DOCSLIB.ORG

AIX V6 Advanced Security Features: Introduction and Configuration 2.4.5 Decrypting a File

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
AIX V6 Advanced Security Features: Introduction and Configuration 2.4.5 Decrypting a File Front cover AIX V6 Advanced Security Features Introduction and Configuration A comprehensive overview of AIX V6 operating system security features New features: Role Based Access Control (RBAC), Trusted AIX (Multilevel Security), and Trusted Execution AIX V6 Security Expert enhancements Brad Gough Christian Karpp Rajeev Mishra Liviu Rosca Jacqueline Wilson Chris Almond ibm.com/redbooks International Technical Support Organization AIX V6 Advanced Security Features Introduction and Configuration September 2007 SG24-7430-00 Note: Before using this information and the product it supports, read the information in “Notices” on page xi. First Edition (September 2007) This edition applies to IBM AIX Version 6.1. Note: This book is based on a pre-GA version of a product and may not apply when the product becomes generally available. We recommend that you consult the product documentation or follow-on versions of this IBM Redbooks publication for more current information. © Copyright International Business Machines Corporation 2007. All rights reserved. Note to U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Notices . xi Trademarks . xii Preface . xiii The team that wrote this book . xiv Acknowledgements . xv Become a published author . xvi Comments welcome. xvi Part 1. AIX V6 operating system security features . 1 Chapter 1. Introduction. 3 1.1 Introduction: security in the enterprise . 5 1.2 Risk analysis . 6 1.3 Types of security threats . 7 1.4 AIX V6.1 security features and the threats they address . 9 1.5 Types of security . 10 1.6 Purpose of security: establishing trust. 11 1.7 Overview of security enhancements to AIX V6 for establishing trust . 12 1.8 Trusting the configuration of the OS with AIX Security Expert . 14 1.8.1 AIX Security Expert enhancements for AIX V6 . 15 1.8.2 AIX Security Expert hardening groupings . 16 1.8.3 AIX Security Expert “undo” option. 17 1.8.4 Consistency check in AIX Security Expert . 17 1.8.5 Centralized AIX Security Expert policy distribution with LDAP . 18 1.9 Trusting the installation of filesets with Secure by Default . 20 1.10 Trusting system access with File Permission Manager. 21 1.11 Trusting executables with Trusted Execution . 22 1.12 Delegating trust for users and the processes with Role Based Access Control . 24 1.12.1 AIX V6 Enhanced RBAC compared to AIX RBAC prior to AIX V6 . 25 1.12.2 Advantages of AIX V6 Role Based Access Control . 26 1.12.3 Relationship of authorizations, roles, and privileges . 27 1.12.4 Privileges versus authorizations . 28 1.13 Trusting file access and providing privacy of files with AIX Encrypted File Systems . 31 1.13.1 Symmetric versus asymmetric encryption. 32 1.13.2 Advanced Encryption Standard (AES) . 34 1.13.3 Block versus streaming ciphers . 35 © Copyright IBM Corp. 2007. All rights reserved. iii 1.13.4 CBC mode versus ECB mode. 36 1.13.5 Selecting key length and modes . 38 1.13.6 RSA algorithm . 38 1.13.7 Creating the EFS keystore: installation of CLiC library . 38 1.13.8 EFS key protection modes: Root Admin or Root Guard mode . 39 1.14 Trusting the entire system: Trusted AIX . 39 1.14.1 Components of Trusted AIX . 41 1.15 In summary: total AIX security capabilities . 43 1.15.1 LDAP Active Directory enhancements . 45 1.15.2 TCP wrappers . 46 1.15.3 IP Security with AES . 46 1.15.4 ipfilter support . 47 1.15.5 Open SSH with Kerberos authentication. 47 1.15.6 Stack Execution Disable . 47 1.15.7 4764 Cryptographic Accelerator with CCA and PKCS11 support. 