668 lines
12 KiB
HTML
668 lines
12 KiB
HTML
<HTML
|
|
><HEAD
|
|
><TITLE
|
|
>Bugzilla Security</TITLE
|
|
><META
|
|
NAME="GENERATOR"
|
|
CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+
|
|
"><LINK
|
|
REL="HOME"
|
|
TITLE="The Bugzilla Guide"
|
|
HREF="index.html"><LINK
|
|
REL="UP"
|
|
TITLE="Administering Bugzilla"
|
|
HREF="administration.html"><LINK
|
|
REL="PREVIOUS"
|
|
TITLE="Groups and Group Security"
|
|
HREF="groups.html"><LINK
|
|
REL="NEXT"
|
|
TITLE="Template Customization"
|
|
HREF="cust-templates.html"></HEAD
|
|
><BODY
|
|
CLASS="section"
|
|
BGCOLOR="#FFFFFF"
|
|
TEXT="#000000"
|
|
LINK="#0000FF"
|
|
VLINK="#840084"
|
|
ALINK="#0000FF"
|
|
><DIV
|
|
CLASS="NAVHEADER"
|
|
><TABLE
|
|
SUMMARY="Header navigation table"
|
|
WIDTH="100%"
|
|
BORDER="0"
|
|
CELLPADDING="0"
|
|
CELLSPACING="0"
|
|
><TR
|
|
><TH
|
|
COLSPAN="3"
|
|
ALIGN="center"
|
|
>The Bugzilla Guide</TH
|
|
></TR
|
|
><TR
|
|
><TD
|
|
WIDTH="10%"
|
|
ALIGN="left"
|
|
VALIGN="bottom"
|
|
><A
|
|
HREF="groups.html"
|
|
ACCESSKEY="P"
|
|
>Prev</A
|
|
></TD
|
|
><TD
|
|
WIDTH="80%"
|
|
ALIGN="center"
|
|
VALIGN="bottom"
|
|
>Chapter 5. Administering Bugzilla</TD
|
|
><TD
|
|
WIDTH="10%"
|
|
ALIGN="right"
|
|
VALIGN="bottom"
|
|
><A
|
|
HREF="cust-templates.html"
|
|
ACCESSKEY="N"
|
|
>Next</A
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
><HR
|
|
ALIGN="LEFT"
|
|
WIDTH="100%"></DIV
|
|
><DIV
|
|
CLASS="section"
|
|
><H1
|
|
CLASS="section"
|
|
><A
|
|
NAME="security"
|
|
></A
|
|
>5.6. Bugzilla Security</H1
|
|
><DIV
|
|
CLASS="warning"
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CLASS="warning"
|
|
WIDTH="100%"
|
|
BORDER="0"
|
|
><TR
|
|
><TD
|
|
WIDTH="25"
|
|
ALIGN="CENTER"
|
|
VALIGN="TOP"
|
|
><IMG
|
|
SRC="../images/warning.gif"
|
|
HSPACE="5"
|
|
ALT="Warning"></TD
|
|
><TD
|
|
ALIGN="LEFT"
|
|
VALIGN="TOP"
|
|
><P
|
|
>Poorly-configured MySQL and Bugzilla installations have
|
|
given attackers full access to systems in the past. Please take these
|
|
guidelines seriously, even for Bugzilla machines hidden away behind
|
|
your firewall. 80% of all computer trespassers are insiders, not
|
|
anonymous crackers.</P
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
><DIV
|
|
CLASS="note"
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CLASS="note"
|
|
WIDTH="100%"
|
|
BORDER="0"
|
|
><TR
|
|
><TD
|
|
WIDTH="25"
|
|
ALIGN="CENTER"
|
|
VALIGN="TOP"
|
|
><IMG
|
|
SRC="../images/note.gif"
|
|
HSPACE="5"
|
|
ALT="Note"></TD
|
|
><TD
|
|
ALIGN="LEFT"
|
|
VALIGN="TOP"
|
|
><P
|
|
>These instructions must, of necessity, be somewhat vague since
|
|
Bugzilla runs on so many different platforms. If you have refinements
|
|
of these directions for specific platforms, please submit them to
|
|
<A
|
|
HREF="mailto://mozilla-webtools@mozilla.org"
|
|
TARGET="_top"
|
|
> mozilla-webtools@mozilla.org</A
|
|
>
|
|
</P
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
><P
|
|
>To secure your installation:
|
|
|
|
<P
|
|
></P
|
|
><OL
|
|
TYPE="1"
|
|
><LI
|
|
><P
|
|
> <EM
|
|
>There is no substitute for understanding the tools on your
|
|
system!</EM
|
|
>
|
|
|
|
Read
|
|
<A
|
|
HREF="http://www.mysql.com/doc/P/r/Privilege_system.html"
|
|
TARGET="_top"
|
|
> The MySQL Privilege System</A
|
|
>
|
|
until you can recite it from memory!</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Lock down <TT
|
|
CLASS="filename"
|
|
>/etc/inetd.conf</TT
|
|
>. Heck, disable
|
|
inet entirely on this box. It should only listen to port 25 for
|
|
Sendmail and port 80 for Apache.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Do not run Apache as
|
|
<SPAN
|
|
CLASS="QUOTE"
|
|
>"nobody"</SPAN
|
|
>
|
|
|
|
. This will require very lax permissions in your Bugzilla
|
|
directories. Run it, instead, as a user with a name, set via your
|
|
httpd.conf file.
