{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"1"},"maxLevel":{"value":"3"}},"macroMetadata":{"macroId":{"value":"b65fbd607ad65475690b00056c0450f6"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"4386ff94-0140-40e5-b3d8-30563e9533dc"}},{"type":"paragraph","content":[{"text":"Security for embedded systems is a serious issue, though often overlooked. This chapter gives an overview of common security risks that might occur during the deployment and lifespan of the product. We also give hints and tips on the implementation of some chosen security mechanisms. Since we are not able to cover every possible risks in the manual, users are strongly recommended to read on further topics regarding these issues.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"For the following list of security risks, no claim of completeness can be made. There may arise other risks or - on the opposite - limitations in the design of your application by following the instructions provided in this chapter.","type":"text"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Services","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"SECO Northern Europe devices are initially shipped with a “developer friendly” state. That means, all services are available and already activated. This provides a helpful state on which customers can easily deploy further application. However, leaving those services unchecked can lead to potential security risks. Once the customers have finalized their deployment on the devices, we recommend a review of the services in-used and to disable all those that are not required for the applications. See chapter [Services] on how to disable.","type":"text"}]},{"type":"paragraph","content":[{"text":"Independent of the device’s application, following special cares need to be taken:","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"SSH","type":"text"}]},{"type":"paragraph","content":[{"text":"An SSH services is enabled by default on SECO Northern Europe devices with Yocto. In addition to the password and user suggestions from [","type":"text"},{"text":"User permissions concept","type":"text","marks":[{"type":"link","attrs":{"href":"https://secogroup.atlassian.net/wiki/spaces/SECONorthTech/pages/1426489651#User-permissions-concept"}}]},{"text":"], there are more hints on securing the ssh service in the chapter [","type":"text"},{"text":"SSH service","type":"text","marks":[{"type":"link","attrs":{"href":"https://secogroup.atlassian.net/wiki/spaces/SECONorthTech/pages/1426817067/Core+operating+system+components#SSH"}}]},{"text":"]. It is possible to restrict users allowed using this service, lock SFTP access to a subfolder only and create custom crypto keys.","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"User permissions concept","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"Linux is designed as a multi-user system and provides a mechanism known as file permissions. Each file has an owner, a group and flags that grant ","type":"text"},{"text":"write","type":"text","marks":[{"type":"strong"}]},{"text":", ","type":"text"},{"text":"read ","type":"text","marks":[{"type":"strong"}]},{"text":"and/or ","type":"text"},{"text":"execute ","type":"text","marks":[{"type":"strong"}]},{"text":"permissions to the owner, the group or anybody. Additionally there is a super user, called root, who has access to all files. More information on this concept can be found ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://tldp.org/LDP/gs/node5.html"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Customers should follow the principle of minimal privilege for user rights on the devices. Please note that SECO Northern Europe tools are usually assigned with access rights for all users since it is more developer friendly.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Root password","type":"text"}]},{"type":"paragraph","content":[{"text":"Since SECO Northern Europe is an OEM manufacturer and we are delivering serial-produced devices to several customers, a default root password would lead to a form of pseudo security. Moreover a default password for all devices is highly vulnerable. For this purpose our devices usually have no root password set. It is essential that a password will be set by customers before the devices are deployed. This is the minimum security measure to be done.","type":"text"}]},{"type":"expand","attrs":{"title":"Setting the root password on the device"},"content":[{"type":"codeBlock","content":[{"text":"root@santaro:~# passwd root \nChanging password for root \nEnter the new password (minimum of 5 characters) \nPlease use a combination of upper and lower case letters and numbers. \nNew password: \nRe-enter new password: \npasswd: password changed. \nroot@santaro:~#","type":"text"}]}]},{"type":"paragraph","content":[{"text":"What does it mean if no root password is set?","type":"text","marks":[{"type":"strong"}]},{"text":" Without root password, anyone connect to the device will have full system control since root user usually have all permissions on the system. ","type":"text"}]},{"type":"paragraph","content":[{"text":"Blocking root access.","type":"text","marks":[{"type":"strong"}]},{"text":" Linux offers the opportunity to disable the root-login for specific services like ssh, or the serial console. Since the root login is always a popular target for attackers this easy mechanism will decrease the risk for those kinds of brute force attacks.","type":"text"}]},{"type":"expand","attrs":{"title":"Block root access"},"content":[{"type":"paragraph","content":[{"text":"This can be done by setting the root account’s shell to /sbin/nologin in the /etc/passwd file:","type":"text"}]},{"type":"codeBlock","content":[{"text":"root:x:0:0:root:/root:/sbin/nologin\n...","type":"text"}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Ensure that another user account with the possibility to gain super user (su) rights is created before the root access is disabled. Otherwise, you might completely lose access to the device.