Upload
ira-merritt
View
216
Download
0
Tags:
Embed Size (px)
Citation preview
COMP2221COMP2221
Networks in OrganisationsNetworks in Organisations
Richard HensonRichard Henson
April 2014April 2014
Week 7: A Closer look Week 7: A Closer look at Active Directoryat Active Directory
ObjectivesObjectives– Explain client-server network logonExplain client-server network logon– Explain security features associated with Explain security features associated with
active directoryactive directory– Apply secure file system principles and Apply secure file system principles and
active directory to controlling access for active directory to controlling access for groups of network usersgroups of network users
– Apply active directory group policies across Apply active directory group policies across one/more domain using active directoryone/more domain using active directory
Logon on Local/RemoteLogon on Local/Remote
Computers boot up locallyComputers boot up locally– includes OSI 7 layer connectivity softwareincludes OSI 7 layer connectivity software– Logon happens at layer 5Logon happens at layer 5
» session layersession layer» allocated a sessionIDallocated a sessionID
– Remote logon also at layer 5Remote logon also at layer 5» software called redirector seeks resources from the software called redirector seeks resources from the
networknetwork» can also look at Active Directory database to find can also look at Active Directory database to find
resources…resources…
The Redirector The Redirector (OSI Level 5)(OSI Level 5)
Client-server Client-server serviceservice
Provides file and Provides file and print connectivity print connectivity between between computerscomputers– one end must be one end must be
“server”“server”– provides the provides the
service…service…
server client
may be logged on
Server Providesservice
redirector requests service
Redirector Redirector (“Workstation” i.e. client-end)(“Workstation” i.e. client-end)
Implemented as a “file system driver”Implemented as a “file system driver”– Invoked “if”:Invoked “if”:
» local file system cannot find the file or servicelocal file system cannot find the file or service
– ““then”… then”… » sends request to active directorysends request to active directory
» locates the data object via next OSI layer (4): locates the data object via next OSI layer (4): Transport Driver Interface (TDI)Transport Driver Interface (TDI)
communicates directly with protocols communicates directly with protocols » independent of OSI layers 2-4 networking componentsindependent of OSI layers 2-4 networking components
Redirector Redirector (Workstation Service)(Workstation Service)
Adherence to OSI layers…Adherence to OSI layers…– Can independently add or remove: Can independently add or remove:
» transport protocols (layers 3 & 4)transport protocols (layers 3 & 4)
» network cards (layers 1 & 2)network cards (layers 1 & 2)
without reconfiguring the whole systemwithout reconfiguring the whole system
Completely transparent in redirection of i/o Completely transparent in redirection of i/o calls not serviced locallycalls not serviced locally– esp. important when applications are being usedesp. important when applications are being used
Server ServiceServer Service
Server end of redirector:Server end of redirector:– implemented as a file system driverimplemented as a file system driver– communicates with lower layers via TDIcommunicates with lower layers via TDI
Supplies the network connections Supplies the network connections requested by the client redirectorrequested by the client redirector
Receives requests via adapter card Receives requests via adapter card drivers, transport protocol (e.g. TCP/IP), drivers, transport protocol (e.g. TCP/IP), and TDIand TDI
Running Client-Server Running Client-Server ApplicationsApplications
Client process & server process provide a Client process & server process provide a mechanism for:mechanism for:– pipes to link processes that need bi-directional pipes to link processes that need bi-directional
communicationcommunication– mailslots to link processes only requiring one-mailslots to link processes only requiring one-
directional communicationdirectional communication– running Winsock to manage the communication running Winsock to manage the communication
channelchannel– RPCs (Remote Procedure Calls) allowing RPCs (Remote Procedure Calls) allowing
distributed applications to call procedures distributed applications to call procedures anywhere on the networkanywhere on the network
File and Print SharingFile and Print Sharing
Shared resource access requires use ofShared resource access requires use of– redirectorredirector– server service…server service…
Multiple UNC Provider allows connection to a Multiple UNC Provider allows connection to a resource on any computer that supports UNC resource on any computer that supports UNC Universal Naming Convention) namesUniversal Naming Convention) names– FilesFiles \\server\shared folder[\sub-folder]\filename))– PrintersPrinters \\server\shared printer
