Why is security important? Practical applications of secure operating systems in E-business. Web site defacement activity (May 2000 April 2001)

Transcription

1 Why is security important? Practical applications of secure operating systems in E-business Nigel Edwards Hewlett-Packard Internet Security Solutions Division 1 2 Web site defacement activity (May 2000 April 2001) Summary of Linux security issues All Platforms Linux All Platforms Excluding Microsoft In June 2000 Linux was run on 30% of active web sites Source: Netcraft ( 26.5% of defaced sites ran Linux Linux was run on 41.8% of non-microsoft sites 65.2% of non-microsoft sites defaced ran Linux January 2001 saw the first Linux Worm Ramen Adore and Lion followed Worms may deface your site and/or do other damage Mar-00 Jun-00 Oct-00 Jan-01 Apr-01 So So what can you do? Source: Attrition ( 3 4

2 Possible operating system security strategies Wait for the latest patch Will you apply it in time? No protection against administration errors Layered security products Minimal protection against attacks exploiting application bugs Strengthen the operating system Protects against administration errors Protects and detects attacks exploiting application bugs Enables safe-sharing of machines Security/strength of mechanisms HP-LX and Virtualvault in context HP Virtualvault TRUSTED SYSTEMS X HP-LX LAYERED SYSTEMS HP-UX Bastille C2 HP-UX C2 HP Webenforcer BASE SYSTEMS HP-UX, Linux Windows Ease of use/administration, performance, compatibility 5 6 What is HP Virtualvault? HP Virtualvault installation A highly secure web server Six years of installation around the world Based on HP-UX Compartmented Mode Workstation Implements the Bell and La Padula lattice security model Remote sites Internet router DMZ LAN proxy host firewa ll In tran et NT server + Edify SQL, other clien t/ server protocols in tern al servers Security Lattice Information Remote u sers SSL-protected transaction data ftp server DNS server Virtu alvau lt In tern a l u s ers On the boundary 7 8

3 HP Virtualvault internals What is HP-LX? In tern et Client 1 4 Browser sends HTTP Web server invokes TCP connection JVM executes servlets OUTSIDE Netscape Web Server HTML Pages 4 Servlet processes request, returns to client browser 2 SYSTEM_HI SAFE tcp SYSTEM Tru sted Operatin g System Au d it Trail INSIDE JVM In tern a l Web Server Servlets 3 Administration, Maintenance In tern a l Server In tern a l Browser A highly secure version of Linux for running applications and services Service provider focus Building on the success of HP Virtualvault Balance ease of use with security A new security model focused on Internet services and applications Minimal kernel changes HP will deliver: Example services (e.g. Apache) SDK and (eventually) integration tools 9 10 Review of major HP-LX features Compartments remote administration HP-LX ready applications System configuration lockdown Sealed Compartments Backend Servers e.g. Tomcat File access control Communication control External network Apache Internal network Compartments Kernel-level auditing Compartments optionally sealed and/or and/or chrooted 11 12

4 Communication access control Example of compartment communication rules Explicit paths in HP-LX HOST:* -> COMPARTMENT:WEB METHOD TCP PORT 80 NETDEV eth0 COMPARTMENT:WEB -> COMPARTMENT:TOMCAT1 METHOD TCP PORT 8007 NETDEV lo COMPARTMENT:WEB -> COMPARTMENT:TOMCAT2 METHOD TCP PORT 8008 NETDEV lo Implicit paths in Conventional T.O.S. No No trusted trusted processes for for intercompartment communications inter- COMPARTMENT:TOMCAT1 -> HOST:SERVER1 METHOD TCP PORT 8080 NETDEV eth File access control System configuration lockdown We do: Removed from from sensitive programs Set-UID (and (and Set- Set- GID) at, Enable password aging permissions on on executables Enhance the the default system logging Etc Etc etc. File Control Table specifies: read, write, append Mandatory Access Control (MAC) Prevents web server overwriting the home page Fine-grain control within a sealed compartment Coarse grain (MAC) protection also available by using chroot Integrity protection Cryptographic hash taken of all immutable files Tripwire Labels Labels are are not not used used to to control control access access to to files files => => No No changes to to what what is is written written on on disk disk We don t: Remove unnecessary programs Ease of of use use (Diagnosis/maintenance) Anything in in Red Red Hat Hat can can be be installed Rely Rely on on containment preventing abuse Use Use special administration compartment 15 16

5 Possible Machine boundary configuration Reporting Program Translation API API Format Template collection daemon API Trusted Application API Why is is kernel-level ing important? Application Space Raw audit data Kernel Space /dev/auditr /dev/auditw Syscall hooks Network hooks Other hooks device driver Answer: it it is is very hard to to by-pass A secure administration model (1/2) other utilities & applications HP-LX administration utilities A secure administration model 2/2 PAM init System calls SSH login SSHD SSH login Kernel + DLKMs HP-LX management utilities Create, destroy, start, stop compartments Configure communication rules for compartments Manage audit system How do we stop the abuse of the system calls used for this? Authorized administrator tlx_admin set Shell tlx_admin set Authorized user, not authorized Shell administrator tlx_admin cleared Each process has has an an additional attribute The The tlx_admin bit bit Code inside kernel checks for for this this bit bit before executing administration functions Works in in parallel to to Linux capability mechanism (which we we also also use) use) A more restricted management model than than capabilities 19 20

6 Typical HP-LX compartment configuration Target platforms and performance External Network Web (apache) Administration compartment (auditd) Syslog (syslogd, klogd) System (cron, getty, crond) Backup (Amandad) Xinetd (xinetd) Mail transport agent (sendmail) Tomcat (tomcat) SSHD (sshd) Internal Network Which Linux Distributions? Redhat 7.1 Will follow up with others including Debian Platform Dual processor 700Mhz Pentium III, 2x20GB Disk, 1GB RAM, rack mounted PC (Netserver) Single processor 500 MHZ Pentium III, 10 GB Disk, 500MB Ram Performance Currently Apache on HP-LX with auditing-off is within 2% of Apache on Redhat Summary A new model for trusted operating systems Using our experience of commercial MLS operation Balance ease of use, portability and security Configure communication patterns explicitly Minimal kernel changes Main features Compartments provide containment File and communication access control System configuration lockdown administration model Protects you and your users from many of the most common attacks seen today 23