Enhancing Software Resilience and Achieving CIS Level 1 Standards

Apart from regular Ubuntu, Sandbox can also run on CIS level 1 hardened Ubuntu.

To harden the operating system first, please use the guide from here: https://www.open-scap.org/security-policies/scap-security-guide/

The upcoming guide will be divided into two different sections:

1. Steps to make the installer antivirus-compliant

2. Fixing post-installation issues, related to the hardened OS

Steps to make the installer antivirus-compliant

In this section, we will unpack the installer and run a script to modify potentially falsely detected files and malware rules.

1. Download the latest release from the OPSWAT Portal

2. If you have internet connection: run the following command: pip3 install plyara

3. Do the first step described on the following link: installation/offline-installation (unpack the zip)

4. Using the same command as previously, but now unpack the sandbox.zip file as well (It's in the sandbox-installer directory that you just unzipped)

5. Now you have a directory inside, called sandbox. Grab the Python script harden-yara.py which you can find below. Copy it next to the sandbox directory.

6. Execute the python script using the following command: python3 harden_yara.py sandbox/transform/yara/rules

7. Execute the python script using the following command: python3 harden_yara.py sandbox/webservice/src/storage/resources/yara_rules

8. Execute the python script using the following command: python3 harden_yara.py sandbox/transform/parser/mwconfig-extractors

9. Now re-zip the sandbox directory and you're done. Example Linux command: 7z a -r sandbox.zip sandbox

10. Now you can proceed on installing Sandbox either in an online or offline manner

harden-yara.py (first)

Copy

›

›

›

import os

import argparse

import plyara

from plyara.utils import rebuild_yara_rule

def string_to_hex_array(s, encoding='ascii'):…

def process_yara_ruleset(yara_ruleset, strip_comments=True):…

harden-yara.py (second)

Copy

›

›

›

›

import re

import os

import argparse

def string_to_hex_array(s):…

def remove_comments_multiline(yara_rule):…

def process_yara_rule(yara_rule, strip_comments=True):…

After-installation troubleshooting

In some rare cases, you can bump into the following issues after installing Sandbox on a hardened operating system:

Caused by: java.io.IOException: Error initiating config file: can not write to /app/broker.cfg

Caused by: java.io.IOException: Error initiating config file: can not write to /app/transform.cfg

nginx: [emerg] cannot load certificate "/etc/ssl/certs/nginx-selfsigned.crt": BIOnewfile() failed (SSL: error:80000002:systemlibrary::No such file or directory:calling fopen(/etc/ssl/certs/nginx-selfsigned.crt, r) error:10000080:BIO routines::no such file)

If you encounter any of those, you should apply the fix below.

1. Copy the hardened-install-fix.sh script below on your sandbox installation path. By default, it is /home/sandbox/sandbox

2. Stop Sandbox services using sudo service sandbox stop

3. Make the script executable by executing sudo chmod +x hardened-install-fix.sh

4. Execute the script by using either sudo ./hardened-install-fix.sh or sudo ./hardened-install-fix.sh --offline depending, whether the initial install you made was using the offline flag or not.

5. Start Sandbox services by executing sudo service sandbox start

hardened-install-fix.sh

Copy

›

›

›

›

#!/bin/bash

DIR="$(dirname "$(realpath "${0}")")"

OFFLINE_INSTALL=false

if [ "$(id -u)" -ne 0 ]; then…

fi

while [ "$#" -gt 0 ]; do…

done

commandOutput() {…