Case Studies. Joint software development Mail 1 / 38. Case Studies Joint Software Development. Mailers
|
|
|
- Shannon Ramsey
- 8 years ago
- Views:
Transcription
1 Joint software development Mail 1 / 38
2 Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications 2 / 38
3 Situations Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications Small team on a single machine Medium-to-large team on a LAN Large, distributed team, spread among several organizations 3 / 38
4 Roles Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications Developer (i.e., can commit changes) Tester Code reviewer 4 / 38
5 Permissions Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications We want the technical mechanisms to reflect the organizational roles The real challenge: mapping the organizational structure to OS primitives Why? 5 / 38
6 Why Enforce Access Controls? Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications Protect software from outsiders reading/stealing it Protect against unauthorized changes Know who made certain changes? 6 / 38
7 Unix Setup Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications Put all developers in a certain group Make files and directories group readable/writable Decision to turn off other read access is site-dependent 7 / 38
8 Windows ACL Setup Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications Could add each developer individually Bad idea if a developer leaves or joins the group, many ACLs must be updated Still want to use groups; vary group membership instead Advantage: can have multiple sets of group permissions why? 8 / 38
9 Reviewer/Tester Access Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications Reviewers and testers need read access They do not need write access No good, built-in solution on classic Unix With ACLs, one group can have r/w permissions; another can have r permissions 9 / 38
10 Medium-Size Group Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications No longer on single machine with simple file permissions More need for change-tracking More formal organizational structure 10 / 38
11 Basic Structure Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications Basic permission structure should be the same Again: use group permissions as the fundamental permission unit Limits of non-acl systems become more critical 11 / 38
12 Version Control Systems Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications For medium-size projects, use of a version control system (i.e., CVS, Subversion, Mercurial, RCS, etc.) is mandatory (Why?) What are the permission implications of a version control system? 12 / 38
13 Structure of a VCS Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications Repository Master copy; records all changes, versions, etc. Working copies Zero or more working copies. Developers check out a version from the repository, make changes, and commit the changes 13 / 38
14 Why use a VCS? Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications Auditability who made which change? When was a given change made? Can you roll back to a known-clean version of the codebase? What patches have been applied to which versions of the system? 14 / 38
15 Note Well Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications All of those features are important just for manageability Security needs are strictly greater we have to deal with active malfeasance as well as ordinary bugs and failures 15 / 38
16 Permission Structure Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications Here are the Unix commands for RCS, CVS, Mercurial, and Subversion. What are the implications? $ ls -l /usr/bin/ci /usr/bin/cvs \ /usr/pkg/bin/hg /usr/pkg/bin/svn -r-xr-xr-x 1 root wheel /usr/bin/ci -r-xr-xr-x 1 root wheel /usr/bin/cvs -rwxr-xr-x 1 root wheel /usr/pkg/bin/hg -rwxr-xr-x 1 root wheel /usr/pkg/bin/svn 16 / 38
17 They re Not SetUID! Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications They execute with the permissions of the invoker They could try to do access control, but it s meaningless anyone else could write code to do the same things The permission structure of the repository is what s important 17 / 38
18 The Repository Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications Essential feature: developers must have write permission on the directories File permissions are irrelevant; old files can be renamed and unlinked instead of being overwritten (Potential for annoyance if new directories are created with the wrong permission must set umask properly) But what prevents a developer with write permission on the respository from doing nasty things? Nothing / 38
19 Large Organization Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications Use client/server model for repository access Most users (including developers) have no direct access to the VCS repository Either build access control into VCS server or layer on top of underlying OS permissions But must restrict what commands can be executed on repository by developers 19 / 38
20 Complications Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems Structure of a VCS Why use a VCS? Note Well Permission Structure They re Not SetUID! The Repository Large Organization Complications If you rely on OS permissions, something has to have root privileges, to let the repository part of the process run as that user If the VCS itself has a root component, is it trustable? If you use, say, ssh, is the command restriction mechanism trustable? If you rely on VCS permissions, you need to implement a reliable authentication and ACL mechanism All of this is possible but is it secure? 20 / 38
21 Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? 21 / 38
22 Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Issue of interest: local mail delivery and retrieval Surprisingly enough, network doesn t add (too much) security complexity 22 / 38
23 Issues Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? must be reliable Users must be able to send to any other users The system should reliably identify the sender of each note All s should be logged Locking is often necessary to prevent race conditions when reading and writing a mailbox Authentication 23 / 38