Multiple Provider Router supports multiple Multiple Provider Router supports multiple redirectorsredirectors
Network BindingNetwork Binding
Binding is about linking network components Binding is about linking network components working at different OSI levels together to working at different OSI levels together to enable communicationenable communication
Windows binding is about linking the Windows binding is about linking the redirector & server service with the transport redirector & server service with the transport protocol and (via NDIS) adapter card driversprotocol and (via NDIS) adapter card drivers– happens automatically when:happens automatically when:
» there is a change of protocol, or protocol settingsthere is a change of protocol, or protocol settings
» different network adapter drivers are installeddifferent network adapter drivers are installed
» existing adapter card settings are alteredexisting adapter card settings are altered
Terminal ServicesTerminal Services
Allows any PC running a version of Allows any PC running a version of Windows to remotely run a Windows Windows to remotely run a Windows serverserver– uses a copy of the server’s desktop on the uses a copy of the server’s desktop on the
client machineclient machine Client tools must be installed first, but Client tools must be installed first, but
the link can run with very little bandwidththe link can run with very little bandwidth– possible to remotely manage a server possible to remotely manage a server
thousands of miles away using a phone thousands of miles away using a phone connection…connection…
The www service Provided by Microsoft’s Web Server (IIS)Provided by Microsoft’s Web Server (IIS)
– links to TCP port 80links to TCP port 80– can also provide:can also provide:
» ftp service (port 21)ftp service (port 21)
» smtp service (port 25)smtp service (port 25)
Purpose of www service:Purpose of www service:– Works with http protocol make html pages Works with http protocol make html pages
available:available:» across the network as an Intranetacross the network as an Intranet
» across trusted external users/domains as an Extranetacross trusted external users/domains as an Extranet
Features of IISFeatures of IIS
Provides server end program execution Provides server end program execution environment:environment:– runs server-scriptsruns server-scripts
Sets up its own directory structure on the Sets up its own directory structure on the Server for developing Intranets, Extranets, Server for developing Intranets, Extranets, etc.etc.
Sets up communication via TCP port 80 in Sets up communication via TCP port 80 in response to client requestresponse to client request
Client end:Client end:– browser HTML display environment on clientbrowser HTML display environment on client
““Static” web page serviceStatic” web page service
client (browser) requests information (HTML page)
server (IIS, web server) processes the request, sends HTML page back to the client…
CLIENT SERVER
RESPONSE
Send RequestRead Results
Process RequestSend Back Results
ClientProgram
REQUEST
ServerProgram
More Features of IISMore Features of IIS
Access to any client-server service can Access to any client-server service can be restricted using username/password be restricted using username/password security at the server endsecurity at the server end– or could bypass security with “anonymous or could bypass security with “anonymous
loginlogin» uses a “guest” account – access granted only to files uses a “guest” account – access granted only to files
that make up the Intranetthat make up the Intranet
» prevents worries about hacking in through guessing prevents worries about hacking in through guessing passwords of existing userspasswords of existing users
Client-Server Web Client-Server Web ApplicationsApplications
Associated with “dynamic” web pagesAssociated with “dynamic” web pages Web servers provides a server-side Web servers provides a server-side
environment that can allow browser data to environment that can allow browser data to query remote online databases using query remote online databases using SQL…SQL…– processing takes place at the server end…processing takes place at the server end…
» usually .aspx or .phpusually .aspx or .php
– centralised and secure!centralised and secure!
Some recent challenges to Some recent challenges to client-server applicationsclient-server applications
apps (especially phone apps…) using apps (especially phone apps…) using local processing, even storage (!)local processing, even storage (!)– open to wireless retrieval?open to wireless retrieval?– again…issue of availability v securityagain…issue of availability v security
Server with logically attached database Server with logically attached database can be wide open to attack by SQL can be wide open to attack by SQL injection….injection….
