![Security Security](http://a.fsdn.com/sd/topics/security_64.png)
![Data Storage Data Storage](http://a.fsdn.com/sd/topics/storage_64.png)
![Software Software](http://a.fsdn.com/sd/topics/software_64.png)
![IT IT](http://a.fsdn.com/sd/topics/it_64.png)
![Linux Linux](http://a.fsdn.com/sd/topics/linux_64.png)
Arkeia Network Backup Agent Remote Access 168
hdm writes "The Metasploit Project has published a security analysis of the Arkeia Network Backup Client. Anyone able to connect to TCP port 617 can gain read/write access to the filesystem of any host running the Arkeia agent software. This appears to be an intentional design decision on the part of the Arkeia developers. A long-winded description of this issue, complete with screen shots, demonstration code, and packet captures can be found in the
research article. Arkeia has been credited with being the
first commercial backup product for the Linux platform."
Somebody has to say it (Score:5, Interesting)
Large enterprises migrating to Linux now should be careful not to throw away the biggest advantage of their new platform by committing to all sorts of closed source software that happens to run on it.
For the time being, I guess I'll stick to my proven, open source (free software even) backup solution involving tar, gpg, and ssh.
Re:Somebody has to say it (Score:5, Funny)
if Arkeia Network Backup had been open source software
Well, it kind of is open source software... install it and it opens up your source (and pretty much anything stored on your computer) to anyone who wants it!
EricSee what headers your browser is sending [ericgiguere.com]
Re:Somebody has to say it (Score:3, Funny)
Looks like someone took Linus' quote and ran with it:
"Only wimps use tape backup. Real men let everyone else mirror their data!"
Re:Somebody has to say it (Score:3, Informative)
You aparently either run a limited number of basic backup jobs and/or have plenty of time to write backup scripts, which is not bad as you need something to make yourself look very good at your job.
And FYI Arkeia Light is free (as in "one can use it at no cost"), see arkeia.org.
Re:Somebody has to say it (Score:3, Insightful)
Here are my requirements:
1. Backups are encrypted.
2. Backup data can be split across media.
3. Backups can use include/exclude criteria.
4. Corrupted backup files are recoverable.
5. Backups are compressed.
I've yet to find anything free which does all of this. Instead I'm using a short shell script combo of tar/bzip/gpg/split which gets the job done, but not elegantly. I'm not 10
Easy: Use QuickPar or some form of PAR2 (Score:4, Informative)
http://sourceforge.net/projects/parchive/
Its frequently used on USENET binaries groups now as well to solve the missing part problems.
I'm sure this exact strategy could be integrated into your backup solution with minimal effort.
Re:Easy: Use QuickPar or some form of PAR2 (Score:3, Insightful)
But it's settable; so if you want to be able to recover fully from losing/corrupting 20% of your backup you just set it to 20% of your backup size, and if you only care about a few minor bit errors or so, you can drop it to a couple of percent or less.
Be nice if vendors provided PAR2's for their ISO/DVD images/anything else big; it sucks when you find the MD5 of your download doesn't match the one they provide (or that 400MB
Re:Somebody has to say it (Score:2, Informative)
Actually, even without par2, dar will be able to get all the files except the ones in regions with bad data, IIRC.
Re:Somebody has to say it (Score:2)
Re:Somebody has to say it (Score:2)
http://www.rarlab.com/download.htm
-Encryption is done using AES
-You can specify a file size to split the archives across or you can let it auto-detect the size
-You can configure your backups with include/exclude file lists
-There are a few ways to do backup recovery. One involves adding some extra data to each archive that allows corrupt archives to be repaired or the parity data can be split off into seperate f
Re:Somebody has to say it (Score:5, Insightful)
With a commercial product, it took someone with a network sniffer to discover this. So it's just a lucky fluke that someone other than the bad guys knows about it.
Re:Somebody has to say it (Score:2)
So it's just a lucky fluke that someone other than the bad guys knows about it.
Sure
Come on.
