Securing Network Access with Open Source solutions

•Télécharger en tant que PPT, PDF•

4 j'aime•2,067 vues

My presentation from Atlanta Linux Fest on how to allow users secure access to your network using open source technologies. Examples include how to add two-factor authentication to Apache, OpenVPN, Astaro, NX etc.

Technologie Actualités & Politique

Securing Network Access with Open Source Solutions Nick Owen 9/19/09 @wikidsystems [email_address]

Letting the Good Guys In ,[object Object],[object Object],[object Object],[object Object]

Is this your Network? ,[object Object],[object Object],[object Object],[object Object]

Our Goal: Securely allow access to the network with simplicity and flexibility.

What's important? ,[object Object],[object Object],[object Object],[object Object],[object Object]

What are we going to do? ,[object Object],[object Object],[object Object],[object Object]

There's more than one way... ,[object Object],[object Object],[object Object]

To skin this cat ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Who or what is connecting? Evil Princess Duck Bot Sweet Chicky Chirpalot

Static Passwords ,[object Object],[object Object],[object Object]

Certs & Keys ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

One-time passwords ,[object Object],[object Object],[object Object],[object Object],[object Object]

Flexibility comes from Protocols ,[object Object],[object Object],[object Object],[object Object],[object Object]

Why I like Radius ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

PAM rules! ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

PAM Radius ,[object Object],[object Object],[object Object],[object Object]

Pam radius example ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

SSH ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Astaro & WiKID ,[object Object],[object Object],[object Object],[object Object]

OpenVPN ,[object Object],[object Object],[object Object],[object Object],[object Object]

Apache! ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Apache Radius Example Install mod-auth-radius $ sudo apt-get install libapache-mod-auth-radius In your httpd.conf add: AddRadiusAuth radius_server:1812 shared_secret 5 AddRadiusCookieValid 60 Remember Radius is port 1812 *UDP*

Apache Radius Example con't Enter this into your apache2.conf: <location> Options Indexes FollowSymlinks AuthType Basic AuthName "WiKID RADIUS authentication" AuthBasicAuthoritative Off AuthBasicProvider radius AuthRadiusAuthoritative on AuthRadiusActive On Require valid-user </location> Restart Apache!

Squid ,[object Object],[object Object],[object Object],[object Object],[object Object]

SSL Attacks ,[object Object],[object Object],[object Object],[object Object]

Prevent MITM attacks with Mutual HTTPS Auth ,[object Object],[object Object],[object Object],[object Object]

Remote Desktop ,[object Object],[object Object],[object Object],[object Object],[object Object]

Postgresql ,[object Object],[object Object],[object Object],[object Object]

Pretty Lame Diagram VPN, SSH, HTTPS Gateway Desktop, Mail, Web Auth/Radius Server RADIUS, LDAP, etc SSH, RDP, VNC, HTTPS

Join the cause! ,[object Object],[object Object],[object Object],[object Object]

The next Dan Kaminsky? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

More Information ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Any questions? [email_address] @wikidsystems

Recommandé

Microservices with MicronautQAware GmbH

Using Document Databases with TYPO3 FlowKarsten Dambekalns

Microservices with MicronautQAware GmbH

Jacopo Nardiello - Monitoring Cloud-Native applications with Prometheus - Cod...Codemotion

Efficient DevOps Tooling with Java and GraalVMQAware GmbH

JEE on DC/OSJosef Adersberger

Oded Coster - Stack Overflow behind the scenes - how it's made - Codemotion M...Codemotion

Control Plane: Continuous Kubernetes Security (DevSecOps - London Gathering, ...Michael Man

Recommandé

Microservices with MicronautQAware GmbH

Using Document Databases with TYPO3 FlowKarsten Dambekalns

Microservices with MicronautQAware GmbH

Jacopo Nardiello - Monitoring Cloud-Native applications with Prometheus - Cod...Codemotion

Efficient DevOps Tooling with Java and GraalVMQAware GmbH

JEE on DC/OSJosef Adersberger

Oded Coster - Stack Overflow behind the scenes - how it's made - Codemotion M...Codemotion

Control Plane: Continuous Kubernetes Security (DevSecOps - London Gathering, ...Michael Man

What is Google Cloud Good For at DevFestInspire 2021Robert John

Twisted: a quick introductionRobert Coup

Leveraging the Power of containerd Events - Evan HazlettDocker, Inc.