24 Accepting Mail Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Must accept mail from users Copy it, either to protected spool directory for network delivery or directly to recipient s mailbox 24 / 38
25 Spool Directory Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? If the mailer is setuid, it can copy the to a protected directory with no trouble If the directory is world-writable but not world-readable, you don t even need setuid add a random component to the filenames to prevent overwriting (Homework submission script does this) File owner is automatically set correctly, for use in generating From: line 25 / 38
26 However... Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Cannot securely write metadata for such directories others could overwrite the metadata file (But if the spooler is executable but not readable, can it have a secret string to add to the filename? No figure out why!) Cannot prevent users from overwriting their own pending Listing the mail queue still requires privilege 26 / 38
27 Local Access or Client/Server? Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? For client/server, issues are similar to VCS: authentication, root programs, restricting actions, etc For local access, must confront permission issues This is complicated by the many different versions of Unix over the years 27 / 38
28 Client/Server Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Standardized, (relatively) simple access protocols, POP and IMAP For ISP or large enterprise, neither need nor want general shell-type access to mail server Large system mailers have their own authentication database Does not rely on OS permissions But a mail server bug exposes the entire mail repository Also how do users change their passwords? 28 / 38
29 Bug Containment Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Separate programs into two sections: Small, simple section that does authentication and changes uid (must run as root) Large section that runs as that user Major advantage: security holes in large section don t matter, since it has no special privileges Much more on program structure later in the semester 29 / 38
30 Local Mail Storage Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Where is mail stored? Central mailbox directory or user s home directory? Note that mail delivery program must be able to (a) create, and (b) write to mailboxes If mailbox is in the user s directory, mail delivery program must have root permissions 30 / 38
31 Central Mail Directory Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? We can put all mailboxes in, say, /var/mail What are the permissions on it? If it s writable by group mail, delivery daemon can create new mailboxes Make mailboxes writable by group mail, and owned by the recipient? Permits non-root delivery but how do new mailboxes get created and owned by the user? 31 / 38
32 Dangers of User-Writable Mailbox Directories Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Permission escalation Vandalism Denial of service ln -s /etc/passwd /var/mail/me rm /var/mail/you touch /var/mail/does-not-exist-yet 32 / 38
33 Defending Against These Attacks Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Escalation Check mailbox permissions and ownership before writing (note: watch for race conditions) Vandalism Set sticky bit on directory DoS Remove (or change ownership of) mailboxes with wrong ownership Note well: most of these are trickier than they seem 33 / 38
34 Delivering Mail to a Program Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Most mail systems permit delivery of to a program Must execute that program as the appropriate user (Who is the appropriate user? Note that on Solaris, you may (depending on system configuration) be able to give away files) Implies the need for root privileges by the local delivery program 34 / 38
35 Privileged Programs Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? What must be privileged? What privileges? Local delivery needs some privileges, frequently root Delivery to a program always requires root The mail reader? 35 / 38
36 Privileged Mail Readers Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? The System V mail reader was setgid to group mail Could delete empty mailboxes More importantly, could create lock files by linking in the mailbox directory But note the danger if the mailer was buggy You don t give privileges to a whale (about 21K lines of code... ) 36 / 38
37 Many More Subtleties Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? Writing a mailer is hard I ve barely scratched the surface of the design decisions, even the permission-related ones Complicated by varying system semantics 37 / 38
38 Why is it Hard? Issues Accepting Mail Spool Directory However... Local Access or Client/Server? Client/Server Bug Containment Local Mail Storage Central Mail Directory Dangers of User-Writable Mailbox Directories Defending Against These Attacks Delivering Mail to a Program Privileged Programs Privileged Mail Readers Many More Subtleties Why is it Hard? cross protection boundaries That is, they copy data from one permission context to another Both can be arbitrary userids Simply importing data to a userid is a lot easier In addition, a lot of functionality is needed Not surprisingly, mailers have a very poor security record 38 / 38
Case Study: Access control 1 / 39
Case Study: Access control 1 / 39 Joint software development Mail 2 / 39 Situations Roles Permissions Why Enforce Access Controls? Classic Unix Setup ACL Setup Reviewer/Tester Access Medium-Size Group
Network Security - ISA 656 Intro to Firewalls
Network Security - ISA 656 Intro to s Angelos Stavrou August 28, 2007 What s a Intro to s What s a Why Use s? Traditional s Advantages Philosophies Devices examining traffic making access control decisions
SSL Tunnels. Introduction
SSL Tunnels Introduction As you probably know, SSL protects data communications by encrypting all data exchanged between a client and a server using cryptographic algorithms. This makes it very difficult,
User Authentication Job Tracking Fax Transmission via RightFax Server Secure Printing Functions HDD/Memory Security Fax to Ethernet Connection
User Authentication Job Tracking Fax Transmission via RightFax Server Secure Printing Functions HDD/Memory Security Fax to Ethernet Connection Outline How do you protect your critical confidential data?
