felixfoertsch/syncthing
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

Create syncthing-security(7)

Browse Source
This commit is contained in:
Stefan Tatschner
2015-05-29 16:45:03 +02:00
parent dada1daded
commit 0e884a9b65
1 changed files with 84 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files
users/security.rst
+84 -94
View File
@@ -1,126 +1,116 @@
###################
Security Principles Security Principles
###################
Security is one of the primary project goals. This means that it should
not be possible for an attacker to join a cluster uninvited, and it
should not be possible to extract private information from intercepted
traffic. Currently this is implemented as follows.
All traffic is protected by TLS. To prevent uninvited nodes from joining
a cluster, the certificate fingerprint of each node is compared to a
preset list of acceptable nodes at connection establishment. The
fingerprint is computed as the SHA-256 hash of the certificate and
displayed in BASE32 encoding to form a reasonably compact and convenient
string.
Incoming requests for file data are verified to the extent that the
requested file name must exist in the local index and the global model.
For information about ensuring you are running the code you think you
are and for reporting security vulnerabilities, please see the official
`security page <http://syncthing.net/security.html>`__.
Information Leakage
=================== ===================
Security is one of the primary project goals. This means that it should not be
possible for an attacker to join a cluster uninvited, and it should not be
possible to extract private information from intercepted traffic. Currently this
is implemented as follows.
All traffic is protected by TLS. To prevent uninvited nodes from joining a
cluster, the certificate fingerprint of each node is compared to a preset list
of acceptable nodes at connection establishment. The fingerprint is computed as
the SHA-256 hash of the certificate and displayed in BASE32 encoding to form a
reasonably compact and convenient string.
Incoming requests for file data are verified to the extent that the requested
file name must exist in the local index and the global model.
For information about ensuring you are running the code you think you are and
for reporting security vulnerabilities, please see the official `security page
<http://syncthing.net/security.html>`__.
Information Leakage
-------------------
Global Discovery Global Discovery
---------------- ~~~~~~~~~~~~~~~~
When global discovery is enabled, Syncthing sends an announcement packet When global discovery is enabled, Syncthing sends an announcement packet every
every 30 minutes to the global discovery server, so that it can keep a 30 minutes to the global discovery server, so that it can keep a mapping between
mapping between your device ID and external IP. Also, when connecting to your device ID and external IP. Also, when connecting to other devices that have
other devices that have not been seen on the local network, a query is not been seen on the local network, a query is sent to the global discovery
sent to the global discovery server containing the device ID of the server containing the device ID of the requested device. The discovery server is
requested device. The discovery server is currently **hosted by currently **hosted by @calmh**. Global discovery defaults to **on**.
@calmh**. Global discovery defaults to **on**.
When turned off, devices with dynamic addresses not on the local network When turned off, devices with dynamic addresses not on the local network cannot
cannot be found and connected to. be found and connected to.
If a different global discovery server is configured, no data is sent to If a different global discovery server is configured, no data is sent to the
the default global discovery server. default global discovery server.
Local Discovery Local Discovery
--------------- ~~~~~~~~~~~~~~~
When local discovery is enabled, Syncthing sends broadcast (IPv4) and When local discovery is enabled, Syncthing sends broadcast (IPv4) and multicast
multicast (IPv6) packets to the local network every 30 seconds. The (IPv6) packets to the local network every 30 seconds. The packets contain the
packets contain the device ID and listening port. Local discovery device ID and listening port. Local discovery defaults to **on**.
defaults to **on**.
An eavesdropper on the local network can deduce which machines are An eavesdropper on the local network can deduce which machines are running
running Syncthing with local discovery enabled, and what their device Syncthing with local discovery enabled, and what their device IDs are.
IDs are.
When turned off, devices with dynamic addresses on the local network When turned off, devices with dynamic addresses on the local network cannot be
cannot be found and connected to. found and connected to.
Upgrade Checks Upgrade Checks
-------------- ~~~~~~~~~~~~~~
When automatic upgrades are enabled, Syncthing checks for a new version When automatic upgrades are enabled, Syncthing checks for a new version at
at startup and then once every twelve hours. This is by an HTTPS request startup and then once every twelve hours. This is by an HTTPS request to the
to the download site for releases, currently **hosted at GitHub**. download site for releases, currently **hosted at GitHub**. Automatic upgrades
Automatic upgrades default to **on** (unless Syncthing was compiled with default to **on** (unless Syncthing was compiled with upgrades disabled).
upgrades disabled).