--
Go Debian!
Re:Somebody has to say it (Score:2)
Re:Somebody has to say it (Score:2)
Haha, point taken. There is no security hole large enough that couldn't be justified by a committed team of developers.
I guess, though, I should have said: Would this problem have gone unnoticed for so long if this had been open source?
Addendum : (Score:3, Funny)
Check it up...
Re:Addendum : (Score:2)
Re:Addendum : (Score:2)
got root? (Score:2, Insightful)
Re:got root? (Score:1, Insightful)
Re:got root? (Score:3, Interesting)
Re:got root? (Score:2)
Re:got root? (Score:2)
of course it is less than elegant..
Re:got root? (Score:3, Informative)
Re:got root? (Score:2)
Use LVM snapshots. You dedicate some freespace out of an LVM pool to an LVM snapshot. If a block of the filesystem gets written to, the original block gets copied to the LVM snapshot. The more of the blocks that get written to while the snapshot is held open, the more space you have to dedicate to it.
In the end, if you have twice the disk space, then you can hold the snapshot open indefinitely (otherwise the snapshot fails once change mo
Re:got root? (Score:2)
Re:got root? (Score:3, Insightful)
Re:got root? (Score:2)
Jeroen
Re:got root? (Score:3, Insightful)
but thats the whole point of the
I hate to spoil yours, but... (Score:2)
Justin.
Re:I hate to spoil yours, but... (Score:2)
IMHO you still have a big problem.
Re:I hate to spoil yours, but... (Score:2)
Having weak security is bad, but having write access as well is a mess.
J.
Re:got root? (Score:5, Insightful)
Re:got root? (Score:2)
That is a really bad thing.
You really don't want the whole world to have access to your shadow password file.
Jreoen
Re:got root? (Score:2)
Re:got root? (Score:3, Informative)
That is not true.
All you need to read a file system in Windows is the backup privilege. You don't even need to be an adminstrator. So if you have this privilege enabled, you can use the BackupRead API to backup stuff.
Re:got root? (Score:3, Informative)
Actually, you'll almost inevitably see backup utilities running as LOCALSYSTEM, which is indeed higher than Administrator, because that's how Windows works.
If a user registers a program to run as a service (note: You must have Administrat
Drop privelages (Score:2)
Re:got root? (Score:2)
Errrm, forgive me, but it's a bit hard to grasp the logic in that. Are you saying that the idiots might say: "look, there's a security problem on Linux, so open source isn't secure." And you remind them that this problem is due to some piece of proprietary software that is not open sou
Re:got root? (Score:2)
You cannot have this kind of "design decisions" if your code is open...
Re:got root? (Score:2)
Re:got root? (Score:2)
Actually, no. If only *one* user (or developer) gives it a look, people will know.
Re:got root? (Score:2)
Not a bug; it's a feature? (Score:5, Funny)
Does this mean that, possibly, they were anticipating people *not* being able to access TCP port 617? I.e. "we trust you know how to properly configure your firewall."
So far, I can narrow down to either that, them being drunk when they coded this, or this being a case of the improper usage of the word "intentional."
Re:Not a bug; it's a feature? (Score:2)
I doubt that "intentional" is correct, but when a security hole is so blatant, the term does come to mind.
Re:Not a bug; it's a feature? (Score:5, Insightful)
I don't think it's so much improper usage of the word "intentional" as an incorrect synonym for the term "brain dead".
Re:Not a bug; it's a feature? (Score:2)
Uh... (Score:3, Insightful)
Firewalling the port on each indivudual system behind the main firewall would then imply that the software couldn't actually function (for any reasonable definition of the word "function").
Re:Uh... (Score:2, Insightful)
Well, duh, (Score:2)
from the arkeia site (Score:5, Funny)
I was looking for a Client-Server backup system that could offer me the possibility of backing up Unix/Linux and NT Servers on a single tape system.
After long research my choice went to the Arkeia solution, because it has all the benefits I needed. Since then, it runs like a black box, without any need of additional Service.