CSE 374 Programming Concepts & Tools. Laura Campbell (Thanks to Hal Perkins) Winter 2014 Lecture 16 Version control and svn
CSE 374 Programming Concepts & Tools Laura Campbell (Thanks to Hal Perkins) Winter 2014 Lecture 16 Version control and svn Where we are Learning tools and concepts relevant to multi-file, multi-person,
FINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE
Purpose: This procedure identifies what is required to ensure the development of a secure application. Procedure: The five basic areas covered by this document include: Standards for Privacy and Security
TEL2821/IS2150: INTRODUCTION TO SECURITY Lab: Operating Systems and Access Control
TEL2821/IS2150: INTRODUCTION TO SECURITY Lab: Operating Systems and Access Control Version 3.4, Last Edited 9/10/2011 Students Name: Date of Experiment: Read the following guidelines before working in
User Authentication Job Tracking Fax Transmission via RightFax Server Secure Printing Functions HDD/Memory Security Fax to Ethernet Connection Data
User Authentication Job Tracking Fax Transmission via RightFax Server Secure Printing Functions HDD/Memory Security Fax to Ethernet Connection Data Security Kit Outline How do you protect your critical
Pragmatic Version Control
Extracted from: Pragmatic Version Control using Subversion, 2nd Edition This PDF file contains pages extracted from Pragmatic Version Control, one of the Pragmatic Starter Kit series of books for project
The Bazaar Version Control System. Michael Hudson, Canonical Ltd michael.hudson@canonical.com
The Bazaar Version Control System Michael Hudson, Canonical Ltd michael.hudson@canonical.com What is Bazaar? Bazaar is a Distributed Version Control System (DVCS) You probably know what a VCS is by now:
Directory and File Transfer Services. Chapter 7
Directory and File Transfer Services Chapter 7 Learning Objectives Explain benefits offered by centralized enterprise directory services such as LDAP over traditional authentication systems Identify major
SMTP Servers. Determine if an email message should be sent to another machine and automatically send it to that machine using SMTP.
SMTP Servers SMTP: Simple Mail Transfer Protocol (TCP Port 25) The Simple Mail Transfer Protocol (SMTP) is an Internet standard for transferring electronic mail between computers. UNIX systems implement
IBM WebSphere Application Server Version 7.0
IBM WebSphere Application Server Version 7.0 Centralized Installation Manager for IBM WebSphere Application Server Network Deployment Version 7.0 Note: Before using this information, be sure to read the
CEN 559 Selected Topics in Computer Engineering. Dr. Mostafa H. Dahshan KSU CCIS mdahshan@ccis.ksu.edu.sa
CEN 559 Selected Topics in Computer Engineering Dr. Mostafa H. Dahshan KSU CCIS mdahshan@ccis.ksu.edu.sa Access Control Access Control Which principals have access to which resources files they can read
Managing your e-mail accounts
Managing your e-mail accounts Introduction While at Rice University, you will receive an e-mail account that will be used for most of your on-campus correspondence. Other tutorials will tell you how to
Data Stored on a Windows Computer Connected to a Network
Attachment A Form to Describe Sensitive Data Security Plan For the Use of Sensitive Data from The National Longitudinal Study of Adolescent to Adult Health Data Stored on a Windows Computer Connected to
Secure Shell Demon setup under Windows XP / Windows Server 2003
Secure Shell Demon setup under Windows XP / Windows Server 2003 Configuration inside of Cygwin $ chgrp Administrators /var/{run,log,empty} $ chown Administrators /var/{run,log,empty} $ chmod 775 /var/{run,log}
05.0 Application Development
Number 5.0 Policy Owner Information Security and Technology Policy Application Development Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 5. Application Development
CloudPassage Halo Technical Overview
TECHNICAL BRIEF CloudPassage Halo Technical Overview The Halo cloud security platform was purpose-built to provide your organization with the critical protection, visibility and control needed to assure
Local File Sharing in Linux
Local File Sharing in Linux Would you like to share files among multiple users on the same Linux system? Surprisingly, this is trickier to accomplish than it appears, so here is a method that works. The
CIS 551 / TCOM 401 Computer and Network Security
CIS 551 / TCOM 401 Computer and Network Security Spring 2007 Lecture 3 1/18/07 CIS/TCOM 551 1 Announcements Email project groups to Jeff (vaughan2 AT seas.upenn.edu) by Jan. 25 Start your projects early!