|
|
<DIV
|
|
CLASS="note"
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CLASS="note"
|
|
WIDTH="100%"
|
|
BORDER="0"
|
|
><TR
|
|
><TD
|
|
WIDTH="25"
|
|
ALIGN="CENTER"
|
|
VALIGN="TOP"
|
|
><IMG
|
|
SRC="../images/note.gif"
|
|
HSPACE="5"
|
|
ALT="Note"></TD
|
|
><TD
|
|
ALIGN="LEFT"
|
|
VALIGN="TOP"
|
|
><P
|
|
> <SPAN
|
|
CLASS="QUOTE"
|
|
>"nobody"</SPAN
|
|
>
|
|
|
|
is a real user on UNIX systems. Having a process run as user id
|
|
<SPAN
|
|
CLASS="QUOTE"
|
|
>"nobody"</SPAN
|
|
>
|
|
|
|
is absolutely no protection against system crackers versus using
|
|
any other user account. As a general security measure, I recommend
|
|
you create unique user ID's for each daemon running on your system
|
|
and, if possible, use "chroot" to jail that process away from the
|
|
rest of your system.</P
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
>
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Ensure you have adequate access controls for the
|
|
<TT
|
|
CLASS="filename"
|
|
>$BUGZILLA_HOME/data/</TT
|
|
> directory, as well as the
|
|
<TT
|
|
CLASS="filename"
|
|
>$BUGZILLA_HOME/localconfig</TT
|
|
> file.
|
|
The localconfig file stores your "bugs" database account password.
|
|
In addition, some
|
|
files under <TT
|
|
CLASS="filename"
|
|
>$BUGZILLA_HOME/data/</TT
|
|
> store sensitive
|
|
information.
|
|
</P
|
|
><P
|
|
>Also, beware that some text editors create backup files in the
|
|
current working directory so you need to also secure files like
|
|
<TT
|
|
CLASS="filename"
|
|
>localconfig~</TT
|
|
>.
|
|
</P
|
|
><DIV
|
|
CLASS="note"
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CLASS="note"
|
|
WIDTH="100%"
|
|
BORDER="0"
|
|
><TR
|
|
><TD
|
|
WIDTH="25"
|
|
ALIGN="CENTER"
|
|
VALIGN="TOP"
|
|
><IMG
|
|
SRC="../images/note.gif"
|
|
HSPACE="5"
|
|
ALT="Note"></TD
|
|
><TD
|
|
ALIGN="LEFT"
|
|
VALIGN="TOP"
|
|
><P
|
|
>Simply blocking <TT
|
|
CLASS="computeroutput"
|
|
>.*localconfig.*</TT
|
|
>
|
|
won't work because the QuickSearch feature requires the web browser
|
|
to be able to retrieve <TT
|
|
CLASS="filename"
|
|
>localconfig.js</TT
|
|
> and
|
|
others may be introduced in the future (see
|
|
<A
|
|
HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=186383"
|
|
TARGET="_top"
|
|
>bug
|
|
186383</A
|
|
> for more information.
|
|
</P
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
><P
|
|
>Bugzilla provides default <TT
|
|
CLASS="filename"
|
|
>.htaccess</TT
|
|
> files
|
|
to protect the most common Apache installations. However, you should
|
|
verify these are adequate according to the site-wide security policy
|
|
of your web server, and ensure that the <TT
|
|
CLASS="filename"
|
|
>.htaccess</TT
|
|
>
|
|
files are allowed to <SPAN
|
|
CLASS="QUOTE"
|
|
>"override"</SPAN
|
|
> default permissions set
|
|
in your Apache configuration files. Covering Apache security is beyond
|
|
the scope of this Guide; please consult the Apache documentation for
|
|
details.
