95-752:6-1

Operating System Security

95-752:6-2

Users

• UNIX user -> username -> uid– uid is systems real name for user– integer 0 ... 65536 (varies in some systems)– mapping is in /etc/passwd

shimeall:*:5003:20:Tim:/users/shimeall:csh• More than one username may map to a uid

– Desired for some system purposes (program tracking)– Problem for ordinary users (confused file ownership)– Security problem (hacker makes duplicate uid account)

• Temporary uid change: su

95-752:6-3

Groups

• User - one or more groups• Group - zero or more users

– Used for file permissions– Defined by /etc/groups and network sharing software– ypcat group.byname– gid - integer system name for group (generally unique)

• Listed for individual users with groups• Change group of file with chgrp

– chgrp newgroup myfile

95-752:6-4

SETUID and SETGID

• Special mechanisms: temporarily use a uid or gid during the execution of a program)

• Part of mode bits– s in user x field - setuid– s in group x field - setgid

• To be effective, both s and x must be set– chmod a+x myprog– chmod u+s myprog– chmod 4755 myprog

• WARNING: Lots of subtle security holes!

95-752:6-5

Dangerous Accounts

• root – superuser

• open, guest, play, nobody - courtesy accounts

• Accounts without passwords

• uucp, sync, pspq - single-command accounts

• Group accounts

95-752:6-6

User Policy• Restricting access

– commands– file access– login times– network access– terminal access

• Inactive users– Detection– Password change– Locking (change shell)– Deletion (after backup)

• Ultimately - need multilevel security

95-752:6-7

Multilevel Security

• Users with different needs to know sharing computer or network

• If don’t need to know – shouldn’t even be able to determine if information exists

• Should be able to filter functionality based on allowable information

• Mandatory and Discretionary protections

95-752:6-8

Monitor Model

• General Schema:– Takes user's request.– Consults access control information.– Allows or disallows request.

• Advantages– Easy to implement.– Easy to understand

• Disadvantages– Bottleneck in system– Controls only direct accesses (not inferences)

95-752:6-9

Graham-Denning Model• Introduces protection rules that operate on:

– A set of subjects S– A set of objects O– A set of rights R– An access control matrix

Subjects S1 S2 O1 O2

s1 Control Read* Owner read

s2 Control Owner

95-752:6-10

Graham-Denning Rights

Eight primitive protection rights– create, delete object– create, delete subject– read, grant, delete, transfer access right

95-752:6-11

Military Security Model

• Information is ranked:– Unclassified– Confidential– Secret– Top Secret

• Least Privilege: Subject should have access to fewest objects needed for successful work– The system backup program may be allowed to bypass

read restrictions on files, but it would not have the ability to modify files.

– Need to Know”

95-752:6-12

CompartmentalizationInformation may belong to one or more

compartmentsCompartments are used to enforce need-to-know.• Classification of Information:

<rank; compartments>• Clearance: <rank; compartments>

– an indication of a level of trust

• A subject can access an object only if– The clearance level of the subject is at least as high as

that of the information.– The subject has a need to know about all compartments

for which the information is classified.

95-752:6-13

Information Flow Models

• Acts as an intelligent filter to control the transfer of information permitted by access to a particular object.

• Information flow analysis can assure that operating system modules that have access to sensitive data cannot leak that data to calling modules.

95-752:6-14

Bell-LaPadula Model• A formal description of the allowable paths of

information flow in a secure system.– Applies only to privacy

– Identifies paths that could lead to inappropriate disclosures.

– Is used as the basis for the design of systems that handle data of multiple levels.

– Includes both discretionary and mandatory access rules

• B-LP Discretionary Access Control– Uses Access Matrix similar to Graham-Denning Model

– Includes functions for dealing with the access matrix.

95-752:6-15

Bell-LaPadula Mandatory Controls

• Fixed security classes for each subject and each object

• Security classes ordered by a relation– Tranquility constraint prevents access classes of

objects from changing

• Simple Security Property

• * Property

95-752:6-16

Bell-LaPadula Properties

Simple Security Property:

• Subject may have read access only if object classified at same level or lower.

* - Property

• Subject may have write access only if all objects read are at same level or higher than object to be written.

95-752:6-17

Biba Model

• Concerned with integrity rather than secrecy.

• Defines integrity levels much like sensitivity levels.– Fixed integrity classes for each subject and

each object– Ordered integrity classes

95-752:6-18

Biba Properties

Simple Integrity Property:• Subject can modify object only if integrity class at

least as high as the object. (untrusted subjects reduce integrity class when writing)

* - Property:• Subjects may have write access only if the

integrity of objects they are reading is at least as high as the object to be written. (untrusted sources reduce integrity of results)

95-752:6-19

Integrity Preservation

A high integrity file is one whose contents are created by high-integrity processes.

• high-integrity file cannot be contaminated by information from low-integrity processes.

