| mysqld defaults to running as root |
| it defaults to allowing external network connections |
| it has a known port number, and is easy to detect |
| it defaults to no passwords whatsoever |
| it defaults to allowing "File_Priv" |
This means anyone from anywhere on the internet can not only drop - the database with one SQL command, and they can write as root to the - system.
To see your permissions do: -
| bash# - - mysql -u root -p - - |
| mysql> - - use mysql; - - |
| mysql> - - show tables; - - |
| mysql> - - select * from user; - - |
| mysql> - - select * from db; - - |
To fix the gaping holes: -
| DELETE FROM user WHERE User=''; |
| UPDATE user SET Password=PASSWORD('new_password') WHERE - user='root'; |
| FLUSH PRIVILEGES; |
If you're not running "mit-pthreads" you can use: -
| GRANT USAGE ON *.* TO bugs@localhost; |
| GRANT ALL ON bugs.* TO bugs@localhost; |
| REVOKE DROP ON bugs.* FROM bugs@localhost; |
| FLUSH PRIVILEGES; |
With "mit-pthreads" you'll need to modify the "globals.pl" - Mysql->Connect line to specify a specific host name instead of - "localhost", and accept external connections: -
| GRANT USAGE ON *.* TO bugs@bounce.hop.com; |
| GRANT ALL ON bugs.* TO bugs@bounce.hop.com; |
| REVOKE DROP ON bugs.* FROM bugs@bounce.hop.com; |
| FLUSH PRIVILEGES; |
Consider also: -
Turning off external networking with "--skip-networking", - unless you have "mit-pthreads", in which case you can't. Without - networking, MySQL connects with a Unix domain socket.
using the --user= option to mysqld to run it as an - unprivileged user.
running MySQL in a chroot jail
running the httpd in a chroot jail
making sure the MySQL passwords are different from the OS - passwords (MySQL "root" has nothing to do with system - "root").
running MySQL on a separate untrusted machine
making backups ;-)
4.1.11. Configuring Bugzilla
4.1.10. Configuring BugzillaYou should run through the parameters on the Edit Parameters page (link in the footer) and set them all to appropriate values. @@ -4362,7 +4087,7 @@ CLASS="section" >
4.2.1. Dependency Charts
4.2.2. Bug Graphs
4.2.3. The Whining Cron
for Bugzilla 2.13 and later, which includes the current release, - Bugzilla &bz-ver;. + Bugzilla 2.16.3.
4.5.1. Bundle::Bugzilla makes me upgrade to Perl 5.6.1
4.5.2. DBD::Sponge::db prepare failed
These instructions must, of necessity, be somewhat vague since Bugzilla runs on so many different platforms. If you have refinements - of these directions for specific platforms, please submit them to - mozilla-webtools@mozilla.org +>Bugzilla.
To secure your installation: - -
Ensure you are running at least MysQL version 3.22.32 or newer. - Earlier versions had notable security holes and (from a security - point of view) poor default configuration choices.
This is not meant to be a comprehensive list of every possible + security issue regarding the tools mentioned in this section. There is + no subsitute for reading the information written by the authors of any + software running on your system. +
5.6.1. TCP/IP Ports
TCP/IP defines 65,000 some ports for trafic. Of those, Bugzilla + only needs 1... 2 if you need to use features that require e-mail such + as bug moving or the e-mail interface from contrib. You should audit + your server and make sure that you aren't listening on any ports you + don't need to be. You may also wish to use some kind of firewall + software to be sure that trafic can only be recieved on ports you + specify. +
5.6.2. MySQL
MySQL ships by default with many settings that should be changed. + By defaults it allows anybody to connect from localhost without a + password and have full administrative capabilities. It also defaults to + not have a root password (this is not the same as + the system root). Also, many installations default to running + mysqld as the system root. +
There is no substitute for understanding the tools on your - system! - - Read - The MySQL Privilege System - until you can recite it from memory!