49 1.16 AIX certifications: independent assurance of security functions . 50 1.16.1 Background on security standards . 50 1.16.2 Security profiles for AIX V6.1: CAPP, LSPP, and RBACPP . 51 1.16.3 The Controlled Access Protection Profile (CAPP) . 51 1.16.4 Labeled Security Protection Profile (LSPP) . 52 1.16.5 Role Based Access Control Protection Profile (RBACPP) . 52 1.16.6 Current AIX certifications: CAPP and LSPP . 52 1.16.7 Evaluation and assurance levels for Common Criteria . 53 1.16.8 What does EAL4+ mean . 54 1.16.9 Definition of EAL4 . 55 1.16.10 Running a system in CAPP or LSPP mode . 56 Chapter 2. Encrypted File System . 59 2.1 EFS . 60 2.2 EFS prerequisites . 60 2.2.1 CLiC installation . 60 2.2.2 Enabling EFS for file systems . 61 2.2.3 The efsenable command. 62 2.2.4 Usage of lock files . 64 2.3 Managing encrypted file systems and encrypted files. 65 2.3.1 Creating an EFS . 65 2.3.2 Operations with EFS-enabled file systems . 67 2.3.3 Encryption inheritance. 67 2.4 Encryption at file level . 70 2.4.1 Creating encrypted files and the umask command . 70 2.4.2 Listing file encryption information . 72 2.4.3 Implication of encryption on file size and location of disk blocks . 73 2.4.4 Looking at disk blocks of an encrypted file . 74 iv AIX V6 Advanced Security Features: Introduction and Configuration 2.4.5 Decrypting a file . 77 2.4.6 Encrypting a file. 79 2.4.7 Changing file encryption key parameters . 80 2.4.8 File access permissions . 81 2.4.9 Changing file ownership . 85 2.4.10 Granting a user or a group access to a file . 87 2.4.11 Revoking a user or group access to a file . 91 2.4.12 Granting/revoking access in root admin mode . 94 2.5 Users management . 95 2.5.1 Defining users . 95 2.5.2 User keystore . 99 2.5.3 Keystore content . 100 2.5.4 Keystore operations . 104 2.5.5 Keystore operations . 105 2.5.6 Changing the user keystore password . 106 2.5.7 Granting access to the user keystore . 106 2.5.8 Revoking access to user keystore . 111 2.5.9 Accepting access keys . 113 2.5.10 Granting security credentials to a process . 115 2.5.11 Exporting the content of keystore . 116 2.5.12 User private keys . 117 2.5.13 User public key . 128 2.5.14 Importance of deprecated keys. ..
Load more

Recommended publications
  • TCPDUMP Caution
    TCPDUMP q Refer to book ”Open Source Network Administration” m Online sample chapter: http://www.phptr.com/articles/article.asp?p=170902&seqNum=4 q Some tools are not based directly on the data being transmitted on a network, but information related to that data. m For example, network bandwidth values m System logs on network equipment q Sometimes needs to examine the packets themselves. m Diagnose some particularly tricky network problems q Widely used open source tool for directly analyzing packets: tcpdump m http://www.tcpdump.org/ Network Analyzer 1-1 Caution q Before you use tcpdump or other analyzer: m Will be able to see some private data m Consult/research Legal implication first m Respect the privacy of other users Network Analyzer 1-2 1 What Tcpdump can do for you q View the entire data portion of an Ethernet frame or other link layer protocol m An IP packet m An ARP packet m Or any protocol at a higher layer than Ethernet. q Very useful m Tcpdump is to a network administrator like a microscope to a biologist. m Give a very clear picture of a specific part of your network m Can be used when the problem is simply that something is not working properly. Network Analyzer 1-3 What tcpdump can do for you? q Case1 : Web browser can not load pages from a server – it hangs. m Problem with client? Server? Or between? m Run tcpdump while loading • Watch every stage to see the following – DNS query – HTTP request to server – Server respond q Case 2: help debug denial of service attacks.
