Lemon security. Previous security enhancements user lemon: lemon-db-admin-OraMon will create user lemon (Miro). - OraMon switches to user lemon at its.

Slides:

Advertisements

Similar presentations

Encrypting Wireless Data with VPN Techniques

Advertisements

Internet Protocol Security (IP Sec)

Cryptography and Network Security

SSL CS772 Fall Secure Socket layer Design Goals: SSLv2) SSL should work well with the main web protocols such as HTTP. Confidentiality is the top.

An Introduction to Secure Sockets Layer (SSL). Overview Types of encryption SSL History Design Goals Protocol Problems Competing Technologies.

Module 5: TLS and SSL 1. Overview Transport Layer Security Overview Secure Socket Layer Overview SSL Termination SSL in the Hosted Environment Load Balanced.

Internet Security CS457 Seminar Zhao Cheng. Security attacks interruption, interception, modification, fabrication passive attack, active attack.

1 Chapter 2: Networking Protocol Design Designs That Include TCP/IP Essential TCP/IP Design Concepts TCP/IP Data Protection TCP/IP Optimization.

Topic 8: Secure communication in mobile devices. Choice of secure communication protocols, leveraging SSL for remote authentication and using HTTPS for.

By: Hassan Waqar.  A PROTOCOL for securely transmitting data via the internet.  NETWORK LAYER application.  Developed by NETSCAPE.

BASIC CRYPTOGRAPHY CONCEPT. Secure Socket Layer (SSL)  SSL was first used by Netscape.  To ensure security of data sent through HTTP, LDAP or POP3.

CHAPTER 8: SECURITY IN COMPUTER NETWORKS Encryption Encryption Authentication Authentication Security Security Secure Sockets Layer Secure.

1.1 © 2004 Pearson Education, Inc. Exam Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 1: Introducing Windows Server.

Network Isolation Using Group Policy and IPSec Paula Kiernan Senior Consultant Ward Solutions.

Mar 19, 2002Mårten Trolin1 This lecture On the assignment Certificates and key management SSL/TLS –Introduction –Phases –Commands.

Environmental Council of States Network Authentication and Authorization Services The Shared Security Component February 28, 2005.

Public Key Infrastructure (PKI) Providing secure communications and authentication over an open network.

70-293: MCSE Guide to Planning a Microsoft Windows Server 2003 Network, Enhanced Chapter 13: Planning Server and Network Security.

Mar 12, 2002Mårten Trolin1 This lecture Diffie-Hellman key agreement Authentication Certificates Certificate Authorities SSL/TLS.

Guide to Network Defense and Countermeasures Second Edition

K. Salah 1 Chapter 31 Security in the Internet. K. Salah 2 Figure 31.5 Position of TLS Transport Layer Security (TLS) was designed to provide security.

Apr 22, 2003Mårten Trolin1 Agenda Course high-lights – Symmetric and asymmetric cryptography – Digital signatures and MACs – Certificates – Protocols Interactive.

Using Internet Information Server And Microsoft ® Internet Explorer To Implement Security On The Intranet HTTP.

How Clients and Servers Work Together. Objectives Learn about the interaction of clients and servers Explore the features and functions of Web servers.

Internet Protocol Security (IPSec)

Chapter 8 Web Security.

SSL (Secure Socket Layer) and Secure Web Pages Rob Sodders, University of Florida CIS4930 “Advanced Web Design” Spring 2004

TLS/SSL Review. Transport Layer Security A 30-second history Secure Sockets Layer was developed by Netscape in 1994 as a protocol which permitted persistent.

What is in Presentation What is IPsec Why is IPsec Important IPsec Protocols IPsec Architecture How to Implement IPsec in linux.

CSCI 6962: Server-side Design and Programming

SYSTEM ADMINISTRATION Chapter 13 Security Protocols.

70-291: MCSE Guide to Managing a Microsoft Windows Server 2003 Network Chapter 9: Securing Network Traffic Using IPSec.

Securing Data at the Application Layer Planning Authenticity and Integrity of Transmitted Data Planning Encryption of Transmitted Data.

SSL and https for Secure Web Communication CSCI 5857: Encoding and Encryption.

32.1 Chapter 32 Security in the Internet: IPSec, SSL/TLS, PGP, VPN, and Firewalls Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction.

