advanced vmware security course 01 - primer and ...advanced vmware security course 01 - primer and...

Advanced VMware Security

Course 01 - Primer and Reaffirming Our

Knowledge

1-1

ESX Networking Components

• Key Virtual Networking Components• Virtual Ethernet adapters vNIC

• Virtual Switches vSwitch

• Distributed Virtual Switch dvSwitch (vSphere4)

• Virtual Port Groups

• These components used to connect the ESX Server service Console to External networks.

Service

Console

Vmware ESX

VMkernel

Production

LANManagement

LAN

NIC Team

Production

LAN

VM 1

OS

APP

-Denotes Virtual Device

VM 3

OS

APP

VM 4

OS

APP

VM 2

OS

APP

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-21-2

How Virtual Ethernet Adapters Work

• 6 Different Types of Adapters– Exclusively Used for Virtual Machines

• Vmxnet - a para-virtualized device that works only if VMware Tools is installed in the guest operating system

• Vmxnet3 – Built on the same architecture as vmxnet but provides up to 10GBps speeds. (ESX4.0 only and requires Version 7 Hardware to be installed)

• Vlance - emulates AMD Lance PCNet32 Ethernet adapter• E1000 – emulates Intel E1000

– Other Adapters• vSwif – Used only by the ESX Server Service Console• Vmknic – Typically used to service vMotion, NFS, iSCSI clients

– All of these • Have their own MAC address• Strictly Layer 2 Ethernet adapter devices

• Note: The speed and duplex settings found in physical networking are not relevant in the virtual network, because all the data transfer takes place in the host system’s RAM, nearly instantaneously and without the possibility of collisions or other signaling-related errors.

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-3

How Virtual Switches Work

• Virtual Switches are the Key Networking Components• Can create up to 128 vSwitches on each ESX 3.5 Host

• Can create up to 248 vSwitches on each ESX 4 Host

• Virtual Switch is Built to Order

• Uses Core Layer 2 forwarding Engine• Key part of the system. Processes only Layer 2 Ethernet

headers so is protocol independent and faster

• VLAN tagging, stripping, and filtering units

• Layer 2 security, checksum, and segmentation offload units.• Modular in nature; to be used in future developments

• Dynamically built at runtime – Utilizing only needed components

• Support built in for 3rd party modules

• VMSafe and VShield Zones are built into ESX4

Note: In many ways, the ESX Server virtual switches are similar to physical switches. In some notable ways, they are different. Understanding these similarities and differences will help you plan the secure configuration of your virtual network and its connections to your physical network.

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-41-4

VMsafe Overview

• Set of APIs built into ESX4/ESXi4

• Allows 3rd Parties to build Security Appliances

• Memory and CPU– Provides detailed monitoring of guest VM memory pages and

vCPU states

• Network Packet Filtering– Monitors into and out of the vSwitch

– Monitors within a dedicated Security VM

• Process execution (guest handling): – APIs that enable complete monitoring and control of process

execution inside guest OS

• Storage– VMDKs can be mounted, manipulated and modified as they

persist on storage devices

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-5

Current VMsafe Partners

• Altor Networks

• Apani

• Bigfix

• BlueLane

• Catbird

• Cenzic

• Check Point

• Configuresoft

• F5

• Fortinet

• Fortispher

• HyTrust

• IBM

• Imperva

• Kaspersky

• ManageIQ

• McAfee

• Montego Networks

• Reflex

• RSA

• Secure Computing

• Symantec

• Third Brigade

• Trend Micro

• Tripwire

• Webroot

Topic 6: Vmsafe and vShield Zones

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-61-6

VS

Virtual Switch vs. Physical Switch• ESX Server vSwitches have these

characteristics in common with Physical Switches

–maintains a MAC:port forwarding table

–Looks up each frame’s destination MAC

when it arrives

–Forwards a frame to one or more ports for transmission

–Avoids unnecessary deliveries (it is not a hub)

–Supports VLAN segmentation at the port level• Can be configured to access a single VLAN

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-71-7

Spanning Tree Protocol Not Needed

• VMI3 and vSphere4 enforces a single-tier network topology– Can’t interconnect multiple virtual switches

– So Bridge Loops can’t exist – Thus:

• No Need for the Spanning Tree Protocol

• Because there is no need to cascade virtual switches, no capability is provided to connect virtual switches.

