DOCSLIB.ORG

The Use of Firewalls in an Academic Environment JTAP-631

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
The Use of Firewalls in an Academic Environment JTAP-631 The Use of Firewalls in an Academic Environment JTAP-631 Tim Chown Jon Read David DeRoure Department of Electronics and Computer Science University of Southampton April 2000 1 Contents 1 CONTENTS .......................................................................................................................................... 2 2 EXECUTIVE SUMMARY .................................................................................................................. 5 3 INTRODUCTION ................................................................................................................................ 7 3.1 ACKNOWLEDGEMENTS .................................................................................................................... 7 4 AN INTRODUCTION TO FIREWALL CONCEPTS...................................................................... 8 4.1 WHAT IS A FIREWALL? .................................................................................................................... 8 4.2 TYPES OF FIREWALL........................................................................................................................ 8 4.3 MODES OF OPERATION..................................................................................................................... 9 4.4 WHERE SHOULD A FIREWALL BE SITUATED? ................................................................................. 10 4.4.1 JANET-level firewalls........................................................................................................... 11 5 GENERAL FIREWALL-RELATED ISSUES................................................................................. 12 5.1 THE COMPUTER MISUSE ACT AND CORPORATE LIABILITY ........................................................... 12 5.2 DATA PROTECTION ACT 1998 ....................................................................................................... 12 5.3 DTI/BSI/ISF STANDARDS............................................................................................................. 13 5.4 GROWTH OF THE INTERNET ........................................................................................................... 14 5.5 SECURITY INCIDENTS ON JANET.................................................................................................. 15 5.6 IMPACT OF AN ATTACK ................................................................................................................. 16 6 EVALUATING A FIREWALL SOLUTION................................................................................... 18 6.1 COST ............................................................................................................................................. 18 6.2 FUNCTIONALITY ............................................................................................................................ 18 6.3 TRAINING, SUPPORT AND DOCUMENTATION ................................................................................. 22 6.4 MISCELLANEOUS FEATURES .......................................................................................................... 22 6.5 FIREWALL EVALUATION CHECKLIST ............................................................................................. 23 7 INTRODUCING A FIREWALL ...................................................................................................... 26 7.1.1 Drivers for change................................................................................................................ 26 7.2 INITIAL NON-FILTERING DEPLOYMENT ......................................................................................... 26 7.3 PERFORMANCE, DEPLOYMENT AND COST ISSUES ......................................................................... 27 7.3.1 Performance ......................................................................................................................... 27 7.3.2 Hardware.............................................................................................................................. 28 7.3.3 Other costs............................................................................................................................ 28 7.3.4 Installation disruption........................................................................................................... 28 7.4 RUNNING A WATCHING BRIEF....................................................................................................... 28 7.4.1 User survey ........................................................................................................................... 29 7.4.2 Understanding the traffic...................................................................................................... 30 7.5 EVOLVING DEFAULT ALLOW RULES............................................................................................... 30 7.5.1 Classifying traffic.................................................................................................................. 30 7.6 ADDING THE FIRST INBOUND DENY RULES..................................................................................... 31 7.6.1 Consulting the users.............................................................................................................. 32 7.6.2 An evolved Firewall-1 rule set.............................................................................................. 33 7.6.3 Initial technical issues .......................................................................................................... 34 7.6.4 Blocking SMTP ..................................................................................................................... 35 7.6.5 The portmapper .................................................................................................................... 35 7.7 DEFINING AND ESTABLISHING A SECURITY POLICY........................................................................ 36 7.7.1 What questions should a firewall policy answer?................................................................. 36 7.8 GOING DEFAULT DENY .................................................................................................................. 37 2 7.9 SIX MONTHS ON ............................................................................................................................. 