Access Control and Audit CS490 - Security in Computing Copyright © 2005 by Scott Orr and the Trustees of Indiana University

Section Overview OS Reference Model CPU protection Memory protection Resource access control Audits

References Security in Computing, 3rd Ed. Online Resources Chapter 4 (pgs. 179-209) Online Resources Role Based Access Control by Michael Lebkicher (SANS Reading Room)

Access Control Model Subject Object OS Reference Monitor Access request OS Reference Monitor Access Granted Object

I/O Device Controllers Hardware Components CPU Memory Bus I/O Device Controllers

Dual-Mode Operation Interrupt User Supervisor Resume

Pentium Protection Rings Application Software I/O Drivers Operating System Kernel

Interrupt vector table Interrupt Handling Memory User Interrupt Handler n System Call Supervisor Interrupt Vector 0 Interrupt Vector n-1 Interrupt Vector n Trap n Interrupt vector table

Interrupt Uses I/O Device Protection CPU Protection Users cannot access devices directly Must go through kernel System calls CPU Protection Exception Handling Fair use (timer)

Fence Registers Operating System n n+1 n+1 User Program Space All memory requests by user programs must be for addresses n+1 or higher. Memory

Base/Bound Registers Operating System n n+1 User A Program Space n+1 p User B Program Space p+1 Bound Register q User C Program Space q+1 Memory requests must fall between base and bound register addresses Memory

Fetch<Data_Seg, 20> Segmentation Seg. Translation Table C: Sub Segment Addr Main b Seg_A e Sub Data_Seg f a B: Data_Seg b Main C: Main c A: Main Seg_A d B: Main Fetch<Data_Seg, 20> e C: Seg_A Sub f + C: Data_Seg Data_Seg g A: Data_Seg h B: Seg_A Program C Memory

Paging Page 0 Page 1 Page 2 Page 3 Page 4 Page 5 Program C Memory c f Translation Table Page 1 Page 0 Page Addr b 1 f 2 i 3 o 4 c 5 g Page 4 c Page 6 Page 2 Page 0 Page 1 f Page 1 Page 1 Page 5 Page 7 Page 2 i Fetch<3, 37> Page 2 Page 0 Page 3 Page 4 l Page 4 Page 4 Page 5 Page 3 Page 5 o + Page 3 Page 2 Program C Page 3 r Page 0 Can be combined with Segmentation Memory

MS File/Directory Attributes Read-Only Hidden System Archive

User Accounts UserID User’s Full Name Password Home Directory Groups System Interface?

“Principle of Least Privilege” Special Users Guest System Accounts Superuser / Administrator Full Access to all system resources Superuser Equivalency “Principle of Least Privilege”

UNIX Accounts Username Password UID GID GCOS Home Directory Default Shell Stored in /etc/passwd: sorr:VsjqYhTwQiJPw:126:10:Scott Orr:/home/sorr:/bin/csh

Microsoft Security Identifiers Created for every user, group, and machine Never reused S-1-5-21-D1-D2-D3-RID S-1-5-21: Standard prefix for NT D1-D2-D3: Local or domain identifier RID (Relative ID): Unique part of SID

File/Directory Permissions Read Create Write Append Delete Execute Search Ownership Access Control Permissions on newly created files/directories?

Access Control Matrix File-1 File-2 Dir-1 Printer-1 alice Read, Write Execute Search Write bob Read Read, Search scott

Object Access Control Lists User Access alice Read, Write bob Read scott File-1

Group Access Users requiring same access to object Simplifies adding/removing of access Adding/Removing users Adding/removing permissions to object Multiple group membership interaction Union Interception Deny permissions

Superuser processes have full system access!!! Programs which are running Inherits access rights from parent Restricting User processes Priority based Process size Number of concurrent user processes Superuser processes have full system access!!!

Permissions and Paths Must have execute permissions to run Running Programs Absolute location Shortcuts PATH environment variable Lists directories to search for programs Order important Having the current directory in your path may be hazardous to your health!!!

Who Controls Access? Discretionary Access Control (DAC) Object owner decides Does not require administrator assistance Mandatory Access Control (MAC) Administration decide Multi-level Security Requirements Role-Based Access Control (RBAC) Based on “role” within an organization Transaction based Least privileged based

UNIX SUID/SGID Programs Permits controlled access to restricted resources SetUID (SUID) – Runs with access permissions of program owner SetGID (SGID) – Runs with access permissions of default group owner Root SUID/SGID programs often the target of Buffer-Overflow Attacks

Using Administrative accounts Principle of Least Privilege Selective use of administrative access UNIX su “switch user” command Microsoft “Run As” command All attempts logged UNIX sudo command Grant specific users root access to programs No need to share root password Remember to avoid ‘.’ in root’s path!!!

Active Audits Monitor what is happening currently Memory/CPU Usage System Load Free memory/swap Time since last reboot Disk Space Usage Current Users

Historical Records Events logged into files Log reduction? Login/Logout Access Programs run Software/Hardware Errors Resource Usage Application logs Log reduction? Log integrity and centralization

How long to keep logs? Don’t log at all Reset the logs periodically Rotate Logs periodically Permanently archive log data File compression tools Tape CDROM/DVD