Case Study: Access control 1 / 39
|
|
|
- Meryl Weaver
- 8 years ago
- Views:
Transcription
1 Case Study: Access control 1 / 39
2 Joint software development Mail 2 / 39
3 Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications 3 / 39
4 Situations Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications Small team on a single machine Medium-to-large team on a LAN Large, distributed team, spread among several organizations 4 / 39
5 Roles Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications Developer (i.e., can commit changes) Tester Code reviewer 5 / 39
6 Permissions Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications We want the technical mechanisms to reflect the organizational roles The real challenge: mapping the organizational structure to OS primitives Why? 6 / 39
7 Why Enforce s? Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications Protect software from outsiders reading/stealing it Protect against unauthorized changes That can include internal rivalries Know who made certain changes? 7 / 39
8 Classic Unix Setup Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications Assume you just have user/group/other permissions, with no ACLs. How would you set things up? Put all developers in a certain group Make files and directories group readable/writable Decision to turn off other read access is site-dependent 8 / 39
9 ACL Setup Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications Could add each developer individually Bad idea if a developer leaves or joins the group, many ACLs must be updated Still want to use groups; vary group membership instead Advantage: can have multiple sets of group permissions why? 9 / 39
10 Reviewer/Tester Access Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications Reviewers and testers need read access They do not need write access No good, built-in solution on classic Unix With ACLs, one group can have r/w permissions; another can have r permissions 10 / 39
11 Medium-Size Group Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications No longer on single machine with simple file permissions More need for change-tracking More formal organizational structure 11 / 39
12 Basic Structure Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications Basic permission structure should be the same Again: use group permissions as the fundamental permission unit Limits of non-acl systems become more critical 12 / 39
13 Version Control Systems Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications For medium-size projects, use of a version control system (i.e., CVS, Subversion, Mercurial, RCS, etc.) is mandatory (Why?) What are the permission implications of a version control system? 13 / 39
14 Why use a VCS? Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications Auditability who made which change? When was a given change made? Can you roll back to a known-clean version of the codebase? What patches have been applied to which versions of the system? 14 / 39
15 Note Well Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications All of those features are important just for manageability Security needs are strictly greater we have to deal with active malfeasance as well as ordinary bugs and failures 15 / 39
16 Structure of a VCS Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications Repository Master copy; records all changes, versions, etc. Working copies Zero or more working copies. Developers check out a version from the repository, make changes, and commit the changes 16 / 39
17 Permission Structure Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications Here are the Unix client commands for RCS, CVS, Mercurial, and Subversion. What are the security implications? $ ls -l /usr/bin/ci /usr/bin/cvs \ /usr/pkg/bin/hg /usr/pkg/bin/svn -r-xr-xr-x 1 root wheel /usr/bin/ci -r-xr-xr-x 1 root wheel /usr/bin/cvs -rwxr-xr-x 1 root wheel /usr/pkg/bin/hg -rwxr-xr-x 1 root wheel /usr/pkg/bin/svn 17 / 39
18 They re Not SetUID! Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications They execute with the permissions of the invoker They could try to do access control, but it s meaningless anyone else could write code to do the same things The permission structure of the repository is what s important 18 / 39
19 The Repository Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications Essential feature: developers must have write permission on the directories File permissions are irrelevant; old files can be renamed and unlinked instead of being overwritten (Potential for annoyance if new directories are created with the wrong permission must set umask properly) But what prevents a developer with write permission on the respository from doing nasty things? Nothing / 39
20 Large Organization Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications Use client/server model for repository access Most users (including developers) have no direct access to the VCS repository Either build access control into VCS server or layer on top of underlying OS permissions But must restrict what commands can be executed on repository by developers 20 / 39
21 Complications Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Why use a VCS? Note Well Structure of a VCS Permission Structure They re Not SetUID! The Repository Large Organization Complications If you rely on OS permissions, something has to have root privileges, to let the repository part of the process run as that user If the VCS itself has a root component, is it trustable? If you use, say, ssh, is the command restriction mechanism trustable? If you rely on VCS permissions, you need to implement a reliable authentication and ACL mechanism All of this is possible but is it secure? 21 / 39
22 Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? 22 / 39
23 Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Issue of interest: local mail delivery and retrieval Surprisingly enough, network doesn t add (too much) security complexity 23 / 39