Likewise Security Benefits
Likewise Enterprise Likewise Security Benefits AUTHOR: Manny Vellon Chief Technology Officer Likewise Software Abstract This document describes how Likewise improves the security of Linux and UNIX computers
CloudPassage Halo Technical Overview
TECHNICAL BRIEF CloudPassage Halo Technical Overview The Halo cloud security platform was purpose-built to provide your organization with the critical protection, visibility and control needed to assure
RemotelyAnywhere. Security Considerations
RemotelyAnywhere Security Considerations Table of Contents Introduction... 3 Microsoft Windows... 3 Default Configuration... 3 Unused Services... 3 Incoming Connections... 4 Default Port Numbers... 4 IP
Version control. HEAD is the name of the latest revision in the repository. It can be used in subversion rather than the latest revision number.
Version control Version control is a powerful tool for many kinds of work done over a period of time, including writing papers and theses as well as writing code. This session gives a introduction to a
2- Electronic Mail (SMTP), File Transfer (FTP), & Remote Logging (TELNET)
2- Electronic Mail (SMTP), File Transfer (FTP), & Remote Logging (TELNET) There are three popular applications for exchanging information. Electronic mail exchanges information between people and file
Incremental Backup Script. Jason Healy, Director of Networks and Systems
Incremental Backup Script Jason Healy, Director of Networks and Systems Last Updated Mar 18, 2008 2 Contents 1 Incremental Backup Script 5 1.1 Introduction.............................. 5 1.2 Design Issues.............................
White Paper BMC Remedy Action Request System Security
White Paper BMC Remedy Action Request System Security June 2008 www.bmc.com Contacting BMC Software You can access the BMC Software website at http://www.bmc.com. From this website, you can obtain information
Security Advice for Instances in the HP Cloud
Security Advice for Instances in the HP Cloud Introduction: HPCS protects the infrastructure and management services offered to customers including instance provisioning. An instance refers to a virtual
3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management
What is an? s Ten Most Critical Web Application Security Vulnerabilities Anthony LAI, CISSP, CISA Chapter Leader (Hong Kong) anthonylai@owasp.org Open Web Application Security Project http://www.owasp.org
Firewalls 1 / 43. Firewalls
What s a Firewall Why Use? Tradttional by Analogy Should We Fix the Network Protocols Instead? Firewall Advantages Schematic of a Firewall Conceptual Pieces The DMZ Positioning Why Administrative Domains?
Git Basics. Christopher Simpkins chris.simpkins@gatech.edu. Chris Simpkins (Georgia Tech) CS 2340 Objects and Design CS 1331 1 / 22
Git Basics Christopher Simpkins chris.simpkins@gatech.edu Chris Simpkins (Georgia Tech) CS 2340 Objects and Design CS 1331 1 / 22 Version Control Systems Records changes to files over time Allows you to
Data Stored on a Windows Server Connected to a Network
Attachment A Form to Describe Sensitive Data Security Plan For the Use of Sensitive Data from The National Longitudinal Study of Adolescent to Adult Health Data Stored on a Windows Server Connected to
Distributed File Systems Part I. Issues in Centralized File Systems
Distributed File Systems Part I Daniel A. Menascé File Naming Issues in Centralized File Systems c:\courses\cs571\procs.ps (MS-DOS) /usr/menasce/courses/cs571/processes.ps (UNIX) File Structure bitstream
Security and Operating Systems It s the Application
What is Security? Internal Roles Protecting Whom? Operating Systems 1 / 38 What is Security? Internal Roles Protecting Whom? What is operating system security? How do operating systems contribute to system
2 Installing Privileged User Manager 2.3
NetIQ Privileged User Manager 2.3.2 Release Notes January, 2013 1 Documentation The following sources provide information about Privileged User Manager: Privileged User Manager 2.3 Documentation Site (http://www.novell.com/documentation/
View access control as a matrix Subjects (processes/users) access objects (e.g., files) Each cell of matrix has allowed permissions
p. 1/3 View access control as a matrix Subjects (processes/users) access objects (e.g., files) Each cell of matrix has allowed permissions p. 2/3 Specifying policy Manually filling out matrix would be
Virtualization Case Study