• Because there is no way to connect virtual switches, there is no need to prevent bad virtual switch connections.

• Because virtual switches cannot share physical Ethernet adapters, there is no way to fool the Ethernet adapter into doing loopback or some similar configuration that would cause a leak between virtual switches.

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-81-8

Virtual Ports

• Provides logical connection points among virtual devices and between virtual and physical devices

– Think of them as RJ45 Connectors

• Each Switch can have up to 1,016 virtual ports on ESX 3.5 and 4,088 on ESX 4.

• Limited to 4096 ports on all virtual switches on a Host

• ESX Virtual Ports:

– no MAC learning is required to populate forwarding tables

– Unlike physical switches, know authoritatively the “hard” configuration of the virtual Ethernet adapters attached to them

• This capability makes it possible to set such policies as “guest can’t change MAC address”

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-9

.

Uplink Ports

•Provides a connection between a virtual network and a physical network

•Virtual Switches can be configured with uplink ports or with no Uplink Ports

vSwitches

VM 1

OS

APP

-Denotes Virtual Device

VM 2

OS

APP

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-101-10

Port Groups

• You can think of port groups as templates for creating virtual ports with particular sets of specifications

• Port groups are important particularly for Vmotion

• Allows you to specify a given VM should have a particular type of connectivity across hosts

• Port Groups are User Named Objects Containing

– Virtual switch name

– VLAN IDs and policies for tagging and filtering

– Teaming policy

– Layer 2 security options

– Traffic shaping parameters

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-111-11

Uplinks

• Physical Ethernet adapters serve as bridges between virtual and physical networks

• VMI3 calls these uplinks

• The virtual ports connected to them are called uplink ports

• A single host may have a maximum of 32 uplinks

– May be on 1 switch

– Or Distributed among multiple switches

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-121-12

Virtual Switch Correctness

• Virtual switches do not learn from the network in order to populate their forwarding tables.

• Virtual switches make private copies of any frame data used to make forwarding or filtering decisions

• ESX Ensures VLAN Isolation by:

– VLAN data is carried outside the frame as it passes through the virtual switch.

– Virtual switches have no dynamic trunking support.

• Dynamic trunking and native VLAN are features in which an attacker may find vulnerabilities that could open isolation leaks.

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-131-13

VLANs in VMWareInfrastructure

• Header of a packet tagged by an 802.1Q VLAN trunking drive

VLANs provide for logical groupings of stations or switch ports

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-141-14

NIC Teaming

• NIC Teaming is used to connect a single vSwitch to multiple Physical adapters

• A team can share the load of traffic between physical and virtual networks

– Teaming is not the same as a physical network

• You can provide passive failover in the event of a hardware failure or a network outage

• You can set NIC teaming policies at the port group level.

• Important: All physical switch ports in the same team must be in the same Layer 2 broadcast domain

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-151-15

Load Balancing

• Route Based on the Originating virtual Switch Port ID– When you use this setting traffic from a given vNIC is

consistently sent to the same physical adapter unless there is a failover in the NIC team

• Route based on source MAC hash– This produces a hash of the source MAC address

– When you use this setting traffic from a given vNIC is consistently sent to the same physical adapter unless there is a failover in the NIC team

• Route based on IP hash– Evenness of traffic distribution depends on the number of

TCP/IP sessions to unique destinations. -no benefit for bulk transfer between a single pair of hosts.

