Transcript chap09
Guide to Operating System Security Chapter 9 Web, Remote Access, and VPN Security Objectives Understand Internet security using protocols and services Configure Web browsers for security Configure remote access services for security Configure virtual private network services for security Guide to Operating System Security 2 Internet Security Protocols and services must be kept secure To ensure privacy of information To discourage the spread of malicious software Guide to Operating System Security 3 Internet Protocols and Services Hypertext Transfer Protocol (HTTP) Secure HTTP (S-HTTP) and Hypertext Transfer Protocol Secure (HTTPS) File Transfer Protocol (FTP) Network File System (NFS) Samba and Server Message Block (SMB) Guide to Operating System Security 4 HTTP TCP/IP-compatible application protocoltransports information over the Web Most recent version: HTTP/1.1 Increases reliability of communications Enables caching Can send message responses before full control information from a request is received Permits multiple communications over a single connection Guide to Operating System Security 5 S-HTTP and HTTPS Forms of HTTP used for more secure communications S-HTTP Standards-based protocol that enables use of a variety of security measures (including CMS and MOSS) HTTPS Essentially proprietary, but more compatible with encryption for IP-level communications Uses SSL as a subprotocol Guide to Operating System Security 6 File Transfer Protocol (FTP) TCP/IP protocol that transfers files in bulk data streams Uses two TCP ports (20 and 21) Supports transmission of binary or ASCII formatted files Commonly used on the Internet Downloading files can be risky Guide to Operating System Security 7 File Transfer Protocol (FTP) Guide to Operating System Security 8 Network File System (NFS) Designed for UNIX/Linux systems for file sharing Connection-oriented protocol that runs within TCP Uses remote procedure calls via TCP port 111 Sends data in record streams For security, let only authorized computers use NFS on host computer Guide to Operating System Security 9 Samba and Server Message Block Samba Available for UNIX and Linux computers Enables exchange of files and printer sharing with Windows-based computers through SMB protocol Server Message Block Used by Windows-based systems Enables sharing files and printers Employed by Samba Guide to Operating System Security 10 Using Samba Guide to Operating System Security 11 Configuring Web Browsers for Security Applying security measures to popular Web browsers Internet Explorer Mozilla Netscape Navigator Guide to Operating System Security 12 Configuring Internet Explorer Security Used with Windows and Mac OS X Configure version of HTTP, use of HTTPS, FTP, and download access Configure security by zones Internet Local intranet Trusted sites Restricted sites Guide to Operating System Security 13 Internet Explorer Security Settings Guide to Operating System Security 14 Configuring Internet Explorer Security Internet Explorer Enhanced Security Configuration (Windows Server 2003) Applies default security to protect server Uses security zones and security parameters preconfigured for each zone Guide to Operating System Security 15 Installing IE Enhanced Security Configuration Guide to Operating System Security 16 Configuring Mozilla Security Open-source Web browser Can run on Linux (by default with GNOME desktop) UNIX Mac OS X OS/2 Windows-based systems Security configuration is combined with privacy configuration options Guide to Operating System Security 17 Mozilla Security Categories Guide to Operating System Security 18 Privacy & Security Option in Mozilla Guide to Operating System Security 19 Configuring Netscape Navigator Security Nearly identical to Mozilla; GUI offers: A buddy list Link to Netscape channels Different sidebar presentation Guide to Operating System Security 20 Netscape Navigator in Windows 2000 Server Guide to Operating System Security 21 Privacy & Security Options in Netscape Guide to Operating System Security 22 Configuring Remote Access Services for Security Remote access Ability to access a workstation or server through a remote connection (eg, dial-up telephone line and modem) Commonly used by telecommuters Guide to Operating System Security 23 Microsoft Remote Access Services Enables off-site workstations to access a server through telecommunications lines, the Internet, or intranets Guide to Operating System Security 24 Microsoft RAS Guide to Operating System Security 25 Microsoft RAS - Supported Clients MS-DOS Windows 3.1 and 3.11 Windows NT/95/98 Windows Millennium Windows 2000 Windows Server 2003 and XP Professional Guide to Operating System Security 26 Microsoft RAS Supports different types of modems and communications equipment Compatible with many network transport and remote communications protocols Guide to Operating System Security 27 Microsoft RAS – Supported Connections (Continued) Asynchronous modems Synchronous modems Null modem communications Regular dial-up telephone lines Leased telecommunication lines (eg, T-carrier) Guide to Operating System Security 28 Microsoft RAS – Supported Connections (Continued) ISDN lines (and “digital modems”) X.25 lines DSL lines Cable modem lines Frame relay lines Guide to Operating System Security 29 Microsoft RAS – Supported Protocols NetBEUI TCP/IP NWLink PPP PPTP L2TP Guide to Operating System Security 30 Understanding Remote Access Protocols Transport protocols TCP/IP IPX NetBEUI Remote access protocols Serial Line Internet Protocol (SLIP) • CSLIP Point-to-Point Protocol (PPP) • • PPTP L2TP Guide to Operating System Security 31 Configuring a RAS Policy Employ callback security options (No Callback, Set by Caller, Always Callback to) Install Internet Authentication Service (IAS) Can be employed with Remote Authentication Dial-In User Service (RADIUS) and RADIUS server Add participating RAS and VPN servers Guide to Operating System Security 32 Remote Access Policies Objects in the IAS Tree Guide to Operating System Security 33 Granting Remote Access Permission to RAS Guide to Operating System Security 34 Enabling Access for a User’s Account via Remote Access Policy Guide to Operating System Security 35 Configuring a RAS Policy Use Remote Access Policies to configure security types Authentication Encryption Dial-in constraints Guide to Operating System Security 36 RAS Authentication Types (Continued) Challenge Handshake Authentication Protocol (CHAP) Extensible Authentication Protocol (EAP) MS-CHAP v1 (aka CHAP with Microsoft extensions) MS-CHAP v2 (aka CHAP with Microsoft extensions version 2) Guide to Operating System Security 37 RAS Authentication Types (Continued) Password Authentication Protocol (PAP) Shiva Password Authentication Protocol (SPAP) Unauthenticated Guide to Operating System Security 38 RAS Encryption Options Guide to Operating System Security 39 RAS Dial-in Constraints Options Idle and session timeouts Day and time restrictions Whether access is restricted to a single number Whether access is restricted based on media used Guide to Operating System Security 40 Security on a Virtual Private Network VPN An intranet designed for restricted access by specific clients based on subnets, IP addresses, user accounts, or a combination Apply same remote access policies as to RAS servers Guide to Operating System Security 41 Summary Protocols and services that enable Internet security Configuring Web browsers for security Internet Explorer Mozilla Netscape Navigator How to configure a server’s remote access services to enforce security Applying security options to a VPN Guide to Operating System Security 42