24 Issues Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? must be reliable Users must be able to send to any other users The system should reliably identify the sender of each message All s should be logged Locking is often necessary to prevent race conditions when reading and writing a mailbox Authentication 24 / 39
25 Accepting Mail Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Must accept mail from users Copy it, either to protected spool directory for network delivery or directly to recipient s mailbox 25 / 39
26 Spool Directory Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? If the mailer is setuid, it can copy the to a protected directory with no trouble If the directory is world-writable but not world-readable, you don t even need setuid add a random component to the filenames to prevent overwriting (Homework submission script does this) File owner is automatically set correctly, for use in generating From: line 26 / 39
27 However... Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Cannot securely write metadata for such directories others could overwrite the metadata file Cannot prevent users from overwriting their own pending Listing the mail queue still requires privilege 27 / 39
28 Local Access or Client/Server? Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? For client/server, issues are similar to VCS: authentication, root programs, restricting actions, etc For local access, must confront permission issues This is complicated by the many different versions of Unix over the years 28 / 39
29 Client/Server Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Standardized, (relatively) simple access protocols, POP and IMAP For ISP or large enterprise, neither need nor want general shell-type access to mail server Large system mailers have their own authentication database Does not rely on OS permissions But a mail server bug exposes the entire mail repository Also how do users change their passwords? 29 / 39
30 Bug Containment Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Separate programs into two sections: Small, simple section that does authentication and changes uid (must run as root) Large section that runs as that user Major advantage: security holes in large section don t matter, since it has no special privileges Much more on program structure later in the semester 30 / 39
31 Local Mail Storage Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Where is mail stored? Central mailbox directory or user s home directory? Note that mail delivery program must be able to (a) create, and (b) write to mailboxes If mailbox is in the user s directory, mail delivery program must have root permissions 31 / 39
32 Central Mail Directory Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? We can put all mailboxes in, say, /var/mail What are the permissions on it? If it s writable by group mail, delivery daemon can create new mailboxes Make mailboxes writable by group mail, and owned by the recipient? Permits non-root delivery but how do new mailboxes get created and owned by the user? 32 / 39
33 Dangers of User-Writable Mailbox Directories Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Permission escalation Vandalism Denial of service ln -s /etc/passwd /var/mail/me rm /var/mail/you touch /var/mail/does-not-exist-yet 33 / 39
34 Defending Against These Attacks Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Escalation Check mailbox permissions and ownership before writing (note: watch for race conditions) Vandalism Set sticky bit on directory DoS Remove (or change ownership of) mailboxes with wrong ownership Note well: most of these are trickier than they seem 34 / 39
35 Delivering Mail to a Program Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Most mail systems permit delivery of to a program Must execute that program as the appropriate user (Who is the appropriate user? Note that on Solaris, you may (depending on system configuration) be able to give away files) Implies the need for root privileges by the local delivery program 35 / 39
36 Privileged Programs Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? What must be privileged? What privileges? Local delivery needs some privileges, frequently root Delivery to a program always requires root The mail reader? 36 / 39
37 Privileged Mail Readers Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? The System V mail reader was setgid to group mail Could delete empty mailboxes More importantly, could create lock files by linking in the mailbox directory But note the danger if the mailer was buggy You don t give privileges to a whale (about 21K lines of code... ) 37 / 39
38 Many More Subtleties Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Writing a mailer is hard I ve barely scratched the surface of the design decisions, even the permission-related ones Complicated by varying system semantics 38 / 39
39 Why is it Hard? Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? cross protection boundaries That is, they copy data from one permission context to another Both can be arbitrary userids Simply importing data to a userid is a lot easier In addition, a lot of functionality is needed Not surprisingly, mailers have a very poor security record 39 / 39
Case Studies. Joint software development Mail 1 / 38. Case Studies Joint Software Development. Mailers
Joint software development Mail 1 / 38 Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems
Network Security - ISA 656 Intro to Firewalls
Network Security - ISA 656 Intro to s Angelos Stavrou August 28, 2007 What s a Intro to s What s a Why Use s? Traditional s Advantages Philosophies Devices examining traffic making access control decisions
SSL Tunnels. Introduction
SSL Tunnels Introduction As you probably know, SSL protects data communications by encrypting all data exchanged between a client and a server using cryptographic algorithms. This makes it very difficult,
User Authentication Job Tracking Fax Transmission via RightFax Server Secure Printing Functions HDD/Memory Security Fax to Ethernet Connection
User Authentication Job Tracking Fax Transmission via RightFax Server Secure Printing Functions HDD/Memory Security Fax to Ethernet Connection Outline How do you protect your critical confidential data?
