Web Site Management

1
Web Site Management

• Dr. Mark Rodekohr
• Energy Information Administration
• January 2000

2
Overview

• Introduction
• Owners, groups and other methods of control
• Security
• Monitoring

3
Introduction

• For a large site management is likely to be the
  single largest cost associated with running the
  site (outside of generating content)
• Hardware can be relatively inexpensive Sun
  Sparc 20 machines are going for as low as 2,000
• Almost all software can be obtained for free
  however free software is free for a reason

4
Owners, Groups etc.

• To provide some security (and I would argue job
  security) every file on a server has a owner
  (generally that person who created and posted the
  file)
• Every owner belongs to a group (which you can
  think of as a common work unit)
• A system administrator assigns and maintains
  these designations

5
Permissions

• In addition to owners and groups each file has a
  set of permissions associated with each
  owner/group.
• There are three types of permissions
• Read permission
• Write permission
• Execute permission

6
Example

• Using the ls 1 myfile command
• -rw-rr 1 john1 staff 335 Jan 22 1323 myfile
• The first () tells us that this is a file
  otherwise a (l) denotes symbolic link, (d)
  denotes directory
• ( r) the owner has read permission
• (w) the owner has write permission
• (-) the owner does not have execute permission

7
Example (continued)

• rr 1 john1 staff 335 Jan 22 1323 myfile
• The next three characters tell us if any member
  of the group has read, write and execute
  permission
• The next three characters tell us if anyone has
  read, write and execute permission. For all
  public files on a web site this set of
  permissions is set to read only.

8
Example (continued)

• 1 john1 staff 335 Jan 22 1323 myfile
• The (1) how many links the file has
• John 1 is the owner
• Staff is the group
• 335 if the file size in bytes
• Jan 22 1323 was the last time the file was
  modified.

9
Example (continued)

• All of these attributes can be changed using the
  chmod (change mode) command.
• For example chmod 660 myfile sets the owner
  permission to read and write, the group to read
  and write and everyone else can do nothing (not
  even read the file)
• This structure allows you to hide system,
  password and other files from the general public

10
Whats the Problem

• If you are only dealing with a few files and a
  small number of owners/groups this system works
  fine.
• I would characterize the EIA web site as
  consistent with a mid level size site we have
• Over 30,000 files
• About 50-60 owners which fall into 7 or 8 groups.

11
Whats the Problem (continued)

• Given the fact that our site was constructed with
  no plan and no documentation from day 1 trying to
  add some rationality to owner/group/permission
  structure is taking countless person hours and to
  this day is still not working well.
• On common problem is that if someone with higher
  level permissions than the author changes a file
  then the original owner cannot change it without
  having someone go back and reset the permissions.
• Dont think using NT solves this problem it is
  just as bad if not worse than Unix. Even
  Microsoft Certified employees have trouble.

12
Security Overview

• Some security axioms
• There is never enough security.
• It is expensive.
• Security officials could care less if your
  customers every get any information and how long
  it takes to get it, or if your staff can post
  anything to your web site in a timely manner.

13
Security Recent Events

• The White House, Justice Department, and many
  other (including DOE) high profile government
  sites have been hacked over the last two years.
• At EIA we have had in excess of 700 hundred
  attempts to break in but only one, rather benign
  person, got through.
• About 300 attempts were made in the two days
  after to mistaken bombing of the Chinees embassy.
  Most of these came from Hong Kong.

14
Security and Statistical Sites

• Problems to worry about
• The mistaken early release of time sensitive
  information (the Bureau of Labor Statistics had
  this happen twice within the same month and each
  time it made the papers). Automation played a
  role in this.
• Someone enters your site, changes some market
  sensitive data and within a few minutes makes a
  lot of money.
• Staff post inappropriate information on your web
  site.

15
Security An Example I

• The five hackers, aged 15 to 17, hacked 26
  Internet service providers (ISPs) in the US and
  overseas. They had a list of 200,000 user
  accounts from Pacific Bell and were able to
  successfully steal the passwords for about 95,000
  accounts, the BBC said, adding that the crackers
  used the accounts to anonymously scan the
  networks of the Sandia and Oak Ridge National
  Laboratories, both involved in the nuclear
  weapons program

16
Security An Example II
17
Security An Example Email

• Unfortunately, URLs can contain other items,
  including parameters that can be transmitted back
  to the site
• ltA HREF"http//www.stuff.com?ufoo_at_bar.com"gtwww.s
  tuff.comlt/Agt If I take the bait and visit the
  site, my e-mail address, foo_at_bar.com, can be put
  on a hot list. Of course, the site managers had
  already obtained my

18
Denial of Service Hacking

• Network hackers engage in several sorts of
  activities. Some, like "denial of service
  attacks" or "mail bombs," are designed to swamp a
  computer network's ability to respond and perform
  its internal functions. For instance, a denial of
  service attack on a Web server floods it with
  bogus requests for pages

19
Network Invasion

• Another form of network hacking involves
  penetrating a secure area by subverting its
  security measures. Network hackers might
  accomplish this by setting up programs that try
  millions of passwords until one is accepted. A
  hacker may set up "sniffers," programs that check
  data to find encrypted or sensitive information.
• Once hackers get onto the machines that host
  networks, they can alter or remove files, steal
  information and erase the evidence of those
  activities.

20
Security Another View
21
Many Tools are on the Net
22
Security What to Do

• Limit the number of staff that have permission to
  post to your web site and train these staff on
  correct procedures.
• Give computer generated passwords every three
  months to these staff do not allow them to change
  the passwords. Also set up a three try and your
  out rule.
• Do not put anything on your web site (except for
  necessary system files) that you dont want
  people to see.
• Keep your software up to date with the latest
  patches.
• Invest in software designed to detect attempts to
  break into your site.

23
Security Some Other Things to Look At
24
Email Can Affect Site Security

• Examples of spoofed email that could affect the
  security of your site include
• email claiming to be from a system administrator
  requesting users to change their passwords to a
  specified string and threatening to suspend their
  account if they do not do this
• email claiming to be from a person in authority
  requesting users to send them a copy of a
  password file or other sensitive information

25
Monitoring TCP/IP Wrapper

• The TCP/IP wrapper program provides additional
  network logging information and gives a system
  administrator the ability to deny or allow access
  from certain systems or domains to the host on
  which the program is installed

26
Monitoring ISS (Internet Security Scanner)

• ISS is a program that will interrogate all
  computers within a specified IP address range,
  determining the security posture of each with
  respect to several common system vulnerabilities

27
Monitoring Tripwire

• Tripwire checks file and directory integrity it
  is a utility that compares a designated set of
  files and directories to information stored in a
  previously generated database. Any differences
  are flagged and logged, including added or
  deleted entries. When run against system files on
  a regular basis, Tripwire enables you to spot
  changes in critical system files and to
  immediately take appropriate damage control
  measures

28
Monitoring People Trying to Hack into a Hacking
Web Site
29
Monitoring Online Checking
30
Summary

• We reviewed the file characteristics with regard
  to owners/groups/permissions to illustrate why
  site management is so expensive.
• We looked at security issues including recent
  events and discussed the various risks.
• We discussed some tools that can be used to
  monitor your web site for security problems.

31
Conclusion

• While this presentation has been fairly technical
  it illustrates some of the problems associated
  with maintaining a web site. It also illustrates
  the reason for using a ISP if you have a fairly
  small site as they are responsible for dealing
  with these technical issues.