Securing WSL - How to have basic security for WSL?

[ghost]

I typed in Google "How to secure WSL" (without quote marks) and found no "general-audience-friendly" article that gives some tips about basic security setups for WSL.

I personally want to use WSL to manage my SSH connections, and consider using WSL-OpenSSH instead of Puttygen-Pageant-Putty.

I wondered how should I secure a basic WSL installment (basically just WSL and OpenSSH and some totally-local utilites like Tree or Zip --- No Webserver, no databases).

I encourage people to create a short, accessible article on this in a blog... Would gladly read it.

[fpqc]

Right now it is insecure by design due to interop. All users are "really" root users.

[aseering]

@fpqc -- well, what's your threat model? All users may be root users, but root is not a Windows Administrator.

[fpqc]

@aseering True, but my threat model is a Linux instance acting as a persistent server as Benosika seems to be indicating.

Edit: Oh, misread. He wants to do the opposite of that.

@Benosika You should be good as long as you aren't running servers. I leave tmux up 24/7 and don't install crap from scripts. It's firewalled by Windows, so should be safe anyhow I think.

[ghost]

Would you agree that OpenSSh server isn't included in the servers you meant to?

[dmex]

@fpqc

"It's firewalled by Windows, so should be safe anyhow I think."

Pico processes are unaffected by firewall rules and are able to send and receive data from the network even when blocked by firewall software (due to the lack of ImageName for pico processes #1031).

[ionescu007]

@dmex That's actually not correct. Pico processes are affected by firewall rules, and additionally in Creators Update, the name query API returns the name for WSL processes.

[cartel0x27]

@ionescu007 reference for this? how do you create windows firewall rules for pico processes?

[ghost]

What about securing an OpenSSH server? I need one on WSL to transfer files easy and fast from my VPS --- To the local session (WSL). Any tips?

[aseering]

@Benosika -- can you use the ssh server built into your VPS?

[ghost]

Yes.

[ghost]

I do wonder what a WSL user that has an OpenSSH-server and uses only a password (without key pairs) could do to reduce the chance for Burte force attack, if it can't install firewalls (something which as of the moment, generally isn't possible in WSL). @aseering

[aseering]

As discussed on another ticket, I wonder if DenyHosts works?

[ghost]

sudo apt-get install denyhosts -y doesn't work in WSL, it outputs "Unable to locate package". Yet, in a native Ubuntu it does being installed fine.

If I install it in WSL, I would prefer to install it only from the repo. Given that Fail2ban on the other hand, is being installed without errors, I might configure it this way instead:

/etc/fail2ban/jail.conf

• Set desired ban time under bantime.
• Set maximum failed attempts under maxretry.

Edit /etc/fail2ban/fail2ban.conf

• Set the time Fail2ban "forgets" restrictions under dbpurge.

---

Your opinion on this will be most helpful!

[dmex]

@Benosika

What about securing an OpenSSH server?

Windows automatically installs an SSH server when you enable the Developer mode option in the Win10 Settings app. Have you tried connecting to the machine and running bash.exe?

could do to reduce the chance for Burte force attack

The SSH server uses local Windows accounts and generates logon/logoff audits and other events in the Event log. The main problem with the default SSH server on Win10 (security wise) seems to be that each connection to the ssh server creates a new process and it doesn't limit the number of connections.

[ghost]

@dmex , right after I've enabled the developer tools I installed WSL and there I had an existing OpenSSH server. Does it say that I now have 2 OpenSSH servers on my Windows10? One of Windows itself and one of WSL?

[aseering]

@Benosika -- denyhosts is in Ubuntu's "universe" repository; you'll have to make sure that it is enabled in /etc/apt/sources.list.

[aseering]

fail2ban might work too, though. I'd say give it a try. That configuration looks right to me, though I haven't configured fail2ban recently so I'm not an expert.

Also, don't forget to start it manually -- just like ssh itself, denyhosts or fail2ban won't be started automatically by Windows.

[benhillis]

Thanks for the discussion.