Operating Systems 15 - security PIETER HARTEL

Contents Authentication Passwords Tokens Biometrics Access control Policies Mechanisms Auditing Logs Intrusion detection

Passwords Why the salt? Salt: two characters of hashed password; 4096 possibilities The salt prevents duplicate passwords from being visible Increases the difficulty of dictionary attacks Increases the difficulty of finding out whether a person has used the same password on different machines By how much does the salting mechanism increase the resilience against password cracking? # entries in the passwd file. Why? Slow hash means take a word from the dictionary and hash it, then see if it occurs in any of the entries With salt this does not work any more, there will be a slow has for every entry for every word in the dictionary. Kerberos does not use the passwd file. Instead it hashes the password on the client and tries to decrypt a challenge from the server with the hashed password as the key.

Reading the password file Output? gcc Getpwent.c ./a.out | more Is there a memory leak? ls –l /etc/shadow /etc/passwd int main(int argc, char* argv[]) { struct passwd *p; while ((p = getpwent()) != NULL) { printf("%s:%s:%d:%d:%s:%s:%s\n", p->pw_name, p->pw_passwd, p->pw_uid, p->pw_gid, p->pw_gecos, p->pw_dir, p->pw_shell); } endpwent(); return 0; $ ./a.out foo:x:1234:5678:bar:/home/foo:/bin/bash etc To investigate whether there is a memory leak, let’s print p and see… gecos field contains the full name The shadow password file simply separates the hashed passwords from the remaining data that must be readable by the world. $ ls -l /usr/bin/passwd rwsr-xr-x 1 root shadow 81824 2008-12-03 13:26 /usr/bin/passwd

Tokens Advantages Generally stronger than passwords Disadvantages May require special hardware Can be lost Authentication protocol Static Dynamic password generator Challenge response Static: follow me printers Dynamic passwords are time based and require synchronization between token and server Cyber-crime Science

Biometrics [Jai00] A. K. Jain, L. Hong, and S. Pankanti. Biometric identification. Commun. ACM, 43(2):90-98, Feb 2000. http://doi.acm.org/10.1145/328236.328110 IIS

Access control policies Policy types Discretionary Mandatory Role based DAC: access control based on the identity of the subject and on access rules that state what identities are allowed to do. Subjects with the right access may grant other subjects access too, hence discretionary. E.g. with write permission on a directory, you can give access to the files in the directory. MAC: uses security labels (i.e. classified, top secret) to grant access of subject and object have compatible clearance levels. Mandatory because subjects cannot change anything. RBAC arose to deal with large numbers of users with the same or similar access requirements.

Discretionary access control mechanisms (for “files”) Enforcement by the reference monitor The matrix is usually sliced (why?) Access control list per object Capabilities per subject The RM must be trusted… The matrix has #objects x #subjects cells and is spars, hence a column major or a row major representation works better See book section 12.8: An ACL states which subjects have which access to the object associated with the ACL A capability states what a subject can do with an object. It is essential that the system manages the capabilities for the subjects otherwise it would be too easy for subjects to given the capabilities away to others.

Role based access control Group user by role Encourage users to switch role Principle of the least privilege Try to pick a role in which you can do what needs to be done, whilst doing the least amount of damage. E.g. a sysadmin should not login as root and co things that do not need root access. Think of rm *…

Monitoring logins #define llsz sizeof(struct lastlog) int main(int argc, char *argv[]) { FILE *fp=fopen("/var/log/lastlog", "r"); int i; for(i=1;i<argc;i++) { struct passwd *p = getpwnam(argv[i]); if(p == NULL) { printf("unknown user: %s\n", argv[i]); } else { struct lastlog ll; fseek(fp, p->pw_uid*llsz, 0); fread(&ll, llsz, 1, fp); printf("%s %s %s %s", argv[i], ll.ll_line, ll.ll_host, ctime(&ll.ll_time)); } fclose(fp); return 0; Monitoring logins last gcc Lastlog.c ./a.out lecturer student Is there a problem? man 5 lastlog ls –l /var/log/lastlog $ ./a.out lecturer student lecturer pts/1 pc1.university Fri Aug 10 12:56:48 2012 student pts/3 pc2.university Thu Aug 9 11:52:55 2012 ll.ll_time is a 32 bit time value, whereas ctime expects a 64 bit time value…

Summary Authentication and access control try to prevent problems Auditing tries to detect problems Technology is only part of the problem Mechanism and policy