Securing Network Access with Open Source solutions

•Télécharger en tant que PPT, PDF•

4 j'aime•2,067 vues

My presentation from Atlanta Linux Fest on how to allow users secure access to your network using open source technologies. Examples include how to add two-factor authentication to Apache, OpenVPN, Astaro, NX etc.

Technologie Actualités & Politique

Securing Network Access with Open Source Solutions Nick Owen 9/19/09 @wikidsystems [email_address]

Letting the Good Guys In ,[object Object],[object Object],[object Object],[object Object]

Is this your Network? ,[object Object],[object Object],[object Object],[object Object]

Our Goal: Securely allow access to the network with simplicity and flexibility.

What's important? ,[object Object],[object Object],[object Object],[object Object],[object Object]

What are we going to do? ,[object Object],[object Object],[object Object],[object Object]

There's more than one way... ,[object Object],[object Object],[object Object]

To skin this cat ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Who or what is connecting? Evil Princess Duck Bot Sweet Chicky Chirpalot

Static Passwords ,[object Object],[object Object],[object Object]

Certs & Keys ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

One-time passwords ,[object Object],[object Object],[object Object],[object Object],[object Object]

Flexibility comes from Protocols ,[object Object],[object Object],[object Object],[object Object],[object Object]

Why I like Radius ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

PAM rules! ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

PAM Radius ,[object Object],[object Object],[object Object],[object Object]

Pam radius example ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

SSH ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Astaro & WiKID ,[object Object],[object Object],[object Object],[object Object]

OpenVPN ,[object Object],[object Object],[object Object],[object Object],[object Object]

Apache! ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Apache Radius Example Install mod-auth-radius $ sudo apt-get install libapache-mod-auth-radius In your httpd.conf add: AddRadiusAuth radius_server:1812 shared_secret 5 AddRadiusCookieValid 60 Remember Radius is port 1812 *UDP*

Apache Radius Example con't Enter this into your apache2.conf: <location> Options Indexes FollowSymlinks AuthType Basic AuthName "WiKID RADIUS authentication" AuthBasicAuthoritative Off AuthBasicProvider radius AuthRadiusAuthoritative on AuthRadiusActive On Require valid-user </location> Restart Apache!

Squid ,[object Object],[object Object],[object Object],[object Object],[object Object]

SSL Attacks ,[object Object],[object Object],[object Object],[object Object]

Prevent MITM attacks with Mutual HTTPS Auth ,[object Object],[object Object],[object Object],[object Object]

Remote Desktop ,[object Object],[object Object],[object Object],[object Object],[object Object]

Postgresql ,[object Object],[object Object],[object Object],[object Object]

Pretty Lame Diagram VPN, SSH, HTTPS Gateway Desktop, Mail, Web Auth/Radius Server RADIUS, LDAP, etc SSH, RDP, VNC, HTTPS

Join the cause! ,[object Object],[object Object],[object Object],[object Object]

The next Dan Kaminsky? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

More Information ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Any questions? [email_address] @wikidsystems

Recommandé

Microservices with MicronautQAware GmbH

Using Document Databases with TYPO3 FlowKarsten Dambekalns

Microservices with MicronautQAware GmbH

Jacopo Nardiello - Monitoring Cloud-Native applications with Prometheus - Cod...Codemotion

Efficient DevOps Tooling with Java and GraalVMQAware GmbH

JEE on DC/OSJosef Adersberger

Oded Coster - Stack Overflow behind the scenes - how it's made - Codemotion M...Codemotion

Control Plane: Continuous Kubernetes Security (DevSecOps - London Gathering, ...Michael Man

Recommandé

Microservices with MicronautQAware GmbH

Using Document Databases with TYPO3 FlowKarsten Dambekalns

Microservices with MicronautQAware GmbH

Jacopo Nardiello - Monitoring Cloud-Native applications with Prometheus - Cod...Codemotion

Efficient DevOps Tooling with Java and GraalVMQAware GmbH

JEE on DC/OSJosef Adersberger

Oded Coster - Stack Overflow behind the scenes - how it's made - Codemotion M...Codemotion

Control Plane: Continuous Kubernetes Security (DevSecOps - London Gathering, ...Michael Man

What is Google Cloud Good For at DevFestInspire 2021Robert John

Twisted: a quick introductionRobert Coup

Leveraging the Power of containerd Events - Evan HazlettDocker, Inc.

