch 100482-08. In your
securenets file you should ONLY have those domains which require NIS
maps. Use the smallest subset of domains possible. Try to not include
subnets with PC's and macs on them if possible, since these machines
have no concept of root; anybody could get your maps.

Restricting Access

* It is a very good idea to make your NIS master machine restricted
access for administrative staff only. This is where all the jewels are
and if it gets compromised it does not good that NIS is protected when
the raw text files are not. It is also a good idea to turn off routed
on this machine and install static routes to all of your local networks
that use NIS service. This way, even if a hacker can bypass your
portmap/securenets security, the information drops on the floor on the
way out of your machine because it doesn't have a way back to the
hackers site.

Blocking TCP Attacks

* TCP sequence number guessing attacks are on the rise. These attacks
rely on the fact the the kernel is not very good at picking random
numbers for TCP sequence numbers. The sequence numbers control the
order of the packets in the TCP/IP stream. If a hacker can guess what
sequence numbers you are using (there are now automated tools to do
this) he can intercept your session. In theory, removing the route to
outside networks should prevent this attack, however, if it does not,
or if you are not able to do this, you may wish to investigate some of
the unsuported patches (for SunOS in particular) that block this kind
of attack by altering the TCP sequence number generation. I've placed a
README containing the rationale and instructions for one such patch
here

Shadow Passwords

* Set your machine up to do Shadow Passwords. Contrary to popular belief,
this does NOT require the C2 security patch. Shadow passwords can be
enabled by following a few short easy steps. (If you use groups with
passwords, you should do the following steps for the group.adjunct file
as well, except for the AU* stuff)
1. Make backup copies of the passwd maps on the NIS master and on all
client and slave machines. Make a backup copy of the Makefile on
your NIS master too.
2. In the directory where you keep your NIS maps, make a directory
called security (e.g. /var/yp/security).
cd /var/yp
mkdir security
chown root security
chmod 700 security
3. Take all of the passwords out of your NIS master passwd map and
stick them in a passwd.adjunct map in the security directory.
Replace all the password entries in the password map with entries
that have the username preceeded by two hash marks. Like this:
root:##root:0:0::/:/bin/csh
The format for the shadow password map is then follows the form of
username:password:::::
Where password is what you removed from the passwd file. The 5
remaining colons will never have anything in them. They are used
by C2 security for mandatory security accesses, but that is
irrelevant here. The following awk script will generate a
passwd.adjunct file.

nawk -F\: '{printf("%s:%s:::::\n", $1, $2)}' passwd >
security/passwd.adjunct

And the following script will fix your passwd file.

nawk -F\: '{printf("%s:##%s:%s:%s:%s:%s:%s\n", $1, $1, $3, $4, $5,
$6, $7)}' passwd > passwd.new

Check the file passwd.new for any errors before replacing passwd
with this new file. Now is also the perfect time to check for
users that have no password and replace the emtpy password entry
with a "*" in the passwd.adjunct file.
4. Create an /etc/security directory on every machine. And take the
root password (and any other local passwords) our of your
/etc/passwd file and into /etc/security/passwd.adjunct file (like
above)
# mkdir /etc/security
# chmod 700 /etc/security
Then fill the file with something like this:
root:ZbAirHUqwr9w:::::
nobody:*:::::
daemon:*:::::
sys:*:::::
bin:*:::::
audit:*:::::
sync:*:::::
AUpwdauthd:*:::::
AUyppasswdd:*:::::
+::::::
Obviously, your root password will be taken our of your
/etc/passwd file. The above password is nonsense anyway. If you
want a different root password for each machine, make sure the
root entry above has a valid password. If you want an identical
root password for all your machines which comes out of NIS, delete
the root line above all together.
5. Insert the following two lines in your NIS master password map AND
in each machines local /etc/passwd file
AUpwdauthd:##AUpwdauthd:10:10::/lost+found:/bin/true
AUyppasswdd:##AUyppasswdd:11:10::/lost+found:/bin/true

Lost+found can be replaced with the name of any local directory.