Even when automatic upgrades are disabled in the configuration, an Even when automatic upgrades are disabled in the configuration, an upgrade check
upgrade check as above is done when the GUI is loaded, in order to show as above is done when the GUI is loaded, in order to show the "Upgrade to ..."
the "Upgrade to ..." button when necessary. This can be disabled only by button when necessary. This can be disabled only by compiling syncthing with
compiling syncthing with upgrades disabled. upgrades disabled.
In effect this exposes the majority of the Syncthing population to In effect this exposes the majority of the Syncthing population to tracking by
tracking by the operator of the download site (currently GitHub). That the operator of the download site (currently GitHub). That data is not available
data is not available to outside parties (including @calmh etc), except to outside parties (including @calmh etc), except that download counts per
that download counts per release binary are available in the GitHub API. release binary are available in the GitHub API. The upgrade check (or download)
The upgrade check (or download) requests *do not* contain any requests *do not* contain any identifiable information about the user, device,
identifiable information about the user, device, Syncthing version, etc. Syncthing version, etc.
Usage Reporting Usage Reporting
--------------- ~~~~~~~~~~~~~~~
When usage reporting is enabled, Syncthing reports usage data at startup When usage reporting is enabled, Syncthing reports usage data at startup and
and then every 24 hours. The report is sent as an HTTPS POST to the then every 24 hours. The report is sent as an HTTPS POST to the usage reporting
usage reporting server, currently **hosted by @calmh**. The contents of server, currently **hosted by @calmh**. The contents of the usage report can be
the usage report can be seen behind the "Preview" link in settings. seen behind the "Preview" link in settings. Usage reporting defaults to **off**
Usage reporting defaults to **off** but the GUI will ask once about but the GUI will ask once about enabling it, shortly after the first install.
enabling it, shortly after the first install.
The reported data is protected from eavesdroppers, but the connection to The reported data is protected from eavesdroppers, but the connection to the
the usage reporting server itself may expose the client as running usage reporting server itself may expose the client as running Syncthing.
Syncthing.
Sync Connections (BEP) Sync Connections (BEP)
---------------------- ~~~~~~~~~~~~~~~~~~~~~~
Sync connections are attempted to all configured devices, when the Sync connections are attempted to all configured devices, when the address is
address is possible to resolve. The sync connection is based on TLS 1.2. possible to resolve. The sync connection is based on TLS 1.2. The TLS
The TLS certificates are sent in clear text (as in HTTPS etc), meaning certificates are sent in clear text (as in HTTPS etc), meaning that the
that the certificate Common Name (by default ``syncthing``) is visible. certificate Common Name (by default ``syncthing``) is visible.
An eavesdropper can deduce that this is a Syncthing connection and An eavesdropper can deduce that this is a Syncthing connection and calculate the
calculate the device ID:s involved based on the hashes of the sent device ID:s involved based on the hashes of the sent certificates.
certificates.
Likewise, if the sync port (default 22000) is accessible from the Likewise, if the sync port (default 22000) is accessible from the internet, a
internet, a port scanner may discover it, attempt a TLS negotiation and port scanner may discover it, attempt a TLS negotiation and thus obtain the
thus obtain the device certificate. This provides the same information device certificate. This provides the same information as in the eavesdropper
as in the eavesdropper case. case.
Web GUI Web GUI
------- ~~~~~~~
If the web GUI is accessible, it exposes the device as running If the web GUI is accessible, it exposes the device as running Syncthing. The
Syncthing. The web GUI defaults to being reachable from the **local host web GUI defaults to being reachable from the **local host only**.
only**.
In Short In Short
======== --------
Parties doing surveillance on your network (whether that be corporate Parties doing surveillance on your network (whether that be corporate IT, the
IT, the NSA or someone else) will be able to see that you use Syncthing, NSA or someone else) will be able to see that you use Syncthing, and your device
and your device ID's `are OK to share ID's `are OK to share anyway
anyway <http://docs.syncthing.net/users/faq.html#should-i-keep-my-device-ids-secret>`__, <http://docs.syncthing.net/users/faq.html#should-i-keep-my-device-ids-secret>`__,
but the actual transmitted data is protected as well as we can. Knowing but the actual transmitted data is protected as well as we can. Knowing your
your device ID can expose your IP address, using global discovery. device ID can expose your IP address, using global discovery.