Securing & Enforcing Network Policy and Encryption with Weave NetLuke Marsden

Asynchronous Python with TwistedAdam Englander

Chris Swan ONUG Academy - Container Networks TutorialCohesive Networks

Luca Relandini - Microservices and containers networking: Contiv, deep dive a...Codemotion

Chris Rutter: Avoiding The Security BrickMichael Man

OWASP ZAP Workshop for QA TestersJavan Rasokat

WTF is Twisted?hawkowl

OpenShift & SELinux with Dan Walsh @rhatdanOpenShift Origin

Kubernetes 101 for_penetration_testers_-_null_mumbain|u - The Open Security Community

GIDS_what does_cloud-native_mean_anyway?Grace Jansen

Distributed fun with etcdAbdulaziz AlMalki

Zombies in KubernetesThomas Fricke

Lessons Learned in Automating Compliance for ContainersAll Things Open

(WEB401) Optimizing Your Web Server on AWS | AWS re:Invent 2014Amazon Web Services

Writing Serverless Application in Java with comparison of 3 approaches: AWS S...Andrew Zakordonets

Istio PlaygroundQAware GmbH

DevOpsDaysRiga 2018: Andrew Martin - Continuous Kubernetes Security DevOpsDays Riga

Unit+eight+ +ubuntu+securityErdo Deshiant Garnaby

Authentication Modules For Linux - PAM ArchitecturePriyank Kapadia

Contenu connexe

Tendances

What is Google Cloud Good For at DevFestInspire 2021Robert John

Twisted: a quick introductionRobert Coup

Leveraging the Power of containerd Events - Evan HazlettDocker, Inc.

Securing & Enforcing Network Policy and Encryption with Weave NetLuke Marsden

Asynchronous Python with TwistedAdam Englander

Chris Swan ONUG Academy - Container Networks TutorialCohesive Networks

Luca Relandini - Microservices and containers networking: Contiv, deep dive a...Codemotion

Chris Rutter: Avoiding The Security BrickMichael Man

OWASP ZAP Workshop for QA TestersJavan Rasokat

WTF is Twisted?hawkowl

OpenShift & SELinux with Dan Walsh @rhatdanOpenShift Origin

Kubernetes 101 for_penetration_testers_-_null_mumbain|u - The Open Security Community

GIDS_what does_cloud-native_mean_anyway?Grace Jansen

Distributed fun with etcdAbdulaziz AlMalki

Zombies in KubernetesThomas Fricke

Lessons Learned in Automating Compliance for ContainersAll Things Open

(WEB401) Optimizing Your Web Server on AWS | AWS re:Invent 2014Amazon Web Services

Writing Serverless Application in Java with comparison of 3 approaches: AWS S...Andrew Zakordonets

Istio PlaygroundQAware GmbH

DevOpsDaysRiga 2018: Andrew Martin - Continuous Kubernetes Security DevOpsDays Riga

Tendances (20)

What is Google Cloud Good For at DevFestInspire 2021

Twisted: a quick introduction

Leveraging the Power of containerd Events - Evan Hazlett

Securing & Enforcing Network Policy and Encryption with Weave Net

Asynchronous Python with Twisted

Chris Swan ONUG Academy - Container Networks Tutorial

Luca Relandini - Microservices and containers networking: Contiv, deep dive a...

Chris Rutter: Avoiding The Security Brick

OWASP ZAP Workshop for QA Testers

WTF is Twisted?

OpenShift & SELinux with Dan Walsh @rhatdan

Kubernetes 101 for_penetration_testers_-_null_mumbai

GIDS_what does_cloud-native_mean_anyway?

Distributed fun with etcd

Zombies in Kubernetes

Lessons Learned in Automating Compliance for Containers

(WEB401) Optimizing Your Web Server on AWS | AWS re:Invent 2014

Writing Serverless Application in Java with comparison of 3 approaches: AWS S...