    [Show full text]
  • I3: Maximizing Packet Capture Performance
    I3: Maximizing Packet Capture Performance Andrew Brown Agenda • Why do captures drop packets, how can you tell? • Software considerations • Hardware considerations • Potential hardware improvements • Test configurations/parameters • Performance results Sharkfest 2014 What is a drop? • Failure to capture a packet that is part of the traffic in which you’re interested • Dropped packets tend to be the most important • Capture filter will not necessarily help Sharkfest 2014 Why do drops occur? • Applications don’t know that their data is being captured • Result: Only one chance to capture a packet • What can go wrong? Let’s look at the life of a packet Sharkfest 2014 Internal packet flow • Path of a packet from NIC to application (Linux) • Switch output queue drops • Interface drops • Kernel drops Sharkfest 2014 Identifying drops • Software reports drops • L4 indicators (TCP ACKed lost segment) • L7 indicators (app-level sequence numbers revealed by dissector) Sharkfest 2014 When is (and isn’t) it necessary to take steps to maximize capture performance? • Not typically necessary when capturing traffic of <= 1G end device • More commonly necessary when capturing uplink traffic from a TAP or SPAN port • Some sort of action is almost always necessary at 10G • Methods described aren’t always necessary • Methods focus on free solutions Sharkfest 2014 Software considerations - Windows • Quit unnecessary programs • Avoid Wireshark for capturing ˗ Saves to TEMP ˗ Additional processing for packet statistics • Uses CPU • Uses memory over time, can lead
    [Show full text]
  • NSA Security-Enhanced Linux (Selinux)
    Integrating Flexible Support for Security Policies into the Linux Operating System http://www.nsa.gov/selinux Stephen D. Smalley [email protected] Information Assurance Research Group National Security Agency ■ Information Assurance Research Group ■ 1 Outline · Motivation and Background · What SELinux Provides · SELinux Status and Adoption · Ongoing and Future Development ■ Information Assurance Research Group ■ 2 Why Secure the Operating System? · Information attacks don't require a corrupt user. · Applications can be circumvented. · Must process in the clear. · Network is too far. · Hardware is too close. · End system security requires a secure OS. · Secure end-to-end transactions requires secure end systems. ■ Information Assurance Research Group ■ 3 Mandatory Access Control · A ªmissing linkº of security in current operating systems. · Defined by three major properties: ± Administratively-defined security policy. ± Control over all subjects (processes) and objects. ± Decisions based on all security-relevant information. ■ Information Assurance Research Group ■ 4 Discretionary Access Control · Existing access control mechanism of current OSes. · Limited to user identity / ownership. · Vulnerable to malicious or flawed software. · Subject to every user©s discretion (or whim). · Only distinguishes admin vs. non-admin for users. · Only supports coarse-grained privileges for programs. · Unbounded privilege escalation. ■ Information Assurance Research Group ■ 5 What can MAC offer? · Strong separation of security domains · System, application, and data integrity · Ability to limit program privileges · Processing pipeline guarantees · Authorization limits for legitimate users ■ Information Assurance Research Group ■ 6 MAC Implementation Issues · Must overcome limitations of traditional MAC ± More than just Multi-Level Security / BLP · Policy flexibility required ± One size does not fit all! · Maximize security transparency ± Compatibility for applications and existing usage.
    [Show full text]
  • Spf Based Selinux Operating System for Multimedia Applications
    International Journal of Reviews in Computing st 31 December 2011. Vol. 8 IJRIC © 2009 - 2011 IJRIC & LLS. All rights reserved. ISSN: 2076-3328 www.ijric.org E-ISSN: 2076-3336 SPF BASED SELINUX OPERATING SYSTEM FOR MULTIMEDIA APPLICATIONS 1NITISH PATHAK, 2NEELAM SHARMA 1BVICAM, GGSIPU, Delhi, India 2Department of Information Technology, Maharaja Agrasen Institute of Technology, Delhi, India E-mail: [email protected], [email protected] ABSTRACT Trusted Operating Systems, offer a number of security mechanisms that can help protect information, make a system difficult to break into, and confine attacks far better than traditional operating systems. However, this security will come at a cost, since it can degrade the performance of an operating system. This performance loss is one of the reasons why Trusted Operating Systems have not become popular. While Trusted Operating Systems offer an incredible amount of security, observations about computing workloads suggest that only some parts of the operating system security are actually necessary. Web servers are the best example. For many web servers, the majority of the information on the server is publicly readable and available on the Internet. Therefore, if a Trusted Operating System is used on a web server, any security used to secure the confidentiality of the server’s information is not necessary. Any security used to protect the confidentiality of web server data can be considered a waste of computational resources. The security needed in web servers is the security to protect the integrity of data, not the confidentiality of data. Other workloads such as multimedia or database workloads may also only need parts of the operating system security.