CSE 374 Programming Concepts & Tools. Laura Campbell (Thanks to Hal Perkins) Winter 2014 Lecture 16 Version control and svn
CSE 374 Programming Concepts & Tools Laura Campbell (Thanks to Hal Perkins) Winter 2014 Lecture 16 Version control and svn Where we are Learning tools and concepts relevant to multi-file, multi-person,
TEL2821/IS2150: INTRODUCTION TO SECURITY Lab: Operating Systems and Access Control
TEL2821/IS2150: INTRODUCTION TO SECURITY Lab: Operating Systems and Access Control Version 3.4, Last Edited 9/10/2011 Students Name: Date of Experiment: Read the following guidelines before working in
User Authentication Job Tracking Fax Transmission via RightFax Server Secure Printing Functions HDD/Memory Security Fax to Ethernet Connection Data
User Authentication Job Tracking Fax Transmission via RightFax Server Secure Printing Functions HDD/Memory Security Fax to Ethernet Connection Data Security Kit Outline How do you protect your critical
The Bazaar Version Control System. Michael Hudson, Canonical Ltd michael.hudson@canonical.com
The Bazaar Version Control System Michael Hudson, Canonical Ltd michael.hudson@canonical.com What is Bazaar? Bazaar is a Distributed Version Control System (DVCS) You probably know what a VCS is by now:
Directory and File Transfer Services. Chapter 7
Directory and File Transfer Services Chapter 7 Learning Objectives Explain benefits offered by centralized enterprise directory services such as LDAP over traditional authentication systems Identify major
SMTP Servers. Determine if an email message should be sent to another machine and automatically send it to that machine using SMTP.
SMTP Servers SMTP: Simple Mail Transfer Protocol (TCP Port 25) The Simple Mail Transfer Protocol (SMTP) is an Internet standard for transferring electronic mail between computers. UNIX systems implement
IBM WebSphere Application Server Version 7.0
IBM WebSphere Application Server Version 7.0 Centralized Installation Manager for IBM WebSphere Application Server Network Deployment Version 7.0 Note: Before using this information, be sure to read the
CEN 559 Selected Topics in Computer Engineering. Dr. Mostafa H. Dahshan KSU CCIS mdahshan@ccis.ksu.edu.sa
CEN 559 Selected Topics in Computer Engineering Dr. Mostafa H. Dahshan KSU CCIS mdahshan@ccis.ksu.edu.sa Access Control Access Control Which principals have access to which resources files they can read
Data Stored on a Windows Computer Connected to a Network
Attachment A Form to Describe Sensitive Data Security Plan For the Use of Sensitive Data from The National Longitudinal Study of Adolescent to Adult Health Data Stored on a Windows Computer Connected to
Pragmatic Version Control
Extracted from: Pragmatic Version Control using Subversion, 2nd Edition This PDF file contains pages extracted from Pragmatic Version Control, one of the Pragmatic Starter Kit series of books for project
Secure Shell Demon setup under Windows XP / Windows Server 2003
Secure Shell Demon setup under Windows XP / Windows Server 2003 Configuration inside of Cygwin $ chgrp Administrators /var/{run,log,empty} $ chown Administrators /var/{run,log,empty} $ chmod 775 /var/{run,log}
05.0 Application Development
Number 5.0 Policy Owner Information Security and Technology Policy Application Development Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 5. Application Development
Local File Sharing in Linux
Local File Sharing in Linux Would you like to share files among multiple users on the same Linux system? Surprisingly, this is trickier to accomplish than it appears, so here is a method that works. The
Likewise Security Benefits
Likewise Enterprise Likewise Security Benefits AUTHOR: Manny Vellon Chief Technology Officer Likewise Software Abstract This document describes how Likewise improves the security of Linux and UNIX computers
FINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE
Purpose: This procedure identifies what is required to ensure the development of a secure application. Procedure: The five basic areas covered by this document include: Standards for Privacy and Security
RemotelyAnywhere. Security Considerations
RemotelyAnywhere Security Considerations Table of Contents Introduction... 3 Microsoft Windows... 3 Default Configuration... 3 Unused Services... 3 Incoming Connections... 4 Default Port Numbers... 4 IP
Version control. HEAD is the name of the latest revision in the repository. It can be used in subversion rather than the latest revision number.
