From 74df256b3cf2c6f253bb8e7ee6bc98fc77fda326 Mon Sep 17 00:00:00 2001 From: prandla Date: Wed, 28 Oct 2026 15:15:22 +0200 Subject: [PATCH] Document more security considerations --- docs/Introduction.rst | 55 ++++++++++++++++++++++++++++++++++++++++++- docs/Running CMS.rst | 4 ++++ 2 files changed, 58 insertions(+), 1 deletion(-) diff --git a/docs/Introduction.rst b/docs/Introduction.rst index 14c92dde3f..bb07897b6a 100644 --- a/docs/Introduction.rst +++ b/docs/Introduction.rst @@ -46,8 +46,61 @@ Some of the services can be replicated on several machine: these are ResourceSer In addition to services, CMS includes many command line tools. They help with importing, exporting and managing of contest data, and with testing. +.. _introduction_security-considerations: Security considerations ======================= -With the exception of RWS, there are no cryptographic or authentication schemes between the various services or between the services and the database. Thus, it is mandatory to keep the services on a dedicated network, properly isolating it via firewalls from contestants or other people's computers. This sort of operations, like also preventing contestants from communicating and cheating, is responsibility of the administrator and is not managed by CMS itself. +Network +------- + +With the exception of RWS, there are no cryptographic or authentication schemes between the various services or between the services and the database. +Thus, it is mandatory to keep the services on a dedicated network, properly isolating it via firewalls from contestants or other people's computers. + +It is recommended to not make AdminWebServer publicly accessible +(instead, either restrict it to only be accessed from a VPN or add authentication in a reverse proxy). +While AWS does have its own authentication, there have been bugs in it, and restricting access also prevents possible DoS attacks. + +Default credentials +------------------- + +To ease testing, the configuration file contains default values for ``web_server.secret_key`` and for RWS credentials +(``proxy_service.rankings`` in ``cms.toml``, and ``username``/``password`` in ``cms_ranking.toml``). +These must be changed in real deployments, ideally to long random values. +Failure to do so (for ``secret_key``) may allow attackers to log in as arbitrary users in CWS or get access to AWS. +Weak or default RWS credentials may allow attackers to deface the leaderboard. + +Sandbox +------- + +The sandbox that submissions are evaluated in is quite conservative. +However, it does allow access to the following directories on the host file system: + +- ``/bin`` +- ``/dev`` (except for ``/dev/shm``) +- ``/etc`` (during compilation) +- ``/etc/alternatives``, ``/etc/mono`` +- ``/opt/pypy3`` +- ``/lib`` and ``/lib64`` +- ``/usr`` +- ``/var/lib/ghc`` (during compilation) + +The most notable of these is ``/etc``. + +Thus, you should make sure that these directories do not contain any world-readable sensitive information. + +Passwords +--------- + +CMS can use both plaintext and bcrypt-hashed passwords. bcrypt is recommended in all cases. + +The browser cookie that is generated upon logging in via CWS contains the authentication data (plaintext password or bcrypt hash, depending on method) in an unencrypted form. +Thus it is recommended to use randomly-generated passwords if possible. + +Denial of service +----------------- + +CWS is written in pure Python and cannot handle many simultaneous connections. +Thus, it is quite vulnerable to denial of service attacks. +For on-site contests, it is recommended to limit CWS to only be accessed from the site using a reverse proxy. +Otherwise, one should be prepared to deploy DoS mitigation techniques (IP banning, etc) if availability is a concern. diff --git a/docs/Running CMS.rst b/docs/Running CMS.rst index 9129203570..9a03022298 100644 --- a/docs/Running CMS.rst +++ b/docs/Running CMS.rst @@ -1,6 +1,10 @@ Running CMS *********** +.. warning:: + + Make sure to read the :ref:`introduction_security-considerations` before running CMS! + Configuring the DB ==================