Security Working Group meeting - Wednesday February 16

Security Working Group meeting - Wednesday February 16

[Joseph Reynolds]

This is a reminder of the OpenBMC Security Working Group meeting 
scheduled for this Wednesday February 16 at 10:00am PDT.

We'll discuss the following items on the agenda 
<https://docs.google.com/document/d/1b7x9BaxsfcukQDqbvZsU2ehMq4xoJRQvLxxsDUWmAOI>, 
and anything else that comes up:

1.Do we need to discuss the concept and need for NoAccess users and how 
they would be different from disabled BMC user accounts?  See discussion 
in https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/49295 
<https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/49295>




Access, agenda and notes are in the wiki:
https://github.com/openbmc/openbmc/wiki/Security-working-group 
<https://github.com/openbmc/openbmc/wiki/Security-working-group>

- Joseph

Re: Security Working Group meeting - Wednesday February 16 - results

[Joseph Reynolds]

On 2/16/22 7:21 AM, Joseph Reynolds wrote:
> This is a reminder of the OpenBMC Security Working Group meeting 
> scheduled for this Wednesday February 16 at 10:00am PDT.
>
> We'll discuss the following items on the agenda 
> <https://docs.google.com/document/d/1b7x9BaxsfcukQDqbvZsU2ehMq4xoJRQvLxxsDUWmAOI>, 
> and anything else that comes up:

Attended: Joseph, Daniil, Dhananjay, Dick, James, Jiang


> 1.Do we need to discuss the concept and need for NoAccess users and 
> how they would be different from disabled BMC user accounts?  See 
> discussion in 
> https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/49295 
> <https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/49295>

DISCUSSION:

Does the project have any NoAccess (priv-noaccess) users?

Is noaccess needed to implement IPMI Callback users?

Note that we prefer to disable ipmi users, not change their role.

Can ipmitool be used to create a callback user?  If so, what role does 
phosphor-user-manager use for that user?

Is the IPMI callback role deprecated?  Can we remove it from OpenBMC?

Is callback needed to implement trusted system interfaces and 
sessionless interfaces IPMB?



BONUS TOPICS:

2 Update on OpenBMC becoming a CNA.

James got CNA admin credentials, and is able to create test CVEs.

James is working on documentation for OpenBMC security responders who 
work to create CVEs .  James is working to document the process for the 
OpenBMC CNA to work with Mitre’s CVEs.  (For example, how OpenBMC will 
reserve CVEs and ensure they are published in a timely manner.)

Next steps: (1) Document process steps in openbmc/docs.  (2) Reserve 
CVEs for existing privately reported vulnerabilities.


3 Question: How does BMC respond to too many failed login attempts?

DISCUSSION: It uses (the deprecated module) pam_tally2 (and should move 
to pam_faillock).

See 
https://gerrit.openbmc-project.xyz/c/openbmc/phosphor-user-manager/+/39853 
<https://gerrit.openbmc-project.xyz/c/openbmc/phosphor-user-manager/+/39853>  
questions:

Background: 
https://github.com/openbmc/docs/blob/master/architecture/user-management.md 
<https://github.com/openbmc/docs/blob/master/architecture/user-management.md>

Note: The default is to not lock out users due to excessive password 
attempts.


Joseph

>
> Access, agenda and notes are in the wiki:
> https://github.com/openbmc/openbmc/wiki/Security-working-group 
> <https://github.com/openbmc/openbmc/wiki/Security-working-group>
>
> - Joseph

Is priv-noaccess needed?

[Joseph Reynolds]

User manager and IPMI maintainers (and please forward to additional 
interested parties):

We are trying to understand how the NoAccess (priv-noaccess) role is 
used in OpenBMC.  See the discussion below, the gerrit review, and the 
IPMI questions.

What are the use cases?  What is this role used for?  If we need this 
role, let's understand why.  Otherwise, can we deprecate this role and 
remove it?

Joseph


-------- Forwarded Message --------
Subject: 	Re: Security Working Group meeting - Wednesday February 16 - 
results
Date: 	Wed, 16 Feb 2022 13:31:25 -0600
From: 	Joseph Reynolds <jrey@linux.ibm.com>
To: 	openbmc <openbmc@lists.ozlabs.org>



On 2/16/22 7:21 AM, Joseph Reynolds wrote:
> This is a reminder of the OpenBMC Security Working Group meeting 
> scheduled for this Wednesday February 16 at 10:00am PDT.
>
> We'll discuss the following items on the agenda 
> <https://docs.google.com/document/d/1b7x9BaxsfcukQDqbvZsU2ehMq4xoJRQvLxxsDUWmAOI>, 
> and anything else that comes up:

Attended: Joseph, Daniil, Dhananjay, Dick, James, Jiang


> 1.Do we need to discuss the concept and need for NoAccess users and 
> how they would be different from disabled BMC user accounts?  See 
> discussion in 
> https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/49295 
> <https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/49295>

DISCUSSION:

Does the project have any NoAccess (priv-noaccess) users?

Is noaccess needed to implement IPMI Callback users?

Note that we prefer to disable ipmi users, not change their role.

Can ipmitool be used to create a callback user?  If so, what role does 
phosphor-user-manager use for that user?

Is the IPMI callback role deprecated?  Can we remove it from OpenBMC?

Is callback needed to implement trusted system interfaces and 
sessionless interfaces IPMB?

...snip...

Joseph

>
> Access, agenda and notes are in the wiki:
> https://github.com/openbmc/openbmc/wiki/Security-working-group 
> <https://github.com/openbmc/openbmc/wiki/Security-working-group>
>
> - Joseph