oss-sec mailing list archives
Re: Fw: Security risk of vim swap files
From: Jason Cooper <osssecurity () lakedaemon net>
Date: Tue, 31 Oct 2017 14:20:34 +0000
Hi Hanno, On Tue, Oct 31, 2017 at 01:23:52PM +0100, Hanno Böck wrote:
I think vim should change the behavior of swap files: 1. they should be stored in /tmp by default
This opens up a host of other issues, which others have highlighted.
2. they should have secure permissions (tmp file security is a tricky thing and needs careful consideration to avoid symlink attacks and the like, but there are dedicated functions for this like mkstemp).
This is only if you move to /tmp.
3. Ideally they also shouldn't leak currently edited filenames (e.g. they shouldn't be called /tmp/.test.txt.swp, but more something like /tmp/.vim_swap.123782173)
Adding this requirement begs for a Rube Goldberg solution. :-) Since vim needs a deterministic name to search for when it opens the file the next time. And next time could be after a reboot. Maybe we just need to change the default backup pattern to something that isn't hidden by default? e.g. wp-config.php.swp (no leading period), or wp-config.php~ ? Thus, it's more likely to be caught by the developer. Honestly, The real problem is just webserver design in general. In order to have automatic reboot/restart, you need to grossly compromise security in several ways. a) store the server ssl key on disk without a password. b) store passwords in the clear in config files, readable by the running server user. The real answer is "Don't do that." Which, years ago, was really infeasible since most servers were physically hosted and redundancy was expensive. But we're not there anymore. Wether you use a caching provider like cloudflare, or a hosting service using VMs, there's plenty of cheap redundancy. Having an individual box down doesn't mean your site is down. So, this gives us some wiggle room to ask for a password to decrypt the key (or, load from remote), and provide credentials for the server to access other resources. But, I digress. Yes, vim swap files are a problem. But only because we've built stupid decisions (necessary at one time) into the design. thx, Jason.
Current thread:
- Fw: Security risk of vim swap files Hanno Böck (Oct 31)
- Re: Fw: Security risk of vim swap files Solar Designer (Oct 31)
- Re: Fw: Security risk of vim swap files Stefan Bühler (Oct 31)
- Re: Fw: Security risk of vim swap files Solar Designer (Oct 31)
- Re: Fw: Security risk of vim swap files Stefan Bühler (Oct 31)
- Re: Fw: Security risk of vim swap files Apostolis Hardalias (Oct 31)
- Re: Fw: Security risk of vim swap files Jakub Wilk (Oct 31)
- Re: Fw: Security risk of vim swap files Solar Designer (Oct 31)
- Re: Fw: Security risk of vim swap files Adam Shannon (Oct 31)
- Re: Fw: Security risk of vim swap files Gordo Lowrey (Oct 31)
- Re: Fw: Security risk of vim swap files Solar Designer (Oct 31)
- Re: Fw: Security risk of vim swap files Jason Cooper (Oct 31)
- Re: Security risk of vim swap files Simon Waters (Surevine) (Oct 31)
- Re: Security risk of vim swap files Matthias Luft (Nov 07)
- Re: Fw: Security risk of vim swap files Tim (Oct 31)
- Re: Fw: Security risk of vim swap files Kurt H Maier (Oct 31)
- Re: Fw: Security risk of vim swap files Tim (Oct 31)
- Re: Fw: Security risk of vim swap files Steffen Nurpmeso (Oct 31)
- Re: Fw: Security risk of vim swap files Leonid Isaev (Nov 01)
- Re: Fw: Security risk of vim swap files Simon McVittie (Nov 01)
- Re: Fw: Security risk of vim swap files Tim (Nov 01)
- Re: Fw: Security risk of vim swap files Jeffrey Walton (Nov 01)
- Re: Fw: Security risk of vim swap files Kurt H Maier (Oct 31)
- Re: Fw: Security risk of vim swap files Solar Designer (Oct 31)