    [Show full text]
  • Looking Back: Addendum
    Looking Back: Addendum David Elliott Bell Abstract business environment produced by Steve Walker’s Com- puter Security Initiative.3 The picture of computer and network security painted in What we needed then and what we need now are “self- my 2005 ACSAC paper was bleak. I learned at the con- less acts of security” that lead to strong, secure commercial ference that the situation is even bleaker than it seemed. products.4 Market-driven self-interest does not result in al- We connect our most sensitive networks to less-secure net- truistic product decisions. Commercial and government ac- works using low-security products, creating high-value tar- quisitions with tight deadlines are the wrong place to ex- gets that are extremely vulnerable to sophisticated attack or pect broad-reaching initiatives for the common good. Gov- subversion. Only systems of the highest security are suffi- ernment must champion selfless acts of security separately cient to thwart such attacks and subversions. The environ- from acquisitions. ment for commercial security products can be made healthy again. 3 NSA Has the Mission In 1981, the Computer Security Evaluation Center was 1 Introduction established at the National Security Agency (NSA). It was charged with publishing technical standards for evaluating In the preparation of a recent ACSAC paper [1], I con- trusted computer systems, with evaluating commercial and firmed my opinion that computer and network security is in GOTS products, and with maintaining an Evaluated Prod- sad shape. I also made the editorial decision to soft-pedal ucts List (EPL) of products successfully evaluated. NSA criticism of my alma mater, the National Security Agency.
    [Show full text]
  • Of Mobile Devices: a Survey on Network Traffic Analysis
    1 The Dark Side(-Channel) of Mobile Devices: A Survey on Network Traffic Analysis Mauro Conti, Senior Member, IEEE, QianQian Li, Alberto Maragno, and Riccardo Spolaor*, Member, IEEE. Abstract—In recent years, mobile devices (e.g., smartphones elements enable both smartphones and tablets to have the and tablets) have met an increasing commercial success and same functionalities typically offered by laptops and desktop have become a fundamental element of the everyday life for computers. billions of people all around the world. Mobile devices are used not only for traditional communication activities (e.g., voice According to the statistics reported in [1], smartphone calls and messages) but also for more advanced tasks made users were 25:3% of the global population in 2015, and this possible by an enormous amount of multi-purpose applications percentage is expected to grow till 37% in 2020. Similarly, the (e.g., finance, gaming, and shopping). As a result, those devices statistics about tablets reported in [2] indicate a global penetra- generate a significant network traffic (a consistent part of the overall Internet traffic). For this reason, the research community tion of 13:8% in 2015, expected to reach 19:2% in 2020. The has been investigating security and privacy issues that are related driving forces of this tremendous success are the ubiquitous to the network traffic generated by mobile devices, which could Internet connectivity, thanks to the worldwide deployment of be analyzed to obtain information useful for a variety of goals cellular and Wi-Fi networks, and a large number of apps (ranging from fine-grained user profiling to device security and available in the official (and unofficial) marketplaces.
    [Show full text]
  • PF: the Openbsd Packet Filter
    PF: The OpenBSD Packet Filter Languages: [en] [de] [es] [fr] [id] [ja] [pl] [up to FAQ] [Next: Getting Started] PF: The OpenBSD Packet Filter Table of Contents ● Basic Configuration ❍ Getting Started ❍ Lists and Macros ❍ Tables ❍ Packet Filtering ❍ Network Address Translation ❍ Traffic Redirection (Port Forwarding) ❍ Shortcuts For Creating Rulesets ● Advanced Configuration ❍ Runtime Options ❍ Scrub (Packet Normalization) ❍ Anchors and Named (Sub) Rulesets ❍ Packet Queueing and Prioritization ❍ Address Pools and Load Balancing ❍ Packet Tagging ● Additional Topics ❍ Logging ❍ Performance ❍ Issues with FTP ❍ Authpf: User Shell for Authenticating Gateways ● Example Rulesets ❍ Example: Firewall for Home or Small Office Packet Filter (from here on referred to as PF) is OpenBSD's system for filtering TCP/IP traffic and doing Network Address Translation. PF is also capable of normalizing and conditioning TCP/IP traffic and providing bandwidth control and packet prioritization. PF has been a part of the GENERIC OpenBSD kernel since OpenBSD 3.0. Previous OpenBSD releases used a different firewall/NAT package which is no longer supported. PF was originally developed by Daniel Hartmeier and is now maintained and developed by Daniel and the rest of the OpenBSD team. This set of documents is intended as a general introduction to the PF system as run on OpenBSD. It is intended to be used as a supplement to the man pages, not as a replacement for them. This document covers all of PF's major features. For a complete and http://www.openbsd.org/faq/pf/index.html (1 of 2) [02/06/2005 14:54:58] PF: The OpenBSD Packet Filter in-depth view of what PF can do, please start by reading the pf(4) man page.