6. Insert the following two lines into your NIS master
passwd.adjunct, and make sure they are contained in every local
/etc/security/passwd.adjunct map as well.
AUpwdauthd:*:::::
AUyppasswdd:*:::::

7. Make sure your rc.local file has the following set of lines
uncommented. These provide a way for clients to authenticate a
password as being valid or not without the password being passed
over the net in clear text. The encrypted password is passed to
the server for authentication.

#
# start up authentication daemon if present and if adjunct file exists
#
if [ -f /usr/etc/rpc.pwdauthd -a -f /etc/security/passwd.adjunct ]; then
rpc.pwdauthd & echo -n ' pwdauthd'
fi

8. Now you need to make sure that when you update passwords and users
that your Makefile is setup properly to push out the
passwd.adjunct map. After the all: rule in your Makefile add a new
entry, we've called ours c2secure. Now you need to add a make rule
for this entry.

c2secure:
-@if [ -f $(DIR)/security/passwd.adjunct ]; then \
if [ ! $(NOPUSH) ]; then $(MAKE) $(MFLAGS) -k \
passwd.adjunct.time group.adjunct.time; \
else $(MAKE) $(MFLAGS) -k NOPUSH=$(NOPUSH) \
passwd.adjunct.time group.adjunct.time; \
fi; \
fi

9. You now need to make sure the rpc.yppasswdd on your NIS master is
running with the right flags. Below is a sample. The -noshell and
-nogecos flags specify that users are not allowed to change their
shell or their full name using the passwd command. They are not
stricly necessary for the proper functioning of rpc.yppasswdd. One
further note: the rpc.yppasswdd supplied with 4.1.3_U1B seems to
crash, so we use the one from 4.1.3 instead, and it works fine.

if [ -f /usr/etc/rpc.yppasswdd ]; then
rpc.yppasswdd /var/yp/dbdir/passwd /var/yp/dbdir/security/passwd.adjunct -nosingle -noshell -nogecos -m passwd.adjunct > /dev/console
echo -n ' yppasswdd'
fi

10. Finally, you need to push the maps out. First run make on your
master. It will update the map and attempt to push it out. If you
have slaves it may fail because the slaves don't know about this
newly created map. Use ctrl-c to break the process and either
ypxfr the map by hand or ypinit -s on each of the slaves to
reinitialize and synchronize with the NIS master.
11. Test it out. If it doesn't work let me know, I may have
inadvertently forgotten a step. In any case, you did follow step 1
and make backups right?

TCP Wrappers Addendum

* Here are some ways to setup your hosts.allow file when you have portmap
installed. Let's assume you have a class B network with address
129.129, subnetted using mask 255.255.255.0. Now let's assume your sun
network has 10 subnets. There are two ways you can setup your
hosts.allow file. You can put all 10 subnets in one at a time like
this:

portmap: 255.255.255.255 0.0.0.0
portmap: 129.129.1.0/255.255.255.0
portmap: 129.129.2.0/255.255.255.0
...
...
portmap: 129.129.10.0/255.255.255.0

Note: the first line is not always necessary, but it's safe to include
it. It is necessary on NIS slaves and masters that have to answer
ypbind broadcast requests on the local network. The second approach is
to just put a broad mask for your entire Class B network. Sometimes
this is easier than doing every single subnet one at a time. (That
would make for a HUGE /etc/hosts.allow file, 1 per machine. Obviously,
this would be impractical. Here's an example of the latter approach.

portmap: 255.255.255.255 0.0.0.0
portmap: 129.129.0.0/255.255.0.0

* Read the documentation included with tcp_wrappers. It's very useful
stuff. You can apply lots of options to the above. For example, you
could put a statement up there such that any request from an
unauthorized host would result in a reverse finger being mailed to the
account of your choice plug a syslog entry that could trip an alarm.

* If you get complaints about 'audit', you'll need to mkdir
/etc/security/audit on the machines where you run shadow passwords.

* Congratulations! You are now immune to most of the security holes and
attacks that been publicized widely and have plagued NIS.

--------------------