MCSE Guide to Microsoft Exchange Server 2003 Administration Chapter Four Configuring Outlook and Outlook Web Access.

12-Sep-15 Virtual Private Network. Why the need To transmit files securely without disclosing sensitive information to others in the Internet.

Secure Socket Layer (SSL)

September, 2005What IHE Delivers 1 G. Claeys, Agfa Healthcare Audit Trail and Node Authentication.

Cosc 4765 SSL/TLS and VPN. SSL and TLS We can apply this generally, but also from a prospective of web services. Multi-layered: –S-http (secure http),

Introduction to Secure Sockets Layer (SSL) Protocol Based on:

Cryptography and Network Security (CS435) Part Fourteen (Web Security)

Web Security : Secure Socket Layer Secure Electronic Transaction.

Digital Envelopes, Secure Socket Layer and Digital Certificates By: Anthony and James.

1 Securing Data and Communication. 2 Module - Securing Data and Communication ♦ Overview Data and communication over public networks like Internet can.

Lecture 11 Page 1 Advanced Network Security Cryptography and Networks: IPSec and SSL/TLS Advanced Network Security Peter Reiher August, 2014.

Internet Security. 2 PGP is a security technology which allows us to send that is authenticated and/or encrypted. Authentication confirms the identity.

Using Encryption with Microsoft SQL Server 2000 Kevin McDonnell Technical Lead SQL Server Support Microsoft Corporation.

Tunneling and Securing TCP Services Nathan Green.

1 Security Protocols in the Internet Source: Chapter 31 Data Communications & Networking Forouzan Third Edition.

Module 8: Planning and Troubleshooting IPSec. Overview Understanding Default Policy Rules Planning an IPSec Deployment Troubleshooting IPSec Communications.

11 SECURING NETWORK COMMUNICATION Chapter 9. Chapter 9: SECURING NETWORK COMMUNICATION2 OVERVIEW  List the major threats to network communications. 

1 CMPT 471 Networking II Authentication and Encryption © Janice Regan,

Advanced Sendmail Part 1

INFORMATION SECURITY MANAGEMENT P ROTECTION M ECHANISMS - C RYPTOGRAPHY.

Mar 28, 2003Mårten Trolin1 This lecture Certificates and key management Non-interactive protocols –PGP SSL/TLS –Introduction –Phases –Commands.

4.1 © 2004 Pearson Education, Inc. Exam Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 12: Implementing Security.

INFORMATION SECURITY MANAGEMENT P ROTECTION M ECHANISMS - C RYPTOGRAPHY.

Securing Access to Data Using IPsec Josh Jones Cosc352.

IP Security (IPSec) Matt Hermanson. What is IPSec? It is an extension to the Internet Protocol (IP) suite that creates an encrypted and secure conversation.

VIRTUAL SERVERS Chapter 7. 2 OVERVIEW Exchange Server 2003 virtual servers Virtual servers in a clustering environment Creating additional virtual servers.

SSL: Secure Socket Layer By: Mike Weissert. Overview Definition History & Background SSL Assurances SSL Session Problems Attacks & Defenses.

Server-to-Client Remote Access and DirectAccess

Goals Introduce the Windows Server 2003 family of operating systems

Unit 8 Network Security.

Designing IIS Security (IIS – Internet Information Service)

Electronic Payment Security Technologies

Presentation transcript:

Lemon security

Previous security enhancements user lemon: lemon-db-admin-OraMon will create user lemon (Miro). - OraMon switches to user lemon at its initd script (David). - ReadOnly and heartBeat files will be moved to /var/lib/OraMon (Miro, David) - /etc/sysconfig/OraMon is owned by lemon, and is readable by user lemon only (David). Samples insertion access control: control what IPs (taken from CDB) may send samples to OraMon: - Investigate efficiency of using IPchains. Alternatives: per IP groups, (preferred, if possible) or per IP list Sensitive data to CDB 10) When CDB supports secure information via hppts, move sensitive EHD and OraMon config file information (user and password) from rpm to CDB. NCM OraMon component has to be changed accordingly (Gernam) 20) cdb get clusters: Needs to be configured for user/password as well (German). TBD: how to provide to cdb get clusters and active alarm nodes the user and password of the 2 sql DBs: lemon and cdb

