Subject: [secdir] Secdir review of draft-ietf-opsawg-vmm-mib-02

From: "Christian Huitema" <[email-masked]>
Date: Wed, 13 May 2015 19:49:05 -0700

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments just
like any other last call comments.

For the security area directions, I consider this document to be "Ready with
nits”.

This document specifies objects (MIB) for managing virtual machines
controlled by a hypervisor (a.k.a. virtual machine monitor) using SNMP.

The security section is thoroughly written, points out the operational risk
if some management variables can be SET, and the privacy or other security
risks if hostile parties can read some of the objects. The essential
recommendation is to use SNMPv3 strong security, or when that strong
security is not available, to disable the "SET" capabilities. 

There is an aggravating factor not mentioned in the security section. In
many large data centers, some virtual machines will not be under the direct
control of the data center manager. They may have been rented to third
parties, or they may have been subverted. These potentially hostile virtual
machines will have direct network connectivity with the hypervisor, and
potentially with other hypervisors in the same subnet. Attackers in control
of these machines can gain advantage of even read-only access to hypervisor
state variables. One wonders whether even GET access should be allowed in
the absence of authentication through SNMPv3. Attempting to support even GET
operations with prior versions of SNMP appears risky.

-- Christian Huitema

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Sat, 23 May 2015 08:13:35 +0200

Christian,

thanks for the review. I am not sure if anything needs changes. The
draft largely follows the security considerations template for MIB
modules. And there is explicit text about GET access:

   [...]  Moreover, the objects in the vmTable,
   vmCpuTable, vmCpuAffinityTable, vmStorageTable and vmNetworkTable
   list information about the virtual machines and their virtual
   resource allocation.  Some may wish not to disclose to others how
   many and what virtual machines they are operating.

   It is thus important to control even GET access to these objects and
   possibly to even encrypt the values of these object when sending them
   over the network via SNMP.  Not all versions of SNMP provide features
   for such a secure environment.

Is this text not already covering your concerns? Below the quoted
text, there is the general boilerplate recommendation to avoid SNMPv1
and to use SNMPv3 instead.

/js

On Wed, May 13, 2015 at 07:49:05PM -0700, Christian Huitema wrote:
> nits".

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: "Christian Huitema" <[email-masked]>
Date: Sun, 24 May 2015 17:35:22 -0700

Yes, your security section does mention the need to control GET as well.

> -----Original Message-----
> From: Juergen Schoenwaelder [mailto:[email-masked]]
> Sent: Friday, May 22, 2015 11:14 PM
> To: Christian Huitema
> Cc: 'The IESG'; [email-masked];
[email-masked]
> Subject: Re: Secdir review of draft-ietf-opsawg-vmm-mib-02
> 
> Christian,
> 

The "GET" paragraph feels a bit generic. I would personally be a bit
stronger. Something like, "It is NOT RECOMMENDED" to provide access to these
variables without using the strong security features of SNMPv3. Of course,
this is a generic problem with SNMP, and I understand your desire to use the
generic text. But is there a good reason to not recommend v3?

I would also mention the specific problem of software running in a virtual
machine and accessing the hypervisor's variables. This is an attack vector
that is somewhat specific to this MIB. It cannot be mitigated by network
firewalls.

-- Christian Huitema

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Mon, 25 May 2015 17:02:46 +0200

On Sun, May 24, 2015 at 05:35:22PM -0700, Christian Huitema wrote:
> generic text.

It seems on every second I-D that contains a MIB module we receive
suggestions to change the boilerplate. The boilerplate was settled
between security ADs and ops ADs and as a mere user of it I prefer to
stick to whatever these folks have worked out.

>  But is there a good reason to not recommend v3?

It is there (page 50):

   It is recommended that the implementers consider the security
   features as provided by the SNMPv3 framework.  Specifically, the use
   of the User-based Security Model [RFC3414] and the View-based Access
   Control Model [RFC3415] is recommended.
 
> that is somewhat specific to this MIB. It cannot be mitigated by network

This MIB module is typically implemented on the hypervisor not inside
a virtual machine. I guess I do not follow what your concern is.

/js

---

From: Michael MacFaden <[email-masked]>
Date: Mon, 25 May 2015 15:06:48 +0000

Christian writes:
>machine and accessing the hypervisor's variable

Yes we could describe this configuration and point out SNMPv3 would be required

>operations with prior versions of SNMP appears risky.

I note it is not just SNMP service that could be vulnerable in such a network configuration.
But direct network connectivity is not typical for commercial systems however.
What normally done in industry at least with VMware products, is to isolate these
VMs networking into separate layer 2 networks. The snmp service is in a separate management
network using either different virtual switches at layer 2 or separate IP stack. 

Mike