Securing & Enforcing Network Policy and Encryption with Weave NetLuke Marsden

Asynchronous Python with TwistedAdam Englander

Chris Swan ONUG Academy - Container Networks TutorialCohesive Networks

Luca Relandini - Microservices and containers networking: Contiv, deep dive a...Codemotion

Chris Rutter: Avoiding The Security BrickMichael Man

OWASP ZAP Workshop for QA TestersJavan Rasokat

WTF is Twisted?hawkowl

OpenShift & SELinux with Dan Walsh @rhatdanOpenShift Origin

Kubernetes 101 for_penetration_testers_-_null_mumbain|u - The Open Security Community

GIDS_what does_cloud-native_mean_anyway?Grace Jansen

Distributed fun with etcdAbdulaziz AlMalki

Zombies in KubernetesThomas Fricke

Lessons Learned in Automating Compliance for ContainersAll Things Open

(WEB401) Optimizing Your Web Server on AWS | AWS re:Invent 2014Amazon Web Services

Writing Serverless Application in Java with comparison of 3 approaches: AWS S...Andrew Zakordonets

Istio PlaygroundQAware GmbH

DevOpsDaysRiga 2018: Andrew Martin - Continuous Kubernetes Security DevOpsDays Riga

Unit+eight+ +ubuntu+securityErdo Deshiant Garnaby

Authentication Modules For Linux - PAM ArchitecturePriyank Kapadia

Contenu connexe

Tendances

What is Google Cloud Good For at DevFestInspire 2021Robert John

Twisted: a quick introductionRobert Coup

Leveraging the Power of containerd Events - Evan HazlettDocker, Inc.

Securing & Enforcing Network Policy and Encryption with Weave NetLuke Marsden

Asynchronous Python with TwistedAdam Englander

Chris Swan ONUG Academy - Container Networks TutorialCohesive Networks

Luca Relandini - Microservices and containers networking: Contiv, deep dive a...Codemotion

Chris Rutter: Avoiding The Security BrickMichael Man

OWASP ZAP Workshop for QA TestersJavan Rasokat

WTF is Twisted?hawkowl

OpenShift & SELinux with Dan Walsh @rhatdanOpenShift Origin

Kubernetes 101 for_penetration_testers_-_null_mumbain|u - The Open Security Community

GIDS_what does_cloud-native_mean_anyway?Grace Jansen

Distributed fun with etcdAbdulaziz AlMalki

Zombies in KubernetesThomas Fricke

Lessons Learned in Automating Compliance for ContainersAll Things Open

(WEB401) Optimizing Your Web Server on AWS | AWS re:Invent 2014Amazon Web Services

Writing Serverless Application in Java with comparison of 3 approaches: AWS S...Andrew Zakordonets

Istio PlaygroundQAware GmbH

DevOpsDaysRiga 2018: Andrew Martin - Continuous Kubernetes Security DevOpsDays Riga

Tendances (20)

What is Google Cloud Good For at DevFestInspire 2021

Twisted: a quick introduction

Leveraging the Power of containerd Events - Evan Hazlett

Securing & Enforcing Network Policy and Encryption with Weave Net

Asynchronous Python with Twisted

Chris Swan ONUG Academy - Container Networks Tutorial

Luca Relandini - Microservices and containers networking: Contiv, deep dive a...

Chris Rutter: Avoiding The Security Brick

OWASP ZAP Workshop for QA Testers

WTF is Twisted?

OpenShift & SELinux with Dan Walsh @rhatdan

Kubernetes 101 for_penetration_testers_-_null_mumbai

GIDS_what does_cloud-native_mean_anyway?

