Unauthenticated packages installed on app and mon servers during initial provisioning

[redshiftzero]

Description

During initial provisioning of the SecureDrop servers, three packages - tor, ntp, and the Tor keyring are installed without verifying cryptographic signatures. As these packages are fetched over HTTP, an attacker with network access could gain remote code execution on the SecureDrop servers if they are able to man-in-the-middle (MitM) the connection to the apt server. This vulnerability was first introduced in SecureDrop 0.3, released February 11, 2015 due to a developer misunderstanding in the functionality of the force option in Ansible’s apt module.

Mitigation

The fix here is to remove the force option such that signature verification occurs.

[redshiftzero]

Fixed in SecureDrop 0.4.4 in commit e4e268d

[heartsucker]

We just go a support email that had this line in an ansible error:

There are problems and -y was used without --force-yes

when installing a package. I have seen this before at work and am almost 100% sure this is why force: yes was added in the first place, because I've seen ops guys add force: yes to "just make fricken ansible work."

I know this ticket is closed, but I'm putting this here as a note.

[sylvaintwp]

Please re-open this issue.

We conducted a test install of 0.4.4 attached are the logs. The NTP package couldn't be authenticated on mon, and appeared to have succesfully installed on app (or did it simply not installed as a result of the mon error??).
sd-admin-install.run.2.log

I have open a separate issue to document the failure to download the 'securedrop-keyring' package, also reported as a failure in the logs (to be attached shortly.)

Kindly expedite fixes to the release. Thanks!
Uploading sd-admin-install.run.2.log…

[heartsucker]

Hey @sylvaintwp. This is actually the exact issue that we opened this issue to solve: to never use force: yes on the apt module. Adding this back in would be a huge security hole. The failure you are seeing should be opened as a separate issue so we can solve the problem of the package failing to install using the safe case of force: no.