    [Show full text]
  • Tcpdump Basics
    TCPdump Basics What we will cover: What is/are TCPdump/WinDump? Why use TCPdump? Installation of TCPdump on Unix/Windows It’s installed, now what? Changing the amount of data collected Reading TCPdump/WinDump Output TCP Flags in TCPdump/WinDump Absolute & Relative Sequence Numbers Dumping TCPdump/WinDump output in hexadecimal format TCPdump ManPage TCPdump is a tool we can use for packet analysis. We will not use ethereal (wireshark) because it does “too much” for us. TCPdump will keep everything “raw” and that’s the way we like it! *note: it is expected that the reader will try out all the TCPdump/WinDump commands listed in the lesson on their own computers as well as the practical exercises. You have to actually run the commands to learn how to use the tool. What is/are TCPdump/WinDump? TCPdump, and its cousin WinDump, is software that allows us to see inside the traffic activity that occurs on a network. TCPdump is a Unix tool used to gather data from the network, decipher the bits, and display the output in a human readable format (granted it does take a little bit of instruction to learn the TCPdump language). Why use TCPdump? Network traffic travels in data packets; each data packet contains the information that it needs to travel across the network. This information is contained in a TCP header. A TCP header will contain the destination and source address, state information, and protocol identifiers. The rest of the packet contains the data that is being sent. Devices that are responsible for routing read the information in these packets and send them to their correct destination.
    [Show full text]
  • BSD Projects IV – BSD Certification • Main Features • Community • Future Directions a (Very) Brief History of BSD
    BSD Overview Jim Brown May 24, 2012 BSD Overview - 5/24/2012 - Jim Brown, ISD BSD Overview I – A Brief History of BSD III – Cool Hot Stuff • ATT UCB Partnership • Batteries Included • ATT(USL) Lawsuit • ZFS , Hammer • BSD Family Tree • pf Firewall, pfSense • BSD License • Capsicum • Virtualization Topics • Jails, Xen, etc. • Desktop PC-BSD II – The Core BSD Projects IV – BSD Certification • Main Features • Community • Future Directions A (Very) Brief History of BSD 1971 – ATT cheaply licenses Unix source code to many organizations, including UCB as educational material 1975 – Ken Thompson takes a sabbatical from ATT, brings the latest Unix source on tape to UCB his alma mater to run on a PDP 11 which UCB provided. (Industry/academic partnerships were much more common back then.) Computer Science students (notably Bill Joy and Chuck Haley) at UCB begin to make numerous improvements to Unix and make them available on tape as the “Berkeley Software Distribution” - BSD A (Very) Brief History of BSD Some notable CSRG • 1980 – Computer Science Research Group members (CSRG) forms at UCB with DARPA funding to make many more improvements to Unix - job control, autoreboot, fast filesystem, gigabit address space, Lisp, IPC, sockets, TCP/IP stack + applications, r* utils, machine independence, rewriting almost all ATT code with UCB/CSRG code, including many ports • 1991 – The Networking Release 2 tape is released on the Internet via anon FTP. A 386 port quickly follows by Bill and Lynne Jolitz. The NetBSD group is formed- the first Open Source community entirely on the Internet • 1992 – A commercial version, BSDI (sold for $995, 1-800-ITS-UNIX) draws the ire of USL/ATT.
