Lesson 11-Remote Access

1. Lesson 11-Remote Access

2. Introduction • Remote access enables users outside a network to have network access and privileges as if they were inside the network.

3. Background • Being outside a network means using a machine that is not physically connected to the network. The user must establish a connection remotely, by dialing in, connecting using the Internet, or connecting through a wireless connection. • A user accessing resources from the Internet through an ISP is also connecting remotely to the resources via the Internet.

4. Background • Connectivity depends upon security requirements as well as hardware and software employed. • Microsoft Windows has a specific server component, the Remote Access Service, which is designed to facilitate the management of remote access connections through dial-up modems. • Vendors have implemented a variety of remote access methods through its networking hardware and software. UNIX systems have built-in methods, as well.

5. Objectives • Upon completion of this lesson, the learner will be able to: • Describe the various methods and protocols for remote access to networks. • Define authentication, authorization, and accounting (AAA) protocols. • Describe authentication, authorization, and accounting (AAA) protocols.

6. Objectives • Upon completion of this lesson, the learner will be able to (continued): • Describe the various wireless protocols and the security implications in their use. • Define virtual private networks (VPNs) and describe their security aspects. • Define Internet Protocol Security (IPsec) and describe its use in securing communications.

7. Remote Access Process • Devices • Media • Security Concerns for Transmission Media • Removable Media • Security Topologies • Tunneling

8. Remote Access Process • Connecting by remote access involves two elements: • A temporary network connection. • A series of protocols to negotiate privileges and commands.

9. Temporary Network Connection • The temporary network connection can be via a dial-up service, the Internet, wireless access, or any other method of connecting to a network.

10. Establishing Proper Privileges • The three steps used to establish proper privileges are authentication, authorization, and accounting (AAA). • Authentication matches user-supplied credentials to stored credentials – usually done with an account name and a password. • Authorization grants specific permissions based on the privileges held by the account. • Accounting collects billing and other detail records. • Accounting functions include keeping detailed security logs to maintain an audit trail of tasks being performed.

11. Remote Access and Encryption • Secure network connections are established using encryption for remote access protocols. • The host operating system authenticates and authorizes users according to established privilege levels. • Encryption of the communications channel prevents others from breaking in or hijacking authorized sessions and the authorized user's credentials. • Authentication matches user-supplied credentials to stored credentials – usually done with an account name and a password.

12. Identification • Identification ascribes a computer ID to a specific user, computer, or network device. • User identification enables authentication and authorization – the basis for accountability. • It traces activities to individual users or computer processes. • It establishes responsibility for actions. • Identification usually takes the form of a unique logon ID or userid.

13. Authentication • Authentication binds a specific ID to a specific computer connection. • Users are identified by three categories of things: • What users know (such as a password). • What users have (such as tokens). • What users are (this can involve static biometrics such as fingerprints).

14. Authentication • Technological advances are establishing a new category – subconscious behaviors. • What users do (this can involve dynamic biometrics such as a voice print). • These methods can be used individually or in a combination.

15. Authorization Authorization permits or denies access to specific resources. • They determine whether a user has permissions for a particular object or resource. • Authentication is a process of verifying the presented credentials; the source of the credentials is not a relevant item. • Any system or resource – hardware (router, workstation) or a software component (database system) that requires authorization can use its own authorization method once authentication for a connection has been resolved for it.

16. Authorization • Telnet is the TCP/IP protocol standard terminal-emulation defined in RFC 854. • Telnet allows users to log on remotely and access resources as if the user had a local terminal connection. • Telnet has little security since information is passed over the TCP/IP connection. • Account names and passwords are vulnerable. • Telnet makes its connection using TCP port 23. • Secure Shell (SSH) provides direct support for secure remote login, secure file transfer, and secure forwarding of TCP/IP and X Window System traffic.

17. SSH • SSH opens a secure transport between machines using an SSH daemon at each end. • These daemons initiate contact over TCP port 22 and communicate over higher ports in a secure mode. • One of the strengths of SSH is its support for different encryption protocols.

