COMP2221 Networks in Organisations Richard Henson March 2014

Week 5: The Windows Registry, Principles of Network Security n Objectives:  Explain confidentiality, integrity, and availability principles for networks  Explain why user and system settings need to be controlled on networked machines  Explain the role of the registry in Windows desktop and network configuration, user settings, and security  Select appropriate software tools for backup and fault tolerance

What is a “platform” n Hardware that will support a CPU  motherboard (or eq1uiv)  ROM and RAM  hard disk and controller n Software that executes through the CPU to provide a stable user environment  low-level operating system functions  utilities  user interface

Connectivity between platforms n OSI: Seven Layer model n As far as the user is concerned…  layer 7 is all that matters n But there should be access control…  user needs to log on (via level 5)  achieved through level 7 pop up and input coupled to interrogation of local or LAN database

BIOS Developments n Earlier motherboards had a single chip containing the BIOS on ROM and a writeable CMOS area  the command line interface invoked was 16-bit n More recent motherboards use EFI (Extensible Firmware Interface)  uses a 32-bit command line  only really exploited with Windows 7, and 2008 Server…

Why “access control”? n Organisations have responsibilities, and confidentiality  nowadays, these are delivered through the network n /ConfidentialityIntegrity:  e.g. Personal data held under the Data Protection Act n Availability:  those who need access to files & services must have it…

Platforms: booting to an Intel/Windows platform n BIOS should “point” to selected medium that contains a “boot loader” program »contains “master boot record” (MBR) »points to the boot partition n containing the operating system n Different media prepared in different ways »hard disk still the conventional boot medium n number of partitions so potential choice of bootable media »CDs & USBs only have one partition

Partitions, Hard Disks and Multiple Operating Systems n MBR must be on the first (C:) partition n Possible to have different operating systems on the same hard disk…  varieties of Windows  varieties of Unix… n BUT…  Master Boot Record systems different on Unix and Windows  still possible to have ONE Unix partition…

Logon n Once the operating system has been loaded…  user logon screen presented n Rapid local boot is fine…  but most organisational computers are on networks… »why?  why does network logon take so long?

“Policies”: Controlling User and System Settings n The Windows user’s desktop is controlled with policies  user policies  system policies n Configuring and using policies - essential part of any network administrator’s job!  could be 100s or 1000s of systems, & users

Storage of User/System Settings: Windows Registry n Early Windows extended DOS text files of system & user settings:  SYSTEM.INI enhanced CONFIG.SYS  WIN.INI enhanced AUTOEXEC.BAT n Windows 95 created a two dimensional structure… known as The Registry  principles later extended in Windows NT v4 to allow system and user settings to be downloaded to local registry across the network

Viewing/Editing the Registry n REGEDT32 from command prompt…  look but don’t touch!  contents should not be changed manually unless you really know what you are doing!!! n Registry data that is loaded into memory can also be overwritten by data:  from local profiles  downloaded across the network…

System Settings n For configuration of hardware and software  different types of system need different settings  system settings for a given computer may need to be changed for particular users e.g. to change screen refresh rate for epileptics

User Settings n More a matter of convenience for the user  mandatory profiles »users all get the same desktop settings! »anything added is lost during logoff!  roaming profiles - desktop settings preserved between user sessions »saved across the network…

What is The Registry? n A hierarchical store of system and user settings n Five basic subtrees:  HKEY_LOCAL_MACHINE : local computer info. Does not change no matter which user is logged on  HKEY_USERS : default user settings  HKEY_CURRENT_USER : current user settings  HKEY_CLASSES_ROOT : software config data  HKEY_CURRENT_CONFIG : “active” hardware profile n Each subtree contains one or more subkeys…

Location of the Windows Registry n In XP…  c:\windows\system32\config folder n Six files (no extensions):  Software  System – hardware settings  Sam, Security »not viewable through regedt32  Default – default user  Sysdiff – HKEY USERS subkeys  Also to be considered: ntuser.dat »user settings that override default user

