1. CIT 470: Advanced Network and System AdministrationSlide #1 CIT 470: Advanced Network and System Administration Security

2. CIT 470: Advanced Network and System AdministrationSlide #2 Topics 1.Risk Management 2.Security Policies 3.OS Hardening 4.Authentication 5.PAM 6.Passwords 7.Incident Response

3. CIT 470: Advanced Network and System AdministrationSlide #3 Risk Management Risk is the relationship between your assets, the vulnerabilities characteristic to those assets, and attackers who wish to access or modify those assets.

4. CIT 470: Advanced Network and System AdministrationSlide #4 Assets 1.Login account. 2.Network bandwidth. 3.Disk space. 4.Data. 5.Reputation.

5. CIT 470: Advanced Network and System AdministrationSlide #5 Security Goals Data confidentiality Customer account data (credit cards, identity) Trade secrets Administrative data (passwords, configuration) Data integrity Administrative data Software downloads (patches, free tools) Web pages

6. CIT 470: Advanced Network and System AdministrationSlide #6 Security Goals System integrity System binaries Kernel System/network availability Network bandwidth Network services (auth, file, mail, print) Disk space

7. CIT 470: Advanced Network and System AdministrationSlide #7 Threats Financial motives Identity theft Phishing Spam Extortion Botnets Political motives Danish sites hacked after Mohammed cartoons. Personal motives Just for fun. Insider revenge.

8. CIT 470: Advanced Network and System AdministrationSlide #8 Vulnerabilities 1.Bad/default passwords. 2.Unused services with open ports. 3.Unpatched software vulnerabilities. 4.Transmitting confidential data in cleartext. 5.Open modems or wireless networks. 6.Physical access to critical systems. 7.Uneducated users.

9. CIT 470: Advanced Network and System AdministrationSlide #9 Attack Trees

10. CIT 470: Advanced Network and System AdministrationSlide #10 Defense Types Perimeter Security –Firewall off network to prevent intrusions. –What about wireless? –What about mobile computing? Defense in Depth –Secure systems at all levels: Network perimeter (firewall) Intrusion detection System hardening

11. CIT 470: Advanced Network and System AdministrationSlide #11 Defenses Vulnerability mitigation Use secure authentication systems. Deploy software in secure configuration. Patch security flaws quickly. Attack mitigation Firewalls to prevent network attacks. IDS to detect attacks. Virus/spyware scanners.

12. CIT 470: Advanced Network and System AdministrationSlide #12 Security Policies User Level Policies Users must sign before receiving resources. 1.Acceptable Use Policy 2.Monitoring and Privacy Policy 3.Remote Access Policy Business Level Policies 1.Network Connectivity Policy 2.Log Retention Policy

13. CIT 470: Advanced Network and System AdministrationSlide #13 OS Hardening 1.Secure the physical system. 2.Install only necessary software. 3.Keep security patches up to date. 4.Delete or disable unnecessary user accounts. 5.Use secure passwords. 6.Disable remote access except where necessary. 7.Use sudo instead of su. 8.Run publicly accessible services in a jail. 9.Check logs regularly. 10.Configure firewall on each host. 11.Run security scanner to check security. 12.Document security configuration.

14. CIT 470: Advanced Network and System AdministrationSlide #14 Secure the physical system 1.Place servers in a physically secure location. 2.Physically secure the case. 3.Place ID tags on all hardware. 4.Password protect the BIOS. 5.Disable booting from removable media.

15. CIT 470: Advanced Network and System AdministrationSlide #15 Install only Necessary Software Put different services on different hosts. A compromise in ftp shouldn’t compromise mail. Improves reliability and maintainability too. Common unnecessary packages X-Windows Software development (gcc, gdb, etc.)

16. CIT 470: Advanced Network and System AdministrationSlide #16 Security Patches Subscribe to vendor security patch list. Or know vendor’s update schedule. MS Windows updates on 2 nd Tuesday. Update test host first. yum update Patches can sometimes break services. Update other hosts after that. May need to schedule downtown if reboot required.

17. CIT 470: Advanced Network and System AdministrationSlide #17 Jails Complete isolation: virtual machines. Partial isolation: chroot chroot /var/httpd httpd chroot filesystem needs: /var/httpd/etc: limited /etc/{passwd,shadow,group} /var/httpd/usr/lib shared libraries /var/httpd/bin: extra binaries /var/httpd/var/log: log space /var/httpd/tmp: temporary space

18. CIT 470: Advanced Network and System AdministrationSlide #18 Check Logs Review logs every morning. Better yet, have a program scan them. logwatch swatch Send logs to a central server for security: attacker can’t hide tracks by deleting ease of use: you can read all logs in one place

19. CIT 470: Advanced Network and System AdministrationSlide #19 Security Scanning Scan host security Run bastille on host. Scan network security Scan for open ports with nmap. Scan for vulnerabilities with nessus.

