Meet the new guy: BASHware and its use in the WSL

Antecedents

In this blog we published last year, an interesting insight of the penguin’s OS in the field of proprietary software, specifically in Microsoft® Windows®. Redmond’s company had just finished its beta phase of “Windows Subsystem for Linux”® (WSL), and we asked ourselves: “Is there security in that environment? ”.
Our rhetorical question was answered at the Rootedcon 2018 Computer Security Congress, held in the city of Madrid in March where the Checkpoint team made a presentation on the subject.

Approach of the theoretical framework

Every time a work tool is added to any software, there will always be incidences -or “bugs“- that can even be analyzed to see if they can have sneaky intentions. Originally, Microsoft® clearly explained the limitations of the WSL: it was not for production (databases, web servers) nor did it support graphic programs. In short, it was just, as we say, an “amusement park” for programmers (both hackers and crackers). In the case of us hackers, this feature saves us a lot of time, since the scripts that we have written for GNU/Linux can be executed in that private environment, but always modifying the environment variables (in any case the work of adaptation is minimal, the unit “C:\” is mounted as “/mnt/C/user”.

In order to enable the “Windows Subsystem for Linux” – which, has nothing to do with the Linux kernel, since GNU utilities really run on the Windows® kernel – you need administrator rights and you need to restart the computer. Although this fact is comforting we must take into account the following: every day Windows 10® occupies every new computer, because it comes with that operating system preinstalled. Who guarantees us that it is disabled, by default? The latter approach is derived from point 15 of the GNU General Public License: “The entire risk of both the quality and performance of the program is at your own expense,” i.e. the final responsibility for our systems always rests on our shoulders.

We must clarify that The people from Microsoft have pronounced on the matter and have refuted that this is a vulnerability of Windows® and that they will not dedicate more time to the matter (nowadays, there are no news about it), but here at Pandora FMS it is our duty to analyze as many scenarios as possible and to provide the tools; Monitoring also includes future events. We’ll write from the point of view of how it might affect our systems.

Monitoring with Pandora FMS

Another very remote possibility, more direct because it is aimed at specific local or virtual networks, is that an actor who has control over some “Active Directory” orders the WSL enablement in hundreds or perhaps thousands of machines that connect to that domain (companies and complete branches). All antivirus programs and substitutes will not detect such changes because they are simply Microsoft® applications, legitimate and digitally signed, hence our responsibility to have knowledge of such an event.

This is when Pandora FMS and its flexibility can help us in our work: we publish an introduction to log monitoring (includes link to check the approach under Pandora FMS), as well as an article in which we explain the difference between filtering and selecting “syslogs” (that are generated even when we activate some Windows® feature), which are part of the common monitoring metrics in modern operating systems. That’s why the flexibility, we insist, is patent: we can configure Pandora FMS so that it informs if some characteristic is incorporated to some computer monitored by us.

This is used to suggest that antivirus applications start taking an “inventory” when they are installed and show a warning -or block it – of possible weaknesses. We also distinguish between what is already installed and the changes made: the first is the task of the antivirus, the second are events that can -and should- detect the monitoring tools.

Terminology: BASHware

“Malware” comes from the contraction of “malicious software” and as the first word comes from Latin malitiosus. But here’s our point: massifying the term “BASHware” with malignant denotation is incorrect, “malware” exists applied in different ways because the tools that we, the network administrators, migrate are entirely innocent. Now, if a person with malicious intentions develops scripts in BASH then we are talking about “badBASHware”.

Steps to use BASHware

Windows® has always integrated its own command line, but from Windows Vista® onwards it has a more powerful tool created to match the BASH/GNU features: Powershell®.

With this tool (Powershell®) we explain the next steps:

Enabling WSL in Windows 10®

Yes, WSL is only for Windows 10®, although in the last one we enabled the remote tools for a virtual machine with Windows 7®. Powershell is active by default, we run it with administrator rights and enter the following command (we must then restart the computer or simply wait for some other frequent Windows Update® task to do it):

Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux

It is also possible to enable it through a Windows terminal window:

dism /Online /Enable-Feature /All /FeatureName:Microsoft-Windows-Subsystem-Linux /NoRestart

WSL: enabling developer mode

The second thing we have to enable – and that makes the process we are proposing even more difficult – is the developer mode and making it permanent. This is accomplished by modifying (or adding) a key in the Windows® registry.

