  |
|
||||
|
Secure Desktops = Happy NetworksBy Lyne BourqueOctober 17, 2006
Last month I talked about some basic concepts that seem to be falling by the wayside, specifically performing backups and having a test environment to ensure that updates, patches and other roll-outs are sufficiently vetted. This month I’d like to discuss two other basic concepts that seem to have fallen by the wayside of late: password strengths and lockouts, as well as standardized desktops. These aren’t new concepts and yet, people still haven’t figured out how to best implement them. Lockouts are straightforward. After a certain number of attempts – usually 3 or 5 – lock the account from further attempts. People have forgotten about things like wardailing. This activity doesn’t happen as often due to the lack of modems in use (although some still use them and are susceptible this kind of attack). But variants of it, such as wardriving and account dictionary attacks, still occur on the physical networks of today. Tough Nut to CrackFor Windows systems, this kind of attack can easily prevented by enabling account lockouts. Active Directory can be used to easily enable this. The use of security policies through the security configuration editor (SCE) can enforce this across your whole domain with little fuss. For many Linux and Unix systems, you can use PAM (pluggable authentication modules) to enforce lockout after too many attempts. Adding two lines like the following in the /etc/pam.d/system-auth will help lock out the account.
This line will keep track of each failed login and failed su attempts for each user. This information will normally be stored in /var/log/faillog (unless you redirect logs to a different location).
This second line is the one that specifically locks out the account after 5 attempts. If the user successfully logs in prior to hitting the magic number 5, the account will reset. The per_user option will help to avoid locking out system accounts after too many tries because it tells PAM to ignore the deny=n on accounts where the maximum number of login failures is set specifically. You can specify this for the GUI interface and system specific accounts (e.g., FTP, mail, etc.) in addition to regular user accounts. Other areas that could be locked down specifically include /etc/pam.d/sshd or /etc/pam.d/login. As a side note, $ISA is Instruction Set Architecture. This variable exists to allow for both 32-bit and 64-bit applications to take advantage of PAM. In addition, the use of minimal password length and a certain amount of complexity helps secure an account from attack. Some administrators are still under the delusion that 8 characters is sufficient strength for passwords. It's not. Let's start with the obvious: get rid of those dictionary passwords. That is, we still see use of basic words to protect our important assets, namely user accounts into the network. Surveys of password usage have historically shown that “password,” “letmein” and “blank” remain the top picks for passwords. Perhaps attempting to perform regular “cracking” of company passwords -- under company approval, of course-- would help eliminate those. Now the question becomes: how long should good passwords be? Today's standard should be at least 12 different characters (i.e., lower and upper case characters, digits and special characters). The challenge remains how to get users to remember these. One idea that Microsoft put forward -- yes, even they have good ideas now and again -- was the use of whole phrases. A password of “The answer to security is 42!” is far stronger than “password”. We need regular reminders to users about how to create good passwords, that they should change their password regularly and that their password will be challenged regularly to verify strength. Conformity Is a Good ThingThe last basic of a system security is to ensure that it is setup in accordance to company policy. This means that a user cannot install software nor can they disable any software that has been installed on the system. You can use some of the features of Active Directory’s security policy editor but it would be far more effective to use something like Faronics Deep Freeze Enterprise or VMware’s ACE products. VMware’s ACE is a relatively newer product but also provides a good opportunity to lock down the common platform of challenge, namely Windows. Deep Freeze’s legacy, however, is from the school system protection and has evolved into a robust and viable enterprise product. Given that they had to prevent curious young minds from compromising their software, it actually bodes well as to how secure the product is. What’s even more impressive is that it now supports OS X and it appears that Faronics is looking toward Linux as it’s next platform. Nonetheless, the importance of standardizing desktops seems to be lost on many. Remember, as long as everyone has the same desktop it’s easier to troubleshoot and sort out issues. This can help ensure faster ticket resolution should a problem crop up. This is one of the reasons why many companies choose a specific vendor and purchase en-masse desktops, laptops and servers. It’s easier to find problems when you know what and where to look for them. Additionally, using tools like ACE or Deep Freeze means that users are less able to and less likely to install “malware” or other nasties on your network. So save yourself some time and headaches by dealing with the basics. This will mean more opportunity to do the important things, like get in a game of Lego Star Wars II. May the force be with you. Resources:Get to know PAMLinux Security andSystem Hardening Securing DesktopsArticle DiscussionDiscuss this article in this AntiOnline thread.
|
|
|
|
  |
|
|
||||||||||||||||||||||||||||||
Managing the Modern Network
Business Service Management: Generate Revenue Through IT 
Evaluating Software as a Service for Your Business
Storage Networking: Configuration and Planning
Is Your Disaster Recovery Plan Good Enough? 
Email
Print
Digg This
Add to del.icio.us