Tom Weber, IT Manager
RTL TV (Europe)
The backup system running like a black box might not be a good thing here eh?
Re:from the arkeia site (Score:5, Insightful)
Unless, of course, they've got everything firewalled to tuesday.
Zzzzapp
Nope, metal.
Specifications (Score:5, Insightful)
Re:Specifications (Score:5, Insightful)
Re:Specifications (Score:3, Interesting)
Well, for this situation finding a potential problem is easy: Port scan, [insecure.org] security scanner. [nessus.org] Two things that you should be doing on every network enabled device.
The time consuming part comes with the follow up where you check the results of the scans on the local machines [tcpdump.org] and determine if you trust that the exposed services are being handled by secure apps. If in doubt, use an encrypte
Re:Specifications (Score:2)
These would not have helped. There was no unusual port to be found via the portscanner-- the Arkeia client was listening on a documented port and since it was installed intentionally, this open port would be considered normal. The Nessus security scanner only looks for known vulnerabilities and again would not have helped here.
HD did an excellen
Re:Specifications (Score:2)
The fact that a port was open would be enough to investigate what it was, why it was open, and if the service was properly secured. Anyone who stops and says "OH, it's just the backup software" should not be an admin.
Re:Specifications (Score:4, Insightful)
Re:Specifications (Score:2, Insightful)
not telling me that number even exists would add security through obscurity
The point is though that this software relied on obscurity to protect the built in backdoor, once that obscurity is gone the software doesn't even have something as brillant as a hard to guess number protecting the backdoor.
I call it the jerk arguement
- I can call you a jerk behind your back - security - obscurity
if you hear about it though - i'm hosed
-
The oldest excuse in the book (Score:5, Insightful)
What a bunch of morons. It's one thing to accidentally write a security hole in your software. It's another thing entirely to claim that you deliberately make it so your software leaves your users' systems wide open to anybody who feels like taking advantage.
A good saying (Score:3, Insightful)
It may have been said before... (Score:5, Funny)
Security available, just not enabled by default (Score:5, Insightful)
It is indeed bad that it is not enabled by default. On the other hand, enabling authentication of the backup server on the backup clients means that it is slightly harder to set up a backup client.
The problem is not much worse than, say, nfs. (Where impersonating a host can get you everywhere unless authenticated rpc is used.
Re:Security available, just not enabled by default (Score:2)
Hum off topic'ish. (Score:5, Insightful)
Hi there.
Well I just dealt recently "simple" backups via rsync + ssh. If you can rsync something from remote onto target with no special protection regarding rsync... If target is compromised, a malicious user can run arbitrary commands through rsync. And rsync server provides full read access to FS. (Well, within user permissions though.) Isn't it a bit the same problem that this software has? I would not be surprised to hear that you can customize the backup server to limit access/actions for better sefety. Which is exactly what you have to do with ssh on remote server: filter commands passed through ssh before running them. I mean: each remote you want to back up will have to be worked on a little.
It's off topic but FYI: Rsync server can take as a file list an arbitrary unix command.
Pretty efficient isn't it ? (unix file perm will limit the damage though).
Bye bye.
Z.
Re:Hum off topic'ish. (Score:2, Insightful)
I'm assuming you are doing really simple backups...how do you handle complicated tape library management (ie: tape robots, backup aging, onsite/offsite backups) automatically without having to use software more complicated than the basic Unix command line utilities? I'm not targeting you in particular, but there seems to be a lack of realization in general in this thread that backup systems are usually more complicated than just sticking an 'rsyn
Re:Hum off topic'ish. (Score:4, Informative)
By not using tape. rsnapshot [rsnapshot.org] going to a sufficiently-large RAID array or drive covers your regular backups, including aging. A separate rsnapshot or rsync can do nicely for offsites, pushing the backups to another server. For enterprises, this approach probably is insufficient, but for smaller firms (e.g., ~70 employees, 5 offices), this works well.
