Security Working Group Meeting - Wed 14 October

Security Working Group Meeting - Wed 14 October

[Parth Shukla]

[-- Attachment #1: Type: text/plain, Size: 1126 bytes --]

This is a reminder of the OpenBMC Security Working Group meeting scheduled
for this Wednesday October 14 at 10:00am PDT.

We'll discuss the following items on the agenda
<https://docs.google.com/document/d/1b7x9BaxsfcukQDqbvZsU2ehMq4xoJRQvLxxsDUWmAOI/edit>,
and anything else that comes up:

   1. (Joseph): Follow up from 2020-8-19: Gerrit code review: BMCWeb webUI
   login change: https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/35457
   Question: What are the security risks of using the proposed config flag
   BMCWEB_INSECURE_ENABLE_UNAUTHENTICATED_ASSETS=YES?
      1. Fingerprinting (leak information about the BMC’s manufacturer and
      version).
      2. Attackers have an easier time getting the code to find and exploit
      security bugs.
      3. May make DoS easier.
      4. More?
   2. (Joseph): Per
   https://lists.ozlabs.org/pipermail/openbmc/2020-October/023530.html do
   we agree on the approach?  What security categories seem most important?

Access, agenda and notes are in the wiki:
https://github.com/openbmc/openbmc/wiki/Security-working-group

Regards,
Parth

[-- Attachment #2: Type: text/html, Size: 1899 bytes --]

Re: Security Working Group Meeting - Wed 14 October - results

[Joseph Reynolds]

On 10/13/20 2:06 PM, Parth Shukla wrote:
> This is a reminder of the OpenBMC Security Working Group meeting 
> scheduled for this...
> This Message Is From an External Sender
> This message came from outside your organization.
>
> This is a reminder of the OpenBMC Security Working Group meeting 
> scheduled for this Wednesday October 14 at 10:00am PDT.
>
> We'll discuss the following items on the agenda 
> <https://docs.google.com/document/d/1b7x9BaxsfcukQDqbvZsU2ehMq4xoJRQvLxxsDUWmAOI/edit>, 
> and anything else that comes up:
>
>  1. (Joseph): Follow up from 2020-8-19: Gerrit code review: BMCWeb
>     webUI login change:
>     https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/35457
>     Question: What are the security risks of using the proposed config
>     flag BMCWEB_INSECURE_ENABLE_UNAUTHENTICATED_ASSETS=YES?
>      1. Fingerprinting (leak information about the BMC’s manufacturer
>         and version).
>      2. Attackers have an easier time getting the code to find and
>         exploit security bugs.
>      3. May make DoS easier.
>      4. More?
>

Yes, those are the main risks we talked about.  And it seems reasonable 
for some environments to accept these risks.  We discussed 
fingerprinting, and the desire to minimize this surface going forward.  
We discussed how the Redfish standard requires files to have 
unauthenticated access to static files while the OpenBMC project has 
uses cases that don’t want to allow that, for example, discussion in 
https://redfishforum.com/thread/375/mtls-enforcement-openbmcs-redfish-implementation



> 2. (Joseph): Per 
> https://lists.ozlabs.org/pipermail/openbmc/2020-October/023530.html do 
> we agree on the approach?  What security categories seem most important?

The Microsoft, IBM, and Common Criteria schemes each have topics that 
seem appropriate.  No other high-level scheme was proposed, so we’ll go 
with these for now.

In particular, will someone please articulate topics from Microsoft 
Security Development Lifecycle (SDL), and we’ll add them to the list. TODO

It was agreed that the list of topics have information that can be 
leveraged by various security development processes.  For example, a 
team that uses OpenBMC in their project and wants to follow a security 
scheme/process/evaluation should be able to use these topics to find 
what they need in the OpenBMC project documentation.

We agreed in principle to organize OpenBMC security work to a subset of 
the topics listed.

Two subtopics were discussed:

2A. We reviewed the security reporting and bug fixing process.  
Specifically:

  *

    The OpenBMC security response team:
    https://github.com/openbmc/docs/blob/master/security/obmc-security-response-team.md

  *

    This is what github advocates using:
    https://github.com/openbmc/openbmc/security/advisories

  *

    What tools do we use to:

  *

    Identify which open source pkgs are used in an openbmc build,

  *

    Identify security bugs in those packages, and

  *

    Ensure that we pull in fixes or otherwise mitigate the problem.


2B. Given that OpenBMC is a Linux Foundation project, what resources 
does the Linux Foundation offer?  Specifically, we want a private secure 
bug tracker for the OpenBMC security response team to use.

The following topic was added:

3. Anton update on privilege separation work

ANSWER:

Progress on ipmi-net & bmcweb -- working on dbus config, sockets; which 
areas to sandbox.

To make the migration work (changing from root user to another user), we 
will need to migrate the process’s environment, for example: bmcweb uses 
files in /home/root and it won't have permission afterward.

We discussed how to do the source bump to help CI go more smoothly.