Registry Files in Windows 7 n HKEY_LOCAL_MACHINE \SYSTEM:  \system32\config\system n HKEY_LOCAL_MACHINE \SAM:  \system32\config\sam n HKEY_LOCAL_MACHINE \SECURITY  \system32\config\security n HKEY_LOCAL_MACHINE \SOFTWARE  \system32\config\software n HKEY_USERS \UserProfile  \winnt\profiles\username n HKEY_USERS.DEFAULT  \system32\config\default

Emergency Recovery if Registry lost or badly damaged n Backup registry files created during text-based part of windows installation  also stored in: »c:\windows\system32\config »have.sav suffix  only updated if “R” option is chosen during a windows recovery/reinstall n NEVER UPDATED backup is saved to  C:\windows\repair folder  no user and software settings  reboots back to “Windows is now setting up”

Backing up the Registry n Much forgotten… an oversight that may later be much regretted!!!  can copy to tape, USB stick CD/DVD, or disk  rarely more than 100 Mb n Two options;  Use third-party backup tool »e.g  Use windows “backup” »not recommended by experts! »but already there & does work! »to copy the registry if this tool is chosen, a “system state” backup option should be selected

System Policy File n A collection of registry settings downloaded from the domain controller during logon n Can apply different system settings to a computer, depending on the user or group logging on n Can overwrite:  local machine registry settings  current user registry settings n Should therefore only be used by those who know what they are doing!!!

System Policy File n Saved as NTCONFIG.POL n Normally held on Domain Controllers  read by local machine during logon procedure  provides desktop settings, and therefore used to control aspects of appearance of the desktop n Different NTCONFIG.POL settings can be applied according to:  User  Group  Computer n Users with roaming profiles additionally save desktop settings to their profile folders

Active Directory n Microsoft equivalent of Novell’s NDS (Network Directory Structure)  An LDAP network-wide directory service for providing paths to files and services n Available from Windows 2000 onwards  of limited use on earlier Windows networks

Windows Workgroups and Domains... n Workgroup = peer-peer n Domain = client-server n Client machines can logon  Locally (i.e. peer-peer)  To domain (client in a client-server network

Servers and Domain Controllers n Client server networks use clients only for users  clients need to log on to the domain to access network resources  domain access managed by domain controllers n Member servers used to provide and manage services

What is Active Directory? n A object-oriented database (Internet- approved x500 standard)  a hierarchy of data objects (& their properties) »domain controllers »computers »users & groups of users »network resources

Domain Controllers and Active Directory n Good practice to have backups  domain controller should have a backup….  managed as part of the Active Directory system  data on network resources, services & users all stored in a single file »ntds.dit  tools available for AD system management »e.g. ntdsutil

Backing up the Database n Goes without saying that the loss of Active Directory will be very bad for the network (!)  people won’t even be able to log on/off! n AD should be backed up…  regularly!  preferably on another computer…  In another location…

Managing Risks… TSI approach predicated on whole-life view (ISO/IEC & 15288), covering Specification, Realisation and Use [TSI/2012/253] © Copyright

TrustworthinessDefinition Trustworthiness: Definition [TSI/2012/183] © Copyright

Trustworthy Software Audiences  Mainstream »“The Industry” (e.g. Microsoft, Oracle,...)  Niche »Specialist Industries (e.g. Aviation, “Security”)  Disbursed »Small scale developers (e.g. SmartPhone Apps)  Collateral »developers don’t consider themselves as such (e.g. embedded components, website CMS users, spreadsheets, …) [TSI/2012/183] © Copyright

Fault Tolerance and Availability n General engineering principle…  if it can go wrong… it will! n Trustworthy software should detect failure and trigger a backup n Essential for Business Continuity

Managing Fault Tolerance n Whole domain controller should be backed up!  active directory designed as a distributed database that backs up all domain controllers to each other  backup domain controller software set up using same active directory wizard

Fault Tolerance (data storage fault) n e.g. Hard disk crash n System needed for a backup to take over “seamlessly”  i.e. without the user even noticing… n Trustworthy software system:  disk mirroring  exact copy available to take over at a moment’s notice

“Trust” n About people! n In this case:  network users on different domains n By default: do not trust strangers with your data!

