Skip to content

Commit 36d3f10

Browse files
fabafffabaff
authored
Add Security section (home-assistant#5459)
* Update sentence * Move fingerprint docs * Add more details * Add new section * Add content for new security section
1 parent f96a49b commit 36d3f10

File tree

4 files changed

+257
-2
lines changed

4 files changed

+257
-2
lines changed

‎source/_docs/security.markdown

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
layout: page
3+
title: "Security of Home Assistant"
4+
description: "Security of Home Assistant."
5+
date: 2017-02-13 12:50
6+
sidebar: true
7+
comments: false
8+
sharing: true
9+
footer: true
10+
---
11+
12+
As Home Assistant is like every other service or daemon that is running on a computer system that allows access over a network connection, certain measurement were taken to increase the overall security while still staying operational.
13+
14+
[Secure your installation](/docs/configuration/securing/) once you've finished with the installation process regardless of your use case.
15+
16+
Home Assistant is NOT able to change the configuration of your router or firewall. This means that you need to setup [port-forwarding](/docs/configuration/remote/) and adjusting firewall rules if you want to allow access from the internet. By default your frontend and your Hass.io add-ons like Mosquitto, SSH and your Samba shares are only accessible from your local network.
17+
18+
## {% linkable_title Server banner %}
19+
20+
Further [details about the fingerprint/server banner](/docs/security/webserver/) of a Home Assistant instance are available.
21+
22+
## {% linkable_title Porosity %}
23+
24+
The default port of Home Assistant is 8123. This is the port where the [`frontend`](/components/frontend/) and the [`API`](/components/api/) is served. Both are depending on the [`http`](/components/http/) component which contains the capability to adjust the settings like `server_host` or `server_port`.
25+
26+
See the [open ports](/docs/security/porosity/) of a Hass.io instance with various add-ons.
27+
28+
## {% linkable_title HTTP SSL/TLS %}
29+
30+
Home Assistant is following the [Mozilla's Operations Security team recommendations](https://wiki.mozilla.org/Security/Server_Side_TLS) for Server side SSL/TLS settings. To allow the users to access Home Assistant with most devices the target is **Intermediate compatibility**.
31+
32+
## {% linkable_title SSH %}
33+
34+
The SSH connection for [debugging](https://developers.home-assistant.io/docs/en/hassio_debugging.html) on port 22222 is not enabled by default and can only be used with keys.
35+
36+
Is SSH used with the [SSH server add-on](/addons/ssh/) then the user is responsible for the configuration and security.
37+
38+
## {% linkable_title Source code %}
39+
40+
Due to the lack of resources we are not able to review all of our dependencies and inspect them for malicious behavior, leakage of information or compliance with GDPR. But we have a keen interest in the development of our dependencies are try to work closely with the upstream developer.
41+

