1. 2. ( ) Secure Secure Shell ssh 5. (xinetd TCP wrappers) 6. (IPsec) 7. Firewall 2

Size: px

Start display at page:

Download "1. 2. ( ) Secure Secure Shell ssh 5. (xinetd TCP wrappers) 6. (IPsec) 7. Firewall 2"

なぎさみやくぼ
5 years ago
Views:

1 (6 20 ) ISP 3 3 SPAM MP3 1

2 1. 2. ( ) Secure Secure Shell ssh 5. (xinetd TCP wrappers) 6. (IPsec) 7. Firewall 2

3 1. 2. ( ) Secure 5. (xinetd TCP wrappers) (i) (ii) ( ) (iii) 6. (IPsec) 7. Firewall 3

4 1 / 1 ; 2 ; 3 ; 4

5 2 tcp_wrapper (1) /etc/inetd.conf Before; #service socket protocol wait? User program arguments ftp stream tcp nowait root /usr/sbin/ftpd ftpd telnet stream tcp nowait root /usr/sbin/telnetd telnetd shell stream tcp nowait root /usr/sbin/rshd rshd login stream tcp nowait root /usr/sbin/logind logind After; #service socket protocol wait? User program arguments ftp stream tcp nowait root /usr/sbin/tcps ftpd telnet stream tcp nowait root /usr/sbin/tcpd telnetd shell stream tcp nowait root /usr/sbin/tcpd rshd login stream tcp nowait root /usr/sbin/tcpdd logind (2) reread - pid-of-inetd-process 5

6 3. (1) /etc/hosts.allow fingerd : ophelia hamlet laertes rshd,rlogind: LOCAL EXCEPT hamlet telnetd,ftpd: LOCAL,.expcons.com, (2) /etc/host.deny ALL (/usr/sbin/safe_finger /usr/sbin/mail -s %d-%h root) & ALL : ALL 6

7 1. 2. ( ) Secure 5. (xinetd TCP wrappers) 6. (IPsec) (1) (2) (3) IPsec 7. Firewall 7

8 1. - PEM, MOSS - S/MIME - PGP (Pretty Good Privacy) 2. - SOCKS ( 3. IPsec - (AH: Authentication Header) - (Encapsulating Security Payload) - (Internet Key Exchange) 8

9 - - Internet IP Payload IP Payload IP ESP IP ESP 9

10 - - IPsec-GW Internet IPsec-GW P1 Payload IP1 Payload IP2 IP1 ESP IP2 IP1 ESP 10

11 [1] ( N bits( ) m bits( ), N>m) [2] (3) DES(Data Encryption Standard) ; RSA(Rivest, Shamir, Adleman) ; 11

12 12

13 ssh (Secured Shelll) : 13

14 MD5 (128 bits) SHA (160 bits) : 14

15 PGP [ ] [ ] -----BEGIN PGP SIGNED MESSAGE BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iqcvawubmey8r6utc+xzfetzaqenuap+n30di02sly+rrya2gbj2u2imwofjeyks 1AkvsN9errDk4N/VcFmc3d6F4heDkiy87u3XAVoulz2orb9xZ3qFveoEZp3QLLa6 Pkzs6/N1nmJZFZFlf1M8yUR5WZTbyaVHQmC1AuSZhJsM8+8S/+IbpXVPJJ68M4JE cdybt86eekm= =UE6f -----END PGP SIGNATURE----- : 15

16 Netscape Web : 16

17 PGP ( RSA+IDEA) : 17

18 PGP [ ] [ ] -----BEGIN PGP MESSAGE----- Version: 2.6.3ia hiwdps0l7hmurnkba/4qk4bdxailag9tos8srdd09ip4pbocw8ernyzkc8bjzhrq bmeposnrpv8qwrpttwb3pkuhph9et5bbgiyuw36hlviet5z5ot3rs+xnfsz1tyxw xkxt+nndce6gntb6jqbuym2/frowwmnoc1bnkd6eiqzfekduwbuhksrduh6bfqya AAA3YBJcBDcrQtcIuA5R+bvivZ8gc8Fx3JCcUtW4yH+embVTTSUw+xTt0JSUoo93 u5+lhgrrzbessg== =00WV -----END PGP MESSAGE----- : 18

19 1. 2. ( ) Secure Secure Shell ssh 5. (xinetd TCP wrappers) 6. (IPsec) 7. Firewall 19

20 4 Levels of Firewall Configurations Intranet Internet Intranet (1) Simple gateway Choke Internet Proxy Proxy (2) Belt and Suspender 20

21 4 Levels of Firewall Configurations Intranet Internet Proxy (3) TIP Intranet Internet (4) Disconnect 21

22 1. FW ( ) Source routing 2. socket{src_ip, src_port, dsrt_ip, dst_port} ( ) - ftp (a) WWW, anonymous-ftp, IRC (b) NIS, NFS, PRC, TFTP, SNMP (c) SMTP, NNTP, HTTP, FTP 22

23 3. ; Proxy Proxy e.g., SOCKS ftp://ftp.nec.com/pub/security/socks.cstc/socks.cstc.4.2.tar.gz 23

24 DNS : A SOCKS Internet SOCKS Router DNS mail.a.com : A : A ftp.a.com : A A Application Gateway socks.a.com A Mail.A.com A A ftp.a.com A DNS socks.a.com : A Intranet 24

25 Firewall System Configuration Internet External Router Proxy Proxy ( ) Proxy Intranet Proxy 25

26 ; APOP ; SMTP ; SPAM 26

27 APOP POP3 telnet(1 / ) (OTP) MD5(PROCESS_ID TIME_STAMP HOSTNAME APOP_PASSWORD) 27

28 SMTP SMTP (/etc/sendmail.cf) IP (Source address) IP IP From (From ) 28

29 PGP S/MIME PEM MOSS KPS (End-to-End) (GW) Received Message-Id 29

30 SPAM SPAM ; TV SPAM SPAM SPAM SPAM 30

31 SPAM IP DNS ML ML ML 31

32 SPAM IP SPAM (/etc/sendmail.cf) HTML 32

33 Signature 33

34 34

35 SCRIPT SSL Secure URL hidden Web (e.g., JAVA) (Inherit) 35

36 WEB 36

37 SCRIPT SSL Secure URL hidden Web (e.g., JAVA) (Inherit) 37

38 ( ) / Perl MS Windows Short Name 38

39 39

40 ( ) / Perl MS Windows Short Name 40

ネットワークセキュリティー

ネットワークセキュリティー (1) (a) ( ) (b) ( ) (c) ( ) (2) (CPU ) (3) (4) 1 One for All, All for One (Intentionally) (Accidentally) (aka Quality, e.g., Proxy, Redirection) 2 QoS Quality of Service (QoS) Quality of Service End-to-End