Domain Trust n This allows users on one domain to log onto resources on another domain n Trusts can be one or two-way Domain A Domain B

Enterprise Structure of Active Directory n A hierarchical system of organisational data objects  i.e. domains, n A Tree can be »a single domain »group of domains

Domain Trees & Forests n Active Directory provides “trust” between the databases of domains that are linked in this way n A “Tree” is the domains and links between them n A “Forest” contains data needed to connect all objects in the tree:  domain objects in the tree are logically linked together in the forest and their users can “trust” each other

Active Directory and Users n Active directory allows set up and management of domain users n Can also define domain groups, and allow domain users to become part of domain groups  aids administration  policy file can be set up »interacts with user machines registry during login »controls user desktop

Organisations, Organisational Units, and Domains n An organisation may:  have several locations  have several functions in same location in same location n Alternative to multiple domains… multiple domains…  organisational units  group policy can be applied selectively

Domain Name System & Active Directory n Active Directory structures designed to be able to mirror naming of servers that are part of the Internet n Systematic Internet server naming already available for some time as DNS (Domain Name System)

Active Directory and DNS n In Active directory, each domain in the tree has a unique DNS identity  therefore a unique IP address…  can cause confusion when setting up domain structure!! n Also, each device within a domain can also made use of DNS, via its IP address…  Windows-based naming (WINS) obsolete

Microsoft TCP/IP stack n Differs from UNIX TCP/IP (e.g. no FTP, SMTP or Telnet) n DNS is available as a network service n Application layer components:  Windows sockets - to interface with sockets-based applications  NetBT - to interface with NetBIOS applications n SNMP, TCP, UDP, IP as with Unix protocol stack

Tips for Configuring TCP/IP on Windows clients n Make sure network card is active n Requires local administrator access!! n Access via “properties” after right- clicking “LAN connection” n TCP/IP settings then easily changed

Manual Setting of IP address n Subnet mask:  for small networks  x.0 for larger networks  x -> 0 as the network gets larger » »About optimisation of network performance… n Default gateway is the IP address of the LAN-Internet interface computer…

TCP/IP Configuration via DHCP n Dynamic Host Configuration Protocol n Network management of IP addresses…  automatically assign IP addresses from a Windows 2000 server machine running DHCP server  integrates with active directory

Windows TCP/IP utilities n Not available from the GUI… n Only accessible via cmd prompt  Ping (packet internet groper):  FTP  Telnet  Finger (retrieval of system information from a computer running TCP/IP & finger  ARP (displays local IP addresses according to equivalent MAC or “physical” addresses)  ipconfig (displays local IP configuration)  tracert (checks route to a remote IP address)

Terminal Services (“thin client”) n Allows any PC running a version of Windows to remotely run an NT series server  uses a copy of the server’s desktop on the client machine n Client tools must be installed first, but the link can run with very little bandwidth  possible to remotely manage a server thousands of miles away using a phone connection…

Remote Access Service (RAS) n Allows access to an external network through public/other networks  uses Point to Point protocol (PPP): remember that?  standard username/password authentication  also PPP Multilink protocol, which allows a combination of communications links and multiple links to be used n Capability for VPNs (Virtual Private Networks) using secure Internet access  using L2TP (point-point “tunnelling” protocol)

RAS & Secure Remote Login n To login remotely, user must have a valid username/password and RAS dial-in permission n RAS can use “call back” security:  Server receives a remote request for access  Server makes a note of the telephone number  Server calls the remote client back, guaranteeing that the connection is made from a trusted site n Login information encrypted by default n All remote connections can be audited

Internet Information Server (IIS) n Microsoft’s Web Server  can also provide ftp or smtp publishing service n Purpose:  make html pages available: »as a local www service »across the network as an Intranet »across trusted external users/domains as an Extranet  run server-scripts in communication with client browsers n Sets up its own directory structure for developing Intranets, Extranets, etc. n Access to any IIS service can be restricted using username/password security

Internet Information Server (2) n Can allow anonymous remote login:  Uses a “guest” account – access only to files that make up the Intranet  Anonymous login prevents trying to hack in through guessing passwords of existing users n Provides the software connectivity for a server-side interface that can connect client- server Internet applications to online databases e.g..aspx or.php