The CLIX Starter Kit: using CLIX to make your system more secure.
0. Self-Hype
CLIX is a good program that replaces system maintenance utilities such as TinkerTool, OnyX, Xupport, and *censored*tail, which are only going to invoke the same Unix commands anyway. The tag says 'command line interface' but it's not that at all - it uses Unix commands, but in a graphic interface.
And it's cheap. Free as in beer.
1. Open the CLIX Package
There are a number of HTML files inside, along with the app itself and a directory called 'CLIX_cmds'. Move the whole thing to a location of your own choosing but don't move it to /Applications.
Use ~/Applications instead. Create it if it doesn't already exist, but your system will always check that path when launching. Always put your own software there in the future. And if some other software title protests and absolutely insists on /Applications, then deal with it. But you can't fix stupid.
What you're after here is putting your software in your: area of the disk - something your furry friends on Windows will never have. Anything under '~' is fair game - just keep your stuff away from '/' or any area that's not yours.
[Good tip? Mask the permissions on all your files in ~ to exclude all group and other rights. Make sure no one can get into your area of the system without your express permission.]
2. Add Even More Security
Add further security to CLIX as soon as you've moved it to its final destination. Drop in to a Terminal at the path for CLIX.app/Contents/MacOS (or use CLIX itself) and type in the following.
$ sudo chown 0:staff CLIX; sudo chmod 0550 CLIX
This allows only root and your default group to read it and run it.
3. Running CLIX
Just double click its application once so the system knows it's there. After that you should be able to double click any of the CLIX command files to open them.
4. Finding What You Want
You don't have to use the provided commands. You can make your own. This is what distinguishes CLIX from the 'Wizards of OS X'. You'll find these commands everywhere - at Mac OS X Hints, at Rixstep, and so forth. You don't have to make small batch files and remember where you've put them all - you store your commands in CLIX files where they're always available and ready to run.
5. Sudo Alerts
Anybody at any time can ask CLIX for your passphrase. Your passphrase is kept in memory until such time as your computer goes to sleep or CLIX exits. These 'sudo alerts' are turned off by default but you can easily turn them on.
$ defaults write com.rixstep.CLIX SudoAlert 1
Then each time one of your commands requests sudo authentication, you'll get a prompt from CLIX. You can allow use of your passphrase once, for all subsequent requests within the current command, or deny completely.
6. TTY Tickets
It's really important to turn on a sudo feature called 'TTY tickets'. TTY tickets imply that a more common way of using privilege escalation is no longer possible. And you want that.
The more common way of using privilege escalation - the default way - implies that once a process in the current login account has authenticated, any other process in the same account can use this authentication for (default) five minutes (the so-called 'grace period').
This 'sudo piggyback hole' can of course be disastrous for your security.
Once TTY tickets are enabled, there's a much smaller risk that the 'sudo piggyback hole' can be used against you, but there's no reason to take any chances, so you'll want to turn off the 'grace period' as well.
The good news is you only need to do this once. Try to do this if you can, as you'll increase your security by an order of magnitude.
- You have to run visudo. From a command line. You must do this from an administrator account. (Don't worry too much - visudo makes it hard to screw up.)
- Go to a command prompt (Terminal.app) and type in 'sudo visudo'. You'll be prompted for your passphrase. Give it.
- Use arrow down to get to the line that says '# Defaults specification'. Hit 'o' on your keyboard. This opens the file for editing.
- Type in 'Defaults tty_tickets'. Hit Enter. Type in 'Defaults:ALL timestamp_timeout=0'. Hit <Esc>.
- You should now have this.
# Defaults specification Defaults tty_tickets Defaults:ALL timestamp_timeout=0
- Type ':q!' if you make a mistake and want to exit without saving changes.
- Type ':w' followed by Enter then ':q' followed by Enter to save your changes.
7. CLIX Adds More Security for Free
Once you've set the grace period to zero and enabled TTY tickets, there should be no way a rogue process (trojan) can exploit you. But CLIX still takes things further.
- Just in case you haven't been careful, and just in case there's an authentication still in the system, and because CLIX wants to know each and every time you're going to be prompted for your passphrase: before running any command, CLIX destroys all authentication data. No command anywhere that requires sudo will succeed without you being prompted.
- Just in case you haven't been careful: CLIX will essentially perform the same task immediately after completing your command as well. (This is completed asynchronously to save you time.)
- When you're about to exit CLIX or when your computer is about to go to sleep: CLIX destroys all privilege escalation information. So even if you have a grace period and have run an escalated command in Terminal, you'll find you're going to need to submit again.
8. $PATH Hijacking
$PATH is system setting for a series of 'command paths' in your file system where system command files are commonly located.
Go to a Terminal command line and run the following command.
$ echo $PATH
Now run the same command from within CLIX. Are the results identical?
You should get the following, perhaps in different order. Terminal may offer even more.
/bin:/sbin:/usr/bin:s/usr/sbin
The Unix 'commands' (programs) in those locations are locked down really tight: the files are protected by root, and their parent directories are as well.
- There's no way anyone less than root can modify files in these locations. - There's no way anyone less than root can replace files in these locations.
They simply can't be touched. And their parent directories can't be touched either.
But $PATH is another matter - it's a shell variable. The original value comes from a read-only area of the OS kernel. But through system startup, this value can change. And after login there are two things that can further change it.
It's namely possible to take complete control of a machine by corrupting $PATH.
There are two ways of corrupting $PATH so your commands go to the wrong files. The attack can come through the Unix shell bash and/or an Apple facility, neither of which you should entertain.
Normally a rogue cannot corrupt this variable for other processes - it's got to do with the way Unix treats its shells 'concentrically'.
Here are three articles worthy of a good read on the subject.
https://rixstep.com/2/20070201,00.shtml https://rixstep.com/2/20070204,00.shtml https://rixstep.com/2/20070320,00.shtml
So what can CLIX do about this? CLIX restores the original value of $PATH from the OS kernel before running your commands.
This is why the output from 'echo $PATH' can be different on CLIX: CLIX uses the kernel's read-only version which cannot be corrupted by a rogue process.
9. Other Precautions
There are other precautions you should take - above and beyond use of any particular program. They're listed at the third article linked above. Briefly:
√ Don't 'sudo' execute a script unless you can guarantee its contents. This is basically the same principle as checking the integrity of modules that are going to be run with privilege escalation.
√ Watch out for sudo calls in scripts. Same thing basically.
√ Make sure your Terminal's invoking a second login when you use it. Your Terminal settings are in an unprotected file in your user area and can be modified to effect 'ordinary' shell sessions that can be hijacked a lot easier.
TTY Tickets https://rixstep.com/2/20050521,00.shtml
The Zero Time Stamp Timeout https://rixstep.com/2/20051119,02.shtml
|