18. SSH • Supports strong encryption, cryptographic host authentication, and integrity protection. • The authentication services are host-based and not user-based. • Individual data-packet integrity is assured through a message authentication code computed from a shared secret, the contents of the packet, and the packet sequence number.

19. SSH • Transport layer protocol. • User authentication protocol. • Connection protocol.

20. Tunnels • PPTP is the most common implementation.

21. Tunnel Steps • Messages may pass over an Asynchronous Transfer Mode (ATM) network from the source to the destination. • At each end of the tunnel, called the tunnel end points, the payload packet is read and understood. • This remote network connection can also span a public switched telephone network (PSTN) and is thus an economical way of connecting remote dial-in users to a corporate data network.

22. Tunnel Steps • The client makes a PPP connection to a NAS – an ISP. • Once the PPP connection is established, a second connection is made over the PPP connection to the PPTP server. • This second connection is a VPN connection between the remote client and the PPTP server. • This connection is a tunnel for future data transfers.

23. PPTP • To do this and still enable routing, an intermediate addressing scheme, Generic Routing Encapsulation (GRE), is used. • The connection, PPTP, uses communications across TCP port 1723. • This port must remain open across the network firewalls for PPTP to be initiated.

24. L2TP • PPTP is designed around PPP and IP networks. • L2F and L2TP are designed for all kinds of networks including ATM and frame relay. It can also be used where PPTP needs to be implemented in software at the client device. • L2TP is a hardware implementation using a router or a special purpose appliance.

25. L2TP • Routers can be enabled to concentrate VPN traffic over higher bandwidth lines. • L2TP may use IPsec and DES as encryption protocols. • L2TP works with established AAA services to aid in user authentication, authorization, and accounting. • RADIUS and TACACS+

26. L2TP • L2TP is established via User Datagram Protocol (UDP) port 1701. • One must leave this port open across firewalls supporting L2TP traffic. • 802.11

27. IEEE 802.11 • Offering wireless connectivity is equivalent to giving an outsider a network drop. • They employ a range of frequencies to mitigate noise. • They prevent casual eavesdropping, as the frequency on which the data moves is always moving in time. • It is an optional encryption method – not all vendors support this option, nor do all network administrators enable this option. • Someone watching the pattern can find the repeated sequences and then break the shared secret key.

28. IEEE 802.11 WEP • The WEP method requires all clients using an access point use the same key for session initiation.

29. IEEE 802.11 Hardware • A wireless network consists of two pieces: • A wireless access point connected to a network. • A wireless network interface card on a client machine. • The access point can be shared among multiple users, and users can move between access points. • VPN • Virtual private networks (VPNs) are secure “virtual” networks built on top of physical networks. • Security lies in the encryption of packet contents between the end points that define the VPN network.

30. VPN • Virtual private networking is not a protocol per se, but rather a method of using protocols to achieve a specific objective; secure communications. • A user wishing to have a secure communication channel with a server across a public network can set up two intermediary devices, VPN end points, to accomplish this task. • VPN end points can be software solutions, routers, or specific servers set up for specific functionality. • User can communicate with their end point, and the server can communicate with its end point. • The two end points then communicate across the public network.

31. VPN • A VPN connection provides a private connection between the machines. • Identification, authorization, and all other standard functions are done with the standard mechanisms for the established system.

32. VPN Protocols • VPNs use different protocols to offer a secure method of communicating between end points. • Both end points know the protocol and share a secret. • All necessary information is established when the VPN is set up. • At the time of use, the VPN only acts as a private tunnel between the two points, and does not constitute a complete security solution.

33. IPSEC • IPsec, short for IP Security, is a set of protocols developed by the Internet Engineering Task Force (IETF) to exchange packets securely at the network layer of the OSI model (RFC 2401–2412).

34. IPsec • IPsec from the Internet Engineering Task Force (IETF) securely exchanges packets at the network layer of the OSI model (RFC 2401–2412). • These protocols only work in conjunction with IP network. • Once an IPsec connection is established, it is possible to tunnel across other networks at lower levels of the OSI model.