GNU tar handles hardlinks (Score:2)
Dump the gpg file to a CD (or DVD... I don't know how much you like to backup) and bring the media to a remote location. Because GNU tar can do hardlinks (and gpg will compress your data), your tarball will be only a little bit larger than what rsnapshot du reports, and your gpg file will be... well.. depends on your data, but
Re:Hum off topic'ish. (Score:2)
Examples at: http://sial.org/howto/rsync/
Re:Hum off topic'ish. (Score:3, Informative)
I agree this is an issue, the best solution I have found is Push Mirroring [debian.org] with this the command that can be run is put in the ssh public key and then the compromised client can only run this specific command.
Only wimps use tape backup... (Score:2, Funny)
Call to slashdot from a now ex-Arkeia customer. (Score:2)
I can't ever trust these guys again. When I first installed it, this issue occured to me, and I just assumed "no way could those guys be that stupid, they must ha
Re:Call to slashdot from a now ex-Arkeia customer. (Score:2)
Could you install CentOS (Veritas doesn't support any free OS's as a server, and while CentOS is free, it is a clone of a Veritas supported OS
Re:Call to slashdot from a now ex-Arkeia customer. (Score:2)
AFAIK Veritas supports several Linux Distros and if you really object to paying the distro vendor there are any number of distributions that are 'close enough' (like CentOS) that the
Re:Call to slashdot from a now ex-Arkeia customer. (Score:2)
I originally tired it on RH9 and had a few problems, that mysteriously went away when I built my own system from RHEL sources.
Last time I looked, only Win32, commerical *nix, and RHEL and SuSE were supported as servers. They support pretty much everything as a client.
Re:Call to slashdot from a now ex-Arkeia customer. (Score:2)
They actually don't support SuSE as a server, and they stopped support for free RH versions at 7.3 (I assume this is when the first version of RHEL came out). The chart says they don't support RHEL 3.0, as a server, but I know someone who is running it on 3.0, and claims they support him.
No BSD's are supported as a server.
Re:Call to slashdot from a now ex-Arkeia customer. (Score:2)
I would like to humbly suggest these guys [tolisgroup.com]. The software was completely self contained (Either static executables, or the dependant libraries on were included). The network agent did a DH key exchange when you first installed it, and after that, each agent contact required a challenge-response before it would do anything. Nothing is ever guaranteed secure, but several very bright engineers who were also experienced sysadmins burned a lot of brain cycles to design the security of this system before a line o
Re:Call to slashdot from a now ex-Arkeia customer. (Score:2)
Extensive platform support and lot's of plugins.
Not free, but you get what you pay for...
Re:Call to slashdot from a now ex-Arkeia customer. (Score:2)
Re:Call to slashdot from a now ex-Arkeia customer. (Score:2)
Netbackup seems to work fine with Debian Sarge clients for us. We've got the server running on a RedHat 7.3 box at the moment but are considering upgrading to a later RedHat/Fedora/CentOS/Mandr
Ever try Tapeware? (Score:2)
Arkeia! (Score:2)
http://www.tapeware.com/ [tapeware.com]
Re:Arkeia! (Score:2)
Re:Arkeia! (Score:2)
The only problem I've run into doing restores involed restoring a MS SQL 7.0 on NT. There was a bug in their connector and I was apparently the first one to hit it. I've long since switched to using an open file manager for Windows-side databases, and moved almost everything to Linux anyway. TapeWare's cross platform support is pretty good, although they do develop first on Windows and then port to Linux, Novell, DOS, and Solaris. I'm in the TW8 beta program but haven't done much as I'm stil
Re:Arkeia! (Score:2)
This was a couple of years ago now. I believe they've gotten better, though, and we didn't upgrade the license to newer
!Tapeware (Score:2)
Re:!Tapeware (Score:2)
Proof that Windows is more secure! (Score:2)
Yes!
