ネットワークセキュリティー

Size: px

Start display at page:

Download "ネットワークセキュリティー"

のぶみつそめや
5 years ago
Views:

1 (1) (a) ( ) (b) ( ) (c) ( ) (2) (CPU ) (3) (4) 1

2 One for All, All for One (Intentionally) (Accidentally) (aka Quality, e.g., Proxy, Redirection) 2

3 QoS Quality of Service (QoS) Quality of Service End-to-End (e.g., Latency RTT ) End-to-End (e.g., CDN chache Proxy) / QoS Compliant Users Malicious Users 3

4 / 4

5 5

6 6

7 Attacker Master Deamon Web 7

8 8

9 9

10 10

11 1. 2. ( ) Secure 5. (xinetd TCP wrappers) 6. (IPsec) 7. Firewall (e.g., socks) 8. 11

12 ( ) (/etc/passwd) - Shadow Password File /etc/master.passwd 3. (OTP One Time Password) - Challenge & Response with 4. ssh Secure Shell - Remote Login with + 5. RADIUS (Remote Authentication Dial In User Services) - 12

13 OTP Challenge & Response ftp://ftp.nrl.navy.mil/pub/security/opie/opie-2.3.tar.gz Windows JOB ARTS WERE FEAT TITLE f(19462,28472) = JOB ARTS WERE FEAT TITLE OK 13

14 Remote Shell -ssh secure shell - RSA IDEA DES Windows (Teraterm) sshd (secure shell daemon) ssh (rlogin) scp (rcp) ssh-keygen.ssh/identity.ssh/identity.pub (client) =>.ssh/authorized_keys (server).ssh/ssh_known_hosts, /etc/ssh_known_hosts 14

15 Remote Shell -ssh secure shell - 1. (Public key) /etc/ssh_known_hosts..ssh/known_hosts 2. Session Key (*) Session key 3. Session Key 4. Session Key A A f ( B) with A B 15 A

16 RADIUS Dial-Up User NAS Port Master (RADIUS Client) RADIUS Server Security System Dial-up User /Passwd 16

17 1. 2. ( ) 3. (i) (ii) Free 4. Secure 5. (xinetd TCP wrappers) 6. (IPsec) 7. Firewall 17

18 (1) Global Group(SGID) User(SUID) (2) Readable Writable ; hiroshi.login Group (elab) writable /etc Group Owner writable (root&sysem) elab login hiroshi.l rm -f /etc/passwd cp /tmp/data526 /etc/passwd 18

19 (1) (e.g., root) (2) (3) Archive unpack tar tf file 4 unpack 5 file 6 19

21 1. 2. ( ) Secure Secure Shell ssh 5. (xinetd TCP wrappers) 6. (IPsec) 7. Firewall 21

22 1. 2. ( ) Secure 5. (xinetd TCP wrappers) (i) (ii) ( ) (iii) 6. (IPsec) 7. Firewall 22

23 1 / 1 ; 2 ; 3 ; 23

24 2 tcp_wrapper (1) /etc/inetd.conf Before; #service socket protocol wait? User program arguments ftp stream tcp nowait root /usr/sbin/ftpd ftpd telnet stream tcp nowait root /usr/sbin/telnetd telnetd shell stream tcp nowait root /usr/sbin/rshd rshd login stream tcp nowait root /usr/sbin/logind logind After; #service socket protocol wait? User program arguments ftp stream tcp nowait root /usr/sbin/tcps ftpd telnet stream tcp nowait root /usr/sbin/tcpd telnetd shell stream tcp nowait root /usr/sbin/tcpd rshd login stream tcp nowait root /usr/sbin/tcpdd logind (2) reread - pid-of-inetd-process 24

25 3. (1) /etc/hosts.allow fingerd : ophelia hamlet laertes rshd,rlogind: LOCAL EXCEPT hamlet telnetd,ftpd: LOCAL,.expcons.com, (2) /etc/host.deny ALL (/usr/sbin/safe_finger /usr/sbin/mail -s %d-%h root) & ALL : ALL 25

26 1. 2. ( ) Secure 5. (xinetd TCP wrappers) 6. (IPsec) (1) (2) (3) IPsec 7. Firewall 26

27 1. - PEM, MOSS -S/MIME - PGP (Pretty Good Privacy) 2. - SOCKS ( 3. IPsec - (AH: Authentication Header) - (Encapsulating Security Payload) - (Internet Key Exchange) 27

28 - - Internet IP Payload IP Payload IP ESP IP ESP 28

29 - - IPsec-GW Internet IPsec-GW IP1 Payload IP1 Payload IP2 IP1 ESP IP2 IP1 ESP 29