35. IPsec at the Network Layer • The set of security services provided by IPsec occurs at the network layer of the OSI model, so higher layer protocols, such as TCP, UDP, ICMP, and BGP are unaffected by the implementation of IPsec services. • IPsec Controls

36. IPsec Methods • IPsec has two defined methods that provide different levels of security. • Tunneling • Transport • Both methods can be used at the same time. • IPsec Transport Method • The transport method encrypts only the data portion of a packet, thus enabling an outsider to see the source and destination IP addresses.

37. IPsec Tunneling Method • Tunneling provides encryption of the source and destination IP addresses, as well as of the data itself. • It provides the greatest security, but it can only be done between IPsec servers (or routers) because the final destination needs to be known for delivery. Protection of the header information is known as context protection. • IPsec Connection Methods • IPsec has three modes of connection: • Host-to-server • Server-to-server • Host-to-host

38. IPsec Tunneling Method Four IPsec Configurations: • Host-to-host • Two Security Devices • Host-to-host and Security Devices • Security Gateway

39. Host-to-Host Configurations • The simplest is a host-to-host connection. • The Internet is not a part of the security association between the machines. • A security association is a formal description of the necessary and sufficient portions of the IPsec protocol to achieve specific protection. • Both communicating parties must agree on the use of the protocols that are available, and this agreement is referred to as a security association.

40. Two Security Device Configuration • Two security devices in the stream relieve the hosts of calculation and encapsulation duties. • The gateways have a security association between them. • The network is assumed to be secure from each machine to its gateway. • No IPsec is performed.

41. Host-to-Host and Security Configuration • A third case combines the first two. • A separate security association exists between the gateway devices and a security association exists between hosts. • This could be considered a tunnel inside a tunnel.

42. Security Gateway Configuration • A remote user connects through the Internet to an organization's network. • The network has a security gateway which secures traffic to and from its servers and authorized users. • The user establishes a security association with the security gateway and then a separate association with the desired server, if required.

43. IPsec Security • IPsec uses two protocols to provide traffic security: • Authentication Header (AH) • Encapsulating Security Payload (ESP)

44. IPsec Key Management • There are three key management and exchange protocols: • Internet Security Association and Key Management Protocol (ISAKMP) • Oakley • Secure Key Exchange Mechanism for Internet (SKEMI)

45. IPsec Key Management • These key management protocols can be collectively referred to as Internet Key Management Protocol (IKMP) or Internet Key Exchange (IKE). • IPsec does not define specific security algorithms, nor does it require specific methods of implementation.

46. IPsec CIA • IPsec allows several security technologies to be combined into a comprehensive solution for network-based confidentiality, integrity, and authentication by using: • Diffie-Hellman key exchange between peers on a public network. • Public key signing of Diffie-Hellman key exchanges to guarantee identity and avoid man-in-the-middle attacks. • Bulk encryption algorithms, such as IDEA and 3DES, for encrypting data.

47. IPsec CIA • IPsec allows several security technologies to be combined into a comprehensive solution by using (continued): • Keyed hash algorithms, such as HMAC, and traditional hash algorithms, such as MD5 and SHA-1, for packet-level authentication. • Digital certificates to act as digital ID cards between parties. • IPsec Header Extensions

48. IPsec CIA • For traffic security, two header extensions are defined for IP datagrams. • The Authentication Header (AH), when added to an IP datagram, ensures the integrity of the data and also the authenticity of the data's origin. • The Encapsulating Security Payload (ESP) provides security services for the higher-level protocol portion of the packet only, not the IP header. • IPsec AH and ESP Security

49. IPsec CIA • In transport mode, the two communication end points provide security primarily for the upper layer protocols. • The cryptographic end points, where encryption and decryption occurs, are located at the source and destination of the communication channel.

50. IPsec AH Security • For AH in transport mode, the original IP header is exposed, but its contents are protected via the AH block in the packet.