Monday Nov 30, 2009

UPDATE: OpenSolaris ISC Construction Kit v1.3

I have been writing about the Immutable Service Container project for quite some time. Since this project was publicly launched earlier this year, we have produced a number of updates, several presentations and podcasts, as well as images that people could use on Amazon EC2 or with VirtualBox. All of these updates had a singular goal - to highlight what is possible when we refactor our existing strategies and processes to pre-integrate greater security capabilities by default into our operating system configurations. While our original goal was to focus on Cloud Computing and virtual machine image security, these concepts really apply more universally. Whether used in a traditional data center or the Cloud, there are significant benefits that can be realized when we begin to put all of the pieces into place. Certainly, I mean more than just patching or hardening, but looking at virtual machine security more comprehensively.

With this as a backdrop, I am very happy to announce the availability of version 1.3 of the OpenSolaris Immutable Service Container Construction Kit! Prior to this update, the Kit was able to automate the creation of a configuration that included:

  • built upon the OpenSolaris 2009.06 release
  • (optional) loose minimization support to help those building and sharing images
  • security hardening of the operating system - based upon the OpenSolaris Security Hardening project
  • non-executable stack functionality enabled (on systems supporting this functionality)
  • encrypted swap enabled
  • encrypted scratch space enabled - default size is 100 Mbytes (customize as needed)
  • kernel-level auditing enabled - default policy audits login/logouts, administrative events, and all commands executed on the system, audit syslog plugin configured (/var/log/auditlog)
  • stateful packet filtering enabled - packet filtering syslog plugin configured (/var/log/ipflog), in-bound network access denied by default (except SSH), out-bound network access permitted by default (customize as needed)
  • a single non-global zone installed (although others can be installed as needed):
    • gzip compressed non-global zone root file system
    • building upon default non-global zone security capabilities
    • unique VNIC limiting visibility of unintended network traffic
    • encrypted scratch space
    • stateful packet filtering and NAT to restrict network-access
    • in-bound network access denied by default (customize for your service)
    • out-bound network access permitted by default (customize as needed)
    • DNS and auditing configurations inherited from the global zone

The v1.3 update goes beyond this foundation to incorporate new capabilities including:

  • configurable virtual network architecture. Non-global zones can be installed into the same or different virtual networks. This capability is required in order to begin constructing ISC configurations that implement more advanced network compartmentalization configurations. Administrators can define to which network a non-global zone should be attached using the -N option to the iscadm.ksh tool.
  • anti-spoofing protection. Each of the non-global zones are configured to leverage the MAC and IP address anti-spoofing protections enabled by Crossbow 1.3 (builds 126 and newer).
  • default resource controls. Non-global zones are configured to have a maximum lightweight process resource control installed (default: 300). This setting helps to mitigate against the effects of certain denial of service attacks. The actual limit can be adjusted using the ISC_MAX_LWPS parameter.
  • default file system quotas. Non-global zone root file systems are configured to have a specific ZFS quota (default: 1G) and reservation (default: 512M). Since ISC nodes (non-global zones) share a common ZFS data set, it is important to have this restriction to prevent one node from exhausting capacity being used by other nodes. The default values can be changed using the ISC_QUOTA and ISC_RESERVATION parameters.
  • site variable override. A new file (isc/etc/site.conf) is used to store any variables that are specific to a site or implementation. This file is not delivered by default and therefore will not be overwritten upon update (preserving any site-specific parameters). This file is intended to be used to store local (site specific) variables such as those listed above.
In addition to these new features and capabilities, several bugs were squashed and the code was generally cleaned up to make it easier to read and extend in future updates. This update was tested using OpenSolaris 2009.06 as well as OpenSolaris 2010.03 (build 127).

It is worth noting that the OpenSolaris ISC Construction Kit uses a modular architecture. Let's say you did not want all of the functionality described above - you just want to harden an OpenSolaris global zone. Well, that can be easily done using the following steps:

$ env ISC_SVCS_DOCK="lockdown" pfexec isc/bin/iscadm.ksh -d

Similarly, if you just wanted just to try out encrypted scratch space and encrypted swap, you could use the command:

$ env ISC_SVCS_DOCK="encrypted_scratch encrypted_swap" pfexec isc/bin/iscadm.ksh -d

The goal of the Kit is to provide a fast, automated, and easy way to implement strong security protections for your systems and virtual machines, but we also recognize that requirements do differ so customization must be a core part of the software architecture.

