SmoothWall Firewall Review 495
Daniel Goscomb, one of the lead developers of Smoothwall, responds:
In our opinion this article is extremely badly researched and written. Furthermore it shows a lack of knowledge on the author's part.
The main concern he has is that of people being able to log in to the firewall and read configuration files. This point is irrelevant as there is only a single user that can access the shell, root. This also removes the need of shadow password files, if you have access to the machine to get the passwd file, you are already in as root anyhow.
Secondly he complains of plain text passwords for the ppp passwords. This is not our doing. The passwords are stored in this format as pppd requires them to be in plain text in the two files. He also mentions that the permissions of these files are wrong. If he looked a little more closely he would have seen that they are in fact symlinks to the 2 real files, which do have the proper permissions on them.
He also mentions the same "problem" with the shared keys system in FreeSWAN. Again, they are stored like this as FreeSWAN requires them in this format to read them.
As to the part about user authentification of the CGI scripts. This is completely irrelevant. There is no authentication in the CGI scripts. The authentication is done via .htaccess files, and has no interaction with the CGI at all, other than when you change the passwords.
I also find it disturbing that the author gave us no room for comment in his article, nor did i see anything to suggest he had even asked us about these so called "problems". We would have been happy to answer any questions he had.
Sincerely,
Daniel Goscomb.
this really surprises me... (Score:3, Insightful)
Smoothwall & GPL (Score:5, Insightful)
Now I'm happy for people to write GPL software if they like, and I'm happy for people to write commecial software if they like, but smoothwall seems to want to get the benifits of both.
They seem to want to get make free use of other peoples work through the GPL, but to feel free to only release parts of their software commercialy. I'm not claiming they are breaking the GPL or anything, but there seems something very unfair about their approach.
Also if you get the GPL edition, there are all kinds of requests on the web site that you donate money to them "SmoothWall developers have kids and families too, and it's all about giving back to the people who helped you.
". And yet I would guess that about 90% of what they are giving out was written by other people and they don't suggest they are going to give 90% of their donations to them.
Again, nothing wrong with that, I just don't much like it.
Basically I suggest that people look at their web site, and search the internet for comments about the creators of this software and how unhappy some people are with them before they go and use it.
Old debate...? (Score:5, Insightful)
It is true that internal security against logged in users can help defeat attackers who can only partially penetrate external defenses. If, for instance, you can only use a CGI bug to get ahold of the passwd file, you can leverage this with a dictionary attack if shadowing isn't installed. Provided you can disable the packet filter and attempt to login as root externally once you have the password... or even use an su type exploit from your original CGI bug. Either way, there are a lot of large corporations with bigger security holes than this.
However to claim that his review "shattered the illusion" of Smoothwall being a complete solution for home users is complete hyperbole. A home user who is trying to secure himself from internal attack from other logged in users in his house is probably pretty savvy in the first place and also has bigger problems. If the purpose of this product is have a CD you can ship to your parents to secure their DSL line against script Kiddiez and Hotmail's Traceroute function, then Smoothwall sounds to me like an outstanding effort.
c't': Two demerits.
Reveiwers have to listen... (Score:4, Insightful)
Excuses (Score:4, Insightful)
Tsstss.. Look at this excerpt from the article that this SmoothWall guy is complaining about:
I also have a strange feeling about other "security" options that they choose. For example: Not using shadowed password files. They say it wouldn't be neccessary since the only user available is root anyway. But what is the _sense_ of not using shadowed password files? (And what is the sense to require the user to be root to configure the system? Even Apache is supposed to be quite secure, but nobody will run it as root because there still might be holes. Impossible in a hacked-together firewall distribution?) The bytes in length on the harddisk they would have saved would be a joke.
All in all, I believe there are some truth- and insightful bits in the c't review, even if the reviewer did a mistake.
btw: To complain that the passwords had to be plaintext because PPPd and FreeSWAN required it is complete nonsense for a Firewall! Sources are available, so why not add a patch to have the passwords encrypted if this is supposed to become a Firewall?
