How to remediate – Network UPS Tools Service STARTTLS Command Support

1. Introduction

2. Technical Explanation

• Root cause: Lack of mandatory client authentication following the STARTTLS handshake.
• Exploit mechanism: An attacker establishes an encrypted connection via STARTTLS and then intercepts or modifies communications.
• Scope: Network UPS Tools service versions that support the STARTTLS command, regardless of platform.

3. Detection and Assessment

• Quick checks: Check the Network UPS Tools documentation for STARTTLS support.
• Scanning: Nessus vulnerability ID 5a501865 may detect this issue as an informational finding.
• Logs and evidence: Examine client configuration files (usually in /etc/networkupstools/) for settings related to SSL/TLS, specifically ‘CERTVERIFY’ and ‘FORCESSL’.

# Example command placeholder:
grep -r "STARTTLS" /etc/networkupstools/

4. Solution / Remediation Steps

4.1 Preparation

• Ensure you have a clear understanding of which clients need access to the UPS data and can configure them accordingly. Roll back involves restoring the original configuration files.
• A change window is recommended for production systems. Approval from the IT security team may be needed.

4.2 Implementation

1. Step 1: Edit the client configuration file (usually in /etc/networkupstools/).
2. Step 2: Add or modify the ‘CERTVERIFY’ option to enable certificate verification.
3. Step 3: Add or modify the ‘FORCESSL’ option to require SSL/TLS for all connections.
4. Step 4: Restart the Network UPS Tools service if necessary.

4.3 Config or Code Example

Before

# /etc/networkupstools/upsmon.conf
server myups
port 3493

After

# /etc/networkupstools/upsmon.conf
server myups
port 3493
certverify = yes
forcssl = yes

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue. Least privilege limits the impact of a compromised client. Input validation prevents malicious data from being sent over the network. Safe defaults ensure that secure configurations are used by default. A regular patch cadence keeps your systems up-to-date with the latest security fixes.

• Practice 1: Implement least privilege to restrict access to sensitive UPS data and control functions.
• Practice 2: Use input validation on any client applications that communicate with the UPS service.

4.5 Automation (Optional)

If you manage your Network UPS Tools configurations using a configuration management tool, you can automate these changes.

# Example Ansible snippet:
- name: Configure upsmon.conf for SSL/TLS
  lineinfile:
    path: /etc/networkupstools/upsmon.conf
    regexp: '^certverify'
    line: 'certverify = yes'
  become: true
- name: Configure upsmon.conf for FORCESSL
  lineinfile:
    path: /etc/networkupstools/upsmon.conf
    regexp: '^forcssl'
    line: 'forcssl = yes'
  become: true

5. Verification / Validation

Confirm the fix by checking the configuration files again and verifying that ‘CERTVERIFY’ and ‘FORCESSL’ are enabled. Re-run the earlier detection method to ensure it no longer reports the issue. Perform a basic service smoke test to confirm functionality remains intact.

• Post-fix check: `grep -r “certverify = yes” /etc/networkupstools/` and `grep -r “forcssl = yes” /etc/networkupstools/`. Both commands should return a match.
• Re-test: Re-run the initial configuration file scan to confirm that ‘CERTVERIFY’ and ‘FORCESSL’ are now set.
• Smoke test: Verify you can still retrieve UPS status information using the `upsmon` command or your monitoring software.
• Monitoring: Monitor logs for SSL/TLS connection errors, which could indicate a misconfiguration.

# Post-fix command and expected output:
grep -r "certverify = yes" /etc/networkupstools/
/etc/networkupstools/upsmon.conf:certverify = yes

6. Preventive Measures and Monitoring

• Baselines: Update security baselines or policies to require ‘CERTVERIFY’ and ‘FORCESSL’.
• Pipelines: Add checks in CI/CD pipelines to validate configuration files for these settings.
• Asset and patch process: Review configurations during regular patch cycles.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Compatibility issues with older clients. Mitigation: Update clients to support SSL/TLS.
• Roll back: Restore the original Network UPS Tools configuration files from your backup.

8. References and Resources

• Vendor advisory or bulletin