Warning: mishandling the Windows registry can lead to system corruption and even prevent system startup and even recovery. Please always test on disposable virtual machines.

In order to do this we use the command “New-Item“, to add the following key:

New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" -ItemType Directory -Force

and define its property with this one, a little longer:

New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" -Name 
AllowDevelopmentWithoutDevLicense -PropertyType DWORD -Value 1

Since we must check if such a key exists before setting the property to a value other than zero, system administrators like to develop scripts to save us from repeating the task again and automating everything. In this link you will be able to read a complete script ahead of its time -year 2016- and the only objection it is that it doesn’t capture the response of the New-Item command and then register in the syslog the work done with its own function intended for that purpose, called Write-CMLogEntry. A hacker cares to record for the audit logs we mentioned in section 2.1, a “cracker” is not aware of this as it boasts about not leaving a trace!

Choosing Favorite BASH

Not many to choose from, but Microsoft has behaved democratically by adding more GNU distributions in addition to Ubuntu, which is the default. To date there is support for:

• openSUSE Leap
• SUSE Linux Enterprise Server
• Debian GNU/Linux
• Kali Linux
• Short-term: Fedora
• And many more are on the way

The most logical thing is to write for Debian and its son, Ubuntu. In any case, if we want to know which we have available we introduce:

wslconfig /l

If Ubuntu is listed, without further delay:

wslconfig /setdefault Ubuntu

Or the one you need or want, changing the last word for one of the ones that appears in the list. We are already halfway towards achieving our BASHware test!

Configuring the default user

The goal here will be to guarantee the necessary privilege, another setback for the reason of the statements of the personnel of the software of the popular window; we execute it in a sale of Windows 10® commands:

• Ubuntu: «ubuntu config –default-user root»
• openSUSE Leap 42: «opensuse-42 –default-user root»
• SUSE Linux Enterprise Server 12: «sles-12 –default-user root»

Needless to say that since we are here we will be able to create our users for different tasks, that is, each user will leave different registers according to the BASHware assigned to execute. With the famous command to add users:

sudo adduser new_user_name

The icing on the cake: syslog, the event logger, although preinstalled, is not enabled by default in WSL. That problem is still open on the Github page at the time of writing and that is out of our reach and it’s a good thing we always keep it in mind.

Installing Wine

We quickly explained that Wine is software that, installed on GNU/Linux, allows certain Windows® applications to run. This is where the very remote possibility presents itself: to be able to run programs beyond the reach of antivirus programs or Windows® itself. Precisely, monitoring takes care of keeping track of these situations, although the line separating the tasks of security and monitoring is extremely thin. To illustrate this point we will say that, by way of example, data is one thing and information is another: the latter is obtained from the former by means of a process or algorithm (monitoring); this information is converted back into data when requested by the personnel in charge of security.

To install Wine, if we choose Debian or Ubuntu:

apt-get install wine

We may well install a graphical system for WSL and run Wine but we don’t want to go that far; in Wikipedia there are instructions on how to do it.

Final recommendations

While this article is written from the point of view of a possible vulnerability, we have also focused on the antivirus defenses and the control mechanisms of the OS itself against possible malBASHware. Also remember at all times that Pandora FMS is always and will be a useful tool due to its flexibility, which we can adapt to our work and the personalized alarms we have created. We can add your possible results to the Integria IMS incident management software, since it has the ability to take hardware inventory, as well as to record and categorize the requests of your users in your technical support center. Ten, a hundred or even thousands of computers: both programs are capable of satisfying the demands of your work!

Microsoft SQL Server ® on Linux GNU is here to stay. Get ready

Introduction

On December 28, 2016 – feast of the Holy Innocents, that special day when Spanish speakers make jokes throughout the day – it was announced the acquisition of a “Platinum” type membership by the company Microsoft ® in the Linux Foundation and the launch of Microsoft SQL Server ®. We took this news very seriously since for us, English-speaking people, we have April Fools’ Day on April 1st, that special day when we joke around. And if we had any doubts, it was officially published in the blog of the Microsoft ® technical team, which included a funny figure which showed a “Microsoft Linux” (sic) sign along with a penguin.

