During the setup of my virtual server instances I require some applications to be built using make. Are there any security risks associated with having make installed? Or should I clean it up before the instance is deployed?
I also have the gcc compiler on the server which I use to build applications before deployment.
Some people will argue that the presence of development tools on a production machine will make life easier for an attacker. This however is such a tiny roadbump to an attacker, that any other argument you can find for or against installing the development tools will weigh more.
If an attacker was able to penetrate the system so far, that they could invoke whatever tools are present on the server, then you already have a serious security breach. Without development tools there are many other ways to write binary data to a file and then run a chmod on that file. An attacker wanting to use a custom build executable on the system at this point could just as well build that on their own machine and transfer it to the server.
There are other much more relevant things to look out for. If an installed piece of software contains a security bug, there is a few ways it could be exposed to an attacker:
I would not expect development tools to match one of the above, and as such is not a high risk package.
If you have workflows in which you would make use of the development tools, then you first have to decide whether those are reasonable workflows, and if they are, you should install the development tools.
If you find that you don't really need those tools on the server, you should refrain from installing them for multiple reasons:
If you decide that for security reasons, you won't allow unprivileged users to put their own executabels on the server, then what you should avoid is not the development tools but rather directories writable to those users on file systems mounted with execute permissions. There may still be a use for development tools even under those circumstances, but it is not very likely.
make is a shell that has a different syntax than bash.
A compiler like gcc is a powerful awk configured with a set of substitutions that standard awk does not support. It is a non-POSIX-compliant sort or cat that injects rubbish in the output. It is an interactive text editor (think vi) which is configured to do some editing on startup, then exit before displaying the user interface.
There is nothing inherently insecure in them, they do not make your machine more insecure than one where you have bash + cat + shell redirection.
make itself is fine. make is merely a dependency tracking and automation framework. It is typically used in conjunction with compilers, though, and those preferrably should not be available on a production system, as they're completely un-necessary. The same holds true for all un-needed packages, whether those be shared libraries, interpreters, etc. Software installed on production systems should be strictly controlled, and only those packages that are required by the application should be present.
You should be building your application on a build server, packaging it, and then deploying the binary package to your production systems.
Note: native packaging tools suck. Don't even bother trying to grok them. Instead, check out Jordan Sissel's fpm. It makes packaging an absolute joy.
On the contrary, the potential issue isn't with having make on the production server, the potential issue is with building the applications on the production server instead of deploying tested pre-built images. There may be valid reasons for this methodology, but it's one I would argue against strenuously were I asked to adopt it.
You’re asking if make should be installed on a production server, but my real question would be: Who has access to that production server & what safeguards do you have in place to deal with an incursion? If make was not installed but someone gain root access, guess what? They can manually install make and anything they want.
The harsh reality about computer security is as much as you want to prevent unwanted access, being obsessed with blocking access is not as important as:
This is all dependent on what kind of work you do. I work primarily in the web server world & my attitude is basically, anyone getting production server access from me needs to prove skills, knowledge & maturity. That’s it. Sometimes it takes a few days. Sometimes it takes months. But basically, your best line of security on production servers is controlling access on top of the sundry other things we do to harden servers.
make itself is harmless. All it does is run applications in a set order, depending on dependencies you specify and what files already exist in the system. It can even be useful as part of the install process: you can use it to put prebuilt files where they need to go, or run unit tests, or other things.
However, you do need to consider what exactly you want to use it for. It is often used in conjunction with compilers and other tools for building applications, and those could be used to negate some of your lines of defense. But make can't do these things if the tools aren't available.