Troubleshooting Local ResourcesTroubleshooting Local Resources Task ManagerTask Manager
– Applications tab just gives the name and status of Applications tab just gives the name and status of each application that is loaded into memoryeach application that is loaded into memory
– Processes tab:Processes tab:» all system processesall system processes» Memory usage of eachMemory usage of each» % CPU time for each% CPU time for each» Total CPU time since boot upTotal CPU time since boot up
– Performance tabPerformance tab» Total no. of threads, processes, handles runningTotal no. of threads, processes, handles running» % CPU usage% CPU usage
Kernel modeKernel mode User modeUser mode
» Physical memory available/usagePhysical memory available/usage» Virtual memory available/usageVirtual memory available/usage
Troubleshooting Local ResourcesTroubleshooting Local Resources Event viewerEvent viewer
– System events recorded into “event log” files System events recorded into “event log” files » Three by default: system, auditing, applicationThree by default: system, auditing, application» customisable customisable
– Three types of events:Three types of events:» InformationInformation» WarningWarning» ErrorError
– More information for each event obtained by More information for each event obtained by double-clickingdouble-clicking
– Event management also required…Event management also required…» E.g. new files daily, old ones archived? dumped? when? E.g. new files daily, old ones archived? dumped? when? » how often to check event files?how often to check event files?» Important to detect security issues and potential failures Important to detect security issues and potential failures
Troubleshooting Local ResourcesTroubleshooting Local Resources System Monitor (perfmon.msc)System Monitor (perfmon.msc)
– monitormonitor many aspects of system performance many aspects of system performance– e.g. capture, filter, or analyses frames or packets sent over the e.g. capture, filter, or analyses frames or packets sent over the
network, or capture data from hardware devicesnetwork, or capture data from hardware devices» either display current data graphically, in real-timeeither display current data graphically, in real-time» or log data at regular intervals to get a longer term pictureor log data at regular intervals to get a longer term picture
– AlertsAlerts» notify when a particular threshold value has been reachednotify when a particular threshold value has been reached
System Recovery…System Recovery…– If a fatal error occurs:If a fatal error occurs:
» immediate dump of system memory is madeimmediate dump of system memory is made can be used for identifying the cause of the problemcan be used for identifying the cause of the problem
» alerts are sent to usersalerts are sent to users» system is restarted automaticallysystem is restarted automatically
The Active Directory “store”The Active Directory “store” Global Catalog Global Catalog
– stored as file NTFS.DIT when the first stored as file NTFS.DIT when the first domain controller is createddomain controller is created
– distributed across alldistributed across all domain controllersdomain controllers» covers all “objects” on domain controllerscovers all “objects” on domain controllers
e.g.e.g. shared resources such as servers, files, printers; shared resources such as servers, files, printers; network user and computer accountsnetwork user and computer accounts
– directory changes automatically replicated directory changes automatically replicated to all domain controllersto all domain controllers
Group Policies and Group Policies and Network AccessNetwork Access
Active directory controls access to all Active directory controls access to all network resourcesnetwork resources
Achieved through giving the right users Achieved through giving the right users the right group policiesthe right group policies
How can the network administrator How can the network administrator know what policies to allocate to which know what policies to allocate to which user(s)… user(s)… – groups must have appropriate settingsgroups must have appropriate settings
Managing Group PolicyManaging Group Policy
Group Policy Management Console Group Policy Management Console (Windows 2003 onwards…)(Windows 2003 onwards…)
Applies principles of MMC (Microsoft Applies principles of MMC (Microsoft Management Console) to managing Management Console) to managing group profilesgroup profiles– particularly useful for testing/viewing the particularly useful for testing/viewing the
resultant profile of interaction between resultant profile of interaction between several group profiles in a particular orderseveral group profiles in a particular order
Security Features of Security Features of Active Directory (1)Active Directory (1)
SSL (secure OSI level 5)SSL (secure OSI level 5) for e-commerce…for e-commerce… Internet Information Server (IIS) supports Internet Information Server (IIS) supports
websites accessible only via https/SSLwebsites accessible only via https/SSL
LDAP over SSLLDAP over SSL LDAP important for internet lookupLDAP important for internet lookup used with secure sockets layer (SSL) for used with secure sockets layer (SSL) for
checking server credentials for extranet and e-checking server credentials for extranet and e-commerce applicationscommerce applications
Security Features of Security Features of Active Directory (2)Active Directory (2)
Transitive Domain TrustTransitive Domain Trust default trust between default trust between
contiguous Windows contiguous Windows domains in a domain treedomains in a domain tree
greatly reduces management greatly reduces management overheadoverhead
Security Features of Security Features of Active Directory (3)Active Directory (3)
Kerberos AuthenticationKerberos Authentication authentication of users on remote domains authentication of users on remote domains
not part of the same DNS zonenot part of the same DNS zone
Smart Card SupportSmart Card Support logon via smart card for strong logon via smart card for strong
authentication to sensitive resourcesauthentication to sensitive resources
Protecting Local PasswordsProtecting Local Passwords More sophisticated challenge-response More sophisticated challenge-response
encryption (NTLMv2) was available to all encryption (NTLMv2) was available to all systems from Windows 2000 on…systems from Windows 2000 on…– until Vista arrived this was turned off by default until Vista arrived this was turned off by default
» for “compatibility reasons”for “compatibility reasons”
– nnless NTLMv2 enabled, passwords on XP nnless NTLMv2 enabled, passwords on XP systems easy to “hack” with right tools (!)systems easy to “hack” with right tools (!)