• high-integrity process cannot be subverted by low integrity processes or data.

The integrity class label on a file guarantees that the contents came only from sources of at least that degree of integrity.

95-752:6-20

Secure Operating SystemsBasic Features of a Multiprogramming OS

– Authentication of users.– Protection of memory.– File and I/O device access control.– Allocation and access control to general objects.– Enforcement of sharing.– Guarantee of fair service.– Interprocess communication and synchronization.

• Basic Considerations– Security must be considered in every aspect of the

design of operating systems.– It is difficult to add on security features.

95-752:6-21

Basic Design Principles• Least privilege - fewest possible privileges for

user.• Economy of mechanism - small, simple, straight

forward.• Open design • Complete mediation - check every access• Permission based - default is denial of access.• Separation of privilege - no single super user.• Least common mechanism - avoid shared objects.• Easy to use.

95-752:6-22

Security Kernel• Responsible for implementing the security

mechanisms of the entire operating system.

• Provides the security interfaces among the hardware, the operating system, and the other parts of the computing system.

• Implementation of a security kernel:– May degrade system performance (one more

layer).– May be large.– No guarantees.

95-752:6-23

Backups

• First line of defense against denial-of-service and modification threats

• Don’t depend on system backups for important data

• User backups• Administrator backups:

– Day-zero backup– Upgrade backup– Full backup– Incremental backup

95-752:6-24

Backup Policy• One backup volume per partition• Time backup for restoration

– How much work are we willing to lose?

• Verify backup at archive location– Content - not just format– Ensure operator training– Ensure archive environment

• Rotate media– Need more than most recent backup

• Maintain physical security on backups• Maintain logical security on backups• Be careful about legal issues on backups

95-752:6-25

Integrity• Compromise of integrity equal to compromise of

privacy• Integrity threats:

– Change permissions to allow modification/reading– Change password file– Change device / interface configurations– Move files– Replace system programs with substitutes– Replace log files with sanitized versions

• 95% of UNIX security incidents result of misconfiguration

95-752:6-26

Integrity Protection Strategies

• Prevention

• Detection

• Recovery

95-752:6-27

Unix Operation Modes• Normal Operating Mode:

– Any user login

– Diverse command set

– Network operations

– Import and export files

• Single User Mode:– Intended for system maintenance / full backup

– Only root login allowed

– Restricted command set

– No network operations

– No file import/export

95-752:6-28

Prevention Strategies• Software Controls:

– File permissions

– Directory permissions

– Restrictions on root access

• Low-level operating system controls:– Immutability - only change in single-user mode

– append - only add to file, except single-user mode

• Hardware controls:– Read-only file systems (CD ROM, WORM)

– Write-protect options

95-752:6-29

Detection Strategies• Comparison copies:

– On read-only media– On standard media, remote storage– Large space, slow, expensive

• Metadata:– Stored list of files– Path to files– Modification times– Easy to fool

• Digital Signature– Encrypt with private key of modifier– Fast, small, hard to fool, requires extra work

95-752:6-30

TRIPWIRE• System to compute signatures on all files in

system– Batch mode - compare against stored signatures &

report differences

– Interactive mode - compare against stored signatures & confirm updates

– Both commercial and freeware products

• Detects:– Corrupted file systems

– Unlogged administrator actions

– Replacement of system programs

95-752:6-31

Recovery Strategies

• Restore from backup - Rollback (Data Loss)• If data problem, may be able to replay changes -

Selective Rollback (some data loss)• If redundant file system, vote file versions -

Masking• If specific changes found - correct - Roll forward• In general -- the more detection and prevention,

the easier the recovery

95-752:6-32

Auditing

• Installing security protection is only a beginning• Need to monitor systems• Monitoring methods: Audits and Logs

– Audit - active scanning of current state of system

– Log - record of actions taken in operation of system

• Audits often use logs, and do more

95-752:6-33

Log File Vulnerabilities

• Alteration– Append mode– Non-rewritable media (print)

• Deletion– Non-rewritable media– Move to restricted log host– PC linked by serial line

• Flooding– Ensure large storage– Reduce before logging (look for repeating patterns)

95-752:6-34

Syslog• General purpose logging utility• Any program can generate syslog messages

– Socket connect to syslogd process TCP port

• Messages to files, devices or computers– Dependent on severity and service

• Messages marked with authentication level– kern, user, mail, lpr, auth, demon, news, uucp,

local0...local7, mark

• Messages marked with priority– emerg, alert, crit, err, warning, notice, info, debug, none

95-752:6-35

Syslog Vulnerabilities

• Network/Device flooding

• Stack overwrites (old versions)

• False log entries

• Need for consistent, frequent review

95-752:6-36

Hand-Written Logs

• Journal System

• Ensure physical protection

• “Where do you keep them?”

• Ensure legitimate entries– Signature rules

• Keep for system

• Keep for site