38 7.9.1 Summary of five weeks of blocked firewall events ................................................................ 38 7.9.2 Unsolicited probes against our network ............................................................................... 39 7.9.3 Services that are hard to filter .............................................................................................. 40 7.9.4 Maintenance on Firewall-1................................................................................................... 40 7.9.5 Outbound filtering................................................................................................................. 40 7.9.6 Interaction with Computing Services.................................................................................... 41 8 OPERATIONAL FIREWALL ISSUES ........................................................................................... 43 8.1 FIREWALL TESTING ....................................................................................................................... 43 8.2 TECHNICAL ISSUES ........................................................................................................................ 43 8.2.1 Getting the more complex services running.......................................................................... 44 8.2.2 Proxy servers – SOCKS ........................................................................................................ 44 8.3 USE OF A DE-MILITARISED ZONE (DMZ)...................................................................................... 45 8.4 ISSUES WITH FIREWALL-1.............................................................................................................. 46 8.5 BEHIND THE FIREWALL ................................................................................................................. 47 8.6 ANALYSING FIREWALL LOGS ........................................................................................................ 47 8.7 INTRUSION AND VIRUS DETECTION SYSTEMS ............................................................................... 48 8.8 USER ISSUES.................................................................................................................................. 50 9 SECURE TRANSIENT FIREWALL ACCESS METHODS ......................................................... 51 9.1 USER AUTHENTICATION ................................................................................................................ 51 9.1.1 SecurID tokens...................................................................................................................... 52 9.2 MAKING SSH AVAILABLE OVER THE WEB...................................................................................... 54 9.3 SSL FOR SECURE WEB SERVERS..................................................................................................... 54 9.4 SSL FOR SECURE E-MAIL ACCESS .................................................................................................. 55 9.5 USE OF TRANSPORT LAYER ENCAPSULATION FOR SECURE ACCESS THROUGH A FIREWALL ......... 55
Load more

Recommended publications
  • Active-Active Firewall Cluster Support in Openbsd
    Active-Active Firewall Cluster Support in OpenBSD David Gwynne School of Information Technology and Electrical Engineering, University of Queensland Submitted for the degree of Bachelor of Information Technology COMP4000 Special Topics Industry Project February 2009 to leese, who puts up with this stuff ii Acknowledgements I would like to thank Peter Sutton for allowing me the opportunity to do this work as part of my studies at the University of Queensland. A huge thanks must go to Ryan McBride for answering all my questions about pf and pfsync in general, and for the many hours working with me on this problem and helping me test and debug the code. Thanks also go to Theo de Raadt, Claudio Jeker, Henning Brauer, and everyone else at the OpenBSD network hackathons who helped me through this. iii Abstract The OpenBSD UNIX-like operating system has developed several technologies that make it useful in the role of an IP router and packet filtering firewall. These technologies include support for several standard routing protocols such as BGP and OSPF, a high performance stateful IP packet filter called pf, shared IP address and fail-over support with CARP (Common Address Redundancy Protocol), and a protocol called pfsync for synchronisation of the firewalls state with firewalls over a network link. These technologies together allow the deployment of two or more computers to provide redundant and highly available routers on a network. However, when performing stateful filtering of the TCP protocol with pf, the routers must be configured in an active-passive configuration due to the current semantics of pfsync.
    [Show full text]
  • DNS Spoofing 2
    Professor Vahab COMP 424 13 November 2016 DNS Spoofing DNS spoofing, also known as DNS Cache Poisoning, is one of the most widely used man-in-the-middle attacks that capitalizes on vulnerabilities in the domain name system that returns a false IP address and routes the user to a malicious domain. Whenever a machine contacts a domain name such as www.bankofamerica.com, it must first contact its DNS server which responds with multiple IP addresses where your machine can reach the website. Your computer is then able to connect directly to one of the IP addresses and the DNS is able to convert the IP addresses into a human-readable domain name. If an attacker is able to gain control of a DNS server and change some of its properties such as routing Bank of America’s website to an attacker’s IP address. At that location, the attacker is then able to unsuspectingly steal the user’s credentials and account information. Attackers use spam and other forms of attack to deliver malware that changes DNS settings and installs a rogue Certificate Authority. The DNS changes point to the hacker's secret DNS name server so that when the users access the web they are directed to proxy servers instead of authorized sites. They can also start to blacklist domains and frustrate the user with their day to day activities. All blacklisted domains would have their traffic dropped instead of forwarded to their intended destination. Based on the rogue Certificate Authority the system has no sign that an attack is taking place or ever took place.