– You can use link aggregation

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-161-16

Failover Configurations

• Link Status Only

– Relies solely on the link status provided by the network adapter

• Beacon Probing

– Sends out and listens for beacon probes

– Ethernet broadcast frames sent by physical adapters to detect upstream network connection failures

• To Minimize Delays

– Disable Spanning Tree Protocol

– Disable Etherchannel Negotiation such as PAgP or LACP

– Disable Trunking Negotiation

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-171-17

Normal Operation

Network

VM

ESX Server Switch 1

Switch 2

Switch 3

Switch 4

nic3

nic2

nic1

Virtual Machine Traffic Handled by nic1

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-181-18

Connection Fails

Network

VM

ESX Server Switch 1

Switch 2

Switch 3

Switch 4

nic3

nic2

nic1

Connection between switch 1 and switch 4 failsEach Ethernet adapter sends a beacon packet

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-191-19

Signaling Process – Beaconing

Network

VM

ESX Server Switch 1

Switch 2

Switch 3

Switch 4

nic3

nic2

nic1

Beacons returned on nic2 and nic3 but not on nic1

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-201-20

Data Rerouted

Network

VM

ESX Server Switch 1

Switch 2

Switch 3

Switch 4

nic3

nic2

nic1

Data to network rerouted through nic3

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-211-21

Layer 2 Security Features

• Promiscuous mode is disabled by default for all virtual machines. This prevents them from seeing unicast traffic to other nodes on the network.

• MAC address change lockdown prevents virtual machines from changing their own unicastaddresses. This also prevents them from seeing unicast traffic to other nodes on the network, blocking a potential security vulnerability that is similar to but narrower than promiscuous mode.

• Forged transmit blocking, when you enable it, prevents virtual machines from sending traffic that appears to come from nodes on the network other than themselves

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-221-22

Forged Transmits – Cont’d

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-231-23

Managing the Virtual Network

• Using VMWare Virtual Center to manage a virtual network.

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-241-24

Symmetric vs. Asymmetric Encryption

Speed:• Symmetric-key algorithms are generally much less

computationally intensive than asymmetric key algorithms.

http://en.wikipedia.org/wiki/Symmetric_key

Type Advantages Disadvantages

Symmetric Speed –Very Fast Insecure Key Exchange

Asymmetric Secure Key Exchange

Speed – Very Slow

Hybrid Very FastSecure Key Exchange

PKI Required.

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-251-25

Hashes

•Types-–MD5 (Considered Insecure)

–SHA1

–SHA2

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-261-26

Digital Signatures

• Digital signatures ensure non-repudiation.

Senders private key

Senders public key

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-271-27

Breaking SSL Traffic

• ARP Cache Poisoning will allow us to perform a successful SSL crack!

• They hacking tools will create fake certificates.• Two simultaneous SSL connections are established. One

between the victim and the hacker, the other between the hacker and the real server.

• The communication process starts on port 443 and once the SSL authentication has been established VMware moves the communication to port 902.

SSL request

SSL reply

(Fake certificate)

SSL request

SSL reply

(Real Self Signed Cert)

F&JLMDHGST*KU P)JDGH$FDSD@Cleartext

Copy &

Alter

Stop

ESX Sever

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-281-28

File System Structure

• Almost everything is treated as a file: many devices, certain elements of processes and, of course, files.

• We are going to look at a high-level map of the file system, there are variations between flavors.

• The top level is known as “root” and it is named / (pronounced slash).

• Everything starts here; we are going to look at the common structure and what is located in the common folder.

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-291-29

File System Structure

/

bin dev etc

passwd group shadow

home lib mnt proc tmp usr

bin man sbin

var

log

Directory Purpose

/ The root directory, which is the tip of the file system.

/bin (along with /sbin on some systems)

Critical system executables needed to boot the system or run it.

/dev Devices connected to the system, such as terminals, disks, USB devices and so on.

/etc System configuration files, including accounts and passwords, network addresses and names, system startup settings and so on.

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-301-30

File System StructureDirectory Purpose

/home Location of user directories.

/lib The home of various shared libraries for programs.