> Access, agenda and notes are in the wiki:
> https://github.com/openbmc/openbmc/wiki/Security-working-group
>
> Regards,
> Parth

Re: Security Working Group Meeting - Wed 14 October - request for security bug tracker

[Joseph Reynolds]

On 10/15/20 9:14 AM, Joseph Reynolds wrote:
> On 10/13/20 2:06 PM, Parth Shukla wrote:
>> This is a reminder of the OpenBMC Security Working Group meeting 
>> scheduled for this...
>> This Message Is From an External Sender
>> This message came from outside your organization.
>>
>> This is a reminder of the OpenBMC Security Working Group meeting 
>> scheduled for this Wednesday October 14 at 10:00am PDT.
>>
>> We'll discuss the following items on the agenda 
>> <https://docs.google.com/document/d/1b7x9BaxsfcukQDqbvZsU2ehMq4xoJRQvLxxsDUWmAOI/edit>, 
>> and anything else that comes up:
>>
...snip...
>
> Two subtopics were discussed:
>
> 2A. We reviewed the security reporting and bug fixing process. 
> Specifically:
>
>  * The OpenBMC security response team:
> https://github.com/openbmc/docs/blob/master/security/obmc-security-response-team.md
>
>  * This is what github advocates using:
>    https://github.com/openbmc/openbmc/security/advisories
>
>  * What tools do we use to:
>
>     * Identify which open source pkgs are used in an openbmc build,
>
>     * Identify security bugs in those packages, and
>
>     * Ensure that we pull in fixes or otherwise mitigate the problem.
>
>
> 2B. Given that OpenBMC is a Linux Foundation project, what resources 
> does the Linux Foundation offer?  Specifically, we want a private 
> secure bug tracker for the OpenBMC security response team to use.

Kurt,

The OpenBMC security response team could benefit from a bug tracker to 
track security vulnerabilities that were reported to the project and not 
yet disclosed.  This is to support [1] and would have to be private and 
secure.
What is commonly used for this?  Can we do it at the project level? Can 
LF help?

- Joseph

[1]: 
https://github.com/openbmc/docs/blob/master/security/obmc-security-response-team.md


...snip...
>> Access, agenda and notes are in the wiki:
>> https://github.com/openbmc/openbmc/wiki/Security-working-group
>>
>> Regards,
>> Parth
>

Re: Security Working Group Meeting - Wed 14 October - request for security bug tracker

[krtaylor]

On 10/15/20 9:22 AM, Joseph Reynolds wrote:
> On 10/15/20 9:14 AM, Joseph Reynolds wrote:
>> On 10/13/20 2:06 PM, Parth Shukla wrote:
>>> This is a reminder of the OpenBMC Security Working Group meeting 
>>> scheduled for this...
>>> This Message Is From an External Sender
>>> This message came from outside your organization.
>>>
>>> This is a reminder of the OpenBMC Security Working Group meeting 
>>> scheduled for this Wednesday October 14 at 10:00am PDT.
>>>
>>> We'll discuss the following items on the agenda 
>>> <https://docs.google.com/document/d/1b7x9BaxsfcukQDqbvZsU2ehMq4xoJRQvLxxsDUWmAOI/edit>, 
>>> and anything else that comes up:
>>>
> ...snip...
>>
>> Two subtopics were discussed:
>>
>> 2A. We reviewed the security reporting and bug fixing process. 
>> Specifically:
>>
>>  * The OpenBMC security response team:
>> https://github.com/openbmc/docs/blob/master/security/obmc-security-response-team.md 
>>
>>
>>  * This is what github advocates using:
>>    https://github.com/openbmc/openbmc/security/advisories
>>
>>  * What tools do we use to:
>>
>>     * Identify which open source pkgs are used in an openbmc build,
>>
>>     * Identify security bugs in those packages, and
>>
>>     * Ensure that we pull in fixes or otherwise mitigate the problem.
>>
>>
>> 2B. Given that OpenBMC is a Linux Foundation project, what resources 
>> does the Linux Foundation offer?  Specifically, we want a private 
>> secure bug tracker for the OpenBMC security response team to use.
> 
> Kurt,

Again, PLEASE cc me directly, I don't read every email on the list. It 
was another happy coincidence that I read this and saw my name. :)

> The OpenBMC security response team could benefit from a bug tracker to 
> track security vulnerabilities that were reported to the project and not 
> yet disclosed.  This is to support [1] and would have to be private and 
> secure.
> What is commonly used for this?  Can we do it at the project level? Can 
> LF help?

Just brainstorming here...

What about a github repo like openbmc/security_tracking or similar with 
its own team? We'd have to experiment with that and make sure it was 
private.

Otherwise, we could do something with hosting with the LF (bugzilla 
instance?), but it would surely cost $$$. Another reason for project 
owned, independent assets, but I digress.

Let's see what we can do with the tools we have now (github) especially 
since we may be moving that way anyway.

Kurt Taylor (krtaylor)

> - Joseph
> 
> [1]: 
> https://github.com/openbmc/docs/blob/master/security/obmc-security-response-team.md 
> 
> 
> 
> ...snip...
>>> Access, agenda and notes are in the wiki:
>>> https://github.com/openbmc/openbmc/wiki/Security-working-group
>>>
>>> Regards,
>>> Parth
>>
>