Linux server.kiran-academy.com 3.10.0-1160.108.1.el7.x86_64 #1 SMP Thu Jan 25 16:17:31 UTC 2024 x86_64
Apache/2.4.57 (Unix) OpenSSL/1.0.2k-fips
: 194.233.91.196 | : 216.73.216.216
Cant Read [ /etc/named.conf ]
7.4.32
finalho
www.github.com/MadExploits
Terminal
AUTO ROOT
Adminer
Backdoor Destroyer
Linux Exploit
Lock Shell
Lock File
Create User
CREATE RDP
PHP Mailer
BACKCONNECT
UNLOCK SHELL
HASH IDENTIFIER
CPANEL RESET
CREATE WP USER
README
+ Create Folder
+ Create File
/
usr /
share /
doc /
varnish-5.2.1 /
html /
users-guide /
[ HOME SHELL ]
Name
Size
Permission
Action
command-line.html
10.23
KB
-rw-r--r--
compression.html
11.79
KB
-rw-r--r--
devicedetection.html
21.88
KB
-rw-r--r--
esi.html
11.71
KB
-rw-r--r--
increasing-your-hitrate.html
61.46
KB
-rw-r--r--
index.html
11.92
KB
-rw-r--r--
intro.html
10.24
KB
-rw-r--r--
operation-logging.html
9.3
KB
-rw-r--r--
operation-statistics.html
8.39
KB
-rw-r--r--
params.html
5.66
KB
-rw-r--r--
performance.html
10.05
KB
-rw-r--r--
purging.html
13.81
KB
-rw-r--r--
report.html
5.48
KB
-rw-r--r--
run_cli.html
15.13
KB
-rw-r--r--
run_security.html
17.29
KB
-rw-r--r--
running.html
7.21
KB
-rw-r--r--
sizing-your-cache.html
6.17
KB
-rw-r--r--
storage-backends.html
11.52
KB
-rw-r--r--
troubleshooting.html
16.57
KB
-rw-r--r--
vcl-actions.html
6.04
KB
-rw-r--r--
vcl-backends.html
21.2
KB
-rw-r--r--
vcl-built-in-subs.html
31.33
KB
-rw-r--r--
vcl-example-acls.html
5.87
KB
-rw-r--r--
vcl-example-manipulating-heade...
6.33
KB
-rw-r--r--
vcl-example-manipulating-respo...
6.47
KB
-rw-r--r--
vcl-example-websockets.html
6.95
KB
-rw-r--r--
vcl-examples.html
5.68
KB
-rw-r--r--
vcl-grace.html
9.83
KB
-rw-r--r--
vcl-hashing.html
8.52
KB
-rw-r--r--
vcl-inline-c.html
6.14
KB
-rw-r--r--
vcl-separate.html
13.18
KB
-rw-r--r--
vcl-syntax.html
10.49
KB
-rw-r--r--
vcl-variables.html
5.93
KB
-rw-r--r--
vcl.html
7.72
KB
-rw-r--r--
Delete
Unzip
Zip
${this.title}
Close
Code Editor : run_security.html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Security first — Varnish version 5.2.1 documentation</title> <link rel="stylesheet" href="../_static/classic.css" type="text/css" /> <link rel="stylesheet" href="../_static/pygments.css" type="text/css" /> <script type="text/javascript"> var DOCUMENTATION_OPTIONS = { URL_ROOT: '../', VERSION: '5.2.1', COLLAPSE_INDEX: false, FILE_SUFFIX: '.html', HAS_SOURCE: true }; </script> <script type="text/javascript" src="../_static/jquery.js"></script> <script type="text/javascript" src="../_static/underscore.js"></script> <script type="text/javascript" src="../_static/doctools.js"></script> <link rel="index" title="Index" href="../genindex.html" /> <link rel="search" title="Search" href="../search.html" /> <link rel="top" title="Varnish version 5.2.1 documentation" href="../index.html" /> <link rel="up" title="Starting and running Varnish" href="running.html" /> <link rel="next" title="Important command line arguments" href="command-line.html" /> <link rel="prev" title="Starting and running Varnish" href="running.html" /> </head> <body role="document"> <div class="related" role="navigation" aria-label="related navigation"> <h3>Navigation</h3> <ul> <li class="right" style="margin-right: 10px"> <a href="../genindex.html" title="General Index" accesskey="I">index</a></li> <li class="right" > <a href="command-line.html" title="Important command line arguments" accesskey="N">next</a> |</li> <li class="right" > <a href="running.html" title="Starting and running Varnish" accesskey="P">previous</a> |</li> <li class="nav-item nav-item-0"><a href="../index.html">Varnish version 5.2.1 documentation</a> »</li> <li class="nav-item nav-item-1"><a href="index.html" >The Varnish Users Guide</a> »</li> <li class="nav-item nav-item-2"><a href="running.html" accesskey="U">Starting and running Varnish</a> »</li> </ul> </div> <div class="document"> <div class="documentwrapper"> <div class="bodywrapper"> <div class="body" role="main"> <div class="section" id="security-first"> <span id="run-security"></span><h1>Security first<a class="headerlink" href="#security-first" title="Permalink to this headline">¶</a></h1> <p>If you are the only person involved in running Varnish, or if all the people involved are trusted to the same degree, you can skip this chapter. We have protected Varnish as well as we can from anything which can come in through an HTTP socket.</p> <p>If parts of your web infrastructure are outsourced or otherwise partitioned along administrative lines, you need to think about security.