/mnt The point where files systems exported from another system are temporarily mounted, as well as removable devices such as the CD-ROM and USB devices.

/proc Images and data about currently executing processes on the system. The /proc directory isn’t even on your hard drive. Instead, it’s a virtual component of your files system, a portal created by the kernel. This directory was designed so you could peek in on what your kernel and processes are doing.

/tmp Temporarily created files by applications which can be removed without fear of harming your system.

/usr A variety of critical system files, including some standard system utilities (/usr/bin), manual pages (/usr/man), headers for C programs (/usr/include), and administration executables (/usr/sbin).

/var A place to store various types of files, often used for administration. The /var directory commonly stores log files (/var/log) and temporary storage space for some services (such as spooling for mail, printers, etc.).

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-311-31

Kernel

Linux and UNIX have a modular

architecture.

The special program at the core is called the kernel, which is

the brain of the entire system.

When a program runs, the kernel

starts a process to execute the

programs code.

Process 1 – Process 2….Process n

The Kernel

Hardware (disks, network interfaces, etc.)

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-321-32

Processes

• It contains the running programs executable code, the memory associated with the program and various threads of execution that are moving their way through the code executing its instructions.

• Think of a process like a bubble that contains all of the guts of a running program.

• The kernel inflates the bubbles, controls the flow of the bubbles and tries to keep them from popping.

• There are hundreds and sometimes thousands of processes running on any given system.

• The CPU only handles one at a time but the kernel juggles them through the CPU.

• Many processes run in the background, they are known as daemons. (Critical system functions and spooling for printing are examples.)

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-331-33

Processes1. When booting the kernel is loaded into memory.

2. Then it starts a daemon called init.

1. init – It is the parent of all other user-level processes.

2. Location: /etc/init.d

3. Some network services are not used all the time and thus should not be running. (FTP and telnet are examples)

4. init starts another process called the Internet Daemon which does the waiting for these processes.

1. Xinetd is the process. xinetd is an extended version of inetd that offers better access control and logging.

2. These files are found in the /etc/xinetd.d directory.

3. The configuration file is /etc/xinetd.conf.

4. The port numbers are defined in the /etc/services file.

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-341-34

Starting and Stopping Processes

Automatically

• Init.d, xinetd.d and cronautomatically start processes.

• So you can edit the xinetd.conffile.

• Edit the crontab files which are found in the /etc/crontabdirectory.

Manually

• By typing the name of a program in the command line, you are starting a process.

• echo $PATH – gives you the path the OS uses to search for your program. If it cannot be found, you get the error, otherwise it just starts.

• You do not want a “.” in your path as this may allow a hacker to run malicious programs with the same name as legitimate ones.

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-351-35

Interacting with Processes

• The Kernel assigns each running process on a machine a unique process ID (called a PID, pronounced P-I-D).

– You can list the processes: ps

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-361-36

Interacting with Processes

• You can Kill a process by simply typing any of the following examples:

– kill –TERM [PID]

– killall –TERM xinetd

• You can reset or restart the process or the entire inetd file by typing one of the following commands

– kill –HUP [PID]

– killall –HUP xinetd

• Another command for listing open files is lsof.

– lsof

– lsof -p [PID]

– lsof -i

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-371-37

ACCOUNTS AND GROUPS

Accounts are created and

managed using the passwd file located

in /etc/passwd.

Each line contains the information for

one account.

You can add a user by simply typing

adduser and follow the prompts.

You can change a password by typing passwd [username].

It is world readable, so to encrypt our

passwords, we use the shadow format.

This places an xwhere the password

would be in the passwd file and

places the password in the shadow file.