Version control Version control is a powerful tool for many kinds of work done over a period of time, including writing papers and theses as well as writing code. This session gives a introduction to a
System Security Fundamentals
System Security Fundamentals Alessandro Barenghi Dipartimento di Elettronica, Informazione e Bioingegneria Politecnico di Milano alessandro.barenghi - at - polimi.it April 28, 2015 Lesson contents Overview
Security Advice for Instances in the HP Cloud
Security Advice for Instances in the HP Cloud Introduction: HPCS protects the infrastructure and management services offered to customers including instance provisioning. An instance refers to a virtual
Firewalls 1 / 43. Firewalls
What s a Firewall Why Use? Tradttional by Analogy Should We Fix the Network Protocols Instead? Firewall Advantages Schematic of a Firewall Conceptual Pieces The DMZ Positioning Why Administrative Domains?
Git Basics. Christopher Simpkins chris.simpkins@gatech.edu. Chris Simpkins (Georgia Tech) CS 2340 Objects and Design CS 1331 1 / 22
Git Basics Christopher Simpkins chris.simpkins@gatech.edu Chris Simpkins (Georgia Tech) CS 2340 Objects and Design CS 1331 1 / 22 Version Control Systems Records changes to files over time Allows you to
Data Stored on a Windows Server Connected to a Network
Attachment A Form to Describe Sensitive Data Security Plan For the Use of Sensitive Data from The National Longitudinal Study of Adolescent to Adult Health Data Stored on a Windows Server Connected to
2 Installing Privileged User Manager 2.3
NetIQ Privileged User Manager 2.3.2 Release Notes January, 2013 1 Documentation The following sources provide information about Privileged User Manager: Privileged User Manager 2.3 Documentation Site (http://www.novell.com/documentation/
Managing your e-mail accounts
Managing your e-mail accounts Introduction While at Rice University, you will receive an e-mail account that will be used for most of your on-campus correspondence. Other tutorials will tell you how to
Virtualization Case Study
INDUSTRY Finance COMPANY PROFILE Major Financial Institution. BUSINESS SITUATION Internal security audits found that VMware ESX, Red Hat Linux, and Solaris systems lacked an efficient way to control access
Auditing and Hardening Unix Systems Using CIS benchmarks on SUSE Linux
Auditing and Hardening Unix Systems Using CIS benchmarks on SUSE Linux André Carrington, P.Eng, CISSP, CISM Unix experience: 13 years SunOS; NeXTSTEP; Sun Interactive; Wyse Unix; BSD; Solaris; QNX; HP-UX;
Data Stored on a Windows Computer Connected to a Network
Attachment A Form to Describe Sensitive Data Security Plan For the Use of Sensitive Data from The National Longitudinal Study of Adolescent to Adult Health Data Stored on a Windows Computer Connected to
Incremental Backup Script. Jason Healy, Director of Networks and Systems
Incremental Backup Script Jason Healy, Director of Networks and Systems Last Updated Mar 18, 2008 2 Contents 1 Incremental Backup Script 5 1.1 Introduction.............................. 5 1.2 Design Issues.............................
2- Electronic Mail (SMTP), File Transfer (FTP), & Remote Logging (TELNET)
2- Electronic Mail (SMTP), File Transfer (FTP), & Remote Logging (TELNET) There are three popular applications for exchanging information. Electronic mail exchanges information between people and file
Written by: Johan Strand, Reviewed by: Chafic Nassif, Date: 2006-04-26. Getting an ipath server running on Linux
Getting an ipath server running on Linux Table of Contents Table of Contents... 2 1.0. Introduction... 3 2.0. Overview... 3 3.0. Installing Linux... 3 4.0. Installing software that ipath requires... 3
Basic Requirements...2. Software Requirements...2. Mailbox...2. Gatekeeper...3. Plan Your Setup...3. Meet Extreme Processing...3. Script Editor...