Make sure you are running at least version 3.22.32 of MySQL + as earlier versions had notable security holes. +Lock down /etc/inetd.conf. Heck, disable inet entirely on this - box. It should only listen to port 25 for Sendmail and port 80 for - Apache.
Consult the documentation that came with your system for + information on making mysqld run as an + unprivleged user. +Do not run Apache as - You should also be sure to disable the anonymous user account + and set a password for the root user. This is accomplished using the + following commands: +
bash$ mysql mysql +mysql> DELETE FROM user WHERE user = ''; +mysql> UPDATE user SET password = password('new_password') WHERE user = 'root'; +mysql> FLUSH PRIVILEGES; +From this point forward you will need to use + mysql -u root -p and enter + new_password when prompted when using the + mysql client. +
If you run MySQL on the same machine as your httpd server, you + should consider disabling networking from within MySQL by adding + the following to your /etc/my.conf: +
[myslqd] +# Prevent network access to MySQL. +skip-networking +
You may also consider running MySQL, or even all of Bugzilla + in a chroot jail; however, instructions for doing that are beyond + the scope of this document. +
5.6.3. Daemon Accounts
Many daemons, such as Apache's httpd and MySQL's mysqld default to + running as either "root" or "nobody" - - . This will require very lax permissions in your Bugzilla - directories. Run it, instead, as a user with a name, set via your - httpd.conf file. -
"nobody" - - is a real user on UNIX systems. Having a process run as user id - "nobody" - - is absolutely no protection against system crackers versus using - any other user account. As a general security measure, I recommend - you create unique user ID's for each daemon running on your system - and, if possible, use "chroot" to jail that process away from the - rest of your system.
You will need to set the webservergroup to + the group you created for your webserver to run as in + localconfig. This will allow + ./checksetup.pl to better adjust the file + permissions on your Bugzilla install so as to not require making + anything world-writable. +5.6.4. Web Server Access Controls
There are many files that are placed in the Bugzilla directory + area that should not be accessable from the web. Because of the way + Bugzilla is currently layed out, the list of what should and should + not be accessible is rather complicated. A new installation method + is currently in the works which should solve this by allowing files + that shouldn't be accessible from the web to be placed in directory + outside the webroot. See + bug + 44659 for more information. +
In the main Bugzilla directory, you should:
Block: + *.pl, *localconfig*, runtests.sh, processmail, syncshadowdb -
Ensure you have adequate access controls for the - $BUGZILLA_HOME/data/ directory, as well as the - $BUGZILLA_HOME/localconfig file. - The localconfig file stores your "bugs" database account password. - In addition, some - files under $BUGZILLA_HOME/data/ store sensitive information. -
But allow: + localconfig.js, localconfig.rdf +
Bugzilla provides default .htaccess files to protect the most - common Apache installations. However, you should verify these are - adequate according to the site-wide security policy of your web - server, and ensure that the .htaccess files are allowed to - "override" default permissions set in your Apache configuration - files. Covering Apache security is beyond the scope of this Guide; - please consult the Apache documentation for details.
In data:If you are using a web server that does not support the - .htaccess control method, - you are at risk!
Block everything
But allow: + duplicates.rdf - - After installing, check to see if you can view the file - "localconfig" in your web browser (e.g.: - http://bugzilla.mozilla.org/localconfig
In data/webdot:
If you use a remote webdot server:
Block everything
But allow + *.dot - - ). If you can read the contents of this file, your web server has - not secured your bugzilla directory properly and you must fix this - problem before deploying Bugzilla. If, however, it gives you a - "Forbidden" error, then it probably respects the .htaccess - conventions and you are good to go.
When you run checksetup.pl, the script will attempt to modify - various permissions on files which Bugzilla uses. If you do not have - a webservergroup set in the localconfig file, then Bugzilla will have - to make certain files world readable and/or writable. - THIS IS INSECURE!Otherwise, if you use a local GraphViz:
Block everything
But allow: + *.png, *.gif, *.jpg, *.map - - . This means that anyone who can get access to your system can do - whatever they want to your Bugzilla installation.