    [Show full text]
  • Secure Shell- Its Significance in Networking (Ssh)
    International Journal of Application or Innovation in Engineering & Management (IJAIEM) Web Site: www.ijaiem.org Email: [email protected] Volume 4, Issue 3, March 2015 ISSN 2319 - 4847 SECURE SHELL- ITS SIGNIFICANCE IN NETWORKING (SSH) ANOOSHA GARIMELLA , D.RAKESH KUMAR 1. B. TECH, COMPUTER SCIENCE AND ENGINEERING Student, 3rd year-2nd Semester GITAM UNIVERSITY Visakhapatnam, Andhra Pradesh India 2.Assistant Professor Computer Science and Engineering GITAM UNIVERSITY Visakhapatnam, Andhra Pradesh India ABSTRACT This paper is focused on the evolution of SSH, the need for SSH, working of SSH, its major components and features of SSH. As the number of users over the Internet is increasing, there is a greater threat of your data being vulnerable. Secure Shell (SSH) Protocol provides a secure method for remote login and other secure network services over an insecure network. The SSH protocol has been designed to support many features along with proper security. This architecture with the help of its inbuilt layers which are independent of each other provides user authentication, integrity, and confidentiality, connection- oriented end to end delivery, multiplexes encrypted tunnel into several logical channels, provides datagram delivery across multiple networks and may optionally provide compression. Here, we have also described in detail what every layer of the architecture does along with the connection establishment. Some of the threats which Ssh can encounter, applications, advantages and disadvantages have also been mentioned in this document. Keywords: SSH, Cryptography, Port Forwarding, Secure SSH Tunnel, Key Exchange, IP spoofing, Connection- Hijacking. 1. INTRODUCTION SSH Secure Shell was first created in 1995 by Tatu Ylonen with the release of version 1.0 of SSH Secure Shell and the Internet Draft “The SSH Secure Shell Remote Login Protocol”.
    [Show full text]
  • Wingate Manual
    Wingate manual So read on to find out what to do after you ve installed WinGate, and how to go about configuring your LAN to get your client machines connecting to the. WinGate is highly capable web proxy software for Windows: caching, intercepting, forward and reverse proxy with https inspection and SSL offload, SOCKS ​WinGate VPN · ​Kaspersky AV for WinGate · ​PureSight for WinGate · ​Lumen. Your license agreement with Qbik New Zealand Limited, which is included with WinGate 3 (“the Software”), specifies the permitted and prohibited uses of the. Install WinGate 7 and have your network up and running in about 5 minutes. This video demonstrates how. WinGate Proxy Server is a sophisticated integrated Internet gateway and Advance => Network => Settings => Manual Proxy Configuration. Control and manage Internet access with WinGate, a sophisticated Internet gateway and communications server designed to meet the control, security and. Wingate Tutorial - Download as Word Doc .doc /.docx), PDF File .pdf), Text Select manual settings Goto edit settings Edit ip settings Set your ip adress as. WinGate is software designed to calibrate canal check gates for flow measurement. WinGate can analyze radial gates and slide gates. The current version is. Manual. WINGATE®. Configuration Tool for UNIGATE®. Deutschmann Automation GmbH & Co. KG | hmann. This manual covers two models - E and E Wingate Option. Watch therefore, for which sections apply to your bike. Monark E and E Wingate. The NCDPI Licensure Form and instructions are also available online at our website under "Forms," then “Licensure” for your convenience. Application. Library LibGuides. Policy Manual Cataloging. Library LibGuides. Policy Manual E-Resources.