Now we can see a system configured for enterprise use with enterprise grade software is completely vulnerable! Linux is a sieve! It can't protect you data, why there are millions of machines infected with Linux that can now be remotely accessed by ANOYNE for any purpose? How many of those machines are being used for kiddie porn, illegal phishing sites and other similar and equally illegal activities?
The message is clear, install Linux and your data is open to the world.
Why, I'
Arkeia Backs-up Great - Restore Is a Problem (Score:4, Informative)
All seemed well until we needed to restore data. The logging indicated a perfect backup, but time and time again our restores were either failing or incomplete. On Windows, it simply wouldn't restore anything.
The solution, according to Arkeia was to purchase an upgrade ($12,000) which would solve all our problems. And since we refused to spend another 15% for a support agreement, that was our only alternative. I don't think so.
Needless to say, we went with someone else. Veritas had a great enterprise solution that worked with Linux and Windows (the server app runs only on Windows) and supports a huge array of tape drives. And it was one-third the price.
I can't definetly recall, but the Veritas agent also has some security peculiarities that raised some eyebrows. If you run any enterprise backup, I guess the answer is to make sure you're firewalled.
In this day and age of cheap disk drives, I wonder if anyone is using USB or Firewire drives and just using those for back-ups. A Lacie 250 gig Firewire drive is <$200.
Re:Arkeia Backs-up Great - Restore Is a Problem (Score:2)
The biggest problem with Netbackup is Veritas will only support the server on RHEL or SuSE, no "free" OS's. So I built an RHEL server from source, and got around that problem. Of course now you could use something like CentOS, if you don't want to build your own.
Re:Arkeia Backs-up Great - Restore Is a Problem (Score:2)
The UltraBac interface is definitely a bit clunky, but their phone support is great. I even get forwarded to their developers when I find potential bugs. (on that note, wait a bit to go with UB8, UB7 works great). UltraBac even claims to have a UNIX agent, although we only
Re:Arkeia Backs-up Great - Restore Is a Problem (Score:2)
Actually Veritas supports a nubmber of UNIX platforms for the server app including Solaris, HP-UX, and Linux (there is the issue that for Linux Veritas only supports RHEL and SuSE, but there are free distros that are 'close enough' to work and given a little effort even Debian
Re:Arkeia Backs-up Great - Restore Is a Problem (Score:2)
For the couple that wanted added reliability, they use two external drives on a rotation basis (the drive that gets taken off-site at the end of the day is swapped with the alternate drive that stays for overnight backup).
Be careful if you decide to firewall port 617 (Score:2)
sco-dtmgr 617/tcp SCO Desktop Administration Server
sco-dtmgr 617/udp SCO Desktop Administration Server
I ran a scan of the larger corporate network and found a lot of these hiding out there...
Re:One more strike (Score:3, Informative)
http://www.bacula.org/
Re:One more strike (Score:2)
We had a rather odd setup(which I inherited), in which we had a network of about 30 (later 50, and then 70) development workstations, all of which were backed up . It was roughly similar to backing up 30 separate servers, though of course the individual data stores weren't that large. But it was a
Re:One more strike (Score:2)
The UI on the for-pay version of Arkeia is just as bad. The only thing I can figure is Knox was intentionally trying to make it look ugly.
I'd rather throw down cash on ARCserve.
I wouldn't go that far. The alternatives have to be pretty bad before I'd consider going within a mile of any CA product.
On the other hand Veritas Netbackup has proven to be an excellent solution for far less tha
Re:One more strike (Score:2)
The software itself is extremely overrated. Legato had far better host agents for unix, windows, DB modules. Tivoli might be even better.
Re:One more strike (Score:2)
I wouldn't know about either Legato or Tivoli as I don't have direct experience with either. I know that people tend to speak very highly of Legato.
I will say that Netbackup blows the doors off anything else I've had experience with such as Arkeia, Backup Exec, and several other rather lame PC/small office backup products.
I like my backup like I like my hookers: (Score:2)
Re:SPAM :: Mod Parent Down ! (Score:2)
Although I receive plenty of spam that has no intelligible language anyway, hmm.