Concern about security database and jails

K

kjpetrie

I run three NATted jails on my 9.3-RELEASE server, which means I get four security e-mails every morning. This morning, one of the jails told me devel/pcre was vulnerable, but not the host nor the other jail with pcre installed.

The jail reporting the vulnerability sent:
Code: 
Checking for packages with security vulnerabilities:
pcre-8.37_3

The other jail concerned sent:
Code: 
Checking for packages with security vulnerabilities:
Database fetched: Sun Aug 23 03:18:50 BST 2015

and the host sent:
Code: 
Checking for packages with security vulnerabilities:
Database fetched: Mon Aug 24 03:08:21 BST 2015

It doesn't take a genius to work out what's going on here, or the threat it poses of a vulnerability being missed. It appears that, to save bandwidth, each machine (IP address?) is only served the database once so when my host or one of my jails downloads the database, the others are refused it or told there's no update since they last downloaded.

Therefore, there is a lottery as to which jail/host gets the database, and whether any vulnerable package is installed in that environment. If the third jail, which doesn't have pcre installed, had downloaded the database, I would have been left in blissful ignorance of the problem for at least another day. A day can be a long time when it comes to published vulnerabilities on a publicly accessible server.

This needs to be handled differently. Either only the host should download the database and then check itself and all jails for vulnerabilities (possibly this can be achieved with some configuration and scripting at my end if I know what to do) or all requests should be served the database unless some arbitrary number of downloads (beyond which my first suggestion becomes mandatory) is exceeded.

It's possible I just need some configuration information, or does the system need to change?
 
FYI, I am seeing the same thing with multiple physical machines behind a NAT box - only one of them has the latest vulnerability database.
 
I use the following (simplistic) script to audit my NATed jails in FreeBSD 10.1 :
Code: 
#! /bin/sh
jail_ids=$(jls -h jid | grep -v -x jid )

echo "Starting auditing jails..."

for x in $jail_ids ; do
  hostname=$(jls -j $x -h host.hostname | grep -v -x host.hostname)
  echo "=================="
  echo $hostname
  echo "------------------"
  echo "$(pkg -j $x audit -F)"
done
echo "=================="
and I saw the security report concerning devel/pcre for all the jails where it was installed. If I correctly understood the -j option, using this script should download the vulnerability database in each jail. So I cannot reproduce your problem on my system.
 
For 10.1 I am using the periodic.conf
Code: 
# Daily security Jails
pkg_jails="*"
daily_status_security_pkgaudit_jails="*"

Its build in and works flawless.
Regards
Markus
 
Are these overriding defaults in 10.1? There appear to be no such defaults in 9.3.

Are the "*"s meant to be literal or placeholders for other values (eg YES or NO)?
 
If this is indeed bound to the IP, then the problem is bigger than jails. My DSL modem is reset by the cable company to a new IP once every day, so what if I get the IP of someone who loaded the database a few minutes ago?
 
You must log in or register to reply here.
Back
Top