</p> <p>Varnish provides four levels of authority, roughly related to how and where control comes into Varnish:</p> <blockquote> <div><ul class="simple"> <li>The command line arguments,</li> <li>The CLI interface,</li> <li>VCL programs, and</li> <li>HTTP requests.</li> </ul> </div></blockquote> <div class="section" id="command-line-arguments"> <h2>Command line arguments<a class="headerlink" href="#command-line-arguments" title="Permalink to this headline">¶</a></h2> <p>The top level security decisions is decided and defined when starting Varnish in the form of command line arguments, we use this strategy in order to make them invulnerable to subsequent manipulation.</p> <p>The important decisions to make are:</p> <ol class="arabic simple"> <li>Who should have access to the Command Line Interface?</li> <li>Which parameters can they change?</li> <li>Will inline-C code be allowed?</li> <li>If/how VMODs will be restricted?</li> <li>How child processes will be jailed?</li> </ol> <div class="section" id="cli-interface-access"> <h3>CLI interface access<a class="headerlink" href="#cli-interface-access" title="Permalink to this headline">¶</a></h3> <p>The command line interface can be accessed in three ways.</p> <p><cite>varnishd</cite> can be told to listen and offer CLI connections on a TCP socket. You can bind the socket to pretty much anything the kernel will accept:</p> <div class="highlight-default"><div class="highlight"><pre><span></span><span class="o">-</span><span class="n">T</span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">631</span> <span class="o">-</span><span class="n">T</span> <span class="n">localhost</span><span class="p">:</span><span class="mi">9999</span> <span class="o">-</span><span class="n">T</span> <span class="mf">192.168</span><span class="o">.</span><span class="mf">1.1</span><span class="p">:</span><span class="mi">34</span> <span class="o">-</span><span class="n">T</span> <span class="s1">'[fe80::1]:8082'</span> </pre></div> </div> <p>The default is <code class="docutils literal"><span class="pre">-T</span> <span class="pre">localhost:0</span></code> which will pick a random port number, which <cite>varnishadm(8)</cite> can learn from the shared memory.</p> <p>By using a "localhost" address, you restrict CLI access to the local machine.</p> <p>You can also bind the CLI port to an IP address reachable across the net, and let other machines connect directly.</p> <p>This gives you no secrecy, i.e. the CLI commands will go across the network as ASCII text with no encryption, but the -S/PSK authentication requires the remote end to know the shared secret.</p> <p>Alternatively you can bind the CLI port to a 'localhost' address, and give remote users access via a secure connection to the local machine, using ssh/VPN or similar.</p> <p>If you use <cite>ssh</cite> you can restrict which commands each user can execute to just <cite>varnishadm</cite>, or even use a wrapper scripts around <cite>varnishadm</cite> to allow specific CLI commands.</p> <p>It is also possible to configure <cite>varnishd</cite> for "reverse mode", using the '-M' argument. In that case <cite>varnishd</cite> will attempt to open a TCP connection to the specified address, and initiate a CLI connection to your central Varnish management facility.</p> <p>The connection in this case is also without encryption, but the remote end must still authenticate using -S/PSK.</p> <p>Finally, if you run varnishd with the '-d' option, you get a CLI command on stdin/stdout, but since you started the process, it would be hard to prevent you getting CLI access, wouldn't it ?</p> </div> <div class="section" id="cli-interface-authentication"> <h3>CLI interface authentication<a class="headerlink" href="#cli-interface-authentication" title="Permalink to this headline">¶</a></h3> <p>By default the CLI interface is protected with a simple, yet powerful "Pre Shared Key" authentication method, which do not provide secrecy (ie: The CLI commands and responses are not encrypted).</p> <p>The way -S/PSK works is really simple: During startup a file is created with a random content and the file is only accessible to the user who started <cite>varnishd</cite> (or the superuser).</p> <p>To authenticate and use a CLI connection, you need to know the contents of that file, in order to answer the cryptographic challenge <cite>varnishd</cite> issues, see <a class="reference internal" href="../reference/varnish-cli.html#ref-psk-auth"><span class="std std-ref">Authentication with -S</span></a>.</p> <p><cite>varnishadm</cite> uses all of this to restrict access, it will only function, provided it can read the secret file.