Unix domain socket firewall

Question

I've got a problem with my debian server. Probably there is some vulnerable script at my web-serser, which is running from www-data user. I also have samba with winbind installed, and samba is joined to windows domain.

So, probably this vulnerable script allows hacker to bruteforce out domain controller through winbind unix domain socket.

Actually I have lots of such lines at netstat -a output:

unix 3 [ ] STREAM CONNECTED 509027 /var/run/samba/winbindd_privileged/pipe

And our DC logs contain lots of recorded authentication attems from root or guest accounts.

How can I restrict my apaches access to winbind? I had an idea to use some kind of firewall for IPC sockets. Is it possible?

Community · Accepted Answer · 2017-05-23 12:11:52Z

1

Unix domain sockets use the file system for endpoints, therefore you can use POSIX file permissions or ACLs to restrict access.

Actually answered before here: AF_UNIX domain - why use local file names only?

edited May 23, 2017 at 12:11

CommunityBot

11 silver badge

answered Mar 14, 2011 at 8:04

Steve-o

12.9k2 gold badges44 silver badges61 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

geekosaur · Accepted Answer · 2011-03-14 07:26:24Z

0

You can't firewall AF_UNIX sockets. I would expect the real problem is that some login form on your web server allows brute force attempts, and should be rate-limited somehow (maximum number of attempts, timeouts, etc.).

answered Mar 14, 2011 at 7:26

geekosaur

61.9k13 gold badges127 silver badges115 bronze badges

Collectives™ on Stack Overflow

Unix domain socket firewall

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related