Is basic HTTP authentication in CouchDB secure enough for replication in EC2 regions?

I can appreciate that seeing “basic out” and “safe enough” in the same sentence is very similar to reading “Is a parachute without a parachute still safe?”, So I will do my best to clarify what I get in.

From what I saw on the Internet, people usually describe the basic HTTP out as insecure because credentials are sent in plain text from client to server; this leaves you open so that your credentials are sniffed by a wicked person or a person in the middle in a network configuration where your traffic can go through an unreliable access point (for example, an open access point in a cafe).

To provide a secure connection between you and the server, the solution usually uses an SSL-based connection, where your credentials can be sent in plain text, but the communication channel between you and the server is provided.

So to my question ...

In the situation of replication of one CouchDB instance from an EC2 instance in one region (for example, us-west) to another CouchDB instance in another region (for example, Singapore), network traffic will move along the path that I would consider "trusted" backbone servers.

Given that (assuming I am not replicating highly sensitive data), does anyone / everyone think that the basic HTTP authenticator for CouchDB replication is safe enough?

If not, please specify which scenarios I am missing here, which would make this installation unacceptable. I understand that this is not suitable for sensitive data, I just want to better understand that fuzzy data is replicated in a relatively trusted network.

+6
source share
3 answers

Bob is right, it's better to err on the side of caution, but I do not agree. Bob may be right in this case (see Details below), but the problem with his general approach is that he ignores the cost of paranoia. He leaves "peaceful dividends" on the table. I prefer Bruce Schneier's assessment that this is a compromise.

Short answer

Start replication now! Do not worry about HTTPS.

The greatest risk is not sniffing the wire, but your own human error, followed by software errors that can destroy or corrupt your data. Make a cue !. If you will regularly replicate, plan to switch to HTTPS or something similar (SSH tunnel, stunnel, VPN).

Justification

Is HTTPS easy with CouchDB 1.1? It's as simple as HTTPS, perhaps, or, in other words, no, it's not easy.

You need to make an SSL key pair, purchase a certificate, or start your own certification authority - you, of course, are not so stupid to self-sign! The user hashed password is clearly displayed from your remote couch! To protect against hacking, will you implement bidirectional SSL authentication? Does CouchDB support this? Maybe you need a VPN? How about the security of your key files? Do not test them in Subversion! And do not associate them with EC1 AMI! It defeats the goal. You must keep them separate and safe. When deploying or restoring from a backup, copy them manually. Also, password protect them so that if someone receives files, they cannot steal (or, even worse, change!) Your data. When you start CouchDB or replicate, you must manually enter the password before replication will work.

In short, every security solution has a cost.

A similar question: "Do I have to lock my house at night? It depends. Your profile says that you are in Tuscon, so you know that some areas are safe and others are not. It is always safer to always lock all your doors all the time. But what is the cost of your time and mental health? The analogy breaks a little, because the time spent on safety in the worst case is much more than twisting a bolt lock.

Amazon EC2 is a moderately safe area. The main risks are opportunistic, widespread scans of common mistakes. In principle, organized crime scans common SSH accounts and web applications such as Wordpress, so they can use a credit card or other database.

You are a small fish in a gigantic ocean. No one cares about you specifically. Unless you specifically target government or organized crime, or someone with resources and motivation (hey, this is CouchDB - it happens!), Then it is ineffective to worry about boogeyman. Your opponents throw wide nets to get the biggest catch. No one is trying to fish.

I see it as an integral calculus in high school: measuring the area under the curve. Time goes to the right (x axis). Risky behavior increases (y axis). When you do something risky, you saved time and effort, but the schedule goes up. When you do something in a safe way, it takes time and effort, but the schedule moves down. Your goal is to minimize the long-term area under the curve, but each decision depends on the specific case. Every day, most Americans drive cars: the most dangerous behavior in American life. We intuitively understand the trade-off between risk and reward. Internet activity is the same.

+5
source

As you can imagine, basic authentication without transport layer security is 100% insecure. Any EC2 user who can sniff your packages can see your password. Assuming no one could be a mistake.

In CouchDB 1.1, you can enable native SSL. In an earlier version, use stunnel. Adding SSL / TLS security is so simple that there really is no excuse for this.

+4
source

I just found this expression from Amazon that can help anyone trying to understand the risk of packet crashes on EC2.

Sniffing packages by other tenants . It is not possible for a virtual instance operating in promiscuous mode to receive or “sniff” traffic destined for another virtual instance. While clients can host their interfaces in promiscuous mode, the hypervisor will not forward any traffic to them that is not addressed to them. This includes two virtual instances belonging to the same client, even if they are located on the same physical host. Attacks such as ARP cache poisoning do not work in EC2. Although Amazon EC2 provides sufficient protection against one client inadvertently or maliciously attempting to view other data, as standard practice, customers should encrypt sensitive traffic.

http://aws.amazon.com/articles/1697

+1
source

Source: https://habr.com/ru/post/894983/


All Articles