We have been using computers since 1989 with the famous MS-DOS® (Mr. Linus Torvalds wasn’t even studying at university at that point) we are still trying to conceive the idea that Microsoft SQL Server ® can be run on Linux. But nowadays, this is an unavoidable reality and those days of antagonism with former CEO Steve Ballmer are long gone. He left office in 2014 and his successor Mr. Satya Nadella led the company and he developed one of the largest computer infrastructures on the cloud computing network with the product “Microsoft Azure®” (formerly known as “Windows Azure®”).

This “Windows Azure®” product stands out because of its software development kit or “SDK” which is published as open-source (which is different from the free software license in Linux). To this day, artificial intelligence is already being developed in “Microsoft Azure®”, which is now known as “machine learning”.

This brief introduction leads us to our article today: Microsoft SQL Server ® on Linux GNU.

Microsoft SQL Server ® on Microsoft Windows®

Okay, we don’t want to fool you and yes, we are going to talk about GNU/Linux but first we need to know the framework of that popular database engine. Microsoft SQL Server ® was born in 1989 to be run on … IBM OS/2, yes, I am not joking. At that time, it was the “Ashton-Tate” company with its flagship product dBase that caused large volumes of data to flow through the local area network because each customer took a copy of the database to each computer where it was running. That’s why Microsoft bought the SQL Server ® license from Sybase which worked with the client/server model through simple commands and returned limited amounts of data (almost all the work is done separately and remotely on the server). Ashton-Tate provided its customer market and dBase worked as an interface for the user, while Microsoft and Sybase handled the work on the server side.

After some time (in 1994) the version 6 of SQL Server ® appeared, which was also run on the recent Windows NT® and that version was no longer made by Sybase. From version 7.0 onwards, it was massively rewritten in C ++ language and as of 2000, when it was time for OS/2 to be discontinued, SQL Server ® remained only for the Windows NT ® operating system. Then in 2001 its successor Windows XP® inherits the Windows NT® technology – by the way, “NT” means “New Technology” – and it was able to reach common users and their small and medium enterprises: the efficient management of relational data was no longer for exclusive use for large corporations.

In 2005, a dilemma emerged: the rise of 64-bit and multi-core processors, as well as a large amount of RAM for which Microsoft SQL Server ® was not prepared to take full advantage of all this potential. In reaction to this, it is decided to make a platform layer to contain “SQLOS layer”. A SQLOS is a “highly configurable user-level operating system with a powerful application-programming interface.” (You can have a look at the official and detailed explanation here) We will soon see why it was a very good choice, since it completely separates programming from the workloads and threads on a computer, on which Microsoft® SQL Server ® is installed.

Microsoft SQL Server ® on Linux GNU

In the world of web servers, GNU/Linux distributions have been the leading ones for many years. Debian has the Ubuntu Server, used by many companies of different sizes, to publish their sites on the Internet. But for the databases there are quite a few programmers who have chosen Microsoft SQL Server ® and because of this, companies must acquire a Microsoft Windows® operating system, this way creating additional work in the management of the local area network due to a mixed environment.

This concern gradually surfaced among Microsoft® customers and so they told the Redmond-based company (in Washington, USA) which put them on the spot because they did not know how to carry the millions of lines of code, accumulated during all these years, to the environment of the operating system of the penguin. The answer to this problem was found in a project dating back to 2011 called Drawbridge®, which was originally intended for virtualization of applications in a secure environment (called “sandbox”).

It was then necessary to “isolate” Microsoft SQL Server ®. Programmers coded in a carefree way as they worked in a well-known environment, which dealt with the various existing hardware. Once the Drawbridge processes were well understood and adapted, the following parameters were established:

• Quality and security must meet the same high bar we set for SQL Server ® on Windows
  Provide the same value, both in terms of functionality, performance, and scale
• Application compatibility between SQL Server ® on Windows and Linux
• Enable a continued fast pace of innovation in the SQL Server ® code base and make sure new features and fixes appear immediately across platforms
• Put in place a foundation for future SQL Server suite services (such as Integration Services) to come to Linux

To make SQL Server ® support multiple platforms, the engineering task is essentially to remove or abstract away its dependencies on Microsoft Windows®, as we can see, it wasn’t easy for the developers, who were being pushed out of their comfort zone!