Guide on EDI automation and use of VAN services Copyright 2008-2009 Etasoft Inc. Main website http://www.etasoft.com Extreme Processing website http://www.xtranslator.com Basic Requirements...2 Software
Continuous Integration. CSC 440: Software Engineering Slide #1
Continuous Integration CSC 440: Software Engineering Slide #1 Topics 1. Continuous integration 2. Configuration management 3. Types of version control 1. None 2. Lock-Modify-Unlock 3. Copy-Modify-Merge
White Paper BMC Remedy Action Request System Security
White Paper BMC Remedy Action Request System Security June 2008 www.bmc.com Contacting BMC Software You can access the BMC Software website at http://www.bmc.com. From this website, you can obtain information
CloudPassage Halo Technical Overview
TECHNICAL BRIEF CloudPassage Halo Technical Overview The Halo cloud security platform was purpose-built to provide your organization with the critical protection, visibility and control needed to assure
Version Control. Luka Milovanov lmilovan@abo.fi
Version Control Luka Milovanov lmilovan@abo.fi Configuration Management Configuration management is the management of system change to software products Version management: consistent scheme of version
Using Likewise Enterprise to Boost Compliance with Sarbanes-Oxley
Likewise Enterprise Using Likewise Enterprise to Boost Compliance with Sarbanes-Oxley IMPROVE SOX COMPLIANCE WITH CENTRALIZED ACCESS CONTROL AND AUTHENTICATION With Likewise Enterprise, you get one user,
CloudPassage Halo Technical Overview
TECHNICAL BRIEF CloudPassage Halo Technical Overview The Halo cloud security platform was purpose-built to provide your organization with the critical protection, visibility and control needed to assure
Distributed File Systems Part I. Issues in Centralized File Systems
Distributed File Systems Part I Daniel A. Menascé File Naming Issues in Centralized File Systems c:\courses\cs571\procs.ps (MS-DOS) /usr/menasce/courses/cs571/processes.ps (UNIX) File Structure bitstream
CIS 551 / TCOM 401 Computer and Network Security
CIS 551 / TCOM 401 Computer and Network Security Spring 2007 Lecture 3 1/18/07 CIS/TCOM 551 1 Announcements Email project groups to Jeff (vaughan2 AT seas.upenn.edu) by Jan. 25 Start your projects early!
XGENPLUS SECURITY FEATURES...
Security Features Table of Contents TABLE OF CONTENTS... 2 1. INTRODUCTION... 3 2. XGENPLUS SECURITY FEATURES... 3 3. SERVER LEVEL FEATURES... 5 4. DOMAIN LEVEL FEATURES... 8 5. USER LEVEL FEATURES...
Configuring Your Email Client: Outlook Express
Configuring Your Email Client: Outlook Express Information in this document created by Webmail.us and provided by Bare Feet Studios. Table of Contents Chapter 1. Introduction... 1-1 What is an Email Client?...
SYSTEM ADMINISTRATION MTAT.08.021 LECTURE 8 SECURITY
SYSTEM ADMINISTRATION MTAT.08.021 LECTURE 8 SECURITY Prepared By: Amnir Hadachi and Artjom Lind University of Tartu, Institute of Computer Science amnir.hadachi@ut.ee / artjom.lind@ut.ee 1 OUTLINE 1.Is
Server Security. Contents. Is Rumpus Secure? 2. Use Care When Creating User Accounts 2. Managing Passwords 3. Watch Out For Aliases 4
Contents Is Rumpus Secure? 2 Use Care When Creating User Accounts 2 Managing Passwords 3 Watch Out For Aliases 4 Deploy A Firewall 5 Minimize Running Applications And Processes 5 Manage Physical Access
IT Support Tracking with Request Tracker (RT)
IT Support Tracking with Request Tracker (RT) Archibald Steiner AfNOG 2013 LUSAKA Overview What is RT? A bit of terminology Demonstration of the RT web interface Behind the scenes configuration options
Desktop : Ubuntu 10.04 Desktop, Ubuntu 12.04 Desktop Server : RedHat EL 5, RedHat EL 6, Ubuntu 10.04 Server, Ubuntu 12.04 Server, CentOS 5, CentOS 6
201 Datavoice House, PO Box 267, Stellenbosch, 7599 16 Elektron Avenue, Technopark, Tel: +27 218886500 Stellenbosch, 7600 Fax: +27 218886502 Adept Internet (Pty) Ltd. Reg. no: 1984/01310/07 VAT No: 4620143786
Linux Network Administration
Linux Network Administration Sendmail Evolution of Email The birth of electronic mail (email) occurred in the early 1960s The mailbox was a file in a user's home directory that was readable only by that
Introduction. Friday, June 21, 2002