‎source/_docs/security/porosity.markdown

Lines changed: 195 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
---
2+
layout: page
3+
title: "Home Assistant/Hass.io porosity"
4+
description: "Use nmap to scan your Home Assistant instance."
5+
date: 2016-10-06 08:00
6+
sidebar: true
7+
comments: false
8+
sharing: true
9+
footer: true
10+
---
11+
12+
As a large amount of users are running [Hass.io](/hassio/), here we are using a Raspberry Pi 3 B and Hass.io 0.70.0 to show how Home Assistant looks from the network side. This is not a full blown investigation, just a quick overview.
13+
14+
The IP address of the Home Assistant machine is 192.168.0.215. The system which is the source of the scans is a machine running Fedora 27 and Nmap 7.60 is used to preform the port scans. Both systems are in the same network.
15+
16+
## {% linkable_title SSH server Add-on %}
17+
18+
To get access to Hass.io in secure way, SSH is provided by the [SSH server add-on](/addons/ssh/).
19+
20+
```bash
21+
$ sudo nmap -A -n --reason -Pn -T5 -p1-65535 192.168.0.215
22+
23+
Starting Nmap 7.60 ( https://nmap.org ) at 2018-05-29 15:08 CEST
24+
Nmap scan report for 192.168.0.215
25+
Host is up, received arp-response (0.00051s latency).
26+
Not shown: 65532 closed ports
27+
Reason: 65532 resets
28+
PORT STATE SERVICE REASON VERSION
29+
22/tcp open ssh syn-ack ttl 63 OpenSSH 7.5 (protocol 2.0)
30+
| ssh-hostkey:
31+
| 2048 e3:a2:2d:20:3a:67:68:b9:b1:9e:16:fa:48:80:82:96 (RSA)
32+
| 256 92:f0:f4:be:4f:44:60:0e:c4:92:8a:cb:34:9e:c5:c2 (ECDSA)
33+
|_ 256 09:da:a2:14:cd:c4:69:e9:13:e6:70:64:98:d0:55:0c (EdDSA)
34+
8123/tcp open http syn-ack ttl 64 aiohttp 3.1.3 (Python 3.6)
35+
|_http-open-proxy: Proxy might be redirecting requests
36+
| http-robots.txt: 1 disallowed entry
37+
|_/
38+
|_http-server-header: Python/3.6 aiohttp/3.1.3
39+
|_http-title: Home Assistant
40+
22222/tcp open ssh syn-ack ttl 64 Dropbear sshd 2016.74 (protocol 2.0)
41+
MAC Address: B8:41:CD:4B:7A:5D (Raspberry Pi Foundation)
42+
Device type: general purpose
43+
Running: Linux 3.X|4.X
44+
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
45+
OS details: Linux 3.2 - 4.8
46+
Network Distance: 1 hop
47+
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
48+
49+
TRACEROUTE
50+
HOP RTT ADDRESS
51+
1 0.51 ms 192.168.0.215
52+
53+
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
54+
Nmap done: 1 IP address (1 host up) scanned in 726.23 seconds
55+
```
56+
57+
That port 22 and 8123 are open was expected. On port 22222 is an additional SSH server running. This port is for [debugging](https://developers.home-assistant.io/docs/en/hassio_debugging.html) and supports only a login with a key. This means that you would need to remove the SD card from your Raspberry Pi, create an `authorized_keys` with your SSH public key in it and put the SD Card back in your Pi to get access.
58+
59+
## {% linkable_title Mosquitto MQTT broker Add-on %}
60+
61+
While setting up the [Mosquitto MQTT broker add-on](/addons/mosquitto/) no settings very modified, the add-on was running with the default settings.
62+
63+
```bash
64+
$ sudo nmap -A -n --reason -Pn -T5 -p1-65535 192.168.0.215
65+
66+
Starting Nmap 7.60 ( https://nmap.org ) at 2018-05-29 15:52 CEST
67+
Nmap scan report for 192.168.0.215
68+
Host is up, received arp-response (0.0011s latency).
69+
Not shown: 65532 closed ports
70+
Reason: 65532 resets
71+
PORT STATE SERVICE REASON VERSION
72+
1883/tcp open mosquitto version 1.4.12 syn-ack ttl 63
73+
| mqtt-subscribe:
74+
| Topics and their most recent payloads:
75+
| $SYS/broker/load/connections/5min: 0.39
76+
[...]
77+
| $SYS/broker/load/connections/15min: 0.13
78+
|_ $SYS/broker/clients/total: 2
79+
8123/tcp open http syn-ack ttl 64 aiohttp 3.1.3 (Python 3.6)
80+
|_http-open-proxy: Proxy might be redirecting requests
81+
| http-robots.txt: 1 disallowed entry
82+
|_/
83+
|_http-server-header: Python/3.6 aiohttp/3.1.3
84+
|_http-title: Home Assistant
85+
22222/tcp open ssh syn-ack ttl 64 Dropbear sshd 2016.74 (protocol 2.0)
86+
MAC Address: B8:41:CD:4B:7A:5D (Raspberry Pi Foundation)
87+
Device type: general purpose
88+
Running: Linux 3.X|4.X
89+
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
90+
OS details: Linux 3.2 - 4.8
91+
Network Distance: 1 hop
92+
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
93+
94+
TRACEROUTE
95+
HOP RTT ADDRESS
96+
1 1.13 ms 192.168.0.215
97+
98+
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
99+
Nmap done: 1 IP address (1 host up) scanned in 223.76 seconds
100+
```
101+
102+
To secure MQTT to consider to use certificates and to specify users with password under `logins:` at least. Use port 1883 only in your local network.
103+
104+
## {% linkable_title Samba Add-on %}
105+
106+
The [Samba add-on](/addons/samba/) enables one to use a Windows system to access the configuration and other shares. Per default there is no user set. To increase your local security we strongly suggest that you set a username and a password and don't allow guests. A sample configuration could look like the one below.
107+
108+
A port scan for Hass.io with this add-on will give you the details.
109+
110+
```bash
111+
$ sudo nmap -A -n --reason -Pn -T5 -p1-65535 192.168.0.215
112+
113+
Starting Nmap 7.60 ( https://nmap.org ) at 2018-05-29 16:29 CEST
114+
Host is up, received arp-response (0.00045s latency).
115+
Not shown: 65523 closed ports
116+
Reason: 65523 resets
117+
PORT STATE SERVICE REASON VERSION
118+
139/tcp open netbios-ssn syn-ack ttl 64 Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
119+
445/tcp open netbios-ssn syn-ack ttl 64 Samba smbd 4.7.3 (workgroup: WORKGROUP)
120+
8123/tcp open http syn-ack ttl 64 aiohttp 3.1.3 (Python 3.6)
121+
|_http-open-proxy: Proxy might be redirecting requests
122+
| http-robots.txt: 1 disallowed entry
123+
|_/
124+
|_http-server-header: Python/3.6 aiohttp/3.1.3
125+
|_http-title: Home Assistant
126+
22222/tcp open ssh syn-ack ttl 64 Dropbear sshd 2016.74 (protocol 2.0)
127+
MAC Address: B8:41:CD:4B:7A:5D (Raspberry Pi Foundation)
128+
Device type: general purpose
129+
Running: Linux 3.X|4.X
130+
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
131+
OS details: Linux 3.2 - 4.8
132+
Network Distance: 1 hop
133+
Service Info: Host: HASSIO; OS: Linux; CPE: cpe:/o:linux:linux_kernel
134+
135+
Host script results:
136+
|_nbstat: NetBIOS name: HASSIO, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
137+
| smb-os-discovery:
138+
| OS: Windows 6.1 (Samba 4.7.3)
139+
| Computer name: \x00
140+
| NetBIOS computer name: HASSIO\x00
141+
| Workgroup: WORKGROUP\x00
142+
|_ System time: 2018-05-29T16:41:05+02:00
143+
| smb-security-mode:
144+
| account_used: guest
145+
| authentication_level: user
146+
| challenge_response: supported
147+
|_ message_signing: disabled (dangerous, but default)
148+
| smb2-security-mode:
149+
| 2.02:
150+
|_ Message signing enabled but not required
151+
| smb2-time:
152+
| date: 2018-05-29 16:41:05
153+
|_ start_date: 1601-01-01 00:53:28
154+
155+
TRACEROUTE
156+
HOP RTT ADDRESS
157+
1 0.46 ms 192.168.0.215
158+
159+
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
160+
Nmap done: 1 IP address (1 host up) scanned in 727.43 seconds
161+
```
162+
163+
139 and 445 are open and it's possible to enumerate the shares. With different tools you will get pretty much the same information.
164+
165+
```bash
166+
$ smbclient -L //192.168.0.215 -U%
167+
168+
Sharename Type Comment
169+
--------- ---- -------
170+
config Disk
171+
addons Disk
172+
share Disk
173+
backup Disk
174+
IPC$ IPC
175+
IPC Service (Samba HomeAssistant config share)
176+
Reconnecting with SMB1 for workgroup listing.
177+
178+
Server Comment
179+
--------- -------
180+
181+
Workgroup Master
182+
--------- -------
183+
WORKGROUP HASSIO
184+
```
185+
186+
But without username and password you can't get access to the configuration file with the settings shown here.
187+
188+
```json
189+
[...]
190+
"guest": false,
191+
"username": "homeassistant",
192+
"password": "homeassistant",
193+
"interface": "eth0"
194+
}
195+
```