(Sorry, had to emphasize this, since this is not some desktop distribution but supposed to be a Firewall.)
Not a real firewall review (Score:4, Insightful)
Why is it that we all will not listen to a SQL review without stats and figures but a firewall review get's any attention at all if it isnt even tested properly by the reviewer?
This review was like a review about ram and bitching about the color and shape.
Re:running CGI's as root ? great idea huh (Score:2, Insightful)
Re:Daniel Goscomb seems far too complacent (Score:2, Insightful)
Re:Old debate...? (Score:4, Insightful)
A false sense of security is worse than no security.
Even if no users other than root should ever be able to log in to the firewall, there is a reason to carefully set file permissions: Just like on a server, the services running should do so under their private username. That is to prevent a security related bug (aka vulnerability) from compromising the whole system. This is obviously less important on a router/firewall where services are only provided to the inside, but the attitude shown by the authors of Smoothwall certainly destroys my confidence in their general ability to provide a secure system.
Then there is the false discrimination between inside and outside: Especially when you deal with "non-techie" users you have to expect their systems to become infected by the latest worms and viruses. This opens the possibility of attacks from the inside which really are attacks from the outside. Granted, that is a remote possibility and if it happens, you have bigger problems than firewall file permissions, but it is still not understandable how an easy to fix thing like this is completely ignored. The german review makes it quite clear that the attitude of the firewall authors played a big part in the thumbs-down.
Replying to the reply (Score:4, Insightful)
In our opinion this article is extremely badly researched and written. Furthermore it shows a lack of knowledge on the author's part.
sjah
The main concern he has is that of people being able to log in to the firewall and read configuration files. This point is irrelevant as there is only a single user that can access the shell, root. This also removes the need of shadow password files, if you have access to the machine to get the passwd file, you are already in as root anyhow.
so you only have one layer of security ? The inability of any attacker to get a shell ? That's it ? I must admit I have not checked if you do that or not but
In my opinion you should at least take a number of these precautions
-> no shell access for nobody but root (of course this is enforced by putting a check in the main loop of bash, which mails "murder" if anybody tries differently)
-> all binaries --x--x--x, on a single partition which is the only one mounted without the "noexec" and with "ro" flag
-> *all* daemons chrooted, none have anything in their
-> *all* programs compiled from source
-> there is no such thing as an irrelevant permission
Secondly he complains of plain text passwords for the ppp passwords. This is not our doing. The passwords are stored in this format as pppd requires them to be in plain text in the two files. He also mentions that the permissions of these files are wrong. If he looked a little more closely he would have seen that they are in fact symlinks to the 2 real files, which do have the proper permissions on them.
plain text ? wrong permissions ? why would you take a chance ?
He also mentions the same "problem" with the shared keys system in FreeSWAN. Again, they are stored like this as FreeSWAN requires them in this format to read them.
again
As to the part about user authentification of the CGI scripts. This is completely irrelevant. There is no authentication in the CGI scripts. The authentication is done via
user authentication is only irrelevant until a hacker gets by the first layer of security (which apparently on your system is the *only* layer of security)
I also find it disturbing that the author gave us no room for comment in his article, nor did i see anything to suggest he had even asked us about these so called "problems". We would have been happy to answer any questions he had.
to quote the other article :
When a group of developers- more than ever one active in the spirit of GPL-want to successfully distribute a good product, they are usually interested in feedback, in order to improve their product. My concrete indications of security problems within SmoothWall found sheer disinterest with Richard Morrell, developer and project initiator. "That doesn't matter" was about the politest of all comments comment. Trust in the developer's competence and integrity is a basic pre-requisite for the usage of security relevant software. Morell has thoroughly destroyed mine."
this suggests he has contacted you
Re:sharethenet (Score:3, Insightful)
And are hacked again in 15 minutes.
