svn commit: r524248 - in head: . security security/imds-filterd
Colin Percival
cperciva at FreeBSD.org
Mon Jan 27 09:01:18 UTC 2020
Author: cperciva
Date: Mon Jan 27 09:01:16 2020
New Revision: 524248
URL: https://svnweb.freebsd.org/changeset/ports/524248
Log:
Add imds-filterd.
The imds-filterd tool allows administrators of EC2 instances to lock down
which data from the Instance Metadata Service can be accessed by specified
system users and groups, thereby making the EC2 Instance Metadata Service
compatible with traditional UNIX privilege separation.
Reviewed by: otis, dizzy, lwhsu
Sponsored by: Tarsnap Backup Inc.
Added:
head/security/imds-filterd/
head/security/imds-filterd/Makefile (contents, props changed)
head/security/imds-filterd/distinfo (contents, props changed)
head/security/imds-filterd/pkg-descr (contents, props changed)
head/security/imds-filterd/pkg-message (contents, props changed)
Modified:
head/GIDs
head/UIDs
head/security/Makefile
Modified: head/GIDs
==============================================================================
--- head/GIDs Mon Jan 27 08:19:09 2020 (r524247)
+++ head/GIDs Mon Jan 27 09:01:16 2020 (r524248)
@@ -194,7 +194,7 @@ sems:*:250:
# free: 251
# free: 252
_adsuck:*:253:
-# free: 254
+imds:*:254:
_i2pd:*:255:
_tor:*:256:
_smtpd:*:257:
Modified: head/UIDs
==============================================================================
--- head/UIDs Mon Jan 27 08:19:09 2020 (r524247)
+++ head/UIDs Mon Jan 27 09:01:16 2020 (r524248)
@@ -199,7 +199,7 @@ sems:*:250:250::0:0:SIP Express Media Server:/nonexist
# free: 251
# free: 252
_adsuck:*:253:253::0:0:Adsuck ad blocking user:/nonexistent:/usr/sbin/nologin
-# free: 254
+imds:*:254:254::0:0:Instance Metadata Service filter:/nonexistent:/usr/sbin/nologin
_i2pd:*:255:255::0:0:I2P daemon:/var/db/i2pd:/usr/sbin/nologin
_tor:*:256:256::0:0:Tor anonymizing router:/var/db/tor:/usr/sbin/nologin
_smtpd:*:257:257::0:0:OpenSMTPD:/var/empty:/usr/sbin/nologin
Modified: head/security/Makefile
==============================================================================
--- head/security/Makefile Mon Jan 27 08:19:09 2020 (r524247)
+++ head/security/Makefile Mon Jan 27 09:01:16 2020 (r524248)
@@ -226,6 +226,7 @@
SUBDIR += idea
SUBDIR += identify
SUBDIR += ike
+ SUBDIR += imds-filter
SUBDIR += integrit
SUBDIR += ipfcount
SUBDIR += ipfilter2dshield
Added: head/security/imds-filterd/Makefile
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/security/imds-filterd/Makefile Mon Jan 27 09:01:16 2020 (r524248)
@@ -0,0 +1,44 @@
+# $FreeBSD$
+
+PORTNAME= imds-filterd
+DISTVERSION= 0.1
+CATEGORIES= security
+
+MAINTAINER= cperciva at FreeBSD.org
+COMMENT= Provides per user/group access controls to the EC2 IMDS
+
+LICENSE= BSD2CLAUSE
+LICENSE_FILE= ${WRKSRC}/COPYRIGHT
+
+USE_GITHUB= YES
+GH_ACCOUNT= cperciva
+
+# Install binaries into ${STAGEDIR}${PREFIX}/sbin
+MAKE_ARGS+= BINDIR=${STAGEDIR}${PREFIX}/sbin
+
+PORTDOCS= README.md USAGE
+PLIST_FILES= etc/rc.d/imds-filterd \