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Non-root users","type":"text"}]},{"type":"paragraph","content":[{"text":"Normally a non-root user should be used for \"everyday tasks\" on the system.","type":"text"}]},{"type":"expand","attrs":{"title":"Creating a non-root user"},"content":[{"type":"paragraph","content":[{"text":"The tool ","type":"text"},{"text":"adduser ","type":"text","marks":[{"type":"strong"}]},{"text":"can be used to create a non-root user","type":"text"}]},{"type":"codeBlock","content":[{"text":"root@santaro:~# adduser \nChanging password for \nEnter the new password (minimum of 5 characters)\nPlease use a combination of upper and lower case letters and numbers.\nNew password:\nRe-enter new password:\npasswd: password changed.","type":"text"}]},{"type":"paragraph","content":[{"text":"This creates a new user with group and the home directory /home//.","type":"text"}]},{"type":"paragraph","content":[{"text":"The new user can be used to login immediately. See the man page of ","type":"text"},{"text":"adduser ","type":"text","marks":[{"type":"strong"}]},{"text":"for more options.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Superuser privileges for non-root users","type":"text"}]},{"type":"paragraph","content":[{"text":"sudo ","type":"text","marks":[{"type":"strong"}]},{"text":"allows non-root users to have access to single commands with root user privileges. If login for root user is disabled, this can be used by non-root user to do system tasks. To enable usages of this feature, the group ","type":"text"},{"text":"sudo ","type":"text","marks":[{"type":"strong"}]},{"text":"should be enabled in the sudoer file and the user needs to be added to this group.","type":"text"}]},{"type":"expand","attrs":{"title":"Enabling sudo"},"content":[{"type":"paragraph","content":[{"text":"Edit the file /etc/sudoers with the command:","type":"text"}]},{"type":"codeBlock","content":[{"text":"nano sudo","type":"text"}]},{"type":"paragraph","content":[{"text":"and uncomment the following line:","type":"text"}]},{"type":"codeBlock","content":[{"text":"%sudo ALL=(ALL) ALL","type":"text"}]},{"type":"paragraph","content":[{"text":"This enables the sudo privilege for users in the group \"sudo\". To add a user to this group, execute the following command:","type":"text"}]},{"type":"codeBlock","content":[{"text":"usermod -G sudo -a user","type":"text"}]},{"type":"paragraph","content":[{"text":"Now it is possible to execute commands with root previleges when logged in as :","type":"text"}]},{"type":"codeBlock","content":[{"text":"user@santaro:~$ cat /etc/sudoers\ncat: can't open '/etc/sudoers': Permission denied\nuser@santaro:~$ sudo cat /etc/sudoers\nPassword:\n## sudoers file.\n##\n## This file MUST be edited with the 'visudo' command as root.\n## Failure to use 'visudo' may result in syntax or file permission errors\n## that prevent sudo from running.\n...","type":"text"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Flash-N-Go System","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"Newer SECO Northern Europe devices are equipped with an ","type":"text"},{"text":"Flash-N-Go","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"System ","type":"text","marks":[{"type":"strong"}]},{"text":"as backup OS. Within ","type":"text"},{"text":"Flash-N-Go","type":"text","marks":[{"type":"strong"}]},{"text":" the user has full control of the device’s configuration and the partitions on the flash disk respectively eMMC without a password or further authentication.","type":"text"}]},{"type":"paragraph","content":[{"text":"As described in [","type":"text"},{"text":"Deploying the Linux system to the target","type":"text","marks":[{"type":"link","attrs":{"href":"https://secogroup.atlassian.net/wiki/spaces/SECONorthTech/pages/1426849841/Adapting+the+image#Deploying-the-Linux-system-to-the-target"}}]},{"text":"] booting into ","type":"text"},{"text":"Flash-N-Go System","type":"text","marks":[{"type":"strong"}]},{"text":" can be triggered by pressing the ","type":"text"},{"text":"bootmode switch","type":"text","marks":[{"type":"strong"}]},{"text":" or with the ","type":"text"},{"text":"bootselect ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#97a0af"}},{"type":"strong"}]},{"text":"tool from the yocto OS.","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"bootselect ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#97a0af"}},{"type":"strong"}]},{"text":"tool can only change the bootmode when called with root privileges, so following password and user suggestions from [","type":"text"},{"text":"User permissions concept","type":"text","marks":[{"type":"link","attrs":{"href":"https://secogroup.atlassian.net/wiki/spaces/SECONorthTech/pages/1426489651#User-permissions-concept"}}]},{"text":"] should solve this issue.","type":"text"}]},{"type":"paragraph","content":[{"text":"The bootmode switch should be secured with restricting physical access by the mechanical construction.","type":"text"}]},{"type":"paragraph","content":[{"text":"If this is impossible, it is recommended to disable the backup OS.","type":"text"}]},{"type":"expand","attrs":{"title":"Disabling the backup