    [Show full text]
  • Performance Evaluation of Tcpdump
    Performance Evaluation of Tcpdump Farhan Jiva University of Georgia Abstract performed relatively similar with respect to packet loss. FreeBSD performed the worst out of the op- With the onset of high-speed networks, using erating systems tested, while Windows usually dis- tcpdump in a reliable fashion can become prob- plays seemingly random spikes of packet loss. For lematic when facing the poor performance of mod- each of the datasets we tested, we found that Fedora ern operating systems. Because of this limitation, performs the best. The rest of the paper is laid out the amount of packet loss a user is willing to face as follows: is an important factor when choosing an operating system for a specific task. In this paper, we evaluate the performance of tcpdump on five modern operat- • In Section 2 we discuss some related work. ing systems. 1 Introduction • Section 3 covers our evaluation, along with our experimental setup and experimental results. The reliable usage of tcpdump as a network an- alyzing/debugging/monitoring tool is arguably a non-trivial task. With the onset of high-speed net- • In Section 4, we discuss our conclusions. works, using tcpdump in a reliable fashion can become problematic when facing the poor perfor- mance of modern operating systems. It is because of this limitation that the amount of packet loss be- 2 Related Work comes an inevitable factor when choosing an oper- ating system for a specific task. For example, a re- One approach to increasing the performance of searcher who needs to extract binary executable files packet capturing is explained by Deri et al.
    [Show full text]
  • A Survey of Security Research for Operating Systems∗
    A Survey of Security Research for Operating Systems∗ Masaki HASHIMOTOy Abstract In recent years, information systems have become the social infrastructure, so that their security must be improved urgently. In this paper, the results of the sur- vey of virtualization technologies, operating system verification technologies, and access control technologies are introduced, in association with the design require- ments of the reference monitor introduced in the Anderson report. Furthermore, the prospects and challenges for each of technologies are shown. 1 Introduction In recent years, information systems have become the social infrastructure, so that improving their security has been an important issue to the public. Besides each of security incidents has much more impact on our social life than before, the number of security incident is increasing every year because of the complexity of information systems for their wide application and the explosive growth of the number of nodes connected to the Internet. Since it is necessary for enhancing information security to take drastic measures con- cerning technologies, managements, legislations, and ethics, large numbers of researches are conducted throughout the world. Especially focusing on technologies, a wide variety of researches is carried out for cryptography, intrusion detection, authentication, foren- sics, and so forth, on the assumption that their working basis is safe and sound. The basis is what is called an operating system in brief and various security enhancements running on it are completely useless if it is vulnerable and unsafe. Additionally, if the operating system is safe, it is an urgent issue what type of security enhancements should be provided from it to upper layers.
    [Show full text]
  • Vid6014-Vr-0001 Draft
    National Information Assurance Partnership ® TM Common Criteria Evaluation and Validation Scheme Validation Report BAE Systems Information Technology, Inc. XTS-400 Version 6.4.U4 Report Number: CCEVS-VR-VID10293-2008 Dated: July 3, 2008 Version: 2.3 National Institute of Standards and Technology National Security Agency Information Technology Laboratory Information Assurance Directorate 100 Bureau Drive 9600 Savage Road Suite 6757 Gaithersburg, Maryland 20878 Fort George G. Meade, MD 20755-6740 i Acknowledgements: The TOE evaluation was sponsored by: BAE Systems Information Technology Inc. Evaluation Personnel: Arca Common Criteria Testing Laboratory Ms. Diann Carpenter Mr. J. David Thompson Dr. Gary Grainger Mr. John Boone Ms. Louise Huang Mr. Ray Rugen Mr. Ken Dill The National Security Agency . Validation Personnel: Dr. Jerome Myers, The Aerospace Corporation Mr. Daniel Faigin, The Aerospace Corporation ii Table of Contents 1 Executive Summary................................................................................................................ 1 2 Identification............................................................................................................................ 3 3 Security Policy ........................................................................................................................ 5 3.1 Identification and Authentication Policy ......................................................................... 5 3.2 Mandatory Access Control Policy .................................................................................
    [Show full text]