Page MenuHomeVyOS Platform
Create Task
Maniphest T4033

VRRP - Error security when setting scripts
Closed, ResolvedPublicBUG
Actions

Description

In VyOS 1.3.0-epa3 and latest 1.4 version, when adding health script checks in VRRP, error occurs.

Simplified config for vrrp:

set high-availability vrrp group Test health-check script '/config/scripts/vrrp-check.sh'
set high-availability vrrp group Test interface 'eth3'
set high-availability vrrp group Test priority '250'
set high-availability vrrp group Test virtual-address '10.0.0.1/24'
set high-availability vrrp group Test vrid '91'

In journalctl:

Dec 01 22:40:17 R01Master Keepalived_vrrp[3436]: Unsafe permissions found for script '/config/scripts/vrrp-check.sh' - disabling.
Dec 01 22:40:17 R01Master Keepalived_vrrp[3436]: Disabling track script healthcheck_Test due to insecure

Relevant content of /run/keepalived/keepalived.conf:

global_defs {
    dynamic_interfaces
    script_user root
    # Don't run scripts configured to be run as root if any part of the path
    # is writable by a non-root user.
    enable_script_security

Workaround: after commenting line with enable_script_security and restarting vrrp, in journalctl we can see:

Dec 01 22:45:05 R01Master Keepalived_vrrp[4003]: Unsafe permissions found for script '/config/scripts/vrrp-check.sh'.
Dec 01 22:45:05 R01Master Keepalived_vrrp[4003]: SECURITY VIOLATION - scripts are being executed but script_security not enabled. There are insecure scripts.

Details

Difficulty level
Unknown (require assessment)
Version
1.3.0-epa3
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Related Objects

Event Timeline

n.fort created this task.Dec 2 2021, 1:49 AM
pasik added a subscriber: pasik.Dec 2 2021, 10:33 AM
m.korobeinikov added a subscriber: m.korobeinikov.Dec 6 2021, 6:13 AM

I have the same problem. I created a script, but it doesn't work. VRRP Log write that the skript is unsecure.

Version: VyOS 1.3-beta-202112050443

kor@vyos:~$ cat /run/keepalived/keepalived.conf

global_defs {

dynamic_interfaces
script_user root
# Don't run scripts configured to be run as root if any part of the path
# is writable by a non-root user.
enable_script_security
notify_fifo /run/keepalived/keepalived_notify_fifo
notify_fifo_script /usr/libexec/vyos/system/keepalived-fifo.py

}

}
vrrp_script healthcheck_outside {

script "/config/scripts/vrrp-check.sh"
interval 1
fall 1
rise 1

keepalived.conf says - Don't run scripts configured to be run as root if any part of the path is writable by a non-root user.

So i created the script

$ sudo nano /config/scripts/vrrp-check.sh
$ sudo chmod +x /config/scripts/vrrp-check.sh

The script:
#!/bin/vbash
/usr/bin/ping -c 2 8.8.8.8 &> /dev/null
if [ $? -eq 0 ];then

exit 0

else

exit 1

fi

VRRP LOG:
Dec 06 04:57:28 Keepalived_vrrp[5196]: Unsafe permissions found for script '/config/scripts/vrrp-check.sh' - disabling.
Dec 06 04:57:28 Keepalived_vrrp[5196]: Disabling track script healthcheck_outside due to insecure

If i disabled this command : #enable_script_security and try restart VRRP the script didnt work too.
VRRP LOG:
Dec 06 05:08:11 Keepalived_vrrp[5730]: Unsafe permissions found for script '/config/scripts/vrrp-check.sh'.
Dec 06 05:08:11 Keepalived_vrrp[5730]: SECURITY VIOLATION - scripts are being executed but script_security not enabled. There are insecure scripts.
Dec 06 05:08:11 Keepalived_vrrp[5730]: Warning - script healthcheck_outside is not used

How did he solve this issue?
https://phabricator.vyos.net/T3352

m.korobeinikov added a project: VyOS 1.4 Sagitta.Dec 6 2021, 8:05 AM
Unknown Object (User) added a subscriber: Unknown Object (User).Dec 6 2021, 8:05 AM

We definitely have to delete enable_script_security from https://github.com/vyos/vyos-1x/blob/current/data/templates/vrrp/keepalived.conf.tmpl#L10

Unknown Object (User) added a subscriber: Unknown Object (User).Dec 6 2021, 11:54 AM

PR:
https://github.com/vyos/vyos-1x/pull/1098

Viacheslav changed the task status from Open to In progress.Dec 6 2021, 12:10 PM
Viacheslav assigned this task to Unknown Object (User).
c-po closed this task as Resolved.Dec 9 2021, 10:31 PM
c-po edited projects, added VyOS 1.3 Equuleus (1.3.0); removed VyOS 1.3 Equuleus.
c-po moved this task from Need Triage to Finished on the VyOS 1.3 Equuleus (1.3.0) board.
c-po moved this task from Need Triage to Finished on the VyOS 1.4 Sagitta board.