[tor-mirrors] Tor Mirror Security

[Taylor Hornby]

On 03/27/2014 07:42 PM, Taylor Hornby wrote:
> 2. To the host of the mirror: A network attacker, or an evil sysadmin at
>    Tor, could insert PHP scripts (or other things that Apache will
>    execute) into my system, then execute by making a web request.
> 
> I worked around (2) by adding "php_flag engine off" to the Directory
> entry in my Apache configuration, but I'm not certain that's good
> enough. Can the .htaccess in the Tor mirror override it? Are there other
> things that Apache will execute that I'm not aware of?

I have another solution. As far as I know, Apache bases its decision on
the file extension, never the file contents, so it should be possible to
whitelist safe extensions with rsync.

This can be done with a command like this:

    rsync -av --filter="merge ./tor-rsync-rules" --delete \
        rsync://rsync.torproject.org/website-mirror tor-mirror-testing/

Where the ./tor-rsync-rules file contains something like this:

    + *.asc
    + *.cgi
    + *.common
    + *.css
    + *.csv
    + *.dmg
    + *.en
    + *.exe
    + *.gif
    + *.gitignore
    + *.gz
    + *.htaccess
    + *.html
    + *.ico
    + *.jpg
    + *.js
    + *.local
    + *.odp
    + *.org
    + *.pdf
    + *.pl
    + *.png
    + *.rdf
    + *.sample
    + *.serial
    + *.sh
    + *.svg
    + *.txt
    + *.wmi
    + *.wml
    + *.xhtml
    + *.xml
    + *.xpi
    + *.xz
    + *.zip

    # Allow all directories (some of them have . in the name)
    + */

    # Disallow everything else that has an extension.
    - *.*

The whitelist of safe file extensions can be generated like this:

    find tor-mirror/ -type f -iname "*.*" | \
        sed 's|.*\.||' | sort -u | sed 's|^|+ *.|'

Be sure to verify the list manually in case you already have a malicious
copy.

I tested this, and it gives me a directory that's exactly the same size
as the one I get when I rsync the normal way. I also commented out the
"*.zip" whitelist, deleted a zip file, and it (correctly) did not the
zip file I deleted.

So it works.

But there are some problems:

1. I'm not sure if the rsync rules are being applied on the client or
   the server. If they're being applied on the server, the server can
   just ignore them, and send .php files anyway.

2. If the Tor people want to add files with a different extension,
   everyone running a mirror will have to update their whitelist. Is
   this likely to happen?

I'd appreciate it if someone could check my work. In particular, I'm not
sure how the filter interacts with deletions. I wonder if it will stop
things from being deleted, too.

-- 
Taylor Hornby