As always, we would love to hear from you! Let's us know what works and what doesn't! What would you like to see in a future update? Is there anything that you would like to see changed? Here is your chance - speak up!

Take care!

Technorati Tag:

Wednesday Nov 04, 2009

Update: Recent Cloud Security Happenings

I have to say that it has been a very busy couple of weeks. That said, I am happy to say that there is a lot to show for everyone's effort however. We have been able to publish quite a lot of new and updated content, and I figured that it might be a good time to shine a spotlight on some of the more interesting items. Without further ado...

Going forward, we are going to try and bring together all of the Cloud Computing security content on our brand new Sun.COM Cloud Security home page. Be sure to check it out regularly!

More is coming, don't miss it!

Technorati Tag:

Monday Nov 02, 2009

Immutable Service Containers @ Amazon EC2

Just in time for the OpenSolaris Developer Conference, we were able to publish new Immutable Service Containers images directly to the Amazon Web Services Elastic Compute Cloud (EC2) environment. Previously, I talked about creating ISCs using our security enhanced OpenSolaris 2009.06 AMIs. Today, I am happy to announce that we have taken the next logical step by making available AMIs that fully incorporate the ISC changes. If you want to try out this configuration, simply provision an Immutable Service Containers AMI on EC2. We have made AMIs available in both the U.S. (ami-48c32021) and European (ami-78567d0c) regions. As always, we would love to get your feedback on these images and what you would like to see next!

Take care!

Technorati Tag:

Immutable Service Containers @ OSDevCon

Just wanted to let everyone know of a new Immutable Service Containers technical presentation (ODF, PDF) that has been posted. This version was delivered last week in Dresden, Germany at the OpenSolaris Developer Conference. This presentation has all of the latest and greatest information particularly on the OpenSolaris ISC Construction Kit. As always, I would love to hear your comments and feedback!

Take care!

Technorati Tag:

Friday Sep 11, 2009

Immutable Service Containers on Amazon EC2

Back in June, we released the very first security hardened virtual machine images for the Amazon Web Services Elastic Compute Cloud (EC2) environment. These original images were based upon the OpenSolaris 2008.11 release and were configured in accordance with the guidelines published by Sun the Center for Internet Security. Since its initial release, we have provided an update to offer this image in the European Region. In August, we took another step forward with the release of a security-enhanced image based upon the OpenSolaris 2009.06 release. This image went beyond just the simple hardening of its predecessor to add functionality such as encrypted swap, non-executable stacks and auditing that was enabled by default. With such a strong foundation, it should have been no surprise that it was likely to be used as a foundation for layered functionality. Just this month, for example, we announced the release of an image pre-configured with Drupal (v6.10) along with Apache (v2.2), MySQL (v5.0), and PHP (v5.2).

In parallel, the Immutable Service Containers project was announced back in June. This project was focused on the creation of secure execution environments for services. One of the key deliverables from this project has been the OpenSolaris ISC Construction Kit (Preview) that transforms an OpenSolaris 2009.06 system into an ISC configuration. Interestingly, several of the functional elements used today as part of the security-enhanced AMIs actually got their start as part of the ISC Construction Kit.

This brings us to today. For the first time, we have been able to create ISCs in the Cloud on Amazon EC2! Using the OpenSolaris ISC Construction Kit and the security-enhanced OpenSolaris 2009.06 AMI, we have deployed an ISC that exposes a representative service (in this case, a web server).

HELLO WORLD!

The nice thing about this is that the installation process was essentially the same as the one we used to create our pre-configured OVF image. There were two settings that needed to be adjusted in order for the ISC Construction Kit to properly work on EC2:

export ISC_SVCS_DOCK="fs network zone encrypted_scratch"
export ISC_DOCK_NET_IF_NAME="xnf0"

These two parameters had to be set before running the iscadm.ksh command. The first parameter simply removes steps that have already been completed in the base AMI (or are not needed for EC2). The second parameter changes the network interface name from e1000g0 (default) to xnf0 which is needed on EC2. That's all there was to it!

If you are interested in ISCs and how you can use them in your environment, I would love to hear from you! Also, just in case you missed it, I had the pleasure of joining Hal Stern to discuss ISCs on a recent Innovating@Sun podcast. Check it out and send us your feedback! Thanks in advance!

Take care!

Technorati Tag:

About

This area of cyberspace is dedicated the goal of raising cybersecurity awareness. This blog will discuss cybersecurity risks, trends, news and best practices with a focus on improving mission assurance.

Search

Archives
« February 2015
SunMonTueWedThuFriSat
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
       
       
Today