|
|
</P
|
|
><P
|
|
>If you are using a web server that does not support the
|
|
<TT
|
|
CLASS="filename"
|
|
>.htaccess</TT
|
|
> control method,
|
|
<EM
|
|
>you are at risk!</EM
|
|
>
|
|
|
|
After installing, check to see if you can view the file
|
|
<TT
|
|
CLASS="filename"
|
|
>localconfig</TT
|
|
> in your web browser (e.g.:
|
|
<A
|
|
HREF="http://bugzilla.mozilla.org/localconfig"
|
|
TARGET="_top"
|
|
> http://bugzilla.mozilla.org/localconfig</A
|
|
>
|
|
|
|
). If you can read the contents of this file, your web server has
|
|
not secured your bugzilla directory properly and you must fix this
|
|
problem before deploying Bugzilla. If, however, it gives you a
|
|
"Forbidden" error, then it probably respects the .htaccess
|
|
conventions and you are good to go.</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>When you run checksetup.pl, the script will attempt to modify
|
|
various permissions on files which Bugzilla uses. If you do not have
|
|
a webservergroup set in the <TT
|
|
CLASS="filename"
|
|
>localconfig</TT
|
|
> file,
|
|
then Bugzilla will have to make certain files world readable and/or
|
|
writable.
|
|
<EM
|
|
>THIS IS INSECURE!</EM
|
|
>
|
|
|
|
. This means that anyone who can get access to your system can do
|
|
whatever they want to your Bugzilla installation.</P
|
|
><DIV
|
|
CLASS="note"
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CLASS="note"
|
|
WIDTH="100%"
|
|
BORDER="0"
|
|
><TR
|
|
><TD
|
|
WIDTH="25"
|
|
ALIGN="CENTER"
|
|
VALIGN="TOP"
|
|
><IMG
|
|
SRC="../images/note.gif"
|
|
HSPACE="5"
|
|
ALT="Note"></TD
|
|
><TD
|
|
ALIGN="LEFT"
|
|
VALIGN="TOP"
|
|
><P
|
|
>This also means that if your webserver runs all cgi scripts
|
|
as the same user/group, anyone on the system who can run cgi
|
|
scripts will be able to take control of your Bugzilla
|
|
installation.</P
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
><P
|
|
>On Apache, you can use <TT
|
|
CLASS="filename"
|
|
>.htaccess</TT
|
|
> files to
|
|
protect access to these directories, as outlined in Bugs
|
|
<A
|
|
HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=57161"
|
|
TARGET="_top"
|
|
> 57161</A
|
|
> and
|
|
<A
|
|
HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=186383"
|
|
TARGET="_top"
|
|
> 186383</A
|
|
>
|
|
|
|
for the <TT
|
|
CLASS="filename"
|
|
>localconfig</TT
|
|
> file, and
|
|
<A
|
|
HREF="http://bugzilla.mozilla.org/show_bug.cgi?id=65572"
|
|
TARGET="_top"
|
|
>Bug
|
|
65572</A
|
|
>
|
|
|
|
for adequate protection in your <TT
|
|
CLASS="filename"
|
|
>data/</TT
|
|
> directory.
|
|
Also, don't forget about the <TT
|
|
CLASS="filename"
|
|
>template/</TT
|
|
> and
|
|
<TT
|
|
CLASS="filename"
|
|
>Bugzilla/</TT
|
|
> directories and to allow access to the
|
|
<TT
|
|
CLASS="filename"
|
|
>data/webdot</TT
|
|
> directory for the
|
|
<TT
|
|
CLASS="computeroutput"
|
|
>192.20.225.10</TT
|
|
> IP address if you are
|
|
using webdot from research.att.com. The easiest way to
|
|
accomplish this is to set <TT
|
|
CLASS="function"
|
|
>$create_htaccess</TT
|
|
> to 1
|
|
in <TT
|
|
CLASS="filename"
|
|
>localconfig</TT
|
|
>. However, the information below
|
|
is provided for those that want to know exactly what is created.