    [Show full text]
  • Pf3e Index.Pdf
    INDEX Note: Pages numbers followed by f, n, priority-based queues, 136–145 or t indicate figures, notes, and tables, match rule for queue assignment, respectively. 137–138 overview, 134–135 Symbols performance improvement, 136–137 # (hash mark), 13, 15 queuing for servers in DMZ, ! (logical NOT) operator, 42 142–144 setting up, 135–136 A on FreeBSD, 135–136 on NetBSD, 136 Acar, Can Erkin, 173 on OpenBSD, 135 ACK (acknowledgment) packets transitioning to priority and class-based bandwidth allocation, queuing system, 131–133 139–140 anchors, 35–36 HFSC algorithm, 124, 126, 142 authpf program, 61, 63 priority queues, 132, 137–138 listing current contents of, 92 two-priority configuration, loading rules into, 92 120–121, 120n1 manipulating contents, 92 adaptive.end value, 188 relayd daemon, 74 adaptive firewalls, 97–99 restructuring rule set with, 91–94 adaptive.start value, 188 tagging to help policy routing, 93 advbase parameter, 153–154 ancontrol command, 46n1 advskew parameter, 153–154, 158–159 antispoof tool, 27, 193–195, 194f aggressive value, 192 ARP balancing, 151, 157–158 ALTQ (alternate queuing) framework, atomic rule set load, 21 9, 133–145, 133n2 authpf program, 59–63, 60 basic concepts, 134 basic authenticating gateways, class-based bandwidth allocation, 60–62 139–140 public networks, 62–63 overview, 135 queue definition, 139–140 tying queues into rule set, 140 B handling unwanted traffic, 144–145 bandwidth operating system-based queue actual available, 142–143 assignments, 145 class-based allocation of, 139–140 overloading to
    [Show full text]
  • Threat Modeling and Circumvention of Internet Censorship by David Fifield
    Threat modeling and circumvention of Internet censorship By David Fifield A dissertation submitted in partial satisfaction of the requirements for the degree of Doctor of Philosophy in Computer Science in the Graduate Division of the University of California, Berkeley Committee in charge: Professor J.D. Tygar, Chair Professor Deirdre Mulligan Professor Vern Paxson Fall 2017 1 Abstract Threat modeling and circumvention of Internet censorship by David Fifield Doctor of Philosophy in Computer Science University of California, Berkeley Professor J.D. Tygar, Chair Research on Internet censorship is hampered by poor models of censor behavior. Censor models guide the development of circumvention systems, so it is important to get them right. A censor model should be understood not just as a set of capabilities|such as the ability to monitor network traffic—but as a set of priorities constrained by resource limitations. My research addresses the twin themes of modeling and circumvention. With a grounding in empirical research, I build up an abstract model of the circumvention problem and examine how to adapt it to concrete censorship challenges. I describe the results of experiments on censors that probe their strengths and weaknesses; specifically, on the subject of active probing to discover proxy servers, and on delays in their reaction to changes in circumvention. I present two circumvention designs: domain fronting, which derives its resistance to blocking from the censor's reluctance to block other useful services; and Snowflake, based on quickly changing peer-to-peer proxy servers. I hope to change the perception that the circumvention problem is a cat-and-mouse game that affords only incremental and temporary advancements.
    [Show full text]
  • Freebsd and Netbsd on Small X86 Based Systems
    FreeBSD and NetBSD on Small x86 Based Systems Dr. Adrian Steinmann <[email protected]> Asia BSD Conference in Tokyo, Japan March 17th, 2011 1 Introduction Who am I? • Ph.D. in Mathematical Physics (long time ago) • Webgroup Consulting AG (now) • IT Consulting Open Source, Security, Perl • FreeBSD since version 1.0 (1993) • NetBSD since version 3.0 (2005) • Traveling, Sculpting, Go AsiaBSDCon Tutorial March 17, 2011 in Tokyo, Japan “Installing and Running FreeBSD and NetBSD on Small x86 Based Systems” Dr. Adrian Steinmann <[email protected]> 2 Focus on Installing and Running FreeBSD and NetBSD on Compact Flash Systems (1) Overview of suitable SW for small x86 based systems with compact flash (CF) (2) Live CD / USB dists to try out and bootstrap onto a CF (3) Overview of HW for small x86 systems (4) Installation strategies: what needs special attention when doing installations to CF (5) Building your own custom Install/Maintenance RAMdisk AsiaBSDCon Tutorial March 17, 2011 in Tokyo, Japan “Installing and Running FreeBSD and NetBSD on Small x86 Based Systems” Dr. Adrian Steinmann <[email protected]> 3 FreeBSD for Small HW Many choices! – Too many? • PicoBSD / TinyBSD • miniBSD & m0n0wall • pfSense • FreeBSD livefs, memstick • NanoBSD • STYX. Others: druidbsd, Beastiebox, Cauldron Project, ... AsiaBSDCon Tutorial March 17, 2011 in Tokyo, Japan “Installing and Running FreeBSD and NetBSD on Small x86 Based Systems” Dr. Adrian Steinmann <[email protected]> 4 PicoBSD & miniBSD • PicoBSD (1998): Initial import into src/release/picobsd/ by Andrzej Bialecki <[email protected]
