Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Swapfile not really disabled #1620

Closed
conorsch opened this issue Mar 15, 2017 · 4 comments
Closed

Swapfile not really disabled #1620

conorsch opened this issue Mar 15, 2017 · 4 comments
Assignees
@conorsch
Labels
bug ops/deployment security
Milestone
0.3.12

Comments

@conorsch
Copy link
Contributor

The Ansible config tries to disable swapfile on the Application and Monitor Servers, via swapoff -a. This works, but only for the current boot cycle. If a machine is configured with a swapfile in /etc/fstab, that swapfile will be restored on a subsequent reboot. Since the machines reboot nightly, the swapoff -a approach is close to useless.

In order to disable swap effectively, the first-run Ansible config should ensure that no swap entries exist in fstab, removing them if found.
@psivesely psivesely added this to the 0.4 milestone Mar 15, 2017
@psivesely
Copy link
Contributor

This may effectively undermine the efforts of 1dbab3c to minimize the duration of plaintext in memory, and should be resolved in the 0.4 release. Last time I checked it is the default to include a swapfile in fstab when using "guided partitioning" in the Ubuntu installer.

@garrettr garrettr modified the milestones: 0.3.12, 0.4 Mar 15, 2017
@garrettr
Copy link
Contributor

garrettr commented Mar 15, 2017 •
edited by conorsch
Loading

Next steps

  • Verify that swap is re-enabled after reboot on our test instance.
  • Announce intent to release 0.3.12 on https://securedrop.org/news ahead of release, so admins have some prior warning.

Goals

  1. Ensure swap is disabled now and forever on all instances after 0.3.12 is installed.
  2. Securely erase any existing swap that may have been populated with sensitive data prior to the 0.3.12 release.
  3. This update should be automatic and not require intervention from the admins. Therefore, we need to investigate how best to achieve these goals within the environment of the securedrop-app-code Debian package and its postinstall script.

@redshiftzero redshiftzero mentioned this issue Mar 15, 2017
Closed
14 tasks
@conorsch
Copy link
Contributor Author

Have a working implementation for detecting active swap, disabling it, shredding it, and removing the fstab entry. The changes are idempotent. Will place them in the preinst script in the securedrop-app-code package and begin testing in VMs and hardware.

conorsch pushed a commit that referenced this issue Mar 16, 2017
Permanently disables swap in securedrop-app-code preinst
f383e0c 
Checks for active swap on system, and if found:

  * disables it so the system won't write to it
  * shreds the contents so any sensitive data is destroyed

Regardless of whether an active swap config was disabled, any fstab
entry of type "swap" will be commented out, effectively disabling it
permanently by ensuring it won't be reenabled on subsequent reboots.

Closes #1620.
@conorsch conorsch mentioned this issue Mar 16, 2017
Merged
conorsch pushed a commit that referenced this issue Mar 16, 2017
Permanently disables swap in securedrop-app-code preinst
8158cfe 
Checks for active swap on system, and if found:

  * disables it so the system won't write to it
  * shreds the contents so any sensitive data is destroyed

Regardless of whether an active swap config was disabled, any fstab
entry of type "swap" will be commented out, effectively disabling it
permanently by ensuring it won't be reenabled on subsequent reboots.

Closes #1620.
@conorsch
Copy link
Contributor Author

#1626 is merged and will be used to fix running instances. Keeping this issue open until we update the Ansible config for first-run installs to disable swap on both App and Mon, and also re-enable the skipped config tests in #1616 (which caught this issue originally).

conorsch pushed a commit that referenced this issue Mar 29, 2017
Enables config test for prohibiting swap on app machines
e7df0cd 
Still permitting swap presence on Monitor hosts, since the first-run
Ansible config hasn't been updated to remove it there. Changes to the
Ansible config are tracked in #1620.
@conorsch conorsch mentioned this issue Mar 29, 2017
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@conorsch conorsch

Labels
bug ops/deployment security
Projects
None yet
Milestone
0.3.12
Development

No branches or pull requests
3 participants
@garrettr @conorsch @psivesely