OpenLabs Security Laboratory The online security experiment platform Johan Zackrisson Charlie Svahnberg
Outline Introduction Requirements Laboratory usage Technical solution Conclusion
History Started in 2006 Continuation of an on-campus security laboratory
Requirements: The Goals Provide a secure environment for remote experiments Must allow advanced security experiments off-campus experiments in advanced security
Advanced security experiments Insecure protocols Insufficient access control Software vulnerabilities See effects of computer viruses ...
Environment Remote controllable Networked Experiment with network services One or more machines Start from a known state Any operating system (x86 at least)
Secure Environment Isolation Student has exclusive access No information can leak to the Internet No information can leak between experiments Can not leave information traces
Hostile Environment Destructive experiments Reboot When a machine hangs Reinstall Need to start over
Laboratory usage From a students point of view Web interface Log in Make reservations
What to install on each machine Reservations When and for how long The number of machines What to install on each machine
Installations Clone images Contains the operating system and the tools needed for the experiment Prepared in advance by the teacher
Before the experiment starts Automatic clone installation Email reminder
The experiment starts Before given access, the student has to choose to start the experiment from the web interface Remote control VNC, Remote Desktop, SSH, X Machine management via the web interface Reboot / Reinstall
The experiment ends The machines are wiped from all information Ready to be used by new experiments
Technical solution
Resources 32 standard rack machines (Xeon, 2.80Ghz, 1Gb RAM) Experiment network (Gigabit) Service machines Power Distribution Units (PDUs)
Core functionality Web interface Cloning / Wiping Firewalling Network switch configuration Power control
Web interface Experiment management Administration
Cloning / Wiping Booted over the network Automatic installation of a prepared clone images Overwrite with zeroes
Firewalling Access are only allowed from the students machine All traffic to/from the experiment must be initiated from the students machine No other traffic can leave the laboratory!
Network switch configuration Managed network switch Dedicated LAN per experiment By using Virtual LAN (IEEE 802.1Q) Isolation between experiments
Power control Done by remote controllable power outlets, Power Distribution Units (PDUs) Force a machine to reboot By the student during experiments By the cloning system
Conclusion Management and reservations Web interface Isolation / Network environment Firewalling Network switch configuration
Automatic installation (and reinstall) Cloning Ability to restart a machine Power control Information leakage Wiping
Other uses Off-campus courses without the possibility to install software Simulations Clustering with LAM/MPI Enable remote access to 3rd party Hardware/Software Antenna Lab
Questions?