C17.pdf

Size: px

Start display at page:

Download "C17.pdf"

きみとしおうじ
4 years ago
Views:

1 Internet Week 99 Internet Week Naoto Matsumoto, Japan Network Information Center

3 1 HTTP TELNET 2 3 VPN Security

4 VPN 1 WWW Authentication Authorization Control Defense

5 Deny 1 制御 Authorization permit 認証 Authentication 防御 Defense deny enable 2 Permit 組織 KEY 認証 Authentication Authorization 制御防御 Defense 2

6 3.2 Legacy password PassPhrase OTP One Time Password Authentication Device Digital Sigunature RADIUS TACACS SecureID defender LDAP 3.3 RADIUS TACACS TACACS DAIMETER RADIUS

7 3.4 Replay Attack Detect State Inspection Packet Filtering Packet Filtering Replay Attack Detect State InspectionSMTP A Packet filtering 3 B (A) Src_A:portA Src_B:* Src_C:portC Src_D:* Dst_A:portA Dst_B:portB Dst_C:* Dst_D:* (B) interface Ethernet 0/0 ip access-group 110 in ip access-group 111 out! access-list 110 deny udp any eq syslog access-list 110 deny udp any host access-list 110 permit udp any eq 500 any eq 500! access-list 111 deny 50 any any access-list 111 permit udp any eq 500 any eq Packet Filtering

8 BUGTRAQ Firewall Defenders 21 4 VPN 4.1 VPN VPN Virtual Private Network VPN VPN VPN PC VPN VPN VPN VPN VPN

9 4.2 VPN VPN VPN - SOCKS - SSL Secure Socket Layer - SSH Secure Shell IP VPN - IPsec IP Security - IPinIP - MobileIP VPN - L2TP Layer 2 Tunneling Protocol - PPTP Point-to-Point Tunneling Protocol - L2F Layer 2 Forwarding protocol - MPLS Multi-Protocol Label Switch - MPOA Multi-Protocol Over ATM - MobilePPP VPN 4 利用者での負担が大きい通信業者側で構築可能 Application 層でのVPN 利用者側 IP 層でのVPN で構築可能 Datalink 層でのVPN 通信事業者での負担が大きい 4 VPN

10 4.3 VPN VPN 2 5 A 5 B (A) VPN Concentrater 単方向接続 (B) 双方向接続 5 VPN

11 5 6 3 RADIUS 2 1. 認証 Authentication RADIUS 2. 制御 Authorization L2TP 3. 防御 defense IPsec RADIUS RADIUS Remote Access Dail-In User Service RADIUS RFC2138 Standards Track RADIUS RFC2139 RADIUS RADIUS RADIUS NAS Network Access Server RADIUS 7 Authentication Authorization RFC2138 RFC2139 [1812 port] RADIUS [1813 port] IP Network NAS PSTN / ISDN etc DSL Accounting PC PC PC 7 RADIUS 1

12 RADIUS 8 RFC2138 RADIUS RFC2139 RADIUS Authentication Authorization Accounting Accounting Accounting Accounting Access-Request Access-Accept Start Response Stop Response PPP NAS LCP NCP PAP/CHAP Address Assign 時間軸進行方向 LCP/NCP Phase Connect! PC LCP/NCP Phase Disconnect! 8 RADIUS 2 Access Request RADIUS Radius Radius Authentication Database Access Accept RADIUS NAS RADIUS 9 Authentication Database NAS NAS NAS NAS NAS NAS NAS NAS 対障害性を考慮 RADIUS データの一元管理不整合対策 RADIUS DB 予備 RADIUS 9 RADUIS

13 RADIUS RADIUS RADIUS 10 RADIUS Thu Feb 4 13:13: : Authenticate: Password check error for ppp-joe: , id=180 : : Wed Sep 15 11:51: : Calc_digest: Wrong NAS Address: , id=133 Wed Sep 15 16:16: : Authenticate: Neither User Nor Default Name for not@iri.co.jp: , id=0 Wed Oct 13 20:48: : forward_duplicate_request: Backlog of 501 exceeds 500 requests Tue Nov 9 15:05: : Authenticate: Neither User Nor Default Name for not@iri.co.jp: , id=12 10 RADIUS 5.2 L2TP 10 ppp-joe NAS RADIUS request RADIUS UDP UDP RADIUS L2TP Layer Two Tunneling Protocol L2TP Standards Track RFC2661 PPP IP IP PPP PPP L2TP PPP over IPPPP L2TP PPP IP ISP

14 L2TP L2TP PPP Encryption Layer 2 Encryption IPsec Layer 3 Encryption) Application Layer Encryption L2TP PPP RADIUS IP L2TP 11 PPP UDP LAC L2TP Access Concentrator PPP PPP LCP/NCP LNS L2TP Network Server 11 L2TP LAC Cisco 12 LNS Assend Max 13 aaa new-model aaa authentication login default local aaa authentication ppp default local aaa authorization exec default local aaa authorization network default local vpdn enanle VPDN vpdn vpdn-group 1 request dialin l2tp ip domain local name LAC00 LAC l2tp tunnel password FoRL2TPPaSSwoRDL2TP Auth 12 LAC

15 Ethernet->Mod config ->L2 Tunneling options L2TP Mode=LNS LNS L2TP Auth Enabled=Yes L2TP Auth L2TP System Name=LNS00 LNS Ethernet->Names / Passwords nat@l2tp.net Name=nat@l2tp.net Active=Yes Recv PW=l2tpPaSSwoRD Ethernet->Names / Passwords LAC-LNS Name=LAC00 LAC00 Active=Yes Recv PW=FoRL2TPPaSSwoRD 13 LNS LAC LAC LNS L2TP L2TP LAC L2TP LNS L2TP PPP PPP 14 PPP Client PPP Client PPP Client PPP Client PPP Client PPP LAC L2TP LNS PPP PPP Server 14 L2TP 14 L2TP PPP QoS Diffserve 1 PPP 1 L2TP PPP L2TP

