saint2012 mod process security
DESCRIPTION
In Web hosting services, hosting systems use access controls like suEXEC on apache Web servers to separate privilege by each virtual host. However, existing access control architectures on Web servers have a problem in their low performance and are not appropriate for dynamic contents like Web API since these architectures require termination of the process after each HTTP session. The system developers are not easy to install existing access controls since these are provided by each interpreter and program execution methods conventionally. In this paper, we propose the access control architecture “mod_process_security”. In this architecture a server process creates a new thread on the server process when accepting a request. Then, the web server separates privilege by the thread and processes the contents on the thread. The server process installed “mod_process_security” executes programs faster. System developers can easily install it on web servers since we replace it with the complicated existing access controls. “mod_process_security” can be installed for Apache HTTP Server on Linux as Apache Module which is widely used.TRANSCRIPT
Access Control Architecture Separating Privilege by a Thread on a Web Server
- mod_process_security -
Ryosuke MATSUMOTO, Yasuo OKABE
Kyoto University
2012/7/18 SAINT2012 Izmir 1
Content
1. Introduction
2. Access Control on Web Servers
3. Proposed Access Control Architecture
4. Experiment and Evaluation
5. Conclusion
2012/7/18 SAINT2012 Izmir 2
Content
1. Introduction
2. Access Control on Web Servers
3. Proposed Access Control Architecture
4. Experiment and Evaluation
5. Conclusion
2012/7/18 SAINT2012 Izmir 3
Background
• Deployment of Cloud Computing – Cost: Reducing the total cost off ownership (TCO), including hardware,
software and operation – Security: Confidentiality, Integrity and Availability
• PaaS (Platform as a Service): Large-Scale Shared Web Hosting Service, or so-called “Virtual Hosting” – Many Web sites share a single Operating System as well as HW resource. – Separation among sites is implemented using mechanism ether in OS or
in the Web server.
• Discretionary Access Control (DAC) : the access control model on UNIX and Windows OS "as a means of restricting access to objects based on the identity of subjects and/or groups to which they belong. …” (wikipedia) – There exist some issues both in security and performance.
• Ex) suEXEC for CGI on Apache HTTP Server
– CGI method: low performance
Executing dynamic contents securely and fast on large-scale shared Web hosting service
2012/7/18 SAINT2012 Izmir 4
Dynamic Contents on Web Servers
• CGI is low-performance
• DSO (Dynamic Shared Object) is enough fast, but…
Server Process
CGI Process
Program
Server Process
Program
CGI DSO
A built-in Interpreter
bottleneck
Engineers’ needs to use DSO on a shared web hosting.
2012/7/18 SAINT2012 Izmir 5
Problem in Dynamic Contents
Problem in access controls – DSO
• Architecture separating privilege by a server process
• Serious performance degradation when securely executed
– CGI • Architecture separating privilege by a CGI process each
• Intrinsically low performance in creating a child process
– Existing access controls are provided by the execution methods each. • CGI , DSO, or other Interpreters
• Complicated and user-unfriendly settings
In executing dynamic contents on a shared Web hosting service, – Use of CGI is almost mandatory for security
– If using DSO, separating privilege by a daemon process or VM
⇒ Too much overhead 2012/7/18 SAINT2012 Izmir 6
Our Research
“Secure and high-performance access control architecture on large-scale shared Web virtual hosting”
• We propose a thread-based security mechanism, and implement as a module “mod_process_security”
– Architecture separating privilege by thread
• Very little performance degradation using DSO
• Enough security
• Independent from the program execution method, either CGI or DSO
– As an module for Apache HTTP Server on Linux
2012/7/18 SAINT2012 Izmir 7
Content
• Introduction
• Access Control on Web Server
• Proposed Access Control Architecture
• Experiment and Evaluation
• Conclusion
2012/7/18 SAINT2012 Izmir 8
Overview of Access Control on a Web Server • Apache HTTP Server (not using access controls)
– Using VirtualHost for a huge number of hosts. – Handling all requests by the privilege of server processes. – Files can be read via programs of any other host areas.
• Basic architecture of access controls – Executing dynamic contents with the privilege of the contents. – Preventing access to other virtual host area. – suEXEC, mod_suid2 or mod_ruid2 and so on…
OS Web Service A Web Service B
Virtual Host B Virtual Host A
×
×
×
×
Single server process
Setting the privilege of the contents at each host area.