</p> <p>If you want to allow other users, local or remote, to be able to access CLI connections, you must create your own secret file and make it possible for (only!) these users to read it.</p> <p>A good way to create the secret file is:</p> <div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">dd</span> <span class="k">if</span><span class="o">=/</span><span class="n">dev</span><span class="o">/</span><span class="n">random</span> <span class="n">of</span><span class="o">=/</span><span class="n">etc</span><span class="o">/</span><span class="n">varnish_secret</span> <span class="n">count</span><span class="o">=</span><span class="mi">1</span> </pre></div> </div> <p>When you start <cite>varnishd</cite>, you specify the filename with '-S', and it goes without saying that the <cite>varnishd</cite> master process needs to be able to read the file too.</p> <p>You can change the contents of the secret file while <cite>varnishd</cite> runs, it is read every time a CLI connection is authenticated.</p> <p>On the local system, <cite>varnishadm</cite> can retrieve the filename from shared memory, but on remote systems, you need to give <cite>varnishadm</cite> a copy of the secret file, with the -S argument.</p> <p>If you want to disable -S/PSK authentication, specify '-S' with an empty argument to varnishd:</p> <div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">varnishd</span> <span class="p">[</span><span class="o">...</span><span class="p">]</span> <span class="o">-</span><span class="n">S</span> <span class="s2">""</span> <span class="p">[</span><span class="o">...</span><span class="p">]</span> </pre></div> </div> </div> <div class="section" id="parameters"> <h3>Parameters<a class="headerlink" href="#parameters" title="Permalink to this headline">¶</a></h3> <p>Parameters can be set from the command line, and made "read-only" (using '-r') so they cannot subsequently be modified from the CLI interface.</p> <p>Pretty much any parameter can be used to totally mess up your HTTP service, but a few can do more damage than others:</p> <dl class="docutils"> <dt><a class="reference internal" href="../reference/varnishd.html#ref-param-cc-command"><span class="std std-ref">cc_command</span></a></dt> <dd>Execute arbitrary programs</dd> <dt><a class="reference internal" href="../reference/varnishd.html#ref-param-vcc-allow-inline-c"><span class="std std-ref">vcc_allow_inline_c</span></a></dt> <dd>Allow inline C in VCL, which would any C code from VCL to be executed by Varnish.</dd> </dl> <p>Furthermore you may want to look at and lock down:</p> <dl class="docutils"> <dt><a class="reference internal" href="../reference/varnishd.html#ref-param-syslog-cli-traffic"><span class="std std-ref">syslog_cli_traffic</span></a></dt> <dd>Log all CLI commands to <cite>syslog(8)</cite>, so you know what goes on.</dd> <dt><a class="reference internal" href="../reference/varnishd.html#ref-param-vcc-unsafe-path"><span class="std std-ref">vcc_unsafe_path</span></a></dt> <dd>Restrict VCL/VMODs to <a class="reference internal" href="../reference/varnishd.html#ref-param-vcl-path"><span class="std std-ref">vcl_path</span></a> and <a class="reference internal" href="../reference/varnishd.html#ref-param-vmod-path"><span class="std std-ref">vmod_path</span></a></dd> <dt><a class="reference internal" href="../reference/varnishd.html#ref-param-vmod-path"><span class="std std-ref">vmod_path</span></a></dt> <dd>The directory (or colon separated list of directories) where Varnish will look for modules. This could potentially be used to load rogue modules into Varnish.</dd> </dl> </div> </div> <div class="section" id="the-cli-interface"> <h2>The CLI interface<a class="headerlink" href="#the-cli-interface" title="Permalink to this headline">¶</a></h2> <p>The CLI interface in Varnish is very powerful, if you have access to the CLI interface, you can do almost anything to the Varnish process.</p> <p>As described above, some of the damage can be limited by restricting certain parameters, but that will only protect the local filesystem, and operating system, it will not protect your HTTP service.</p> <p>We do not currently have a way to restrict specific CLI commands to specific CLI connections. One way to get such an effect is to "wrap" all CLI access in pre-approved scripts which use <cite>varnishadm(1)</cite></p> <p>to submit the sanitized CLI commands, and restrict a remote user to only those scripts, for instance using sshd(8)'s configuration.</p> </div> <div class="section" id="vcl-programs"> <h2>VCL programs<a class="headerlink" href="#vcl-programs" title="Permalink to this headline">¶</a></h2> <p>There are two "dangerous" mechanisms available in VCL code: VMODs and inline-C.