16 L2TP RADIUS L2TP 5.3 IPsec IPsec IP security protocolip IP IP IPsec 1 RFC 1 IPsec RFC RFC RFC 1320 RFC 1321 RFC 1828 RFC 1829 RFC 2040 RFC 2085 RFC 2104 RFC 2144 RFC 2202 RFC 2268 RFC 2401 RFC 2402 RFC 2403 RFC 2404 RFC 2405 RFC 2406 RFC 2407 RFC 2408 RFC 2409 RFC 2410 RFC 2411 The MD4 Message-Digest Algorithm The MD5 Message-Digest Algorithm IP Authentication using Keyed MD5 The ESP DES-CBC Transform The RC5, RC5-CBC, RC5-CBC-Pad, and RC5-CTS Algorithms HMAC-MD5 IP Authentication with Replay Prevention HMAC: Keyed-Hashing for Message Authentication The CAST-128 Encryption Algorithm Test Cases for HMAC-MD5 and HMAC-SHA-1 A Description of the RC2(r) Encryption Algorithm Security Architecture for the Internet Protocol IP Authentication Header The Use of HMAC-MD5-96 within ESP and AH The Use of HMAC-SHA-1-96 within ESP and AH The ESP DES-CBC Cipher Algorithm With Explicit IV IP Encapsulating Security Payload (ESP) The Internet IP Security Domain of Interpretation for ISAKMP Internet Security Association and Key Management Protocol The Internet Key Exchange (IKE) The NULL Encryption Algorithm and Its Use With IPsec IP Security Document Roadmap

17 1 IPsec RFC RFC RFC 2412 RFC 2451 RFC 2631 RFC 2521 RFC 2522 RFC 2523 RFC 2709 The OAKLEY Key Determination Protocol The ESP CBC-Mode Cipher Algorithms Diffie-Hellman Key Agreement Method ICMP Security Failures Messages (E) Photuris: Session-Key Management Protocol (E) Photuris: Extended Schemes and Attributes Security Model with Tunnel-mode IPsec for NAT Domains IPsec 3 IPsec 15 IKE IPsec IPsec SA Security Association IKE Internet Key Exchange AH Authentication Header 2 ESP Encapsulating Security Payload 2 IKE で接続形態を調整この状態が SA(Security Association) IPsec Device IPsec Device IPsec 接続を開始例 : ESP Tunnel mode 15 IPsec

18 5.3.1 IKE IKE Internet Key ExchangeIP UDP 500 IP IKE SA IKE Encryption algorithm DES-CBC Hash algorithm MD5 Authentication methodpre-shared key Group Description MODP ECP EC2N Life Type seconds kilobytes PRF Pseudo-Random Functions AH AH Authentication Header IP IP IP AH AH IP 2 AH 16 Original IPv4 Orig IP Hdr TCP DATA AH Transport mode Orig IP Hdr AH TCP DATA AH Tunnel mode 認証範囲 New IP Hdr AH Orig IP Hdr TCP DATA 認証範囲 16 AH

19 5.3.3 ESP ESP Encapsulating Security Payload AH IP 2 AH ESP IP ESP 17 ESP Transport mode Orig IP Hdr ESP Hdr TCP 暗号化範囲 ESP ESP DATA Trailer Auth 認証範囲 ESP Tunnel mode New IP Hdr ESP Hdr 暗号化範囲 ESP ESP Orig IP Hdr TCP DATA Trailer Auth 認証範囲 17 ESP 5.4 IPsec IPsec 2 IPsec VPN VPN 18 A IPsec IPsec IPsec B 18 B VPN IPsec SGW Security GateWay

20 (A) IPsec client IPsec Concentrater IPsec client IPsec client IPsec client IPsec client IPsec client 単方向接続 IPsec client (B) IPsec SGW 双方向接続 IPsec SGW IPsec SGW IPsec SGW IPsec SGW IPsec SGW IPsec SGW IPsec SGW 18 IPsec IPsec 19 IPsec 1

19 DES SHA-1 ESP IPsec 20 IPsec 2 20 # RT100i Rev.3.01.13 (Thu Mar 25 11:35:41 1999) ipsec auto refresh on ipsec ike host 10.13.10.26 ipsec pre-shared-key 10.13.10.26 text himitsu ipsec sa policy 101 10.

21 19 DES SHA-1 ESP IPsec 20 IPsec 2 20 # RT100i Rev (Thu Mar 25 11:35: ) ipsec auto refresh on ipsec ike host ipsec pre-shared-key text himitsu ipsec sa policy esp des-cbc md5-hmac tunnel select 1 ip tunnel route add net /24 2 ipsec tunnel 101 tunnel enable 1 21 IPsec 3 21 IPsec SGW

22 IPsec IPsec IPsecThe Ethernet Network Analyzer IPsec 6 VPN L2TP Windows 2000 IPsec

23 7 BUGTRAQ Firewall Defenders RADIUS-JP ML RADIUS Discussion List in Japan VPN Operators Homepage PKI-Talk/JP ML PKI Talk List in Japan IDS Intrusion Detection Systems

橡sirahasi.PDF

橡sirahasi.PDF Internet Week 2000 T5 IPsec VPN 2000/12/18 1 Virtual Private Network 2 IPsec 3 IPsec VPN 4 IPsec VPN 2 1 Virtual Private Network 3 Ethernet, WAN PPTP(PPP) IPSec SSL/TLS SOCKS V5 SSH, SSL-Telnet, PET PGP,