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-381-38

Password & Shadow File Formats

•While some other Linux distributions force you to install the Shadow Password Suite in order to use the shadow format, Red Hat makes it simple. To switch between the two formats, type (as root):

•/usr/sbin/pwconv - To convert to the shadow format•/usr/sbin/pwunconv - To convert back to the traditional format

•With shadow passwords, the “/etc/passwd” file contains account information, and looks like this:

•kstuart:x:561:561:Kevin Stuart:/home/kstuart:/bin/bash

•The “/etc/shadow” file contains password and account expiration information for users, and looks like this:

•kstuart:A46mckrOLChF.:10063:0:99999:7:::

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-391-39

Accounts and Groups

The format of the passwd file includes the following items:

• Login Name, Encrypted/Hashed Password, UID Number, Default GID Number, GECOS Information, Home Directory and Login Shell.

Yes, to help save time, you can also utilize groups in UMIX and Linux.

The group information is found in the /etc/group file.

The group file contains the following information:

• Group Name, Encrypted or Hashed Group Password, GID Number, Group Members

• The password area is never used.

The most important and powerful account is, of course, root!!!

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-401-40

Linux and UNIX Permissions

• Every file has permissions. They were actually ahead of the game on this.

– Every file has an owner and an owner group. The root user and the owner can access the file.

• There are 3 different areas:

– Owner, group owner and everyone

• With 3 different levels:

– Read, write and execute

• Leaving 9 standard forms of permissions.

• You can look at the permissions of all the files in a given directory with the following command.

– ls –l

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-411-41


There are 10 characters we need to look at when discussing permissions.

If the first character is a d then it is a directory, otherwise it is a file.

• The first group of 3 covers the owner – in most cases the owner can perform all levels of access.

• The second group covers the owner group.

• The third group cover the everyone account.

• If there is a - the access is not allowed.

The next nine are permissions.

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-421-42


• You can utilize the chmod command to change the permissions for given users.

• You must understand the Octal Equivalents in order to make these changes.

• The next slide covers these.

• If you wanted to set the following for the file document1, your command would be: chmod 745 document1

– Owner account (read, write and execute)

– Owner group (read)

– Everyone (read and execute)

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-431-43


r w x Octal Equivalent

0 0 0 0

0 0 1 1

0 1 0 2

0 1 1 3

1 0 0 4

1 0 1 5

1 1 0 6

1 1 1 7

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-441-44

Set UID Programs

• How does a lowly user change his password without root level access? The answer lies in the SetUID capabilities.

• With SetUID, a program can be configured to always execute with the permissions of its owner!

• This is needed unless you want to pay the admin guy to spend every second on rudimentary issues.

• You can find all programs whose SetUID is set to run as root by typing the following:– find / -uid 0 –perm -4000 -print

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-451-45

Logs and Auditing

• Event Logs are created by the syslog daemon know as syslogd.

– Receives information from various system and user processes including the kernel.

– Configuration is in the file /etc/syslog.conf

• Logs are stored in the /var/log folder.

• Common Log files are:

– Secure - Such as /var/log/secure

– Local16.warning - /var/log/vmkwarning

– Local15.* - var/log/vmkproxy

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

1-461-46

Logs and Auditing

• User Access information is stored in accounting files. These files are used by administrators to detect anomalous activity.

• The following files are of interest:– utmp – Information about who is currently logged in.

• Accessed by typing the “who” command.

• Found in /var/run

– wtmp – Records all logins and logouts from the system.• The command “last” will display the information found in this

file.

• Stored in /var/log

– lastlog – Contains information about the time and location of each user’s last login to the system.• You can access this information by using the “lastlog” command.

• Located at /var/log/lastlog.

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

______________________________________________________________________________________

Review Questions:

1. A standard VMware vSwitch is susceptible to which of the following attacks against physical switches?

A. MAC flooding B. 802.1Q and ISL tagging C. Double-encapsulation D. None of the above

2. Which of the following is not a network connection type for a standard virtual switch?

A. Service console port B. Virtual machine port group C. VMkernel port D. Cisco discovery protocol port

3. Which of the following is used to define a service console port?

A. vmnic B. Vmnic-COS C. vswif D. vmknic

4. Which of the following are the default settings for the security mode policy exceptions?

A. Promiscuous mode reject B. Promiscuous mode accept C. MAC address changes reject D. MAC address changes accept E. All of the above F. A and C G. B and D H. A and D I. B and C J. None of the above

5. Which of the following are the supported network failover detection methods?

A. Uplink NIC failure B. Link state only C. Link state plus beaconing D. Link state plus uplink failure E. All of the above F. A and B G. B and C H. A and D I. C and D J. None of the above

6. What technology do you implement in order to have the best network performance possible for

your VM?