INDUSTRY Finance COMPANY PROFILE Major Financial Institution. BUSINESS SITUATION Internal security audits found that VMware ESX, Red Hat Linux, and Solaris systems lacked an efficient way to control access
System Security Fundamentals
System Security Fundamentals Alessandro Barenghi Dipartimento di Elettronica, Informazione e Bioingegneria Politecnico di Milano alessandro.barenghi - at - polimi.it April 28, 2015 Lesson contents Overview
Auditing and Hardening Unix Systems Using CIS benchmarks on SUSE Linux
Auditing and Hardening Unix Systems Using CIS benchmarks on SUSE Linux André Carrington, P.Eng, CISSP, CISM Unix experience: 13 years SunOS; NeXTSTEP; Sun Interactive; Wyse Unix; BSD; Solaris; QNX; HP-UX;
Linux Network Administration
Linux Network Administration Sendmail Evolution of Email The birth of electronic mail (email) occurred in the early 1960s The mailbox was a file in a user's home directory that was readable only by that
Enabling Active Directory Authentication with ESX Server 1
1 Enabling Active Directory Authentication with ESX Server 1 This document provides information about how to configure ESX Server to use Active Directory for authentication. ESX Server system includes
Using LDAP Authentication in a PowerCenter Domain
Using LDAP Authentication in a PowerCenter Domain 2008 Informatica Corporation Overview LDAP user accounts can access PowerCenter applications. To provide LDAP user accounts access to the PowerCenter applications,
Desktop : Ubuntu 10.04 Desktop, Ubuntu 12.04 Desktop Server : RedHat EL 5, RedHat EL 6, Ubuntu 10.04 Server, Ubuntu 12.04 Server, CentOS 5, CentOS 6
201 Datavoice House, PO Box 267, Stellenbosch, 7599 16 Elektron Avenue, Technopark, Tel: +27 218886500 Stellenbosch, 7600 Fax: +27 218886502 Adept Internet (Pty) Ltd. Reg. no: 1984/01310/07 VAT No: 4620143786
How To Fix A Snare Server On A Linux Server On An Ubuntu 4.5.2 (Amd64) (Amd86) (For Ubuntu) (Orchestra) (Uniden) (Powerpoint) (Networking
Snare System Version 6.3.5 Release Notes is pleased to announce the release of Snare Server Version 6.3.5. Snare Server Version 6.3.5 Bug Fixes: The Agent configuration retrieval functionality within the
Data Stored on a Windows Computer Connected to a Network
Attachment A Form to Describe Sensitive Data Security Plan For the Use of Sensitive Data from The National Longitudinal Study of Adolescent to Adult Health Data Stored on a Windows Computer Connected to
CMSC 421, Operating Systems. Fall 2008. Security. URL: http://www.csee.umbc.edu/~kalpakis/courses/421. Dr. Kalpakis
CMSC 421, Operating Systems. Fall 2008 Security Dr. Kalpakis URL: http://www.csee.umbc.edu/~kalpakis/courses/421 Outline The Security Problem Authentication Program Threats System Threats Securing Systems
Practical Mac OS X Insecurity. Security Concepts, Problems and Exploits on your Mac
Practical Mac OS X Insecurity Security Concepts, Problems and Exploits on your Mac Who am I? Student of physics, mathematics and astronomy in Bonn Mac user since 1995 I love Macs Mac evangelist Intentions
Cisco Networking Academy Program Curriculum Scope & Sequence. Fundamentals of UNIX version 2.0 (July, 2002)
Cisco Networking Academy Program Curriculum Scope & Sequence Fundamentals of UNIX version 2.0 (July, 2002) Course Description: Fundamentals of UNIX teaches you how to use the UNIX operating system and
Database security issues PETRA BILIĆ ALEXANDER SPARBER
Database security issues PETRA BILIĆ ALEXANDER SPARBER Introduction Database security is one aspect of computer security It uses different information security controls to protect databases Information
Lab 0: Version control
Lab Handout ENGI3891 Faculty of Engineering and Applied Science 16,23 Sep 2015 1 Purpose and outcomes This lab will give you hands-on experience with an essential development tool: a version control system
Written by: Johan Strand, Reviewed by: Chafic Nassif, Date: 2006-04-26. Getting an ipath server running on Linux
Getting an ipath server running on Linux Table of Contents Table of Contents... 2 1.0. Introduction... 3 2.0. Overview... 3 3.0. Installing Linux... 3 4.0. Installing software that ipath requires... 3
QMAIL & SMTP: A Secure Application for an Unsecure Protocol. Orr Dunkelman. orrd@vipe.technion.ac.il. January 27, 2004 SMTP and QMAIL Slide 1
QMAIL & SMTP: A Secure Application for an Unsecure Protocol Orr Dunkelman January 27, 2004 SMTP and QMAIL Slide 1 SMTP, MUA and MTA Speak English Whenever we deal with protocols we (=Internet geeks) like
Module 7 Security CS655! 7-1!
