JLAB Password Security Ian Bird Jefferson Lab HEPiX-SLAC 6 Oct 1999

History Aug ’97 – break-in & compromise –Off the net for 5 days Enforced password changes & tightened rules Installed network and system monitors Tightened/created access policies –Denied off-site access for non-verified & monitored systems

Since then… Install firewall + traffic monitors Continual tightening of access –Very few systems directly open to outside now Push to ssh on all platforms –Teratem/ssh on PCs, DataFellows on Mac –Shutdown telnet, rsh etc. Mail : IMAP + SSL –Netscape + Outlook as remote clients Creation of “DMZ” Continue to move to switched network (> 70%) Protect with routers: –Business Services/HR –Accelerator controls

External access Need still to provide clear-text password access from off-site Implementing “DMZ” outside firewall with: –Split horizon DNS –External mail server (forwarder) –ftp server (not through firewall) –Web server –(eventually) telnet/ssh forwarder Only 3 central hosts open to outside –Ssh or web access to selected internal hosts These have to be monitored.

Mail Currently allow POP, IMAP and S-IMAP (SSL) –Switch off POP, clear-text IMAP soon UW IMAP server –SSLeay provides password encryption Server provides certificate to client Clients : –Netscape (everywhere), Outlook (PC’s) S-IMAP has been working well for > 1 year

External mail server Server in DMZ forwards S-IMAP, IMAP, POP to internal mail server (ports only) –Perl script –Avoids copying files or mounting filesystems outside firewall –No authentication outside No password file accessible on external server Working on telnet/ssh forwarder (gateway) –Deny direct telnet access to inside, but –Provide telnet access where needed

Developments Would be nice to have a consistent framework for all authenticated applications and processes Something that: –Works with SSL, that can: Handle normal logins Do process-process authentication Minimize the number of credentials a user has to keep track of Setup a general CA –Currently use (different) certificates for Mail MIS applications

Developments.. Cont. Possible candidates: –Globus/GSI Ssh that uses certificates Authenticates processes Can span sites with different encryption schemes (Kerberos, etc, etc.) –Kerberos?

Summary Close to removing clear text passwords internally Provide clear-text external access in a controlled way Need a consistent framework for authentication Problems: –NIS – ypcat –X-terminals (although most are now on switched ports) –Win95/98 LANManager hash cripples NT security Suppress W95/98 in domain by mid-2000 –Modems – back door