20. CIT 470: Advanced Network and System AdministrationSlide #20 Intrusion Detection Host-based intrusion detection Check if system files are modified. Check for config / process modifications. Tools: tripwrite, osiris, samhain Network-based intrusion detection NIDS = Sniffer + traffic analysis + alert system. Check for suspicious activities: port scans, etc. Check for attack signatures: worms, etc. Tools: snort, air snort

21. CIT 470: Advanced Network and System AdministrationSlide #21 Security Auditing Internal and External Audits –Internal: by a group within organization. –External: by a group external to organization. Audit areas –Check compliance with security policy. –Check physical security of building, data center. –Check that machines have up to date patches. –Scan networks to verify hosts + services. –Penetration testing.

22. CIT 470: Advanced Network and System AdministrationSlide #22 Authentication Binding of an identity to a subject Based on: 1.What the entity knows (e.g., passwords) 2.What the entity has (e.g., access card) 3.What the entity is (e.g., fingerprints) 4.Where the entity is (e.g., local terminal) Two-factor authentication

23. CIT 470: Advanced Network and System AdministrationSlide #23 Purpose of Authentication Access Control –Most systems base access rights on identity of principal executing the process. Accountability –Logging and auditing functions. –Need to track identity across account/role changes (e.g., su, sudo ).

24. CIT 470: Advanced Network and System AdministrationSlide #24 Access Control Matrix GroupDevREFinResHROpsInfraSec DevelopersWRR Release EngineersRWR FinanceWR Human ResourcesRW OperationsRRW System AdministrationAAAAAAA SecurityAAAAAAAA Dev = developer, RE = release engineering, Fin = finance, Res = corporate resource (intranet), HR = human resources, Ops = operations, Inf = infrastructure (mail/auth servers, etc.), Sec=security (firewalls, IDS) A = administrative access, R = read, W = write

25. CIT 470: Advanced Network and System AdministrationSlide #25 Single-sign on Login once to access all computing resources UNIX Windows Web Applications Databases Remote access Difficult to achieve in practice. Kerberos (Active Directory)

26. CIT 470: Advanced Network and System AdministrationSlide #26 PAM Problem: Many programs require authentication. Ex: ftp, rlogin, ssh, etc. New auth schemes require rewrites. Ex: longer passwords, keys, one-time passwords Solution: Separate authentication from programs. Use Pluggable Authentication Modules for auth. Programs choose PAMs to use at runtime by reading config files.

27. CIT 470: Advanced Network and System AdministrationSlide #27 PAM Configuration Configured under /etc/pam.d Each PAM-aware service has a file there. Format: Module interface: one of 4 module types. Control flag: how module will react to failure or success (multiple successes may be required.) Module name: PAM shared library. Module args: Files to use, other options.

28. CIT 470: Advanced Network and System AdministrationSlide #28 Module Interfaces auth — Authenticates use of service. For example, it may request and verify a password. account — Verifies that access is permitted, e.g. check for expired accounts or location/time. password — Sets and verifies passwords. session — Configures and manages user sessions, e.g. mounting user home directories or mailboxes.

29. CIT 470: Advanced Network and System AdministrationSlide #29 Module Stacking Example rlogin PAM requirements The file /etc/nologin must not be present. Root may not login over network (securetty.) Environment variables may be loaded. ~/.rhosts entry allows login without password. Otherwise perform standard password login. PAM config file auth required pam_nologin.so auth required pam_securetty.so auth required pam_env.so auth sufficient pam_rhosts_auth.so auth required pam_stack.so service=system-auth

30. CIT 470: Advanced Network and System AdministrationSlide #30 Control Flags required — Module result must be successful for authentication to continue. User is not notified on failure until results on all modules referencing that interface are available. requisite — Module result must be successful for authentication to continue. User is notified immediately with a message reflecting the first failed required or requisite module. sufficient — Module result ignored if it fails. If a sufficient flagged module result is successful and no required flagged modules above it have failed, then no other results are required and the user is authenticated to the service. optional — Module result is ignored. Only necessary for successful authentication when no other modules reference the interface.

31. CIT 470: Advanced Network and System AdministrationSlide #31 PAM Files /etc/pam.d : PAM configuration files. /lib/libpam.so : Main PAM library. Reads configuration files. Loads other PAM modules. /lib/security : Pluggable modules. /usr/share/doc/*pam* : Documentation.

32. CIT 470: Advanced Network and System AdministrationSlide #32 Use Secure Passwords Attacks against Passwords Password sniffing Password guessing via login Password cracking Defences Do not transfer passwords over the network. Secure /etc/{passwd,shadow} Configure password quality/aging rules. Test your passwords by cracking them.