Module 7 Security CS655! 7-1! Issues Separation of! Security policies! Precise definition of which entities in the system can take what actions! Security mechanism! Means of enforcing that policy! Distributed
Basic Requirements...2. Software Requirements...2. Mailbox...2. Gatekeeper...3. Plan Your Setup...3. Meet Extreme Processing...3. Script Editor...
Guide on EDI automation and use of VAN services Copyright 2008-2009 Etasoft Inc. Main website http://www.etasoft.com Extreme Processing website http://www.xtranslator.com Basic Requirements...2 Software
TFS UnixControl White Paper
White Paper Consolidate and simplify UNIX system management with TFS UnixControl TFS Technology www.tfstech.com Table of Contents Overview 3 Introduction 3 TFS UnixControl Functionality 3 System Architecture
Continuous Integration. CSC 440: Software Engineering Slide #1
Continuous Integration CSC 440: Software Engineering Slide #1 Topics 1. Continuous integration 2. Configuration management 3. Types of version control 1. None 2. Lock-Modify-Unlock 3. Copy-Modify-Merge
Columbia University Web Security Standards and Practices. Objective and Scope
Columbia University Web Security Standards and Practices Objective and Scope Effective Date: January 2011 This Web Security Standards and Practices document establishes a baseline of security related requirements
Version Control with. Ben Morgan
Version Control with Ben Morgan Developer Workflow Log what we did: Add foo support Edit Sources Add Files Compile and Test Logbook ======= 1. Initial version Logbook ======= 1. Initial version 2. Remove
Version Control. Luka Milovanov lmilovan@abo.fi
Version Control Luka Milovanov lmilovan@abo.fi Configuration Management Configuration management is the management of system change to software products Version management: consistent scheme of version
Workflow Templates Library
Workflow s Library Table of Contents Intro... 2 Active Directory... 3 Application... 5 Cisco... 7 Database... 8 Excel Automation... 9 Files and Folders... 10 FTP Tasks... 13 Incident Management... 14 Security
enicq 5 System Administrator s Guide
Vermont Oxford Network enicq 5 Documentation enicq 5 System Administrator s Guide Release 2.0 Published November 2014 2014 Vermont Oxford Network. All Rights Reserved. enicq 5 System Administrator s Guide
Using Likewise Enterprise to Boost Compliance with Sarbanes-Oxley
Likewise Enterprise Using Likewise Enterprise to Boost Compliance with Sarbanes-Oxley IMPROVE SOX COMPLIANCE WITH CENTRALIZED ACCESS CONTROL AND AUTHENTICATION With Likewise Enterprise, you get one user,
Security in Plan 9. Russ Cox, MIT LCS Eric Grosse, Bell Labs Rob Pike, Bell Labs Dave Presotto, Avaya Labs and Bell Labs Sean Quinlan, Bell Labs
Security in Plan 9 Russ Cox, MIT LCS Eric Grosse, Bell Labs Rob Pike, Bell Labs Dave Presotto, Avaya Labs and Bell Labs Sean Quinlan, Bell Labs rsc,ehg,rob,presotto,seanq @ plan9.bell labs.com What comprises
15 AFS File Sharing. Client/Server Computing. Distributed File Systems
15 AFS File Sharing Adapted from the Open AFS Guide, http://openafs.org/doc/ AFS makes it easy for people to work together on the same files, no matter where the files are located. AFS users do not have
CIS 551 / TCOM 401 Computer and Network Security. Spring 2005 Lecture 4
CIS 551 / TCOM 401 Computer and Network Security Spring 2005 Lecture 4 Access Control: The Big Picture Objects - resources being protected E.g. files, devices, etc. Subjects - active entities E.g. processes,
Snare System Version 6.3.3 Release Notes
Snare System Version 6.3.3 Release Notes is pleased to announce the release of Snare Server Version 6.3.3. Snare Server Version 6.3.3 Bug Fixes: Implemented enhanced memory management features within the
Active Directory Self-Service FAQ
Active Directory Self-Service FAQ General Information: info@cionsystems.com Online Support: support@cionsystems.com CionSystems Inc. Mailing Address: 16625 Redmond Way, Ste M106 Redmond, WA. 98052 http://www.cionsystems.com
XGENPLUS SECURITY FEATURES...