|
|
</P
|
|
><P
|
|
>Note the instructions which follow are Apache-specific. If you
|
|
use IIS, Netscape, or other non-Apache web servers, please consult
|
|
your system documentation for how to secure these files from being
|
|
transmitted to curious users.</P
|
|
><P
|
|
><TT
|
|
CLASS="filename"
|
|
>$BUGZILLA_HOME/.htaccess</TT
|
|
>
|
|
<TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><FONT
|
|
COLOR="#000000"
|
|
><PRE
|
|
CLASS="programlisting"
|
|
> # don't allow people to retrieve non-cgi executable files or our private data
|
|
<FilesMatch ^(.*\.pl|.*localconfig.*|processmail|runtests.sh)$>
|
|
deny from all
|
|
</FilesMatch>
|
|
<FilesMatch ^(localconfig.js|localconfig.rdf)$>
|
|
allow from all
|
|
</FilesMatch>
|
|
</PRE
|
|
></FONT
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
>
|
|
</P
|
|
><P
|
|
><TT
|
|
CLASS="filename"
|
|
>$BUGZILLA_HOME/data/.htaccess</TT
|
|
>
|
|
<TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><FONT
|
|
COLOR="#000000"
|
|
><PRE
|
|
CLASS="programlisting"
|
|
> # nothing in this directory is retrievable unless overriden by an .htaccess
|
|
# in a subdirectory; the only exception is duplicates.rdf, which is used by
|
|
# duplicates.xul and must be loadable over the web
|
|
deny from all
|
|
<Files duplicates.rdf>
|
|
allow from all
|
|
</Files>
|
|
</PRE
|
|
></FONT
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
>
|
|
</P
|
|
><P
|
|
><TT
|
|
CLASS="filename"
|
|
>$BUGZILLA_HOME/data/webdot</TT
|
|
>
|
|
<TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><FONT
|
|
COLOR="#000000"
|
|
><PRE
|
|
CLASS="programlisting"
|
|
> # Restrict access to .dot files to the public webdot server at research.att.com
|
|
# if research.att.com ever changed their IP, or if you use a different
|
|
# webdot server, you'll need to edit this
|
|
<FilesMatch ^[0-9]+\.dot$>
|
|
Allow from 192.20.225.10
|
|
Deny from all
|
|
</FilesMatch>
|
|
|
|
# Allow access by a local copy of 'dot' to .png, .gif, .jpg, and
|
|
# .map files
|
|
<FilesMatch ^[0-9]+\.(png|gif|jpg|map)$>
|
|
Allow from all
|
|
</FilesMatch>
|
|
|
|
# And no directory listings, either.
|
|
Deny from all
|
|
</PRE
|
|
></FONT
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
>
|
|
</P
|
|
><P
|
|
><TT
|
|
CLASS="filename"
|
|
>$BUGZILLA_HOME/Bugzilla/.htaccess</TT
|
|
>
|
|
<TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><FONT
|
|
COLOR="#000000"
|
|
><PRE
|
|
CLASS="programlisting"
|
|
> # nothing in this directory is retrievable unless overriden by an .htaccess
|
|
# in a subdirectory
|
|
deny from all
|
|
</PRE
|
|
></FONT
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
>
|
|
</P
|
|
><P
|
|
><TT
|
|
CLASS="filename"
|
|
>$BUGZILLA_HOME/template/.htaccess</TT
|
|
>
|
|
<TABLE
|
|
BORDER="0"
|
|
BGCOLOR="#E0E0E0"
|
|
WIDTH="100%"
|
|
><TR
|
|
><TD
|
|
><FONT
|
|
COLOR="#000000"
|
|
><PRE
|
|
CLASS="programlisting"
|
|
> # nothing in this directory is retrievable unless overriden by an .htaccess
|
|
# in a subdirectory
|
|
deny from all
|
|
</PRE
|
|
></FONT
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
>
|
|
</P
|
|
></LI
|
|
></OL
|
|
>
|
|
</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="NAVFOOTER"
|
|
><HR
|
|
ALIGN="LEFT"
|
|
WIDTH="100%"><TABLE
|
|
SUMMARY="Footer navigation table"
|
|
WIDTH="100%"
|
|
BORDER="0"
|
|
CELLPADDING="0"
|
|
CELLSPACING="0"
|
|
><TR
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="left"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="groups.html"
|
|
ACCESSKEY="P"
|
|
>Prev</A
|
|
></TD
|
|
><TD
|
|
WIDTH="34%"
|
|
ALIGN="center"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="index.html"
|
|
ACCESSKEY="H"
|
|
>Home</A
|
|
></TD
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="right"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="cust-templates.html"
|
|
ACCESSKEY="N"
|
|
>Next</A
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="left"
|
|
VALIGN="top"
|
|
>Groups and Group Security</TD
|
|
><TD
|
|
WIDTH="34%"
|
|
ALIGN="center"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="administration.html"
|
|
ACCESSKEY="U"
|
|
>Up</A
|
|
></TD
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="right"
|
|
VALIGN="top"
|
|
>Template Customization</TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
></BODY
|
|
></HTML
|
|
> |