    [Show full text]
  • IP Filter - TCP/IP Firewall/NAT Software
    IP Filter - TCP/IP Firewall/NAT Software IP Filter Current version: 5.1.0 Next release status Patches for last release What's new ? Click here! Mailing list ? Send mail to [email protected] with "subscribe ipfilter" in the body of the mail. What is it ? IPFilter is a software package that can be used to provide network address translation (NAT) or firewall services. To use, it can either be used as a loadable kernel module or incorporated into your UNIX kernel; use as a loadable kernel module where possible is highly recommended. Scripts are provided to install and patch system files, as required. To see an overview of how IP Filter fits into the overall picture of TCP/IP with your kernel and the order in which the various phases of packet processing is done, click here. The IPFilter FAQ by Phil Dibowitz! It comes as a part of the following operating systems: FreeBSD-current (post 2.2) NetBSD-current (post 1.2) xMach Solaris 10 Open Solaris http://coombs.anu.edu.au/~avalon/ip-filter.html (1 of 7)19.2.2011 •. 14:01:49 IP Filter - TCP/IP Firewall/NAT Software It has been tested and run on: Solaris/Solaris-x86 2.3 - 9 SunOS 4.1.4 - 4.1.4 NetBSD 1.0 - 1.4 FreeBSD 2.0.0 - 2.2.8 BSD/OS-1.1 - 4 IRIX 6.2, 6.5 OpenBSD 2.0 - 3.5 Linux(*) 2.4 - 2.6 HP-UX 11.00 Tru64 5.1a AIX 5.3 ML05 QNX 6 Port * - It has been tested and shown to work on RedHat 9.0, SuSE 9.1 and will, in general work with 2.4 and 2.6 kernels.
    [Show full text]
  • Protokollsupport
    Reference Guide WinRoute Pro 4.1 SE För version 4.1 Build 22 och sinare Tiny Software Inc. Contents Innehållsförteckning Läs mig först 2 Beskrivning av WinRoute 5 WinRoute sammanfattning...................................................................................... 6 Omfattande protokollsupport .................................................................................. 9 NAT-router............................................................................................................ 10 Introduktion i NAT .................................................................................... 11 Hur NAT fungerar...................................................................................... 12 WinRoutes struktur .................................................................................... 13 Att ställa in NAT på båda gränssnitten ...................................................... 15 Portmappning - paketbefordran ................................................................. 18 Portmappning för system med flera hem (flera IP-adresser)...................... 21 Multi-NAT ................................................................................................. 22 Gränssnittstabell......................................................................................... 24 VPN-support .............................................................................................. 24 Brandvägg med paketfilter.................................................................................... 25 Översikt
    [Show full text]
  • HP-UX Ipfilter Version A.03.05.13 Administrator's Guide
    HP-UX IPFilter Version A.03.05.13 Administrator’s Guide HP-UX 11i v3 January 2007 HP Networking Manufacturing Part Number : 5991-7705 E0107 United States © Copyright 2001-2007 Hewlett-Packard Development Company, L.P. Legal Notices The information in this document is subject to change without notice. Hewlett-Packard makes no warranty of any kind with regard to this manual, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Hewlett-Packard shall not be held liable for errors contained herein or direct, indirect, special, incidental, or consequential damages in connection with the furnishing, performance, or use of this material. Warranty A copy of the specific warranty terms applicable to your Hewlett-Packard product and replacement parts can be obtained from your local Sales and Service Office. U.S. Government License Proprietary computer software. Valid license from HP required for possession, use, or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s standard commercial license. Copyright Notice © Copyright 2001–2007 Hewlett-Packard Development Company, L.P. All rights reserved. Reproduction, adaptation, or translation of this document without prior written permission is prohibited, except as allowed under the copyright laws. Trademark Notices UNIX® is a registered trademark of The Open Group. ii Contents Preface: About This Document 1. Installing and Configuring HP-UX IPFilter Overview of HP-UX IPFilter Installation . 3 Installation and Configuration Checklist . 3 Step 1: Checking HP-UX IPFilter Installation Prerequisites .