A. NIC Teaming on the Virtual Switch B. NIC Teaming in the Virtual Machine C. VLANs D. Traffic Shaping

7. Which of the following are the correct definitions for symmetric encryption?

A. Encryption uses a key to encode data. In symmetric encryption, the same key is used to encode and decode data

B. This fast-performing algorithm is typically used for bulk (large volume of data) encryption C. An encryption system in which two different keys are used for encryption and decryption D. This slow-performing algorithm is typically used for small volume of data encryption E. A and B F. C and D G. None of the above

8. In cryptography, a cryptographic hash function is a transformation that takes an input and

returns a string, which is called the hash value. When you change a password, for example, from Pass123 to Pass1234, what happens to the hash value?

A. The hash value adds another value to the end of the hash, changing the size of the hash B. The hash value changes but the size of the hash does not C. Nothing, the hash value does not change since there was only one number added D. The hash value is padded with 0000 on the end

9. Which of the following types of load balancing uses both the destination and source IP address?

A. Route based on the originating Virtual Switch Port ID B. Route based on source MAC hash C. Route based on source and destination hash D. Route based on IP hash

10. What is the default multipathing policy for a SAN storage device?

A. Preferred Path (Fixed) B. Most Recently Used (MRU) C. Round Robin (RR) D. Custom

Answer Key:

1. D The common attacks will not work since the functionality does not exist in the architecture due to the simplicity of a standard virtual switch.

2. D Each virtual switch can contain port groups of multiple types. The allowable types are service console ports used for management purposes, virtual machine port groups that are used for virtual machine communication, and VMkernel ports that are used to connect to IP-based storage, fault tolerance, and VMotion.

3. C

Service console ports are defined as vswif ports. The VMkernel ports are defined as vmknic ports. The uplink ports are defined as vmnic ports.

4. H

Security policies defined at the virtual switch level by default are promiscuous mode-reject, MAC address changes-accept and forged transmits-accept.

5. G

The only two supported network failover detection methods are link state only and link state plus beaconing. Link state plus beaconing allows for the ability to detect if the link to the physical switch has failed, and also if the link to an upper-level physical switch has failed by sending broadcast messages out to one physical NIC and listening on another for the message (i.e., it requires two physical NICs on the vSwitch).

6. D

NIC Teaming can only be implemented on the vSwitch or port group. It provides the only option available in an ESX server to perform load balancing which will provide you with better performance for the VM. Traffic Shaping prevents a VM from overloading the network, which will limit the VM performance.

7. E

Symmetric encryption uses the same key to both encode and decode data; it is also faster than asymmetric and therefore is generally used to encrypt large volumes of data.

8. B A hash is a fixed length set of characters derived from an algorithm. The length never changes, but the hash will change with every change in a password.

9. D

Route based on IP hash uses the source and destination IP address and produces a hash in order to provide load balancing. There is no such option called route based on source and destination hash.

10. A The default multipathing policy is Preferred Path (Fixed). In the case of failover, ESX will select a different path; however, once the original path has been restored ESX will failback to the original path. MRU is used as the policy in active/passive storage devices. In the case of MRU, once a failover occurs the path will not revert once restored. Round Robin will rotate the paths on a per number of I/Os or per number of blocks basis. Round Robin was experimental in 3.5 but is now supported as the recommended multipathing policy.

advanced vmware security course 01 - primer and ...advanced vmware security course 01 - primer and...

Documents