Istio Playground

DevOpsDaysRiga 2018: Andrew Martin - Continuous Kubernetes Security

En vedette

Unit+eight+ +ubuntu+securityErdo Deshiant Garnaby

Authentication Modules For Linux - PAM ArchitecturePriyank Kapadia

Social Media PowerPoint Presentation - March 2016Misty Hataway-Cone'

Holistic view of 802.1x integration & optimizationBangladesh Network Operators Group

The ROI of Trust in Social SellingBarbara Giamanco

Be a Digital Trailblazer When Building Your Brand Carrie Kerpen

How to Create the Perfect Social-Media PostGuy Kawasaki

50 Expert Tips for Getting Started on Social MediaConstant Contact

A Complete Guide To The Best Times To Post On Social Media (And More!)TrackMaven

How Often Should You Post to Facebook and TwitterBuffer

6 Questions to Lead You to a Social Media StrategyMark Schaefer

How to Determine the ROI of AnythingGary Vaynerchuk

Go Viral on the Social Web: The Definitive How-To guide!XPLAIN

Why Content Marketing FailsRand Fishkin

En vedette (14)

Unit+eight+ +ubuntu+security

Authentication Modules For Linux - PAM Architecture

Social Media PowerPoint Presentation - March 2016

Holistic view of 802.1x integration & optimization

The ROI of Trust in Social Selling

Be a Digital Trailblazer When Building Your Brand

How to Create the Perfect Social-Media Post

50 Expert Tips for Getting Started on Social Media

A Complete Guide To The Best Times To Post On Social Media (And More!)

How Often Should You Post to Facebook and Twitter

6 Questions to Lead You to a Social Media Strategy

How to Determine the ROI of Anything

Go Viral on the Social Web: The Definitive How-To guide!

Why Content Marketing Fails

Similaire à Securing Network Access with Open Source solutions

FreeBSD and Hardening Web ServerMuhammad Moinur Rahman

Null bhopal Sep 2016: What it Takes to Secure a Web ApplicationAnant Shrivastava

Squid serverRohit Phulsunge

Wifi Security, or Descending into Depression and DrinkSecurityTube.Net

presentation_4102_1493726768.pdfssuserf0e32f

EAP TLS, the Rolls-Royce of extensible authentication protocol (EAP) methods ...Jisc

e-Xpert Gate / Reverse Proxy - WAF 1ere générationSylvain Maret

Cloud Foundry Day in Tokyo Lightning Talk - Cloud Foundry over the ProxyMaki Toshio

Defending Against Attacks With RailsTony Amoyal

Ssl Vpn presentation at CoolTech clubiplotnikov

Magento security best practices magento's approach to pci complianceRitwik Das

Vpn 3Swarup Kumar Mall

Vpn 2Swarup Kumar Mall

Beyond the Pentest: How C2, Internal Pivoting, and Data Exfiltration Show Tru...Beau Bullock

Palo Alto Networks authenticationAlberto Rivai

WordPress + Amazon Web Services Hands-on WARSAWMatt Pilarski

AMIMOTO: WordPress + Amazon Web Services Hands-on WARSAW Kel

FIWARE Wednesday Webinars - How to Secure IoT DevicesFIWARE

DevSec Delight with Compliance as Code - Matt Ray - AgileNZ 2017AgileNZ Conference

Rhel5Yash Gulati

Similaire à Securing Network Access with Open Source solutions (20)

FreeBSD and Hardening Web Server

Null bhopal Sep 2016: What it Takes to Secure a Web Application

Squid server

Wifi Security, or Descending into Depression and Drink

presentation_4102_1493726768.pdf

EAP TLS, the Rolls-Royce of extensible authentication protocol (EAP) methods ...

e-Xpert Gate / Reverse Proxy - WAF 1ere génération

Cloud Foundry Day in Tokyo Lightning Talk - Cloud Foundry over the Proxy

Defending Against Attacks With Rails

Ssl Vpn presentation at CoolTech club

Magento security best practices magento's approach to pci compliance

Vpn 3

Vpn 2

Beyond the Pentest: How C2, Internal Pivoting, and Data Exfiltration Show Tru...

