Date: Tue, 31 Oct 2017 14:20:34 +0000 From: Jason Cooper <osssecurity@...edaemon.net> To: oss-security@...ts.openwall.com Subject: Re: Fw: Security risk of vim swap files Hi Hanno, On Tue, Oct 31, 2017 at 01:23:52PM +0100, Hanno Böck wrote: > I think vim should change the behavior of swap files: > 1. they should be stored in /tmp by default This opens up a host of other issues, which others have highlighted. > 2. they should have secure permissions (tmp file security is > a tricky thing and needs careful consideration to avoid symlink attacks > and the like, but there are dedicated functions for this like mkstemp). This is only if you move to /tmp. > 3. Ideally they also shouldn't leak currently edited filenames (e.g. > they shouldn't be called /tmp/.test.txt.swp, but more something > like /tmp/.vim_swap.123782173) Adding this requirement begs for a Rube Goldberg solution. :-) Since vim needs a deterministic name to search for when it opens the file the next time. And next time could be after a reboot. Maybe we just need to change the default backup pattern to something that isn't hidden by default? e.g. wp-config.php.swp (no leading period), or wp-config.php~ ? Thus, it's more likely to be caught by the developer. Honestly, The real problem is just webserver design in general. In order to have automatic reboot/restart, you need to grossly compromise security in several ways. a) store the server ssl key on disk without a password. b) store passwords in the clear in config files, readable by the running server user. The real answer is "Don't do that." Which, years ago, was really infeasible since most servers were physically hosted and redundancy was expensive. But we're not there anymore. Wether you use a caching provider like cloudflare, or a hosting service using VMs, there's plenty of cheap redundancy. Having an individual box down doesn't mean your site is down. So, this gives us some wiggle room to ask for a password to decrypt the key (or, load from remote), and provide credentials for the server to access other resources. But, I digress. Yes, vim swap files are a problem. But only because we've built stupid decisions (necessary at one time) into the design. thx, Jason.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.