33. CIT 470: Advanced Network and System AdministrationSlide #33 Password Quality Use pam_cracklib.so in system-auth Options retry=#: Maximum # of retries. minlen=#: Minimum password length. lcredit=#: Min # of lower case letters. ucredit=#: Min # of upper case letters. dcredit=#: Min # of digits. ocredit=#: Min # of other chars.

34. CIT 470: Advanced Network and System AdministrationSlide #34 Password Aging Configure /etc/login.defs before creating accounts. PASS_MAX_DAYS: Max # of days before password expires. PASS_MIN_DAYS: Min # of days before user can change pw. PASS_WARN_AGE: # of days for pw change notice given. Also configure /etc/default/useradd INACTIVE: # of days after pw expiration that account is disabled. EXPIRE: Account expiration date in format YYYY-MM-DD. Remember old passwords with pam_unix.so Prevents users from changing password back to old value. Modify /etc/pam.d/system-auth Set pam_unix.so option remember=26 Create /etc/security/opasswd to store old passwords.

35. CIT 470: Advanced Network and System AdministrationSlide #35 One-Time Passwords A password that’s invalidated once used. Challenge: number of auth attempt Response: one-time password Problems –Generation of one-time passwords Use hash or crytographic function –Synchronization of the user and the system Number or timestamp passwords

36. CIT 470: Advanced Network and System AdministrationSlide #36 Biometrics Identify by physical chars –Fingerprint –Iris scan Unique identifiers. –Not secrets. –Can’t be changed at will. Possible outcomes: 1.Correct person accepted 2.Imposter rejected 3.Correct person rejected (False Rejection) 4.Imposter accepted (False Acceptance) A tradeoff always exists between false acceptances and false rejections.

37. CIT 470: Advanced Network and System AdministrationSlide #37 Disable Unnecessary Accounts /etc/passwd contains application accounts. Delete unnecessary application accounts. Common ex: uucp, games, gdm, xfs, rpcuser, rpc All should have locked passwords. Set shell to /bin/noshell or /bin/false. Disable user accounts immediately on termination of employment.

38. CIT 470: Advanced Network and System AdministrationSlide #38 Disabling Remote Access Disable cleartext protocols telnet, ftp, rsh, rlogin Disable root access via ssh. Set PermitRootLogin to “no” in sshd_config Remove root non-terminal consoles Set in /etc/securetty Disable password access via ssh Use keys instead.

39. CIT 470: Advanced Network and System AdministrationSlide #39 sudo Login as root only for single-user mode. Use sudo instead of su. sudo command Advantages: Uses user password instead of root’s password. Logs who executed what commands as root. Can delegate limited powers to some users.

40. CIT 470: Advanced Network and System AdministrationSlide #40 What is an Incident? Violation of security policy: –Unauthorized access of information –Unauthorized access to machines –Embezzlement –Virus or worm attack –Denial of service attacks –Email spam or harassment

41. CIT 470: Advanced Network and System AdministrationSlide #41 Incident Response Goals 1.Determine if a security breach occurred. 2.Contain intrusion to prevent further damage. 3.Recover systems and data. 4.Prevent future intrusions of same kind. 5.Investigate and/or prosecute intrusion. 6.Prevent public knowledge of incident.

42. CIT 470: Advanced Network and System AdministrationSlide #42 Incident Response Phases to restore system to satisfy site security policy: 1.Preparation for attack (before attack detected) 2.Identification of attack 3.Containment of attack (confinement) 4.Damage assessment 5.Preserve evidence (if necessary) 6.Eradication of attack (stop attack) 7.Recovery from attack (restore system to secure state) 8.Follow-up to attack (analysis and other actions)

43. CIT 470: Advanced Network and System AdministrationSlide #43 References 1.Michael D. Bauer, Linux Server Security, 2 nd edition, O’Reilly, 2005. 2.Aeleen Frisch, Essential System Administration, 3 rd edition, O’Reilly, 2002. 3.Simson Garfinkel, Gene Spafford, and Alan Schartz, Practical UNIX and Internet Security, 3 rd edition, O’Reilly & Associates, 2003. 4.Andrew Morgan, Linux PAM System Administrator’s Guide, http://www.kernel.org/pub/linux/libs/pam/Linux-PAM- html/pam.html, 2002. http://www.kernel.org/pub/linux/libs/pam/Linux-PAM- html/pam.html 5.Evi Nemeth et al, UNIX System Administration Handbook, 3 rd edition, Prentice Hall, 2001. 6.RedHat, Red Hat Enterprise Linux 4 Reference Guide, http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/ref- guide/, 2005. http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/ref- guide/