Outline Miro’s suggestions for OraMon security David’s related thoughts

Lemon security Those who have access to CERN machines can openly interfere with Lemon, because it uses unsecure sockets

Miro: security of OraMon As we have discussed before, iptables could help us to restrict the domains, but I would take that a little bit further and asked for an authentication mechanism. use ssl for encryption and well as for the authentication. Client (MSA) on install downloads the oramon's public key, creates a challenge and sends its own public key (host's key). It receives back a reply with encoded clientID or with client's signature. MSA uses oramon's public key to encrypt the message plus encapsulates the clientID. oramon will store all of the allowed host's public keys inside database.

Miro: security of OraMon. Cont. Performance overhead: encrypting the samples + having three way authentication would create an overhead… Currently we have about 10kB/s throughput, so having encryption on top of that should not be a problem (even if we scale to 400kB/s). Communication of OraMon to oracle server could over ssl – I think that in OCI oracle supports SSL.

Enhance lemon security now?

Extending OraMon security to lemon security 1.Sensor  MSA 2.MSA  OraMon 3.OraMon  Oracle 4.Client  Oracle 5.Client  OraMon (SOAP)

1) Sensor  MSA (Since it is) TCP based, ssl may be added

2) MSA  OraMon Pertains to many machines  big vulnerability Requires changes at OraMon and at MSA Is UDP based, hence SSL can not be used What should be secured? –What machines speak to OraMon (iptables) –What users speak to OraMon –What applications speak to OraMon (feasible?) Guideline: Prevent reinventing wheels – use standards, where possible Candidate standard to secure UDP: IPSec

TCP security alternatives SSL is also known by a new, IETF standard name: Transport Layer Security, or TLS

UDP security alternatives IPsec: + Is standard - Complicated. Requires operating system support SecureUPD: - Is not standard

IPSec Strong security standard –Encryption & Encapsulation –Authentication & Anti-Replay –Key Management & Digital Signatures –Support of Unique Digital Certificates –Interoperability between the various IPSec compliant products Is supported by Linux – as add-on ipsec.doc ipsec.doc Transport mode vs. tunnel mode Usage of IPSec implies ‘tailoring’ of it into lemon

OraMon  Oracle TCP/IP with SSL Protocol Enables an Oracle application on a client to communicate with remote Oracle databases through TCP/IP and SSL. Oracle Advanced SecurityOracle Advanced Security product needed in order to use TCP/IP with SSL. SSL stores authentication data, (certificates, private keys), in an Oracle Wallet. When the client initiates a connection to the database server, SSL performs a handshake between the two using the certificate: –The client and database server negotiate a cipher suite--a set of authentication, encryption, and data integrity types--to apply to the messages they exchange. –Depending on its configuration, the database server sends its certificate to the client in a message encrypted with the client's public key. The client decrypts this message by using its own private key, then verifies that the database server's certificate bears the certificate authority's signature. –If required, the client may send the user's certificate to the database server. The certificate ensures that the user's information is correct and that the public key actually belongs to that user. The database server checks the user's certificate to verify that it bears the certificate authority's signature. From

Oracle Advanced Security A product that provides security features to protect enterprise networks: –network encryption –authentication –single sign-on services –security protocols Does CERN have a license for it?

4) Client  Oracle Makes sense to learn if Client-Oracle security may be enhanced.

5) Client  OraMon (SOAP) 1) HTTPS/SSL: Not used by (g)SOAP by default, may be added: : –Secure SOAP Web Services with HTTPS/SSL When a Web Service is installed as CGI, it uses standard I/O that is encrypted/decrypted by the Web server that runs the CGI application. Therefore, HTTPS/SSL support must be configured for the Web server.: –install OpenSSL –Recompile sources with option -DWITH_OPENSSL 2) Digital Signature (SOAP-DSIG): (In addition to SSL) defines syntax and rules for digitally signing SOAP messages and validating signatures.

Lemon security: Summary 1.Sensor  MSA 2.MSA  OraMon: IPSec. Complicated 3.OraMon  Oracle: Oracle Advanced Security Oracle Advanced Security 4.Client  Oracle 5.Client  OraMon (SOAP): OpenSSL+SOAP-DSIG?