This is why computer forensics [honeynet.org] are important.
Re:Smoothwall & GPL (Score:1, Insightful)
Thats not working with the community, thats working against the community.
It's not like they are hiring up freeswan hackers to get freeswan to do more than it does right now (like interoperate with leading vpn manufactures vpn boxes, etc) Its mostly a nice default setup with a ton of knobs that hook into config files.
Try OpenBSD for a firewall with minimal hardware. (Score:5, Insightful)
You can find all kinds of examples of how to set one up like here. [onlamp.com]
Older distro's used IPF, but as of 3.0 they use pf. You can read about pf here. [openbsd.org]
OpenBSD has gone 4 years without a remote hole in the default install. Pretty impressive.
But hey, only use it if you are SERIOUS about security AND don't want to pay anything.
Although you should consider helping fund the project out of the kindness of you
Re:Smoothwall is GREAT (Score:3, Insightful)
If we see a posting on bugtraq or a properly documented break-in sent to us, we'll act on it.
Re:Why not plaintext passwords? (Score:2, Insightful)
Whoever moderated this post as "Informative" needs to stick to moderating posts on which they are competent to judge, not just anything that sounds good but might be a line of complete BS.
Re:Reveiwers have to listen... (Score:1, Insightful)
Security = Probability (Score:5, Insightful)
Every part of the system has a (hopefully low) propability to be successfully hacked. The more barriers you have, the securer your system is.
It's also worth nothing that the only interactive account is root. There are daemons running under different user ids (I assume in favor of the SW team). As with every remote exploit, these daemons are the entry gates. Also note that remote exploits by definition don't relate to any interactive accounts!
Now, if one service has been hacked, the whole system is already compromised because there are no shadow passwords, files have the wrong permissions, etc.
You can argue about the passwort files for remote connections. You can't argue about not using shadow passwords, that's just plain stupid.
It's like leaving your safe unlocked because there is already the locked front door...
Re:Old debate...? (Score:2, Insightful)
From the review: The password for the DSL access was in plain text in an unprotected file.
The provider password is probably the most valuable information on the firewall, second only to full backdoor access. I have not yet verified that it is actually the secrets file itself which has the wrong permissions, but since c't has a reputation to lose, they wouldn't let an obvious misperception as mistaking a link for the file slip through.
There are many ways an attacker could gain inside access to the firewall. Most involve security vulnerabilities, others rely on uneducated users. Anyway, if the cgi-bins which are used to configure the firewall are not 100% secure, a buffer overflow in one of them could potentially be used to read any file which is accessible to the cgi-bins user. That's why file permissions do matter. Seeing how many people defend the "only root can log in anyway" statement, do you think they have really taken the necessary steps to avoid such a vulnerability by implementing several layers of security?
Now aren't you in deep shit already if an attacker can use your inside systems to connect to the firewall? Of course you are. But think about this: Anti-Virus tools will eventually detect backdoors on your user system(s), but not on the firewall. An undetected attacker can easily cause much more damage by actively destroying your data or just abusing your connection for his purposes over a long time. And who would suspect a backdoor on a rock-solid, completely secure firewall? That's why a false sense of security is worse than no security.
Re:Excuses (Score:5, Insightful)
Let's go even farther on this theme of bad choices.
You can logon directly to the root account remotely? You don't have to su first?
Ouch, but that's a major hole. That's like waving a Big Flag. Kiddies, look at this "firewall." Guess what account you should try?
Never allow remote logons to uid 0. Always at least force wheels to su.
There are CGIs available to manage the firewall? Oh, and they use port 81 to access it. How... creative. And it gets better. SSH is on port 222. Have you guys ever heard of port scanners? Custom ports is a way of flagging to intruders which firewall software is being used, except when the custom port pattern is unique.
I can go on. It has a built-in DHCP server. DHCP servers should never be mounted on external firewalls as their logfiles contain too much valuable information when the firewall's security is compromised.