This is how they created “SQL Platform Abstraction Layer” (SQL PAL) that merges the concepts of “SQLOS layer” and Drawbridge®. From now on the development team can work with a single base code and they do not need to worry about where the code will run (this includes the new Microsoft Azure® platform we talked about earlier). As we can see, so far, everything has come to fruition and the projects and resources of the computer giant, which seemed scattered, are now part of a whole.

Installing Microsoft SQL Server ®

As St Thomas once said: “Seeing is believing” that is why we took a virtual machine with 4 gigabytes of RAM (the minimum requirement is 3.25 gigabytes). Then, we downloaded Ubuntu Server 16.04 through Torrent technology and after installing it and doing the required security updates (just because it is a test server, we shouldn’t loose our good work habits!) and then we decided to install Microsoft® SQL Server ® on this “clean” machine. (Jimmy Olano, writer of this article, has made a 23 minutes recording with the complete installation process, you can watch it on YouTube by clicking on this link)

Essentially the instructions are to import the Microsoft® enabled security keys of its website so that we can certify that the content downloaded from that company has not been altered. Then we will add the link of the location of the repository in our file made for this, and then we need to update the list of components and give the order to download and install the packages. In fact, in the Microsoft® blog, where the instructions are published, it talks about the use of the “-y” parameter in order to accept the license immediately. We recommend installing without this option, so that we are always aware that we are using exclusive software and that we must stick to the license shown in the following figure of our authorship (Creative Commons Attribution-Share Alike 4.0 International):

Installing SQL Server ® command-line tools

Once we have installed our SQL Server ®, we must configure the “firewall” and establish the access policies to the computer which should be ready to start receiving data through other computers. But if we want to work directly on the console of our machine we must install the command-line tools with the command «sudo apt-get install mssql-tools unixodbc-dev» which, as expected, also contains questions for the acceptance – or denial – of accepting the conditions of use.
In our case, in that video we mentioned earlier, apart from installing the “command-line tools” we had the opportunity to create a database, as well as to create a table, and to introduce a few values ​​and to make a simple conditional query. But, we will not forget about this tool, which can offer a lot more.

Monitoring SQL Server ®

As a monitoring tool, the Microsoft® SQLCAT12 development team concluded that three tools are needed to monitor:

• collectd.
• InfluxDB.
• Grafana.

We will focus on collectd and we will talk briefly about InfluxDB and Grafana.

“collectd”

This open source software is written in C language and is a daemon or service which we will install and run on the server where Microsoft® SQL Server ® is hosted. It is very popular in routers that use OpenWrt, which is a well-known Linux distribution specially designed for these devices, which also has more than 100 plugins, which makes it easier to configure popular Linux applications such as Apache and MySQL (When writing this article, we reviewed that list and we did not find a specific one for Microsoft® SQL Server ®, given the novelty of the arrival of this software in the GNU world.
In order to deliver the “collectd” data, you can either write them in RDD file format (“RDDfile”) so that they can then be plotted with RDDtool or they can be collected using a plugin.
Currently Pandora FMS does not have a plugin for collectd but it has no problem connecting via SNMP.

To install collectd we must have Git and Docker Engine installed and then create an account in Microsoft® SQL Server ® using the following instructions:

USE master;
GO
CREATE LOGIN [collectd] WITH PASSWORD = N'mystrongpassword';
GO
GRANT VIEW SERVER STATE TO [collectd];
GO
GRANT VIEW ANY DEFINITION TO [collectd];
GO

The latter is very important in order for collectd to have proper access to our database server. Microsoft® invites you to clone your repository in GiHub, where you can find some very detailed instructions and we can contribute with any observation, correction or we can collaborate with an improvement if we request a pull request.

“InfluxDB”

It is responsible for communicating with collectd and then it saves and organises the data collected.

“Grafana”

Software that produces stunning graphics and drawings that represent the data collected by InfluxDB. It is strongly recommended that both InfluxDB and Grafana be installed on another computer different from the one running Microsoft® SQL Server ® or even each one on their own machine if the amount of systems to be monitored is large enough.

Conclusions

Microsoft® made sure to make a good deal with its application SQL Server ®: the code will not be able to run away towards Linux and it avoids compromising its reliability. It also has a base code ready to be improved upon the arrival of new hardware or to cover other operating systems.

All trademarks named herein are accompanied by the “®” symbol and are owned by Microsoft® Corporation and comply with the proper use of such trademarks.

About Pandora FMS

Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.