Security Features Table of Contents TABLE OF CONTENTS... 2 1. INTRODUCTION... 3 2. XGENPLUS SECURITY FEATURES... 3 3. SERVER LEVEL FEATURES... 5 4. DOMAIN LEVEL FEATURES... 8 5. USER LEVEL FEATURES...
Configuring Your Email Client: Outlook Express
Configuring Your Email Client: Outlook Express Information in this document created by Webmail.us and provided by Bare Feet Studios. Table of Contents Chapter 1. Introduction... 1-1 What is an Email Client?...
SYSTEM ADMINISTRATION MTAT.08.021 LECTURE 8 SECURITY
SYSTEM ADMINISTRATION MTAT.08.021 LECTURE 8 SECURITY Prepared By: Amnir Hadachi and Artjom Lind University of Tartu, Institute of Computer Science amnir.hadachi@ut.ee / artjom.lind@ut.ee 1 OUTLINE 1.Is
Server Security. Contents. Is Rumpus Secure? 2. Use Care When Creating User Accounts 2. Managing Passwords 3. Watch Out For Aliases 4
Contents Is Rumpus Secure? 2 Use Care When Creating User Accounts 2 Managing Passwords 3 Watch Out For Aliases 4 Deploy A Firewall 5 Minimize Running Applications And Processes 5 Manage Physical Access
IT Support Tracking with Request Tracker (RT)
IT Support Tracking with Request Tracker (RT) Archibald Steiner AfNOG 2013 LUSAKA Overview What is RT? A bit of terminology Demonstration of the RT web interface Behind the scenes configuration options
Snare System Version 6.3.4 Release Notes
Snare System Version 6.3.4 Release Notes is pleased to announce the release of Snare Server Version 6.3.4. Snare Server Version 6.3.4 New Features The behaviour of the Snare Server reflector has been modified
Introduction. Friday, June 21, 2002
This article is intended to give you a general understanding how ArGoSoft Mail Server Pro, and en Email, in general, works. It does not give you step-by-step instructions; it does not walk you through
How To Secure An Rsa Authentication Agent
RSA Authentication Agents Security Best Practices Guide Version 3 Contact Information Go to the RSA corporate web site for regional Customer Support telephone and fax numbers: www.rsa.com. Trademarks RSA,
Email on the RaQ 3. General. Email server. Services
Email on the RaQ 3 General This document explains the following email functions available on the RaQ 3: email server and Simple Mail Transfer Protocol (SMTP) server configuring the email parameters email
Deciphering the Safe Harbor on Breach Notification: The Data Encryption Story
Deciphering the Safe Harbor on Breach Notification: The Data Encryption Story Healthcare organizations planning to protect themselves from breach notification should implement data encryption in their
Talk Internet User Guides Controlgate Administrative User Guide
Talk Internet User Guides Controlgate Administrative User Guide Contents Contents (This Page) 2 Accessing the Controlgate Interface 3 Adding a new domain 4 Setup Website Hosting 5 Setup FTP Users 6 Setup
Google Apps and Open Directory. Randy Saeks Twitter: @rsaeks http://www.techrecess.com
Google Apps and Open Directory Randy Saeks Twitter: @rsaeks http://www.techrecess.com Agenda Quick Google Apps Overview Structure Setup Preparing OD Configuration Q&A&S Resources http://techrecess.com/technical-papers/gapps/
Configuration Task 3: (Optional) As part of configuration, you can deploy rules. For more information, see "Deploy Inbox Rules" below.
Configure the E-mail Router After the E-mail Router has been installed, you can configure several aspects of it. Some of these configuration tasks are mandatory. Others are optional in that you use them
without the fixed perimeters of legacy security.
TECHNICAL BRIEF The Halo cloud security platform was purpose-built to provide your organization with the critical protection, visibility and control needed to assure cloud security without the fixed perimeters
Features. The Samhain HIDS. Overview of available features. Rainer Wichmann
Overview of available features November 1, 2011 POSIX (e.g. Linux, *BSD, Solaris 2.x, AIX 5.x, HP-UX 11, and Mac OS X. Windows 2000 / WindowsXP with POSIX emulation (e.g. Cygwin). Please note that this
Using Network Attached Storage with Linux. by Andy Pepperdine
Using Network Attached Storage with Linux by Andy Pepperdine I acquired a WD My Cloud device to act as a demonstration, and decide whether to use it myself later. This paper is my experience of how to
Before starting to use the new system you will need to know the password to your e-wire email account.