And if you don't use any dot:
Block everything
In Bugzilla:
Block everything
In template:
Block everything
This also means that if your webserver runs all cgi scripts - as the same user/group, anyone on the system who can run cgi - scripts will be able to take control of your Bugzilla - installation. Bugzilla ships with the ability to generate + .htaccess files instructing Apache which files + should and should not be accessible. + |
On Apache, you can use .htaccess files to protect access to - these directories, as outlined in - Bug - 57161 - - for the localconfig file, and - You should test to make sure that the files mentioned above are + not accessible from the Internet, especially your + localconfig file which contains your database + password. To test, simply point your web browser at the file; for + example, to test mozilla.org's installation, we'd try to access + Bug - 65572http://bugzilla.mozilla.org/localconfig. You should + get a 403 Forbidden - - for adequate protection in your data/ directory.
Note the instructions which follow are Apache-specific. If you - use IIS, Netscape, or other non-Apache web servers, please consult - your system documentation for how to secure these files from being - transmitted to curious users.
Place the following text into a file named ".htaccess", - readable by your web server, in your $BUGZILLA_HOME/data directory. -
<Files comments> allow from all </Files>
- deny from all
Place the following text into a file named ".htaccess", - readable by your web server, in your $BUGZILLA_HOME/ directory. - <Files localconfig> deny from all </Files> |
5.7.1. What to Edit
5.7.2. How To Edit Templates
5.7.3. Template Formats
5.7.4. Particular Templates
- A.1.1. Where can I find information about Bugzilla?
- A.1.2. What license is Bugzilla distributed under?
- A.1.3. How do I get commercial support for Bugzilla?
- A.1.4. What major companies or projects are currently using Bugzilla for bug-tracking?
- A.1.5. Who maintains Bugzilla?
- A.1.6. How does Bugzilla stack up against other bug-tracking databases?
- A.1.7. Why doesn't Bugzilla offer this or that feature or compatability with this other tracking software?
- A.1.8. Why MySQL? I'm interested in seeing Bugzilla run on Oracle/Sybase/Msql/PostgreSQL/MSSQL.
- A.1.9. Why do the scripts say "/usr/bonsaitools/bin/perl" instead of "/usr/bin/perl" or something else?
- A.1.10. Is there an easy way to change the Bugzilla cookie name?
- A.2.1. Is Bugzilla web-based, or do you have to have specific software or a specific operating system on your machine?
- A.2.2. Can Bugzilla integrate with Perforce (SCM software)?
- A.2.3. Does Bugzilla allow the user to track multiple projects?
- A.2.4. If I am on many projects, and search for all bugs assigned to me, will Bugzilla list them for me and allow me to sort by project, severity etc?
- A.2.5. Does Bugzilla allow attachments (text, screenshots, URLs etc)? If yes, are there any that are NOT allowed?
- A.2.6. Does Bugzilla allow us to define our own priorities and levels? Do we have complete freedom to change the labels of fields and format of them, and the choice of acceptable values? @@ -9619,35 +9679,35 @@ HREF="#AEN1833" >
- A.2.7. Does Bugzilla provide any reporting features, metrics, graphs, etc? You know, the type of stuff that management likes to see. :)
- A.2.8. Is there email notification and if so, what do you see when you get an email?
- A.2.9. Can email notification be set up to send to multiple people, some on the To List, CC List, BCC List etc?
- A.2.10. Do users have to have any particular type of email application?
- A.2.11. Does Bugzilla allow data to be imported and exported? If I had outsiders write up a bug report using a MS Word bug template, could that template be imported into "matching" fields? If I wanted to take the results of a query @@ -9656,28 +9716,28 @@ HREF="#AEN1864" >
- A.2.12. Has anyone converted Bugzilla to another language to be used in other countries? Is it localizable?
- A.2.13. Can a user create and save reports? Can they do this in Word format? Excel format?
