I worked as a system administrator for a medium sized Norwegian company. Our department was administering a large number of network devices and Unix/Linux servers. The company had two international offices each with different network security zones. This complex network topology combined with a severe strict password policy, made it impossible to memorize all different passwords.
We solved this by equipping each administrator with their own Palm with an approved secure password application. These Palms had to be manually fed, which meant in practice that they never were in sync. The authoritative password "database" was a green folder with sheets upon sheets of paper combined with post-it notes scribbled all over. In other words, it was a mess. The only up-turn was that this folder was stored in a huge fire-proof safe.
We decided to clean this up. First, we wanted an online central password database, stored as secure as possible, and running on Linux. I found dozens upon dozens of password applications. However, most of these could be placed in one of two categories (and in some cases both):
- The application is designed for one user. Many of these applications are pretty usable, some even with a nice graphical user interface. A familiar example; both Firefox and Thunderbird allow you to save username and passwords. When enabling the Master password, you should, these passwords are encrypted on disk. However, these passwords are only available to the user of the application. The desktop managers GNOME and KDE both have the ability to save passwords securely.
- The application is fundamentally flawed. For example, the application allows core dumps or being swapped to disk. One password application I found even stored the passwords in clear(!) text in a SQL database. Really dumb.
Fortnunately, there was one application that caught my eye. It did not fit any of these conditions above.
Console Password Management
CPM is one of those rare applications that have done many things right when it comes to secure passwords storage. At startup it checks
- whether core dumps are disabled,
- whether memory is locked from paging,
- whether the application is protected from ptrace spying,
- whether the application has environment checks enabled, and
- whether it's running without root privileges.
Installation
Installing CPM from source can be a little hassle unless you are familiar with compiling your own software. On Debian, you can just add CPM's apt source and install it using Debian's own package manager. You'll find instructions on CPM's homepage. Unfortunately, I did not find updated packages for Fedora/Red Hat Enterprise. I know that the developer is busy updating CPM and that a static binary is high on his priority list. A static binary would ease the installation tremendously.
Note that CPM is installed SUID root (mode 4755), meaning that CPM will be executed with root privileges regardless whether root executes the application or the user. This is necessary to enable memory locking and protection from strace/ptrace attacks. The root privilege is dropped right after memory locking.
GnuPG
Before we start using CPM, we need to have an asymmetric keypair generated by GnuPG. GnuPG is a free implementation of the commercial PGP and is included in most Linux distributions. Since CPM relies so heavily on GPG, it is imperative that you and your co-users have a grip on GnuPG. If you plan to have more than one user accessing the same CPM database, you need to create a GnuPG "web-of-trust", which basically is signing each others keys. If you are the only users of CPM, this is not necessarily.
If you don't already have a GnuPG keypair, you can create one:
$ gpg --gen-key
You'll be asked some questions, where you safely can choose the default options. Be sure to type in your name and email address when asked so. Choose a really good passphrase! This will be the only password you'll have to remember. But do remember it! If you forget this, there is no way to recover the password database.
You can now list your newly created key:
$ gpg --list-keys
Good! Lets get started using CPM.
Configuration and usage
First, we need to configure CPM. Copy /etc/cpm/cpmrc to ~/.cpmrc
$ cp /etc/cpm/cpmrc ~/.cpmrc
Open this file with the editor of your choice. In this file, you need to set the "EncryptionKey" variable. Its value would be the GnuPG email-address you typed in when you generated the GnuPG keys. So for me, that would be:
EncryptionKey "lars.strand@linpro.no"
Save and exit. Start CPM with a security test:
$ cpm --security
You should now get an output like the one in the image above. It looks like we're secure enough. The first time we start CPM, we get an error telling us that it can't find any database. That's ok, since we haven't created one yet. There is no host added, so you'll be greeted with an empty CPM as shown in the image below.
You populate the database by pressing Ctrl-A. Enter the hostname, and press enter. Selecting the host and pressing enter, enables you to add one or more services for this host. Each service can have one or more username/password pairs linked to it. Every host, service or username/password can have a comment associated with it. See the image below.
Install the password checker cracklib, and CPM also warns you if you enter a weak password. See figure:
Every entry has a timestamp indicating when it was updated and by which GnuPG key. This way, we can see which user has updated this particular entry.
Finally, save by pressing Ctrl-W. If this is the first time you run CPM, we'll be prompted for our GnuPG password. Otherwise we're asked for the password at startup - else CPM is not able to read our database. Quit by pressing ESC. The database is now saved in ~/.cpmdb in our home directory:
$ file ~/.cpmdb
/home/lars/.cpmdb: PGP armored data message
This file is just an encrypted and compressed XML-file. We can easily decrypt the content by issuing the command:
$ gpg --decrypt ~/.cpmdb | gzip -cd > cpm-decrypted.xml
$ file cpm-decrypted.xml
cpm-decrypted.xml: XML document text
CPM also provides command line search. Here I search for every entry containing "trinity:
$ cpm valhall
enter your passphrase (try #1)
Lars Strand
login root@valhall secretpassword3
1 match found.
This is quite useful when I'm in a hurry.
More than one user
If you plan to use CPM with several users, be sure that everyone has grip on GnuPG and how to proper handle their keys. You also want to store the database somewhere else. Your home directory is not a good place! Create a directory /var/lib/cpm/ and call the database cpmdb. Create a group called "cpm" and populate it with users of CPM. Then make sure the directory is (only) readable by that group. If CPM is running on a high trusted host, you've come a long way to see the security officer in your company smile.
You need to consult the GnuPG documentation on how to sign each others GnuPG keys to create a "web-of-trust".
If there is more than one user accessing CPM at the same time. Only the first user has read-write access. All other users will have read-only.
Conclusion
CPM does one thing, and it does it really well. It stores passwords securely. If you and your co-workers know how to handle GnuPG, it is way better than most other solutions out there.
This article originally appeared in Linux+DVD magazine in the January 2009 issue.
No comments:
Post a Comment