</p> <p>Both of these mechanisms allow execution of arbitrary code and will thus allow a person to get access to the machine, with the privileges of the child process.</p> <p>If <cite>varnishd</cite> is started as root/superuser, we sandbox the child process, using whatever facilities are available on the operating system, but if <cite>varnishd</cite> is not started as root/superuser, this is not possible. No, don't ask me why you have to be superuser to lower the privilege of a child process...</p> <p>Inline-C is disabled by default starting with Varnish version 4, so unless you enable it, you don't have to worry about it.</p> <p>The parameters mentioned above can restrict the loading of VMODs to only be loaded from a designated directory, restricting VCL wranglers to a pre-approved subset of VMODs.</p> <p>If you do that, we are confident that your local system cannot be compromised from VCL code.</p> </div> <div class="section" id="http-requests"> <h2>HTTP requests<a class="headerlink" href="#http-requests" title="Permalink to this headline">¶</a></h2> <p>We have gone to great lengths to make Varnish resistant to anything coming in through the socket where HTTP requests are received, and you should, generally speaking, not need to protect it any further.</p> <p>The caveat is that since VCL is a programming language which lets you decide exactly what to do with HTTP requests, you can also decide to do stupid and potentially dangerous things with them, including opening yourself up to various kinds of attacks and subversive activities.</p> <p>If you have "administrative" HTTP requests, for instance PURGE requests, we strongly recommend that you restrict them to trusted IP numbers/nets using VCL's <a class="reference internal" href="vcl-syntax.html#vcl-syntax-acl"><span class="std std-ref">Access control lists (ACLs)</span></a>.</p> </div> </div> </div> </div> </div> <div class="sphinxsidebar" role="navigation" aria-label="main navigation"> <div class="sphinxsidebarwrapper"> <h3><a href="../index.html">Table Of Contents</a></h3> <ul> <li><a class="reference internal" href="#">Security first</a><ul> <li><a class="reference internal" href="#command-line-arguments">Command line arguments</a><ul> <li><a class="reference internal" href="#cli-interface-access">CLI interface access</a></li> <li><a class="reference internal" href="#cli-interface-authentication">CLI interface authentication</a></li> <li><a class="reference internal" href="#parameters">Parameters</a></li> </ul> </li> <li><a class="reference internal" href="#the-cli-interface">The CLI interface</a></li> <li><a class="reference internal" href="#vcl-programs">VCL programs</a></li> <li><a class="reference internal" href="#http-requests">HTTP requests</a></li> </ul> </li> </ul> <h4>Previous topic</h4> <p class="topless"><a href="running.html" title="previous chapter">Starting and running Varnish</a></p> <h4>Next topic</h4> <p class="topless"><a href="command-line.html" title="next chapter">Important command line arguments</a></p> <div role="note" aria-label="source link"> <h3>This Page</h3> <ul class="this-page-menu"> <li><a href="../_sources/users-guide/run_security.txt" rel="nofollow">Show Source</a></li> </ul> </div> <div id="searchbox" style="display: none" role="search"> <h3>Quick search</h3> <form class="search" action="../search.html" method="get"> <div><input type="text" name="q" /></div> <div><input type="submit" value="Go" /></div> <input type="hidden" name="check_keywords" value="yes" /> <input type="hidden" name="area" value="default" /> </form> </div> <script type="text/javascript">$('#searchbox').show(0);</script> </div> </div> <div class="clearer"></div> </div> <div class="related" role="navigation" aria-label="related navigation"> <h3>Navigation</h3> <ul> <li class="right" style="margin-right: 10px"> <a href="../genindex.html" title="General Index" >index</a></li> <li class="right" > <a href="command-line.html" title="Important command line arguments" >next</a> |</li> <li class="right" > <a href="running.html" title="Starting and running Varnish" >previous</a> |</li> <li class="nav-item nav-item-0"><a href="../index.html">Varnish version 5.2.1 documentation</a> »</li> <li class="nav-item nav-item-1"><a href="index.html" >The Varnish Users Guide</a> »</li> <li class="nav-item nav-item-2"><a href="running.html" >Starting and running Varnish</a> »</li> </ul> </div> <div class="footer" role="contentinfo"> © Copyright 2010-2014, Varnish Software AS. Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.4.9. </div> </body> </html>
Close