Any client network user should make sure Any client network user should make sure this password protection feature is turned this password protection feature is turned on…on…– can be added for domain users through group can be added for domain users through group
policypolicy
Active Directory and Active Directory and “controlling” Users“controlling” Users
““Groups” already well established for Groups” already well established for managing network users managing network users
Active directory centrally organised resources Active directory centrally organised resources including all computers including all computers – allowed groups to become more powerful for user allowed groups to become more powerful for user
managementmanagement– exploited by enabling the organisation of users exploited by enabling the organisation of users
and groups of users into:and groups of users into:» organisational unitsorganisational units» sitessites» domainsdomains
Managing Domain Users with Managing Domain Users with Active DirectoryActive Directory
Same user information stored on all Same user information stored on all domain controllersdomain controllers
Users can be administered at or by Users can be administered at or by secure access to administrator on any secure access to administrator on any domain controller for that domaindomain controller for that domain– flexibility but potential danger!flexibility but potential danger!
Making Sure Users don’t get Making Sure Users don’t get the Administrator Password!the Administrator Password! File security assumes that only the File security assumes that only the
network manager can log on as network manager can log on as administratoradministrator– but if a user can guess the password… (!)but if a user can guess the password… (!)
Strategies:Strategies:– rename the administrator account to something rename the administrator account to something
more obscuremore obscure– only give administrator password to one other only give administrator password to one other
personperson– change administrator password regularlychange administrator password regularly
How AD Provides SecurityHow AD Provides Security Manages which “security principal(s)” Manages which “security principal(s)”
have access to each specific resourcehave access to each specific resource– i.e. users, computers, groups, or services i.e. users, computers, groups, or services
(via service accounts)(via service accounts)» each has a unique identifier (SID) each has a unique identifier (SID)
Validates the authentication process…Validates the authentication process…– for computers, at startupfor computers, at startup– for users, at logonfor users, at logon
More about the SIDMore about the SID
The SID (Security ID) comprises:The SID (Security ID) comprises:– domain IDdomain ID
» common to all security principals common to all security principals within the domainwithin the domain
– unique relative identifier (RID)unique relative identifier (RID)
Access TokensAccess Tokens
Generated when a user logs on to the Generated when a user logs on to the networknetwork
Contains:Contains:– user’s SIDuser’s SID– SIDs for each group to which the user is a SIDs for each group to which the user is a
membermember– assigned user rights or privileges as a result of assigned user rights or privileges as a result of
processing the IDs in the specified orderprocessing the IDs in the specified order
ACE (Access Control Entries)ACE (Access Control Entries)
Each object or resource has an access Each object or resource has an access control list (ACL) e.g.control list (ACL) e.g.– objects and their propertiesobjects and their properties– shared folders and printer sharesshared folders and printer shares– folders and files within the NTFS file systemfolders and files within the NTFS file system
ACEs contained within ACLACEs contained within ACL– protects resource against unauthorised usersprotects resource against unauthorised users
More on ACLsMore on ACLs Two distinct ACLs each object or Two distinct ACLs each object or
resource:resource:– discretionary access control list (DACL) discretionary access control list (DACL)
» list of the SIDs that are either granted or denied list of the SIDs that are either granted or denied access and the degree of access that is allowed access and the degree of access that is allowed
– systems access control list (SACL)systems access control list (SACL)» list of all the SIDs whose access or manipulation of list of all the SIDs whose access or manipulation of
the object or resource needs to be audited, and the the object or resource needs to be audited, and the type of auditing that needs to be performedtype of auditing that needs to be performed
