securing_syslog_onFreeBSD

Securing syslog on FreeBSD © Albert Mietus [email_address] [email_address]

Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

ALbert Mietus ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Syslog (1) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Syslog (2) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Syslog, Again .. ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Syslog-secure ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Device Collector Relay Relay Collector Relay

Part 2 a 5 minutes introduction into cryptography

Cryptography ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Asymmetric key authentication ,[object Object],[object Object],Some text you can read Fbzr grkg lbh pna ernq Some text you can read NB It’s impossible to calculate the "other" key !!! Result : you are sure who SENT it ! ! ! Private key Public key

Hashes & Signatures ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

All, in a nutshell Some text you can read HASH UNFU HASH HASH IFF the HASHes are equal, the message is OK ! ! ! Private key hash Some text you can read UNFU hash Public key compare

Part 3 securing syslog , using syslog-sign . A simple implementation

Step by step ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Step 1: “rfc3164 mode” ,[object Object],[object Object],[object Object],[object Object],Max 1024 bytes MSG optional Usually up to a few hundreds of bytes about 70 bytes 3 to 5 bytes HEADER PRI TIME-STAMP HOST-NAME < ddd > TAG CONTENT Free format readable text

rfc3164-mode: design ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Rfc3164-mode: implementation ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Syslog-sign: concept SIGN Send & Store hash MSG HEADER PRI N+1: H ( N+1) hash MSG HEADER PRI N+2: H ( N+2 ) hash MSG HEADER PRI N+3: H ( N+3 ) hash MSG HEADER PRI N: H ( N ) H(N) H(N+1) H(N+2) H(N+3) HEADER PRI Private key hash

Syslog-sign: transport & storage Send & Store All messages are handled as normal syslog messages. They are transported and stored by all (rfc3164 compliant) syslog daemons ! MSG HEADER PRI N+1: MSG HEADER PRI N+2: MSG HEADER PRI N+3: MSG HEADER PRI N: H(N) H(N+1) H(N+2) H(N+3) HEADER PRI SIGN

Syslog-sign concept: verifying Continue Matching SIGN It’s possible to mark all “good” messages! ! ! MSG HEADER PRI N+1: MSG HEADER PRI N+2: MSG HEADER PRI N+3: MSG HEADER PRI N: H(N) H(N+1) H(N+2) H(N+3) HEADER PRI hash Compare Match? Match? Match? Match? hashes H ( N+3 ) H ( N+2 ) H ( N+1) H ( N ) Public key

Syslog-sign, details ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

signed in syslogd ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Syslogd-sign, design ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Syslogd-sign, implementation ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Complication : “compression” ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

The public key ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Base64 is used to send a binary part @#SigCer Base64 HEADER PRI @#SigCer is used HEADER PRI @#SigCer to send HEADER PRI @#SigCer a b i nary HEADER PRI @#SigCer part HEADER PRI Public key

Public key & verification Validation can start after the public key is assembled from Certificate Blocks SIGN ,[object Object],[object Object],But they don’t need to be “in order”! MSG HEADER PRI MSG HEADER PRI MSG HEADER PRI MSG HEADER PRI H(N) H(N+1) H(N+2) H(N+3) HEADER PRI SIGN @#SigCer Base64 HEADER PRI @#SigCer is used HEADER PRI @#SigCer to send HEADER PRI @#SigCer a b i nary HEADER PRI @#SigCer part HEADER PRI Public key

Result ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],You can assure the log-messages are correct ! ! !

And finally ... ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

securing_syslog_onFreeBSD

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Andere mochten auch

Andere mochten auch (7)

Ähnlich wie securing_syslog_onFreeBSD

Ähnlich wie securing_syslog_onFreeBSD (20)

Mehr von webuploader

Mehr von webuploader (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

securing_syslog_onFreeBSD