Abstract:In recent years, misconfigurations have become one of the major causes of software system failures, resulting in numerous service outages. What is worse, misconfigurations are also costly to diagnose and troubleshoot. This remains a great challenge for sysadmins (system administrators) to detect, diagnose, or troubleshoot these misconfigurations. Unlike software bugs, misconfigurations are more vulnerable to sysadmins mistakes. Developers and researchers are attempting to improve system reactions to misconfigurations to ease the burden of sysadmins' diagnoses. Such efforts would greatly benefit from the techniques that can comprehensively detect bad system reactions through injected misconfigurations. Unfortunately, few such studies have achieved the above goal in the past, primarily because they only relied on generic alterations and failed to find a way to systematically generate misconfigurations. In this paper, we study eight mature open-source and commercial software packages and summarize a fine-grained classification of option types. Based on this classification, we use Augmented Backus-Naur Form to summarize and extract syntactic and semantic constraints of each type. In order to generate comprehensive misconfigurations in the test systems, we propose misconfiguration generation methods for our constraints. We implement a tool named Configuration Vulnerability Detector (ConfVD) to conduct misconfiguration injection and further analyze the systems' reaction abilities to various misconfigurations. We carried out comprehensive analyses upon Apache Httpd, MySQL, PostgreSQL, and Yum. The results of our analysis show that our option classification covers 96% of 1582 options from the above-mentioned systems. Our constraints are more fine grained than previous works and their accuracy was found to be 91% (ascertained by manual verification). Our technique could improve generic alteration approaches without constraints, and we found that ConfVD could find nearly three times the bad reactions that were found by ConfErr. In total, we found 65 bad reactions from the systems being tested and our fine-grained constraints contributed 27.7% more bad reactions than techniques only using coarse-grained constraints.

STAD: Stack Trace Based Automatic Software Misconfiguration Diagnosis Via Value Dependency Graph

Automated diagnosis of software misconfigurations based on static analysis

Practical and accurate pinpointing of configuration errors using static analysis

Software Misconfiguration Troubleshooting Based on State Analysis

Automated Configuration Bug Report Prediction Using Text Mining.

ConfVD: System Reactions Analysis and Evaluation Through Misconfiguration Injection

MisconfDoctor: Diagnosing Misconfiguration via Log-Based Configuration Testing

Rethinking Software Misconfigurations in the Real World: An Empirical Study and Literature Analysis

Multi-misconfiguration Diagnosis via Identifying Correlated Configuration Parameters

ConfMapper: Automated Variable Finding for Configuration Items in Source Code.

ConfTainter: Static Taint Analysis for Configuration Options

Automated Reasoning and Detection of Specious Configuration in Large Systems with Symbolic Execution

Configfile Plus Plus : Automatic Comment Enhancement For Misconfiguration Prevention

Automatic Type Inference for Proactive Misconfiguration Prevention.

Real-Time Diagnosis of Configuration Errors for Software of AI Server Infrastructure

Configuration Error Localization Based on Delta Debugging

Automated Runtime Mitigation for Misconfiguration Vulnerabilities in Industrial Control Systems.

An Evolutionary Study of Configuration Design and Implementation in Cloud Systems

Inter-Procedural Diagnosis Path Generation for Automatic Confirmation of Program Suspected Faults

Static program analysis assisted dynamic taint tracking for software vulnerability discovery

A Novel Method to Prevent Misconfigurations of Industrial Automation and Control Systems