Palo Alto Networks authentication

WordPress + Amazon Web Services Hands-on WARSAW

AMIMOTO: WordPress + Amazon Web Services Hands-on WARSAW

FIWARE Wednesday Webinars - How to Secure IoT Devices

DevSec Delight with Compliance as Code - Matt Ray - AgileNZ 2017

Rhel5

Dernier

Gen AI in Business - Global Trends Report 2024.pdfAddepto

Dev Dives: Streamline document processing with UiPath Studio WebUiPathCommunity

From Family Reminiscence to Scholarly Archive .Alan Dix

Leverage Zilliz Serverless - Up to 50X Saving for Your Vector Storage CostZilliz

"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...Fwdays

Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxLoriGlavin3

Nell’iperspazio con Rocket: il Framework Web di Rust!Commit University

DevEX - reference for building teams, processes, and platformsSergiu Bodiu

Artificial intelligence in cctv survelliance.pptxhariprasad279825

Vertex AI Gemini Prompt Engineering TipsMiki Katsuragi

Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada

CloudStudio User manual (basic edition):comworks

E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxnull - The Open Security Community

"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek SchlawackFwdays

How AI, OpenAI, and ChatGPT impact business and software.Curtis Poe

DMCC Future of Trade Web3 - Special EditionDubai Multi Commodity Centre

Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdfPrecisely

Advanced Test Driven-Development @ php[tek] 2024Scott Keck-Warren

Unraveling Multimodality with Large Language Models.pdfAlex Barbosa Coqueiro

New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada

Dernier (20)

Gen AI in Business - Global Trends Report 2024.pdf

Dev Dives: Streamline document processing with UiPath Studio Web

From Family Reminiscence to Scholarly Archive .

Leverage Zilliz Serverless - Up to 50X Saving for Your Vector Storage Cost

"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...

Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx

Nell’iperspazio con Rocket: il Framework Web di Rust!

DevEX - reference for building teams, processes, and platforms

Artificial intelligence in cctv survelliance.pptx

Vertex AI Gemini Prompt Engineering Tips

Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024

CloudStudio User manual (basic edition):

E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx

"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack

How AI, OpenAI, and ChatGPT impact business and software.

DMCC Future of Trade Web3 - Special Edition

Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdf

Advanced Test Driven-Development @ php[tek] 2024

Unraveling Multimodality with Large Language Models.pdf

New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024

Securing Network Access with Open Source solutions

1. Securing Network Access with Open Source Solutions Nick Owen 9/19/09 @wikidsystems [email_address]

4. Our Goal: Securely allow access to the network with simplicity and flexibility.

9. Who or what is connecting? Evil Princess Duck Bot Sweet Chicky Chirpalot

10.

11.

12.

13.

14.

15.

16.

17.

18.

19.

20.

21.

22. Configure Radius on Astaro

23. Enable Radius

24. Point it to the OTP or Radius server

25. Associate the Group with a VPN

26. Create A WiKID Domain

27. Create a Radius Network Client

28. Add Shared Secret

29. Done!

30. For the End-User

31. Select Domain & Enter PIN

32. Enter OTP & Connect

33.

34.

35. Apache Radius Example Install mod-auth-radius $ sudo apt-get install libapache-mod-auth-radius In your httpd.conf add: AddRadiusAuth radius_server:1812 shared_secret 5 AddRadiusCookieValid 60 Remember Radius is port 1812 *UDP*

36. Apache Radius Example con't Enter this into your apache2.conf: <location> Options Indexes FollowSymlinks AuthType Basic AuthName "WiKID RADIUS authentication" AuthBasicAuthoritative Off AuthBasicProvider radius AuthRadiusAuthoritative on AuthRadiusActive On Require valid-user </location> Restart Apache!

37.

38.

39.

40.

41.

42. Pretty Lame Diagram VPN, SSH, HTTPS Gateway Desktop, Mail, Web Auth/Radius Server RADIUS, LDAP, etc SSH, RDP, VNC, HTTPS

43.

44.

45.

46. Any questions? [email_address] @wikidsystems