This article is intended to give you a general understanding how ArGoSoft Mail Server Pro, and en Email, in general, works. It does not give you step-by-step instructions; it does not walk you through
How To Fix A Snare Server On A Linux Server On An Ubuntu 4.5.2 (Amd64) (Amd86) (For Ubuntu) (Orchestra) (Uniden) (Powerpoint) (Networking
Snare System Version 6.3.5 Release Notes is pleased to announce the release of Snare Server Version 6.3.5. Snare Server Version 6.3.5 Bug Fixes: The Agent configuration retrieval functionality within the
Talk Internet User Guides Controlgate Administrative User Guide
Talk Internet User Guides Controlgate Administrative User Guide Contents Contents (This Page) 2 Accessing the Controlgate Interface 3 Adding a new domain 4 Setup Website Hosting 5 Setup FTP Users 6 Setup
CMSC 421, Operating Systems. Fall 2008. Security. URL: http://www.csee.umbc.edu/~kalpakis/courses/421. Dr. Kalpakis
CMSC 421, Operating Systems. Fall 2008 Security Dr. Kalpakis URL: http://www.csee.umbc.edu/~kalpakis/courses/421 Outline The Security Problem Authentication Program Threats System Threats Securing Systems
Google Apps and Open Directory. Randy Saeks Twitter: @rsaeks http://www.techrecess.com
Google Apps and Open Directory Randy Saeks Twitter: @rsaeks http://www.techrecess.com Agenda Quick Google Apps Overview Structure Setup Preparing OD Configuration Q&A&S Resources http://techrecess.com/technical-papers/gapps/
Configuration Task 3: (Optional) As part of configuration, you can deploy rules. For more information, see "Deploy Inbox Rules" below.
Configure the E-mail Router After the E-mail Router has been installed, you can configure several aspects of it. Some of these configuration tasks are mandatory. Others are optional in that you use them
Practical Mac OS X Insecurity. Security Concepts, Problems and Exploits on your Mac
Practical Mac OS X Insecurity Security Concepts, Problems and Exploits on your Mac Who am I? Student of physics, mathematics and astronomy in Bonn Mac user since 1995 I love Macs Mac evangelist Intentions
Features. The Samhain HIDS. Overview of available features. Rainer Wichmann
Overview of available features November 1, 2011 POSIX (e.g. Linux, *BSD, Solaris 2.x, AIX 5.x, HP-UX 11, and Mac OS X. Windows 2000 / WindowsXP with POSIX emulation (e.g. Cygwin). Please note that this
Before starting to use the new system you will need to know the password to your e-wire email account.
Contents E-Wire Email Configuration and Migration... 2 Webmail... 2 Migration Process... 2 POP Accounts... 3 Checking Current POP Configuration... 3 POP Migration Process... 5 IMAP Accounts... 6 IMAP Migration
APPENDIX 4 GREATER LONDON AUTHORITY SUN ACCOUNTS UNIX REVIEW FINAL AUDIT REPORT. Auditor: Chris Power & Michael Lacey Date: April 2003 Reference: 320
APPENDIX 4 GREATER LONDON AUTHORITY SUN ACCOUNTS UNIX REVIEW FINAL AUDIT REPORT Auditor: Chris Power & Michael Lacey Date: April Reference: 320 Table of Contents 1 INTRODUCTION 2 Page 2 OBJECTIVES AND
View access control as a matrix Subjects (processes/users) access objects (e.g., files) Each cell of matrix has allowed permissions
p. 1/3 View access control as a matrix Subjects (processes/users) access objects (e.g., files) Each cell of matrix has allowed permissions p. 2/3 Specifying policy Manually filling out matrix would be
Using LDAP Authentication in a PowerCenter Domain
Using LDAP Authentication in a PowerCenter Domain 2008 Informatica Corporation Overview LDAP user accounts can access PowerCenter applications. To provide LDAP user accounts access to the PowerCenter applications,
QMAIL & SMTP: A Secure Application for an Unsecure Protocol. Orr Dunkelman. orrd@vipe.technion.ac.il. January 27, 2004 SMTP and QMAIL Slide 1
QMAIL & SMTP: A Secure Application for an Unsecure Protocol Orr Dunkelman January 27, 2004 SMTP and QMAIL Slide 1 SMTP, MUA and MTA Speak English Whenever we deal with protocols we (=Internet geeks) like
Thick Client Application Security
Thick Client Application Security Arindam Mandal (arindam.mandal@paladion.net) (http://www.paladion.net) January 2005 This paper discusses the critical vulnerabilities and corresponding risks in a two