Mechanism of AD securityMechanism of AD security Users are usually assigned to several groupsUsers are usually assigned to several groups When a user attempts to access a directory When a user attempts to access a directory
object or network resource…object or network resource…– the security subsystem…the security subsystem…
» looks at the SID for the user and the SIDs of the security looks at the SID for the user and the SIDs of the security groups to which the user is a membergroups to which the user is a member
» checks to see whether it/they match the security descriptors checks to see whether it/they match the security descriptors assigned to the resourceassigned to the resource
If there is a match…If there is a match…– user is granted the degree of access to the user is granted the degree of access to the
resource that is specified in the ACLresource that is specified in the ACL
Power of Group IDs in Power of Group IDs in Policy-based SecurityPolicy-based Security
Group Policy…Group Policy… allows groups of users to be granted or denied allows groups of users to be granted or denied
access to or control over entire classes of objects access to or control over entire classes of objects and sets of resourcesand sets of resources
allows security & usage policies to be established allows security & usage policies to be established separately for:separately for:
» computer accountscomputer accounts» user accountsuser accounts
can be applied at multiple levels: can be applied at multiple levels: » users or computers residing in a specific OUusers or computers residing in a specific OU» computers or users in a specific AD sitecomputers or users in a specific AD site» an entire AD domainan entire AD domain
Active Directory and Active Directory and Group PolicyGroup Policy
Power of Group Policy:Power of Group Policy:– allows network administrators to define and allows network administrators to define and
control the policies governing:control the policies governing:» groups of computersgroups of computers
» groups of usersgroups of users
– administrators can set group policy for any administrators can set group policy for any of the sites, domains, or organizational units of the sites, domains, or organizational units in the Active Directory Domain Treein the Active Directory Domain Tree
Monitoring Group Policy Monitoring Group Policy
Policies, like permissions, are ADDITIVEPolicies, like permissions, are ADDITIVE– watch simulation… (AGAIN!)watch simulation… (AGAIN!)
Windows 2000 policiesWindows 2000 policies– need to assess which specific cumulative set of need to assess which specific cumulative set of
policies were controlling the environment for a policies were controlling the environment for a specific user or computerspecific user or computer
Windows 2003 GPMCWindows 2003 GPMC– tracking and reporting the Resultant Set of Policy tracking and reporting the Resultant Set of Policy
(RSoP):(RSoP):» net effect of each of the overlapping policies on a specific user net effect of each of the overlapping policies on a specific user
or computer within the domainor computer within the domain
Extending User/Group Extending User/Group Permissions beyond a domainPermissions beyond a domain Possible for user permissions to be safely Possible for user permissions to be safely
applied beyond the local domainapplied beyond the local domain– so users on one network can gain access to files on another so users on one network can gain access to files on another
networknetwork
– authentication controlled between servers on the local authentication controlled between servers on the local and trusted domainsand trusted domains
Normally achieved through “adding” groups from Normally achieved through “adding” groups from a trusted domaina trusted domain
NOT the same as “remote logon”NOT the same as “remote logon”– needs special username/password authorisation…needs special username/password authorisation…
Enterprise NetworksEnterprise Networks
Multiple Domains in a treeMultiple Domains in a tree– Transitive Domain TrustTransitive Domain Trust
Single enterprise Single enterprise administratoradministrator ““enterprise admin”enterprise admin” greatly reduces greatly reduces
management overheadmanagement overhead
Managing Users Managing Users & Their Profiles& Their Profiles
Once they get the hang of it, users save Once they get the hang of it, users save all sorts of rubbish to their user areasall sorts of rubbish to their user areas– may well include lots of downloaded web may well include lots of downloaded web
pages and imagespages and images Problem!Problem!