Distributed fun with etcd

Zombies in Kubernetes

Lessons Learned in Automating Compliance for Containers

(WEB401) Optimizing Your Web Server on AWS | AWS re:Invent 2014

Writing Serverless Application in Java with comparison of 3 approaches: AWS S...

Istio Playground

DevOpsDaysRiga 2018: Andrew Martin - Continuous Kubernetes Security

En vedette

Unit+eight+ +ubuntu+securityErdo Deshiant Garnaby

Authentication Modules For Linux - PAM ArchitecturePriyank Kapadia

Social Media PowerPoint Presentation - March 2016Misty Hataway-Cone'

Holistic view of 802.1x integration & optimizationBangladesh Network Operators Group

The ROI of Trust in Social SellingBarbara Giamanco

Be a Digital Trailblazer When Building Your Brand Carrie Kerpen

How to Create the Perfect Social-Media PostGuy Kawasaki

50 Expert Tips for Getting Started on Social MediaConstant Contact

A Complete Guide To The Best Times To Post On Social Media (And More!)TrackMaven

How Often Should You Post to Facebook and TwitterBuffer

6 Questions to Lead You to a Social Media StrategyMark Schaefer

How to Determine the ROI of AnythingGary Vaynerchuk

Go Viral on the Social Web: The Definitive How-To guide!XPLAIN

Why Content Marketing FailsRand Fishkin

En vedette (14)

Unit+eight+ +ubuntu+security

Authentication Modules For Linux - PAM Architecture

Social Media PowerPoint Presentation - March 2016

Holistic view of 802.1x integration & optimization

The ROI of Trust in Social Selling

Be a Digital Trailblazer When Building Your Brand

How to Create the Perfect Social-Media Post

50 Expert Tips for Getting Started on Social Media

A Complete Guide To The Best Times To Post On Social Media (And More!)

How Often Should You Post to Facebook and Twitter

6 Questions to Lead You to a Social Media Strategy

How to Determine the ROI of Anything

Go Viral on the Social Web: The Definitive How-To guide!

Why Content Marketing Fails

Similaire à Securing Network Access with Open Source solutions

FreeBSD and Hardening Web ServerMuhammad Moinur Rahman

Null bhopal Sep 2016: What it Takes to Secure a Web ApplicationAnant Shrivastava

Squid serverRohit Phulsunge

Wifi Security, or Descending into Depression and DrinkSecurityTube.Net

presentation_4102_1493726768.pdfssuserf0e32f

EAP TLS, the Rolls-Royce of extensible authentication protocol (EAP) methods ...Jisc

e-Xpert Gate / Reverse Proxy - WAF 1ere générationSylvain Maret

Cloud Foundry Day in Tokyo Lightning Talk - Cloud Foundry over the ProxyMaki Toshio

Defending Against Attacks With RailsTony Amoyal

Ssl Vpn presentation at CoolTech clubiplotnikov

Magento security best practices magento's approach to pci complianceRitwik Das

Vpn 3Swarup Kumar Mall

Vpn 2Swarup Kumar Mall

Beyond the Pentest: How C2, Internal Pivoting, and Data Exfiltration Show Tru...Beau Bullock

Palo Alto Networks authenticationAlberto Rivai

WordPress + Amazon Web Services Hands-on WARSAWMatt Pilarski

AMIMOTO: WordPress + Amazon Web Services Hands-on WARSAW Kel

FIWARE Wednesday Webinars - How to Secure IoT DevicesFIWARE

DevSec Delight with Compliance as Code - Matt Ray - AgileNZ 2017AgileNZ Conference

Rhel5Yash Gulati

Similaire à Securing Network Access with Open Source solutions (20)

FreeBSD and Hardening Web Server

Null bhopal Sep 2016: What it Takes to Secure a Web Application

Squid server

Wifi Security, or Descending into Depression and Drink

presentation_4102_1493726768.pdf

EAP TLS, the Rolls-Royce of extensible authentication protocol (EAP) methods ...

e-Xpert Gate / Reverse Proxy - WAF 1ere génération

Cloud Foundry Day in Tokyo Lightning Talk - Cloud Foundry over the Proxy

Defending Against Attacks With Rails

Ssl Vpn presentation at CoolTech club

Magento security best practices magento's approach to pci compliance

Vpn 3

Vpn 2

Beyond the Pentest: How C2, Internal Pivoting, and Data Exfiltration Show Tru...