Operating System Security
Operating System Security Klaus Schütz Windows OS Security Microsoft Redmond Before I start My VP love(d) me A frustrated friend 1 Agenda Evolution of Threats Client vs. Server Security Operating System
Nixu SNS Security White Paper May 2007 Version 1.2
1 Nixu SNS Security White Paper May 2007 Version 1.2 Nixu Software Limited Nixu Group 2 Contents 1 Security Design Principles... 3 1.1 Defense in Depth... 4 1.2 Principle of Least Privilege... 4 1.3 Principle
Enabling Active Directory Authentication with ESX Server 1
1 Enabling Active Directory Authentication with ESX Server 1 This document provides information about how to configure ESX Server to use Active Directory for authentication. ESX Server system includes
3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management
What is an? s Ten Most Critical Web Application Security Vulnerabilities Anthony LAI, CISSP, CISA Chapter Leader (Hong Kong) anthonylai@owasp.org Open Web Application Security Project http://www.owasp.org
How To Manage Web Content Management System (Wcm)
WEB CONTENT MANAGEMENT SYSTEM February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in
Remote Administration
Windows Remote Desktop, page 1 pcanywhere, page 3 VNC, page 7 Windows Remote Desktop Remote Desktop permits users to remotely execute applications on Windows Server 2008 R2 from a range of devices over
Quick Scan Features Setup Guide
Xerox WorkCentre 7132 Quick Scan Features Setup Guide 701P45042 This guide includes instructions for: Scan to Email on page 1 Scan to Mailbox Setup (Optional) on page 5 Network Scanning Setup (Optional)
Setup Guide. Email Archiving for Microsoft Exchange Server 2007
Setup Guide Email Archiving for Microsoft Exchange Server 2007 COPYRIGHT Copyright 2012 McAfee, Inc. Do not copy without permission. TRADEMARK ATTRIBUTIONS McAfee, the McAfee logo, McAfee Active Protection,
15 AFS File Sharing. Client/Server Computing. Distributed File Systems
15 AFS File Sharing Adapted from the Open AFS Guide, http://openafs.org/doc/ AFS makes it easy for people to work together on the same files, no matter where the files are located. AFS users do not have
Unifying Information Security. Implementing TLS on the CLEARSWIFT SECURE Email Gateway
Unifying Information Security Implementing TLS on the CLEARSWIFT SECURE Email Gateway Contents 1 Introduction... 3 2 Understanding TLS... 4 3 Clearswift s Application of TLS... 5 3.1 Opportunistic TLS...
Module 7 Security CS655! 7-1!
Module 7 Security CS655! 7-1! Issues Separation of! Security policies! Precise definition of which entities in the system can take what actions! Security mechanism! Means of enforcing that policy! Distributed
enicq 5 System Administrator s Guide
Vermont Oxford Network enicq 5 Documentation enicq 5 System Administrator s Guide Release 2.0 Published November 2014 2014 Vermont Oxford Network. All Rights Reserved. enicq 5 System Administrator s Guide
Lab 0: Version control
Lab Handout ENGI3891 Faculty of Engineering and Applied Science 16,23 Sep 2015 1 Purpose and outcomes This lab will give you hands-on experience with an essential development tool: a version control system
Version Control with. Ben Morgan
Version Control with Ben Morgan Developer Workflow Log what we did: Add foo support Edit Sources Add Files Compile and Test Logbook ======= 1. Initial version Logbook ======= 1. Initial version 2. Remove
Configuring Your Email Client: Outlook Express. Quick Reference
Configuring Your Email Client: Outlook Express Quick Reference Table of Contents Chapter 1. Introduction...1-1 What is an Email Client?...1-1 Who Should Read This Manual?...1-1 POP, IMAP, and SSL: Which
StarterPlus Mailbox Email Software Setup Guide
StarterPlus Mailbox Email Software Setup Guide Setting up an StarterPlus mailbox only takes a few minutes. You can set up any email software to send and receive email from your mailbox. You can connect
Last Updated: July 2011. STATISTICA Enterprise Server Security
Last Updated: July 2011 STATISTICA Enterprise Server Security STATISTICA Enterprise Server Security Page 2 of 10 Table of Contents Executive Summary... 3 Introduction to STATISTICA Enterprise Server...
