0

Assume I run a custom app on an arbitrary port on a linux box - let's say 7890.

This is a go language web server. Runs an app on top of HTTP. No HTTPS. It runs as a dedicated but "normal" user with no sudo rights. The firewall rule for this port allows "everyone (world)" to access it.

All ssh access is secured and firewall rules allow only access via a set of known IPs. SSH access is configured to allow only key-based access.

Is this enough information to answer the following questions:

  • Can an attacker ever gain access to the command line via that exposed port?
  • If the previous question can be answered with "yes, if...", what are the most important things I need to take care of so that the app can't be exploited to get access to the box?

The assumption would be that there are no other known security holes.

Obviously I am no security expert. I hope this is enough information to give an informed statement. I assume there are myriads of related issues and no "absolute" yes/no can be given, but maybe some rough idea is enough for me to get an idea.

Thanks.

Improve this question
4
  • 1
    IMHO, without a specific example application, answers would have to say "yes" to the first question (because saying "no" can't ever be proven), and the second question would need a seminar series' worth of material to answer in the general case. In short, the question is far too broad. – Kusalananda♦ Apr 19 at 16:06
  • Yeah, I am not shocked about this answer...Thank you nonetheless – transient_loop Apr 19 at 16:59
  • Actually there is an important learning here for me - even if it sounds stupid, it means I need to go check myself deeper at all levels of the app - because there is no way to say it's not possible. I am taking over an app and that is why I was asking. – transient_loop Apr 19 at 17:07
  • Check the "normal" user's entries in /etc/passwd, /etc/groups, /etc/sudoers. Read man -a passwd;man sudo sudoers. – waltinator Apr 19 at 17:15
1

Can an attacker ever gain access to the command line via that exposed port?

If there are vulnerabilities in your app, yes.

what are the most important things I need to take care of so that the app can't be exploited to get access to the box?

That's a very difficult question.

  • Go is a pretty safe language, so ostensibly the app can only be hacked if you have issues with the application logic
  • To add an extra layer of security you can use 1) systemd features to limit what the daemon can do 2) write a SeLinux/Apparmor policy 3) run the daemon in chroot/virtualized environment 4) run it under docker or any other lightweight userspace container/hyperviser
Improve this answer
1
  • Makes sense. Sorry for the very broad question, you made a best effort to answer, thanks. – transient_loop Apr 19 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.