- A.2.14. Does Bugzilla have the ability to search by word, phrase, compound search?
- A.2.15. Does Bugzilla provide record locking when there is simultaneous access to the same bug? Does the second person get a notice that the bug is in use or how are they notified? @@ -9685,19 +9745,19 @@ HREF="#AEN1887" >
- A.2.16. Are there any backup features provided?
- A.2.17. Can users be on the system while a backup is in progress?
- A.2.18. What type of human resources are needed to be on staff to install and maintain Bugzilla? Specifically, what type of skills does the person need to have? I need to find out if we were to go with Bugzilla, what types of @@ -9707,7 +9767,7 @@ HREF="#AEN1903" >
- A.2.19. What time frame are we looking at if we decide to hire people to install and maintain the Bugzilla? Is this something that takes hours or weeks to install and a couple of hours per week to maintain and customize or is this @@ -9717,7 +9777,7 @@ HREF="#AEN1909" >
- A.2.20. Is there any licensing fee or other fees for using Bugzilla? Any out-of-pocket cost other than the bodies needed as identified above?
- A.3.1. How do I completely disable MySQL security if it's giving me problems (I've followed the instructions in the installation section of this guide)?
- A.3.2. Are there any security problems with Bugzilla?
- A.3.3.
I've implemented the security fixes mentioned in Chris Yeh's security
advisory of 5/10/2000 advising not to run MySQL as root, and am running into
problems with MySQL no longer working correctly.
@@ -9763,48 +9823,48 @@ HREF="#faq-email"
>
- A.4.1. I have a user who doesn't want to receive any more email from Bugzilla. How do I stop it entirely for this user?
- A.4.2. I'm evaluating/testing Bugzilla, and don't want it to send email to anyone but me. How do I do it?
- A.4.3. I want whineatnews.pl to whine at something more, or other than, only new bugs. How do I do it?
- A.4.4. I don't like/want to use Procmail to hand mail off to bug_email.pl. What alternatives do I have?
- A.4.5. How do I set up the email interface to submit/change bugs via email?
- A.4.6. Email takes FOREVER to reach me from Bugzilla -- it's extremely slow. What gives?
- A.4.7. How come email from Bugzilla changes never reaches me?
- A.5.1. I've heard Bugzilla can be used with Oracle?
- A.5.2. I think my database might be corrupted, or contain invalid entries. What do I do?
- A.5.3. I want to manually edit some entries in my database. How?
- A.5.4. I try to add myself as a user, but Bugzilla always tells me my password is wrong.
- A.5.5. I think I've set up MySQL permissions correctly, but Bugzilla still can't connect.
- A.5.6. How do I synchronize bug information among multiple different Bugzilla databases?
- A.6.1. What is the easiest way to run Bugzilla on Win32 (Win98+/NT/2K)?
- A.6.2. Is there a "Bundle::Bugzilla" equivalent for Win32?
- A.6.3. CGI's are failing with a "something.cgi is not a valid Windows NT application" error. Why?
- A.6.4. I'm having trouble with the perl modules for NT not being able to talk to to the database.
- A.7.1. How do I change my user name (email address) in Bugzilla?
- A.7.2. The query page is very confusing. Isn't there a simpler way to query?
- A.7.3. I'm confused by the behavior of the "accept" button in the Show Bug form. Why doesn't it assign the bug to me when I accept it?
- A.7.4. I can't upload anything into the database via the "Create Attachment" link. What am I doing wrong?
- A.7.5. Email submissions to Bugzilla that have attachments end up asking me to save it as a "cgi" file.
- A.7.6. How do I change a keyword in Bugzilla, once some bugs are using it?
Microsoft has some advice on this matter, as well:
B.2.1. Bugzilla Database Basics
B.2.1.1. Bugzilla Database Tables
0-9, high ascii
- 5.6.1. TCP/IP Ports
- 5.6.2. MySQL
- 5.6.3. Daemon Accounts
- 5.6.4. Web Server Access Controls
- 5.7.