OS"},"content":[{"type":"paragraph","content":[{"text":"Execute following command sequence:","type":"text"}]},{"type":"codeBlock","content":[{"text":"root@gufboardll:~# mount /dev/mmcblk0p2 /mnt/\nroot@gufboardll:~# mv /mnt/boot.cfg /mnt/boot-alt.cfg\nroot@gufboardll:~# umount /mnt/\n\nroot@gufboardll:~# mount /dev/mmcblk0p1 /mnt/\nroot@gufboardll:~# mv /mnt/boot-alt.cfg /mnt/boot-alt.cfg.bak\nroot@gufboardll:~# umount /mnt/","type":"text"}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"This change disables the access to the backup OS ","type":"text"},{"text":"Flash-N-Go System","type":"text","marks":[{"type":"strong"}]},{"text":" completely. If the normal OS becomes inaccessible for some reason, there is no way for a customer to fix the device.","type":"text"}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Updating the system normally without the backup OS ","type":"text"},{"text":"Flash-N-Go System","type":"text","marks":[{"type":"strong"}]},{"text":" is impossible. Though it is possible to revert the change and re-enable Flash-N-Go System from the normal OS, if it is functional.","type":"text"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Networking","type":"text"}]},{"type":"rule"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Firewall - netfilter/iptables","type":"text"}]},{"type":"paragraph","content":[{"text":"By default, all network communication is allowed. However, Linux can be configured to block certain IP packets depending on its header (e.g. by port or by protocol) using ","type":"text"},{"text":"iptables","type":"text","marks":[{"type":"strong"}]},{"text":", which is basically a firewall. As this mechanism is very powerful and complex, it is not documented here in detail. Please take a look at the following ","type":"text"},{"text":"link ","type":"text","marks":[{"type":"link","attrs":{"href":"https://help.ubuntu.com/community/IptablesHowTo"}}]},{"text":"for a basic introduction.","type":"text"}]},{"type":"paragraph","content":[{"text":"As a first start we show some basic usecases here.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"If you call these commands from a network login, your connection will/could break. Without physical access to the serial or USB console, you won’t be able to access the device anymore.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Working with netfilter/iptables"},"content":[{"type":"paragraph","content":[{"text":"Block all network traffic:","type":"text"}]},{"type":"codeBlock","content":[{"text":"root@santaro:~# iptables -F\nroot@santaro:~# iptables -A INPUT -j DROP","type":"text"}]},{"type":"paragraph","content":[{"text":"This is the first step and it is a mandatory preparation for the following steps.","type":"text"}]},{"type":"paragraph","content":[{"text":"Open SSH access only:","type":"text"}]},{"type":"codeBlock","content":[{"text":"root@santaro:~# iptables -I INPUT 1 -i eth0 -p tcp --dport 22 -m state --state NEW, ESTABLISHED -j ACCEPT\nroot@santaro:~# iptables -I OUTPUT 1 -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT","type":"text"}]},{"type":"paragraph","content":[{"text":"Open network access on port 80 and DNS replies on port 53 from the device:","type":"text"}]},{"type":"codeBlock","content":[{"text":"root@santaro:~# iptables -I INPUT 1 -p udp --source-port 53 -j ACCEPT\nroot@santaro:~# iptables -I OUTPUT 1 -o eth0 -p tcp --dport 80 -m state --state NEW, ESTABLISHED -j ACCEPT\nroot@santaro:~# iptables -I INPUT 1 -i eth0 -p tcp -m state --state ESTABLISHED -j ACCEPT","type":"text"}]},{"type":"paragraph","content":[{"text":"Save the firewall configuration as persistent:","type":"text"}]},{"type":"codeBlock","content":[{"text":"root@santaro:~# iptables-save > /etc/iptables.rules\nroot@santaro:~# echo \"iptables-restore < /etc/iptables.rules\" > /etc/network/if-pre-up.d/iptables\nroot@santaro:~# chmod +x /etc/network/if-pre-up.d/iptables","type":"text"}]},{"type":"paragraph","content":[{"text":"Disable the firewall:","type":"text"}]},{"type":"codeBlock","content":[{"text":"root@santaro:~# iptables -F","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Using secure network protocols","type":"text"}]},{"type":"paragraph","content":[{"text":"Newer and more secure network protocols, e.g. HTTPS, FTPS and SSH, are strongly recommended over their outdated counterparts. ","type":"text"}]},{"type":"paragraph","content":[{"text":"Further mechanisms regarding the security for network connected Linux systems are described ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://embeddedcomputing.com/technology/security/network-security/improving-security-for-network-connected-linux-based-systems"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Restrict physical access","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"Each physical interface like USB, SD-Card or Ethernet socket can serve as possible entrance gates for attackers. Unessential ports should be physically disabled or restricted from easy outside access. This reduces the likelihood that an attacker can connect to the system and therefore lower the risk of a potential security issue.","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Application security","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"Application security is seldom a high priority for embedded devices. But it is, of course, essential to take account of identifying risks in embedded applications. Since application development is a very complex subject and it is out of scope for SECO Northern Europe, we will refer to secondary lecture at this point.","type":"text"}]}],"version":1}