Cacti Security

SecurityPro · Post by **SecurityPro** » Thu Sep 17, 2009 9:48 am

Hello Cacti Enthusiasts,

I have recently installed Cacti 0.8.7e and have a question about the .XML coded graph templates that are posted by other users. How secure are these templates? Has anyone found any with malicious intent such as, pointing traffic out of your intranet to a remote server? As working for a company that wishes to implement this RRD graphic tool, I have a multitude of risk assessments to produce based on a preliminary investigation. I know there are associated risks with SQL injections and php alterations in previous versions of Cacti, have all of these been addressed? I could not find specific information in the release notes. I do not speak XML so I was really looking for some insight into these templates.
Thank you very much for your time in advance gentlemen,
SecurityPro

BSOD2600 · Post by **BSOD2600** » Thu Sep 17, 2009 12:49 pm

1) moving to a forum with a wider audience.

2) I've never heard of anything like that happening with altering the xml templates. Feel free to look through the XML parsing code, analyze it yourself, and come to your own conclusions. "speaking" XML isn't that hard really -- have you look at a xml file in a web browser?

SecurityPro · Post by **SecurityPro** » Thu Sep 17, 2009 1:31 pm

Yes sir I have, I researched some parts of XML and it seems that it is geared towards being a plain text language, meaning both the pc and the user can interpret the data clearly. The template I really have in question contains a few different sections that incorporate MD5 hashs, which are obviously much less secure than something like Sha-2, but I found it odd that a XML code would even include a hash, is this normal practice? Also where shall I post ? I work in a windows environment so I assumed this was a safe haven.

SecurityPro · Post by **SecurityPro** » Thu Sep 17, 2009 1:36 pm

:ignore:

BSOD2600 · Post by **BSOD2600** » Thu Sep 17, 2009 2:36 pm

The hash you see is actually a combination of things, some which is outlined here: http://docs.cacti.net/howto:determine_c ... te_version

Howie · Post by **Howie** » Thu Sep 17, 2009 3:56 pm

As far as I know, for the most part the hashes are just unique IDs, not any kind of checksum, so how 'secure' MD5 is vs SHA is not really relevant.

It does bring up another interesting issue though - I can't think of anything that stops someone creating a script query that runs some random command-line and then exporting that for the rest of us to enjoy. I don't really see what you could do to protect against it either, apart from add some restrictions on where the script query command runs from, which doesn't really address the problem.

Ultimately, you are taking software from at least two parties (the Cacti team and the template author), and running it on your systems. If you either don't trust them or don't want to review the code yourself, you should consider that risk. Plenty of people consider the payoff exceeds the risk. Presumably you have done the same analysis for PHP, Mysql, rrdtool, the OS, etc etc etc?

Technology isn't going to help you, without going to some kind of code-signing for templates, and even then you still need to trust whoever is signing the templates.

Post by **TheWitness** » Thu Sep 17, 2009 7:33 pm

Agreeing with Howie. True understanding begins when we realize how little we truly understand. An in doing so, we first see, understanding, then we can speak from the standpoint of both knowledge and understanding.

You must seek first to understand. That understanding can be sped along by going to http://docs.cacti.net

TheWitness

SecurityPro · Post by **SecurityPro** » Fri Sep 18, 2009 8:20 am

So would it be safe to say that all templates developed by an author other than BSOD2600 or Howard Jones should be avoided?

(Only trusting the implied good intentions of the developers)

Howie · Post by **Howie** » Fri Sep 18, 2009 8:31 am

SecurityPro wrote:So would it be safe to say that all templates developed by an author other than BSOD2600 or Howard Jones should be avoided?

(Only trusting the implied good intentions of the developers)

Don't trust me. I don't even trust me half the time

SecurityPro · Post by **SecurityPro** » Fri Sep 18, 2009 8:36 am

In that case, I presume I need to devlope my own templates, point me to a guide if you find a moment.

Post by **TheWitness** » Fri Sep 18, 2009 8:55 am

The most appropriate methodology to accomplish this is to have two servers:

1) Production
2) Test

Make sure you make backups. Then, you must install the Templates on your Test box. Qualify them, and once qualified, export and import on your production server.

Until we have template signing and certification processes established, this is the most appropriate methodology to utilize.

TheWitness

johncoths · Post by **johncoths** » Mon Nov 02, 2009 9:56 am

Yes maybe having a two server is really a good idea so I guess that is a best thing that we should do for the security of the site. the one is for testing and the one is for the final and functioning one.

_________________
Home Security Systems

Cacti

Cacti Security

Cacti Security

Cacti

Trust

Re: Trust

Who is online