Hmm, at least it has an HTTP proxy. Probably Squid. No SOCKS support though. And yes, it uses NAT. Gack.
Well anyway, maybe this c't review will convince a few people to give up a NAT-based solution. Sadly, they'll probably just go to another one.
Surprise /. double standard (Score:1, Insightful)
THEN the guy goes on to blame pppd and FreeSWAN which comes bundled with the product for using plain text passwords. Are you joking? If you want one that's secure write it yourself. I don't care who wrote the thing originally, if you want a secure product, then follow the openbsd model and check and recode every line yourself. We don't blame MS Indexing Server (the cause of many of the recent MS bugs), we blame IIS.
I'm sorry but this is just terrible.
Re:My smoothwall experiance (it was bad) (Score:2, Insightful)
Please don't misunderstand me: I understand it requires a lot of time, money and effort to bring SmoothWall into existance; the work is appreciated. SmoothWall is a valuable addition to the free software world. It is frustrating dealing with people who won't read docs. But there is no reason to be belligerant. Morrell does his work and his SmoothWall finances no favors by being rude.
The unfortunate failure of a great idea... (Score:5, Insightful)
Upon joining the channel, I was bombarded with the omnipresent topic, "Welcome to #smoothwall
support if you haven't donated. http://redirect.smoothwall.org/donate"
Ignoring the blatantly anti-open-source sentiment, I proceeded to ask about features and functionality that I feel are paramount to implementation of a device designed to secure my entire network. Before anyone so much as regarded my first question, I was bombarded with "Have you paid yet?" A simple 'not yet' got me my first response: "Can't you read the f**king topc?!"
Of course, I wasn't looking for support -- simply answers to questions about the products capabilities. Off to a great start.
In the end, my questions were answered, privately, by MacGyver, whose answers unfortunaely indicated that features I think are critical in a firewall are only available in the commercial version. To suggest a few:
- No support for multiple IP's on the external interface
- No ability to write filter rules for outbound traffic
- No inherent ability to manage IDS policies used by Snort
- No immediate planned support for a stateful kernel
etc...
Granted, I could accomplish all of these tasks through custom modifications to the product -- but that would defeat the purpose of the product in the first place -- to create a secure filtering firewall that can be easily and securely managed through an integrated portable interface without the need for extensive customization.
To comment on the article posted this evening, I think that despite the article author's process for review or lack thereof, SmoothWall's response was unacceptable. To say that passwords are not shadowed because the box has but the root user would be to say that Bind and Sendmail need not be firewalled because their latest revisions have no vulnerabilities...
yet.
To say that the open-source security packages that comprise the firewall _require_ clear-text passwords is to insult the intelligence of everyone here who knows better or has found more secure alternatives to the same problems in the past. The open-source community is not ignorant, nor are we fooled by any comapny's efforts to conceal laziness.
Security is an unknown. We place our confidence in hybrid hardware and software solutions that provide protection from the exploits we've identified already, but we expect that new vulnerabilities are inevitable. We cannot neglect commonly accepted security practices because our products have not yet been broken. The correlary would be to argue against home alarms because we already have a lock on the door.
A single layer of security is never enough. ESPECIALLY for a firewall. If this were to be an end-user distribution sitting _behind_ a firewall, the lack of external access would _probably_ be enough. However, as a firewall, such neglect for security practices that have a negligible effect on performance but provide such a significant measure of protection is both arrogant and ignorant at the same time.
In conclusion, neither the product's lackluster featureset, nor it's father company's poor customer support practices would have individually discouraged my using it.
Couple those with questionable security practices, though, and I can assure you that SmoothWall will never be enough to protect _my_ network...
Re:The unfortunate failure of a great idea... (Score:2, Insightful)
what is anti-open-source about giving away the software under the GPL, but asking that people donate something back to the project to get support?
Re:this really surprises me... (Score:2, Insightful)
One can see their dilemma. Given their most excellent track record (shame my German is not much better). I would tend to give the benefit of the doubt to C't on this occasion.