– 5000 users5000 users– each user takes 1 Gb of space...each user takes 1 Gb of space...– total disk space required is 5000 Gbytes!total disk space required is 5000 Gbytes!
Managing User ProfilesManaging User Profiles
Windows 2003 Server “Disk Quotas”:Windows 2003 Server “Disk Quotas”:– allows administrators to track and control user allows administrators to track and control user
NTFS disk usageNTFS disk usage» coupled with Group Policy and Active Directory coupled with Group Policy and Active Directory
technologytechnology
» easy to manage user spaceeasy to manage user space
» even enterprise-wide…even enterprise-wide…
– users find this irritating but stops them keeping users find this irritating but stops them keeping data they’re never likely to use again…data they’re never likely to use again…
User RightsUser Rights Users MUST NOT have access to Users MUST NOT have access to
sensitive parts of the system (e.g. sensitive parts of the system (e.g. network servers, local system software) network servers, local system software) – operating system can enforce thisoperating system can enforce this
Users SHOULD:Users SHOULD:– have access to basic software toolshave access to basic software tools– NOT be denied on the grounds that the NOT be denied on the grounds that the
software could be misused…software could be misused…» c.f. no-one is allowed to drive a car because some c.f. no-one is allowed to drive a car because some
drivers cause accidents!drivers cause accidents!
Controlling/Monitoring Group Controlling/Monitoring Group Policy across DomainsPolicy across Domains
AD across a distributed enterprise…AD across a distributed enterprise…– ““enterprise” administrators have the authority to enterprise” administrators have the authority to
implement and alter Group Policies anywhere implement and alter Group Policies anywhere – important to manage and restrict their number... important to manage and restrict their number...
Enterprise admins need to inform domain admins:Enterprise admins need to inform domain admins:– what has changedwhat has changed– when it changedwhen it changed– the implications of the change for directory and network the implications of the change for directory and network
operations…operations… Otherwise…Otherwise…
– a change to Group Policies affecting a domain might a change to Group Policies affecting a domain might occur with distastrous consequencesoccur with distastrous consequences
NFR Example:NFR Example:Possible Security FeaturesPossible Security Features
Information labelling and handlingInformation labelling and handling Equipment siting and protectionEquipment siting and protection Supporting utilitiesSupporting utilities Cabling securityCabling security MaintenanceMaintenance Secure disposal or re-useSecure disposal or re-use Separation of development, test and operational Separation of development, test and operational
facilitiesfacilities Controls against malicious codeControls against malicious code Controls against mobile codeControls against mobile code Information back-upInformation back-up Network controlsNetwork controls Security of network servicesSecurity of network services Electronic messagingElectronic messaging On-line transactionsOn-line transactions Publicly available informationPublicly available information Audit loggingAudit logging Auditing system useAuditing system use Protection of log informationProtection of log information Clock synchronisationClock synchronisation Privilege managementPrivilege management Equipment identification in networksEquipment identification in networks
Remote diagnostic and configuration port protectionRemote diagnostic and configuration port protection Segregation in networksSegregation in networks Network connection controlNetwork connection control Network routing controlNetwork routing control Secure log-on proceduresSecure log-on procedures User identification and authentication User identification and authentication Password management systemPassword management system Use of system utilitiesUse of system utilities Session time-outSession time-out Limitation of connection time Limitation of connection time Information access restrictionInformation access restriction Sensitive system isolationSensitive system isolation Input data VerificationInput data Verification Control of internal processing, including Least Control of internal processing, including Least
PrivilegePrivilege Message integrityMessage integrity Output data VerificationOutput data Verification Cryptographic controlsCryptographic controls Key managementKey management Technical vulnerability management (patches and Technical vulnerability management (patches and
updates)updates) Collection of evidenceCollection of evidence
A Checklist of areas to consider, abtracted from ISO/IEC 27001 / 27002 Control Sets [TSI/2012/183]© Copyright 2003-2012