1. OpenLabs Security Laboratory
The online security experiment platform
Johan Zackrisson
Charlie Svahnberg

2. Outline Introduction Requirements Laboratory usage Technical solution
Conclusion

3. History
Started in 2006
Continuation of an on-campus security laboratory

4. Requirements: The Goals
Provide a secure environment for remote experiments
Must allow advanced security experiments
off-campus experiments in advanced security

5. Advanced security experiments
Insecure protocols
Insufficient access control
Software vulnerabilities
See effects of computer viruses
...

6. Environment Remote controllable Networked
Experiment with network services
One or more machines
Start from a known state
Any operating system (x86 at least)

7. Secure Environment Isolation Student has exclusive access
No information can leak to the Internet
No information can leak between experiments
Can not leave information traces

8. Hostile Environment Destructive experiments Reboot
When a machine hangs
Reinstall
Need to start over

9. Laboratory usage From a students point of view
Web interface
Log in
Make reservations

10. What to install on each machine
Reservations
When and for how long
The number of machines
What to install on each machine

11. Installations Clone images
Contains the operating system and the tools needed for the experiment
Prepared in advance by the teacher

12. Before the experiment starts
Automatic clone installation
reminder

13. The experiment starts
Before given access, the student has to choose to start the experiment from the web interface
Remote control
VNC, Remote Desktop, SSH, X
Machine management via the web interface
Reboot / Reinstall

14. The experiment ends The machines are wiped from all information
Ready to be used by new experiments

15. Technical solution

16. Resources 32 standard rack machines (Xeon, 2.80Ghz, 1Gb RAM)
Experiment network (Gigabit)
Service machines
Power Distribution Units (PDUs)

18. Core functionality Web interface Cloning / Wiping Firewalling
Network switch configuration
Power control

19. Web interface
Experiment management
Administration

20. Cloning / Wiping Booted over the network
Automatic installation of a prepared clone images
Overwrite with zeroes

21. Firewalling Access are only allowed from the students machine
All traffic to/from the experiment must be initiated from the students machine
No other traffic can leave the laboratory!

22. Network switch configuration
Managed network switch
Dedicated LAN per experiment
By using Virtual LAN (IEEE 802.1Q)
Isolation between experiments

23. Power control
Done by remote controllable power outlets, Power Distribution Units (PDUs)
Force a machine to reboot
By the student during experiments
By the cloning system

24. Conclusion Management and reservations Web interface
Isolation / Network environment
Firewalling
Network switch configuration

25. Automatic installation (and reinstall)
Cloning
Ability to restart a machine
Power control
Information leakage
Wiping

26. Other uses
Off-campus courses without the possibility to install software
Simulations
Clustering with LAM/MPI
Enable remote access to 3rd party Hardware/Software
Antenna Lab

27. Questions?