Contents E-Wire Email Configuration and Migration... 2 Webmail... 2 Migration Process... 2 POP Accounts... 3 Checking Current POP Configuration... 3 POP Migration Process... 5 IMAP Accounts... 6 IMAP Migration
APPENDIX 4 GREATER LONDON AUTHORITY SUN ACCOUNTS UNIX REVIEW FINAL AUDIT REPORT. Auditor: Chris Power & Michael Lacey Date: April 2003 Reference: 320
APPENDIX 4 GREATER LONDON AUTHORITY SUN ACCOUNTS UNIX REVIEW FINAL AUDIT REPORT Auditor: Chris Power & Michael Lacey Date: April Reference: 320 Table of Contents 1 INTRODUCTION 2 Page 2 OBJECTIVES AND
Thick Client Application Security
Thick Client Application Security Arindam Mandal (arindam.mandal@paladion.net) (http://www.paladion.net) January 2005 This paper discusses the critical vulnerabilities and corresponding risks in a two
CUIT UNIX Standard Operating Environment and Security Best Practices
Objective and Scope Effective Date: August 2008 This CUIT UNIX Standard Operating Environment (SOE) document defines the agreed system hardening requirements as well as security best practices for CUIT
Operating System Security
Operating System Security Klaus Schütz Windows OS Security Microsoft Redmond Before I start My VP love(d) me A frustrated friend 1 Agenda Evolution of Threats Client vs. Server Security Operating System
Nixu SNS Security White Paper May 2007 Version 1.2
1 Nixu SNS Security White Paper May 2007 Version 1.2 Nixu Software Limited Nixu Group 2 Contents 1 Security Design Principles... 3 1.1 Defense in Depth... 4 1.2 Principle of Least Privilege... 4 1.3 Principle
TELE 301 Lecture 7: Linux/Unix file
Overview Last Lecture Scripting This Lecture Linux/Unix file system Next Lecture System installation Sources Installation and Getting Started Guide Linux System Administrators Guide Chapter 6 in Principles
Web application security
Web application security Sebastian Lopienski CERN Computer Security Team openlab and summer lectures 2010 (non-web question) Is this OK? int set_non_root_uid(int uid) { // making sure that uid is not 0
Remote Administration
Windows Remote Desktop, page 1 pcanywhere, page 3 VNC, page 7 Windows Remote Desktop Remote Desktop permits users to remotely execute applications on Windows Server 2008 R2 from a range of devices over
Quick Scan Features Setup Guide
Xerox WorkCentre 7132 Quick Scan Features Setup Guide 701P45042 This guide includes instructions for: Scan to Email on page 1 Scan to Mailbox Setup (Optional) on page 5 Network Scanning Setup (Optional)
LiteCommerce Advanced Security Module. Version 2.8
LiteCommerce Advanced Security Module Version 2.8 Reference Manual Revision date: Jul/03/2007 LiteCommerce Advanced Security Module Reference Manual I Table of Contents Introduction...1 Administrator...2
Technical White Paper BlackBerry Enterprise Server
Technical White Paper BlackBerry Enterprise Server BlackBerry Enterprise Edition for Microsoft Exchange For GPRS Networks Research In Motion 1999-2001, Research In Motion Limited. All Rights Reserved Table
Setup Guide. Email Archiving for Microsoft Exchange Server 2007
Setup Guide Email Archiving for Microsoft Exchange Server 2007 COPYRIGHT Copyright 2012 McAfee, Inc. Do not copy without permission. TRADEMARK ATTRIBUTIONS McAfee, the McAfee logo, McAfee Active Protection,
IMail Server for Windows NT Version 4.06 Addendum. IMail Server for Windows NT Version 4.03 Addendum. IMail Server for Windows NT User s Guide
This online guide provides up-to-date information about your software. You can click one of the links below or use the bookmarks in the left margin to navigate this guide. Version 4.06 Addendum Version
Unifying Information Security. Implementing TLS on the CLEARSWIFT SECURE Email Gateway
Unifying Information Security Implementing TLS on the CLEARSWIFT SECURE Email Gateway Contents 1 Introduction... 3 2 Understanding TLS... 4 3 Clearswift s Application of TLS... 5 3.1 Opportunistic TLS...