Curmudgeon
My Smoothwall review (Score:5, Insightful)
My major concern is not, that somebody other than the administrator might log into the machine. The major issue of a firewall system is, to tighten security, not to remove existing security mechanisms like tight access rigts to sensitive files, shaddow passwords, etc. But that is exactly what Smoothwall does in direct comparism to any standard linux distribution.
I'm sorry, if the text doesn't make it clear, that I'm not complaining about the format of files but about sensitive files with passwords or secret keys, that are world readable (ie mode 0644). Something like
is a bad thing - period.
I made every effort, to get "printable" response from the developers. I wrote several E-Mails about the issues to Richard Morrel - who was named as contact person- and I went to the IRC channel of the developers. The only printable comment to the subject I got there is "This doesn't matter".
Re:My smoothwall experiance (it was bad) (Score:3, Insightful)
It didn't apper tobe the case so I joined the irc chan and asked about the problem I had had, result: kickban
I was actually going to offer to write the pnp stuff I had done properly and then submit it to them, not any more thank you :)
Re:Attitude Problems with Smoothwall Developers (Score:3, Insightful)
Sure, it's free, it's GPLed. Big deal. There are plenty of free, GPLed firewalls out there, and the developers of them are probably a lot nicer. What sets Smoothwall above the rest? Tech support? Reading
Gawyn
Re:The unfortunate failure of a great idea... (Score:2, Insightful)
I use open-source software EVERY day, general applications and security tools alike. And you guys at SmoothWall are the _first_ I've encountered to beg for money and refuse to assist those who don't offer any. That's not GPL, that's shareware. Shit, that's not even shareware, that's worse than nagware. You give me a feature-limited product and when I ask about the product's capabilities, you tell me, "donate money for us to help you with it, pay more if you want a real version, or piss off and leave us alone."
Many of the tools I use were written from scratch by people who had to expend at least as much time and money in development as your group. Look at Ethereal, Nessus, Astaro, FreeS/WAN, OpenSSH and the OpenBSD project.
Spend a while using Trinux, whose developer has personally invested countless hours individually supporting the people who use his product simply because we've all helped him to make it better! The end result? A damn fine product! And a well-tested product at that!
You guy's need to do a little reality check, here. If you want money for the development of your project/product -- then make it SO DAMN GOOD people feel karmically compelled to send you donations. Bullying people into paying isn't gonna make them like your product, and probably won't help with word-of-mouth either. Hell, that's why we're having this discussion in the first place...
Re:Old debate...? (Score:3, Insightful)
In this day and age, the majority of network security incidents have some sort of internal connection. Implicitly trusting your internal users is suicidal in terms of network defense.
I think c't is right on with his assessment regarding things like file permissions, shadowed passwords, etc. In a security device, there is no excuse for not finishing the job - that is, securing your file permissions, using shadowed passwords, etc.
The SmoothWall people argue against the need for shadowed passwords as the only interactive user on the system is root. How about the CGIs that manage the applications? How about the possibility of exploiting some sort of weakness in one of them, resulting in the display of the encrypted passwords? Or are they so arrogant as to believe there couldn't possibly be any vulnerabilities in their code?
Re: Unfair? How so? (Score:3, Insightful)
I think it's pretty clear that they haven't openly violated GPL. (They had a previous version where some wording needed a couple small changes to fully comply with GPL, but those changes were made before the latest release.)
As for the author, so what? The guy invested a lot of his time to give you a product that you can use for free. *That* is the bottom line. Is there a requirement anyplace that says you have to regularly report to Richard Morrell or interact with him directly in any way while you use Smoothwall? Not that I know of!
I joined the Smoothwall mailing list for quite a while, and what I saw was a flood of beginner questions that could have been answered by the user reading the instructions (or by actually installing the product before asking if it did or didn't have certain features!). If I was the author, I'd get angry with these people after a while too.