2012/7/18 SAINT2012 Izmir 9
execve()
Child Server Process (owner : apache)
CGI Process (owner : root)
index.php (owner: user1)
fork() execve() suexec-program
CGI Process (owner : user1)
setuid(), setgid()
terminate process
Parent Server Process (owner : root)
bottleneck
CGI suEXEC Archtecture
2012/7/18 SAINT2012 Izmir 10
execve()
Parent Server Process (owner : root)
Child Server Process (owner : apache)
Set capability
index.php (owner: user1)
Set cap(Linux capability)
Child Server Process (owner : user1) Set capability
setuid(), setgid()
setuid(), setgid() terminate process
×
DSO mod_ruid2 Architechture
bottleneck
Unset cap
Changing the privilege of Server Process × 2012/7/18 SAINT2012 Izmir 11
Contents
• Introduction
• Exsiting Access Control on Web Server
• Proposed Access Control Architecture
• Experiment and Evaluation
• Conclusion
2012/7/18 SAINT2012 Izmir 12
Proposed Access Control Architecture - mod_process_security -
1. Reducing the bottleneck using a thread
• separating privilege by a controlling thread
• Need not to terminate server processes
• Creating a thread instead of forking a process
2. Independent of executing methods
• Need not to install a software individually for CGI or DSO
3. Installation and setting are easy
• Apache module
• User-friendly specification
2012/7/18 SAINT2012 Izmir 13
execve()
Child Server Process (owner : apache)
Control Thread (owner : apache)
index.php (owner: user1)
Create thread, set cap
Control Thread (owner : user1)
setuid・setgid, unset cap
destroy thread
Parent Server Process (owner : root)
CGI mod_process_security
CGI Process (owner : user1)
terminate process
CGI Specification
2012/7/18 SAINT2012 Izmir 14
Child Server Process (owner : apache)
Control Thread (owner : apache)
Create thread, set cap
Control Thread (owner : user1)
setuid・setgid, unset cap
destroy thread
Parent Server Process (owner : root)
DSO mod_process_security
execve()
index.php (owner: user1)
DSO Specification
2012/7/18 SAINT2012 Izmir 15
Contents
• Introduction
• Exsiting Access Control on Web Server
• Proposed Access Control Architecture
• Experiment and Evaluation
• Conclusion
2012/7/18 SAINT2012 Izmir 16
Experiment
Clinent Machine
CPU Intel Core2Duo E8400 3.00GHz
Memory 4GB
NIC Realtek RTL8111/8168B 1Gbps
OS CentOS 5.6
Web Server Machine
CPU Intel Xeon X5355 2.66GHz
Memory 8GB
NIC Broadcom BCM5708 1Gbps
OS CentOS 5.6
Middle Ware Apache 2.2
• Measuring response per second from a Web server • Generating requests per second from a client to a Web server
• Evaluation of throughput by changing the number of requests • Evaluation of throughput by using each access controls
• Printing phpinfo program(54KB), Benchmark software(httperf 0.9.0)
2012/7/18 SAINT2012 Izmir 17
Throughput
0
500
1000
1500
2000
2500
3000
Re
spo
nse
s/se
c
Requests/sec
DSO(mod_process_security) DSO(not using access control)
DSO(mod_ruid2) CGI(not using access control)
CGI(suEXEC) CGI(mod_process_security)
DSO(mod_process_security ): Low throughput degradation
DSO(mod_ruid2): about 4.5 responses for all requests
Access control for CGI Low performance degradation
CGI (Magnified in the next slide)
DSO
2012/7/18 SAINT2012 Izmir 18
Throughput for CGI
100
120
140
160
180
200
100 200 300 400 500 600 700 800 900 1000
Re
spo
nse
s/se
c
Requests/sec
CGI(not using access control) CGI(suexec) CGI(mod_process_security)
Not using access control、mod_process_secuiry、suEXEC
2012/7/18 SAINT2012 Izmir 19
Contents
• Introduction
• Exsiting Access Control on Web Server
• Proposed Access Control Architecture
• Experiment and Evaluation
• Conclusion
2012/7/18 SAINT2012 Izmir 20
Conclusion
1. High performance and secure access control on multitenant apprications
– High performance access control architecture for DSO
– Use computing resource efficiently ⇒ Low cost
2. Independent of executing methods like CGI or DSO
– Easy to install
– user-friendly setting
⇒ In this architecture, you can withstand the advancement of Web services considering multitenant
applications and low cost hosting services 2012/7/18 SAINT2012 Izmir 21
Future Research Plans
• Encourage using mod_process_scurity
– Now relesing in https://modules.apache.org/
• We plan to design new virtual host architecture by combining mod_process_security with the module that can manage resources more flexibility on each virtual host.
2012/7/18 SAINT2012 Izmir 22