‎source/_docs/frontend/webserver.markdown renamed to ‎source/_docs/security/webserver.markdown

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ sidebar: true
77
comments: false
88
sharing: true
99
footer: true
10-
redirect_from: /details/webserver/
10+
redirect_from: /docs/frontend/webserver/
1111
---
1212

1313
It was only a matter of time until the first queries for tools like [https://www.shodan.io](https://www.shodan.io/search?query=Home+Assistant) to search for Home Assistant instances showed up.
@@ -36,6 +36,19 @@ PORT STATE SERVICE VERSION
3636

3737
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
3838
Nmap done: 1 IP address (1 host up) scanned in 12.13 seconds
39+
```
40+
41+
We don't have an unique server banner but in combination with the HTML title `Home Assistant`, is it simple to identify Home Assistant instances.
3942

43+
```bash
44+
$ nc 192.168.0.3 8123
45+
GET / HTTP/1.1
46+
host: localhost
47+
48+
HTTP/1.1 200 OK
49+
Server: Python/3.6 aiohttp/3.1.3
50+
[...]
4051
```
4152

53+
One option to avoid this exposure is using a [reverse proxy](/docs/ecosystem/nginx/).
54+

‎source/_includes/asides/docs_navigation.html

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,6 @@ <h1 class="title delta">Topics</h1>
6363
<b>{% active_link /docs/frontend/ Frontend %}</b>
6464
<ul>
6565
<li>{% active_link /docs/frontend/mobile/ Android/iOS Homescreen %}</li>
66-
<li>{% active_link /docs/frontend/webserver/ Web server fingerprint %}</li>
6766
<li>{% active_link /docs/frontend/browsers/ Browser Compatibility List %}</li>
6867
</ul>
6968
</li>
@@ -98,6 +97,13 @@ <h1 class="title delta">Topics</h1>
9897
<li>{% active_link /docs/tools/keyring/ keyring %}</li>
9998
</ul>
10099
</li>
100+
<li>
101+
<b>{% active_link /docs/security/ Security %}</b>
102+
<ul>
103+
<li>{% active_link /docs/security/webserver/ Web server fingerprint %}</li>
104+
<li>{% active_link /docs/security/porosity/ Porosity %}</li>
105+
</ul>
106+
</li>
101107
<li>
102108
<b>{% active_link /docs/z-wave/ Z-Wave %}</b>
103109
<ul>

0 commit comments

Comments
 (0)