|
|
 |
|
| |
NOTE: CentOS Enterprise Linux is built from the Red Hat Enterprise Linux source code. Other than logo and name changes CentOS Enterprise Linux is compatible with the equivalent Red Hat version. This document applies equally to both Red Hat and CentOS Enterprise Linux.
Red Hat Enterprise Linux ships with two different FTP
servers:
-
Red Hat Content Accelerator — A
kernel-based Web server that delivers high performance Web server
and FTP services. Since speed as its primary design goal, it has
limited functionality and runs only as an anonymous FTP server. For
more information about configuring and administering Red Hat Content Accelerator, consult the
documentation available online at https://www.redhat.com/docs/manuals/tux/.
-
vsftpd — A fast, secure FTP
daemon which is the preferred FTP server for Red Hat Enterprise
Linux. The remainder of this chapter focuses on vsftpd.
The Very Secure FTP Daemon (vsftpd) is
designed from the ground up to be fast, stable, and, most
importantly, secure. Its ability to handle large numbers of
connections efficiently and securely is why vsftpd is the only stand-alone FTP distributed with
Red Hat Enterprise Linux.
The security model used by vsftpd has
three primary aspects:
-
Strong separation of privileged and
non-privileged processes — Separate processes handle
different tasks, and each of these processes run with the minimal
privileges required for the task.
-
Tasks requiring elevated privileges are
handled by processes with the minimal privilege necessary
— By leveraging compatibilities found in the libcap library, tasks that usually require full
root privileges can be executed more safely from a less privileged
process.
-
Most processes run in a chroot jail — Whenever possible, processes
are change-rooted to the directory being shared; this directory is
then considered a chroot jail. For
example, if the directory /var/ftp/ is the
primary shared directory, vsftpd reassigns
/var/ftp/ to the new root directory, known
as /. This disallows any potential
malicious hacker activities for any directories not contained below
the new root directory.
Use of these security practices has the following effect on how
vsftpd deals with requests:
-
The parent process runs with the least
privileges required — The parent process dynamically
calculates the level of privileges it requires to minimize the
level of risk. Child processes handle direct interaction with the
FTP clients and run with as close to no privileges as possible.
-
All operations requiring elevated privileges
are handled by a small parent process — Much like the
Apache HTTP Server, vsftpd launches
unprivileged child processes to handle incoming connections. This
allows the privileged, parent process to be as small as possible
and handle relatively few tasks.
-
All requests from unprivileged child
processes are distrusted by the parent process —
Communication with child processes are received over a socket, and
the validity of any information from child processes is checked
before being acted on.
-
Most interaction with FTP clients is handled
by unprivileged child processes in a chroot jail — Because these child
processes are unprivileged and only have access to the directory
being shared, any crashed processes only allows the attacker access
to the shared files.
|
|
|