- 5.7.1. What to Edit
- 5.7.2. How To Edit Templates
- 5.7.3. Template Formats
- 5.7.4. Particular Templates
The Bugzilla Guide The Bugzilla Guide - 2.16.3 Release Ensure you are running at least MysQL version 3.22.32 or newer. - Earlier versions had notable security holes and (from a security - point of view) poor default configuration choices.
Make sure you are running at least version 3.22.32 of MySQL + as earlier versions had notable security holes. +There is no substitute for understanding the tools on your - system! - - Read - The MySQL Privilege System - until you can recite it from memory!
Consult the documentation that came with your system for + information on making mysqld run as an + unprivleged user. +Lock down /etc/inetd.conf. Heck, disable inet entirely on this - box. It should only listen to port 25 for Sendmail and port 80 for - Apache.
You should also be sure to disable the anonymous user account + and set a password for the root user. This is accomplished using the + following commands: +bash$ mysql mysql +mysql> DELETE FROM user WHERE user = ''; +mysql> UPDATE user SET password = password('new_password') WHERE user = 'root'; +mysql> FLUSH PRIVILEGES; +From this point forward you will need to use + mysql -u root -p and enter + new_password when prompted when using the + mysql client. +
If you run MySQL on the same machine as your httpd server, you + should consider disabling networking from within MySQL by adding + the following to your /etc/my.conf: +
[myslqd] +# Prevent network access to MySQL. +skip-networking +
Do not run Apache as - You may also consider running MySQL, or even all of Bugzilla + in a chroot jail; however, instructions for doing that are beyond + the scope of this document. +
The Bugzilla Guide The Bugzilla Guide - 2.16.3 ReleaseThe Bugzilla Guide The Bugzilla Guide - 2.16.3 ReleaseThe Bugzilla Guide The Bugzilla Guide - 2.16.3 ReleaseBugzilla Security The Bugzilla Guide The Bugzilla Guide - 2.16.3 Release1.1. Copyright Information This is not meant to be a comprehensive list of every possible + security issue regarding the tools mentioned in this section. There is + no subsitute for reading the information written by the authors of any + software running on your system.
5.6.1. TCP/IP Ports
TCP/IP defines 65,000 some ports for trafic. Of those, Bugzilla + only needs 1... 2 if you need to use features that require e-mail such + as bug moving or the e-mail interface from contrib. You should audit + your server and make sure that you aren't listening on any ports you + don't need to be. You may also wish to use some kind of firewall + software to be sure that trafic can only be recieved on ports you + specify. +
5.6.2. MySQL
MySQL ships by default with many settings that should be changed. + By defaults it allows anybody to connect from localhost without a + password and have full administrative capabilities. It also defaults to + not have a root password (this is not the same as + the system root). Also, many installations default to running + mysqld as the system root. +
To secure your installation: - -
5.6.3. Daemon Accounts
Many daemons, such as Apache's httpd and MySQL's mysqld default to + running as either "root" or "nobody" - - . This will require very lax permissions in your Bugzilla - directories. Run it, instead, as a user with a name, set via your - httpd.conf file. -
. Running + as "root" introduces obvious security problems, but the + problems introduced by running everything as "nobody" may + not be so obvious. Basically, if you're running every daemon as + "nobody" and one of them gets comprimised, they all get + comprimised. For this reason it is recommended that you create a user + account for each daemon. +"nobody" - - is a real user on UNIX systems. Having a process run as user id - "nobody" - - is absolutely no protection against system crackers versus using - any other user account. As a general security measure, I recommend - you create unique user ID's for each daemon running on your system - and, if possible, use "chroot" to jail that process away from the - rest of your system.
You will need to set the webservergroup to + the group you created for your webserver to run as in + localconfig. This will allow + ./checksetup.pl to better adjust the file + permissions on your Bugzilla install so as to not require making + anything world-writable. +