30 [1] ( N bits( ) m bits( ), N>m) [2] (3) DES(Data Encryption Standard) ; RSA(Rivest, Shamir, Adleman) ; 30

31 31

32 ssh (Secured Shelll) : 32

33 MD5 (128 bits) SHA (160 bits) : 33

34 PGP [ ] [ ] -----BEGIN PGP SIGNED MESSAGE BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iqcvawubmey8r6utc+xzfetzaqenuap+n30di02sly+rrya2gbj2u2imwofjeyks 1AkvsN9errDk4N/VcFmc3d6F4heDkiy87u3XAVoulz2orb9xZ3qFveoEZp3QLLa6 Pkzs6/N1nmJZFZFlf1M8yUR5WZTbyaVHQmC1AuSZhJsM8+8S/+IbpXVPJJ68M4JE cdybt86eekm= =UE6f -----END PGP SIGNATURE----- : 34

35 Netscape Web : 35

36 PGP ( RSA+IDEA) : 36

37 PGP [ ] [ ] -----BEGIN PGP MESSAGE----- Version: 2.6.3ia hiwdps0l7hmurnkba/4qk4bdxailag9tos8srdd09ip4pbocw8ernyzkc8bjzhrq bmeposnrpv8qwrpttwb3pkuhph9et5bbgiyuw36hlviet5z5ot3rs+xnfsz1tyxw xkxt+nndce6gntb6jqbuym2/frowwmnoc1bnkd6eiqzfekduwbuhksrduh6bfqya AAA3YBJcBDcrQtcIuA5R+bvivZ8gc8Fx3JCcUtW4yH+embVTTSUw+xTt0JSUoo93 u5+lhgrrzbessg== =00WV -----END PGP MESSAGE----- : 37

38 1. 2. ( ) Secure Secure Shell ssh 5. (xinetd TCP wrappers) 6. (IPsec) 7. Firewall 38

39 4 Levels of Firewall Configurations Intranet Internet Intranet (1) Simple gateway Choke Internet Proxy Proxy (2) Belt and Suspender 39

40 4 Levels of Firewall Configurations Intranet Internet Proxy (3) TIP Intranet Internet (4) Disconnect 40

41 1. FW ( ) Source routing 2. socket{src_ip, src_port, dsrt_ip, dst_port} ( ) - ftp (a) WWW, anonymous-ftp, IRC (b) NIS, NFS, PRC, TFTP, SNMP (c) SMTP, NNTP, HTTP, FTP 41

42 3. ; Proxy Proxy e.g., SOCKS ftp://ftp.nec.com/pub/security/socks.cstc/socks.cstc.4.2.tar.gz 42

43 DNS : A SOCKS Internet SOCKS Router DNS mail.a.com : A : A ftp.a.com : A A Application Gateway socks.a.com A Mail.A.com A A ftp.a.com A DNS socks.a.com : A Intranet 43

44 Firewall System Configuration Internet External Router Proxy Proxy ( ) Proxy Intranet Proxy 44

45 ; APOP ; SMTP ; SPAM 45

46 APOP POP3 telnet(1 / ) (OTP) MD5(PROCESS_ID TIME_STAMP HOSTNAME APOP_PASSWORD) 46

47 SMTP SMTP (/etc/sendmail.cf) IP (Source address) IP IP From (From ) 47

48 PGP S/MIME PEM MOSS KPS (End-to-End) (GW) Received Message-Id 48

49 SPAM SPAM ; TV SPAM SPAM SPAM SPAM 49

50 SPAM IP DNS ML ML ML 50

51 SPAM IP SPAM (/etc/sendmail.cf) HTML 51

52 Signature 52

53 (1) ( ) 1 N A M N (T ) M 100% {N, A, M} 2 T 1 53

54 (2) 1 ( ) W 54

1. 2. ( ) Secure Secure Shell ssh 5. (xinetd TCP wrappers) 6. (IPsec) 7. Firewall 2

1. 2. ( ) Secure Secure Shell ssh 5. (xinetd TCP wrappers) 6. (IPsec) 7. Firewall 2 (6 20 ) ISP 3 3 SPAM MP3 1 1. 2. ( ) 3. 4. Secure Secure Shell ssh 5. (xinetd TCP wrappers) 6. (IPsec) 7. Firewall 2 1. 2. ( ) 3. 4. Secure 5. (xinetd TCP wrappers) (i) (ii) ( ) (iii) 6. (IPsec) 7. Firewall