Workflow Templates Library
Workflow s Library Table of Contents Intro... 2 Active Directory... 3 Application... 5 Cisco... 7 Database... 8 Excel Automation... 9 Files and Folders... 10 FTP Tasks... 13 Incident Management... 14 Security
CIS 551 / TCOM 401 Computer and Network Security. Spring 2005 Lecture 4
CIS 551 / TCOM 401 Computer and Network Security Spring 2005 Lecture 4 Access Control: The Big Picture Objects - resources being protected E.g. files, devices, etc. Subjects - active entities E.g. processes,
Access Control Lists in Linux & Windows
Access Control Lists in Linux & Windows Vasudevan Nagendra & Yaohui Chen Categorization: Access Control Mechanisms Discretionary Access Control (DAC): Owner of object specifies who can access object (files/directories)
USERS MANUAL FOR OWL A DOCUMENT REPOSITORY SYSTEM
USERS MANUAL FOR OWL A DOCUMENT REPOSITORY SYSTEM User Manual Table of Contents Introducing OWL...3 Starting to use Owl...4 The Logging in page...4 Using the browser...6 Folder structure...6 Title Bar...6
Scheduling in SAS 9.3
Scheduling in SAS 9.3 SAS Documentation The correct bibliographic citation for this manual is as follows: SAS Institute Inc 2011. Scheduling in SAS 9.3. Cary, NC: SAS Institute Inc. Scheduling in SAS 9.3
Dell KACE K1000 System Management Appliance Version 5.4. Service Desk Administrator Guide
Dell KACE K1000 System Management Appliance Version 5.4 Service Desk Administrator Guide October 2012 2004-2012 Dell Inc. All rights reserved. Reproduction of these materials in any manner whatsoever without
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks
Windows Security. CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger. www.cse.psu.edu/~tjaeger/cse497b-s07/
Windows Security CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse497b-s07/ Windows Security 0 to full speed No protection system in early versions
Active Directory Self-Service FAQ
Active Directory Self-Service FAQ General Information: info@cionsystems.com Online Support: support@cionsystems.com CionSystems Inc. Mailing Address: 16625 Redmond Way, Ste M106 Redmond, WA. 98052 http://www.cionsystems.com
Architecture and Mode of Operation
Software- und Organisations-Service Open Source Scheduler Architecture and Mode of Operation Software- und Organisations-Service GmbH www.sos-berlin.com Scheduler worldwide Open Source Users and Commercial
Snare System Version 6.3.3 Release Notes
Snare System Version 6.3.3 Release Notes is pleased to announce the release of Snare Server Version 6.3.3. Snare Server Version 6.3.3 Bug Fixes: Implemented enhanced memory management features within the
TFS UnixControl White Paper
White Paper Consolidate and simplify UNIX system management with TFS UnixControl TFS Technology www.tfstech.com Table of Contents Overview 3 Introduction 3 TFS UnixControl Functionality 3 System Architecture
Snare System Version 6.3.4 Release Notes
Snare System Version 6.3.4 Release Notes is pleased to announce the release of Snare Server Version 6.3.4. Snare Server Version 6.3.4 New Features The behaviour of the Snare Server reflector has been modified
Linux VPS with cpanel. Getting Started Guide
Linux VPS with cpanel Getting Started Guide First Edition October 2010 Table of Contents Introduction...1 cpanel Documentation...1 Accessing your Server...2 cpanel Users...2 WHM Interface...3 cpanel Interface...3
CISC 275: Introduction to Software Engineering. Lab 5: Introduction to Revision Control with. Charlie Greenbacker University of Delaware Fall 2011
CISC 275: Introduction to Software Engineering Lab 5: Introduction to Revision Control with Charlie Greenbacker University of Delaware Fall 2011 Overview Revision Control Systems in general Subversion
APPLICATION LAYER: TELNET, EMAIL. By Nidhi Jindal
APPLICATION LAYER: TELNET, EMAIL. By Nidhi Jindal TELNET In the Internet, users may want to run application programs at a remote site & create results that can be transferred to their local site. Students
Git - Working with Remote Repositories
Git - Working with Remote Repositories Handout New Concepts Working with remote Git repositories including setting up remote repositories, cloning remote repositories, and keeping local repositories in-sync
Deciphering the Safe Harbor on Breach Notification: The Data Encryption Story
Deciphering the Safe Harbor on Breach Notification: The Data Encryption Story Healthcare organizations planning to protect themselves from breach notification should implement data encryption in their