Secure Access to ECE Computers

1
Secure Access to ECE Computers
Department of Electrical and Computer Engineering
Christopher E. Cramer, Ph.D.
2
Overview of Talk

• Problem of plain text logins
• Why is this important?
• Encrypted login access
• What other services are insecure?
• Secure Mail
• Solutions

3
Problem of insecure logins

• Most access methods (telnet, rsh, rlogin, etc)
  send all data across the network in clear text
• This data can be read by examing the network data
  at sender or receiver - network sniffing
• Easy to get userid and passwd

4
Sample from a hacker's log
5
So what? - "there's nothing valuable in my
account."

• Account itself is valuable to a hacker - 100Mb/s
  access to Internet 2
• Hacked accounts can be used to obtain root access
  allowing for network snooping
• Hacked accounts used to make trouble elsewhere
• Chains of accounts can be used to disguise
  hacker's original location

6
Example - ECE last May

• U. of Houston account hacked - root access
• Sniffer found ECE userid/passwd
• Bug in Solaris used to get root access on ECE
• ECE sniffer found user logging into work
• accessed user's work account, exploited bug, got
  root access there
• Eventually got onto NIH site, altering files
• FBI called in

7
Stopping the Hacker

• Prevent him from gaining root access
• Many sites don't keep security patches up to date
• Sun didn't have a patch for this bug for 2 more
  months
• Minimize damage by immediately shutting down
  hacked accounts
• Prevent him from sniffing

8
Encrypted Access

• Encrypting all data makes sniffing next to
  impossible
• Most widely used encrypted login SSH
• Clients
• Windows 3.1, 95, 98, NT, 2000
• Mac
• Linux (and other Unix variants)

9
SSH

• Problems
• RSA patent
• Some clients are hard to configure
• Two incompatiple versions 1.x and 2.x
• Obtaining SSH - free and commercial clients
• Web site http//www.ee.duke.edu/SSH
• CD - OIT and maybe ECE will produce a CD
  containing popular OS clients

10
Other problem areas

• From the hacker's log - two more ports snooped
• Post Office Protocol (pop3)
• File Transfer Protocol (ftp)
• scp (secure copy) - like old rcp, but with all
  data encrypted
• ssh tunneled ftp - can be hard to set up, but
  very cool (instructions on our SSH web site)

11
Secure Mail

• What about IMAP?
• By default, sends passwords in the clear
• Allows for encryption, but difficult to setup
• Solution - Secure Socket Layer (SSL) encrypted
  POP3 and IMAP
• Available for Outlook, Outlook express, Netscape
• Not for Eudora - can use APOP instead (see the
  mail section of the Computing FAQ)

12
Security Implementation

• Will take place before the fall semester
• Turn off insecure logins (telnet, rsh, rlogin)
• Turn off insecure email services - email
  accesible via SSL-pop, SSL-imap, APOP
• Would like to turn off insecure non-anonymous FTP
  - will depend on client availibility
• telnet/rlogin/rsh wrapped to use SSH where server
  has the capability

13
Security Implementation

• ACPUB also going SSH only by end of summer
• People should start using secure services now
• SSH servers already on all Unix machines
• SSL-pop, SSL-imap and APOP already on
  mail.ee.duke.edu
• SSH tunneling of ftp can be done
• We need feedback - PLEASE