+ etc/rc.d/imds-proxy \
+ sbin/imds-filterd \
+ sbin/imds-proxy \
+ "@sample etc/newsyslog.conf.d/imds.conf.sample" \
+ "@sample etc/syslog.d/imds.conf.sample" \
+ "@sample etc/imds.conf.sample"
+
+OPTIONS_DEFINE= DOCS
+
+USERS= imds
+GROUPS= imds
+
+post-install:
+ @${MKDIR} ${STAGEDIR}${DOCSDIR}
+ ${INSTALL_DATA} ${PORTDOCS:S,^,${WRKSRC}/,} ${STAGEDIR}${DOCSDIR}
+ @${MKDIR} ${STAGEDIR}${PREFIX}/etc/syslog.d
+ ${INSTALL_DATA} ${WRKSRC}/freebsd-conf/syslog-imds.conf ${STAGEDIR}${PREFIX}/etc/syslog.d/imds.conf.sample
+ @${MKDIR} ${STAGEDIR}${PREFIX}/etc/newsyslog.conf.d
+ ${INSTALL_DATA} ${WRKSRC}/freebsd-conf/newsyslog-imds.conf ${STAGEDIR}${PREFIX}/etc/newsyslog.conf.d/imds.conf.sample
+ ${INSTALL_DATA} ${WRKSRC}/imds.conf ${STAGEDIR}${PREFIX}/etc/imds.conf.sample
+ ${INSTALL_SCRIPT} ${WRKSRC}/freebsd-conf/rc.d-imds-filterd ${STAGEDIR}${PREFIX}/etc/rc.d/imds-filterd
+ ${INSTALL_SCRIPT} ${WRKSRC}/freebsd-conf/rc.d-imds-proxy ${STAGEDIR}${PREFIX}/etc/rc.d/imds-proxy
+
+.include <bsd.port.mk>
Added: head/security/imds-filterd/distinfo
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/security/imds-filterd/distinfo Mon Jan 27 09:01:16 2020 (r524248)
@@ -0,0 +1,3 @@
+TIMESTAMP = 1580074291
+SHA256 (cperciva-imds-filterd-0.1_GH0.tar.gz) = e0e8b28046b2a917e110d1313242947aa6901635e81552107ab2f6a2fba83441
+SIZE (cperciva-imds-filterd-0.1_GH0.tar.gz) = 64011
Added: head/security/imds-filterd/pkg-descr
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/security/imds-filterd/pkg-descr Mon Jan 27 09:01:16 2020 (r524248)
@@ -0,0 +1,12 @@
+imds-filterd (pronounced "I M D S Filter D") is a pair of utilities which
+work together to intercept and filter requests to the EC2 Instance Metadata
+Service -- or theoretically any other service at 169.254.169.254:80.
+
+It validates requests against a configured ruleset which specifies whether
+given users and groups should be allowed or denied access to certain prefixes
+in the Instance Metadata Service. For example, "root" could be granted
+access to everything; most unprivileged users granted access to everything
+except IAM role credentials; but the www user denied access to the entire
+Instance Metadata Service in order to guard against SSRF and similar attacks.
+
+WWW: http://github.com/cperciva/imds-filterd
Added: head/security/imds-filterd/pkg-message
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/security/imds-filterd/pkg-message Mon Jan 27 09:01:16 2020 (r524248)
@@ -0,0 +1,14 @@
+[
+{ type: install
+ message: <<EOM
+To enable imds-filterd, add imds_filterd_enable=YES to /etc/rc.conf.
+
+To configure imds-filterd, edit $PREFIX/etc/imds.conf.
+
+imds-filterd ships with configurations for syslogd and newsyslog which log
+accesses to the Instance Metadata Service to /var/log/imds.log and rotate
+this file upon reaching 1 MB; these settings can be modified via
+$PREFIX/etc/{syslog.d, newsyslog.conf.d}/imds.conf.
+EOM
+}
+]
More information about the svn-ports-head
mailing list