    [Show full text]
  • Thesis That TW-OR Forwards All DNS Queries to a Resolver in China
    The Impact of DNSSEC on the Internet Landscape Von der Fakult¨atf¨urIngenieurwissenschaften, Abteilung Informatik und Angewandte Kognitionswissenschaft der Universit¨atDuisburg-Essen zur Erlangung des akademischen Grades Doktor der Ingenieurwissenschaften genehmigte Dissertation von Matth¨ausWander aus Lubin (L¨uben) Gutachter: Prof. Dr.-Ing. Torben Weis Prof. Dr.-Ing. Felix Freiling Tag der m¨undlichen Pr¨ufung:19. Juni 2015 Abstract In this dissertation we investigate the security deficiencies of the Domain Name System (DNS) and assess the impact of the DNSSEC security extensions. DNS spoofing attacks divert an application to the wrong server, but are also used routinely for blocking access to websites. We provide evidence for systematic DNS spoofing in China and Iran with measurement-based analyses, which allow us to examine the DNS spoofing filters from van- tage points outside of the affected networks. Third-parties in other countries can be affected inadvertently by spoofing-based domain filtering, which could be averted with DNSSEC. The security goals of DNSSEC are data integrity and authenticity. A point solution called NSEC3 adds a privacy assertion to DNSSEC, which is supposed to prevent disclosure of the domain namespace as a whole. We present GPU-based attacks on the NSEC3 privacy assertion, which allow efficient recovery of the namespace contents. We demonstrate with active measurements that DNSSEC has found wide adoption after initial hesitation. At server-side, there are more than five million domains signed with DNSSEC. A portion of them is insecure due to insufficient cryptographic key lengths or broken due to maintenance failures. At client-side, we have observed a worldwide increase of DNSSEC validation over the last three years, though not necessarily on the last mile.
    [Show full text]
  • Abusing Transparent Proxies with Flash V2.00
    Abusing Transparent Proxies with Flash v2.00 By Robert Auger PayPal Information Risk Management AppSec DC November 2009 The OWASP Foundation http://www.owasp.org Overview What are transparent and intercepting proxies? When are transparent proxies used? How do they operate? Brief intro to the SOP Flash and the socket policy The abuse case Solutions and mitigations Conclusions OWASP 2 What are transparent and intercepting proxies? Explicit Proxy: A proxy explicitly configured by a client or user system. Also known as a classic web proxy. Transparent Proxy: Proxy which is NOT explicitly configured by the client machine. Intercepting Proxy: A more intrusive version of a transparent proxy. May modify traffic. OWASP 3 When are transparent proxies used? OWASP 4 How traffic gets to transparent proxies Technologies such as WCCP/GRE/IPTables/IPFW are often used to force/redirect traffic to the transparent proxy The user is unaware this is going on Proxy is typically on a dedicated machine, sometimes deployed on the gateway/router itself Often involves rewriting the packet’s destination to the proxies IP address and port (NAT) Some implementations merely sniff the wire and may not terminate to a service If the proxy is listening on all addresses then rewriting shouldn’t be required, although it is unknown how common this approach is OWASP 5 Common transparent proxy architectures OWASP 6 Approach A: Use the destination IP from the client Proxy server determines destination based on original destination-IP address of client request. In this configuration the transparent proxy routes requests much like a standard router by basing its routing decisions off of the network layer (layer 3).
    [Show full text]