Palo Alto Networks authentication

WordPress + Amazon Web Services Hands-on WARSAW

AMIMOTO: WordPress + Amazon Web Services Hands-on WARSAW

FIWARE Wednesday Webinars - How to Secure IoT Devices

DevSec Delight with Compliance as Code - Matt Ray - AgileNZ 2017

Rhel5

Dernier

What Are The Drone Anti-jamming Systems Technology?Antenna Manufacturer Coco

The 7 Things I Know About Cyber Security After 25 Years | April 2024Rafal Los

2024: Domino Containers - The Next Step. News from the Domino Container commu...Martijn de Jong

From Event to Action: Accelerate Your Decision Making with Real-Time AutomationSafe Software

Scaling API-first – The story of a global engineering organizationRadu Cotescu

🐬 The future of MySQL is Postgres 🐘RTylerCroy

08448380779 Call Girls In Diplomatic Enclave Women Seeking MenDelhi Call girls

A Domino Admins Adventures (Engage 2024)Gabriella Davis

Automating Google Workspace (GWS) & more with Apps Scriptwesley chun

Presentation on how to chat with PDF using ChatGPT code interpreternaman860154

08448380779 Call Girls In Greater Kailash - I Women Seeking MenDelhi Call girls

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Miguel Araújo

08448380779 Call Girls In Civil Lines Women Seeking MenDelhi Call girls

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Neo4j

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024The Digital Insurer

EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEarley Information Science

Real Time Object Detection Using Open CVKhem

08448380779 Call Girls In Friends Colony Women Seeking MenDelhi Call girls

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Drew Madelung

[2024]Digital Global Overview Report 2024 Meltwater.pdfhans926745

Dernier (20)

What Are The Drone Anti-jamming Systems Technology?

The 7 Things I Know About Cyber Security After 25 Years | April 2024

2024: Domino Containers - The Next Step. News from the Domino Container commu...

From Event to Action: Accelerate Your Decision Making with Real-Time Automation

Scaling API-first – The story of a global engineering organization

🐬 The future of MySQL is Postgres 🐘

08448380779 Call Girls In Diplomatic Enclave Women Seeking Men

A Domino Admins Adventures (Engage 2024)

Automating Google Workspace (GWS) & more with Apps Script

Presentation on how to chat with PDF using ChatGPT code interpreter

08448380779 Call Girls In Greater Kailash - I Women Seeking Men

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

08448380779 Call Girls In Civil Lines Women Seeking Men

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024

EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx

Real Time Object Detection Using Open CV

08448380779 Call Girls In Friends Colony Women Seeking Men

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

[2024]Digital Global Overview Report 2024 Meltwater.pdf

Securing Network Access with Open Source solutions

1. Securing Network Access with Open Source Solutions Nick Owen 9/19/09 @wikidsystems [email_address]

4. Our Goal: Securely allow access to the network with simplicity and flexibility.

9. Who or what is connecting? Evil Princess Duck Bot Sweet Chicky Chirpalot

10.

11.

12.

13.

14.

15.

16.

17.

18.

19.

20.

21.

22. Configure Radius on Astaro

23. Enable Radius

24. Point it to the OTP or Radius server

25. Associate the Group with a VPN

26. Create A WiKID Domain

27. Create a Radius Network Client

28. Add Shared Secret

29. Done!

30. For the End-User

31. Select Domain & Enter PIN

32. Enter OTP & Connect

33.

34.

35. Apache Radius Example Install mod-auth-radius $ sudo apt-get install libapache-mod-auth-radius In your httpd.conf add: AddRadiusAuth radius_server:1812 shared_secret 5 AddRadiusCookieValid 60 Remember Radius is port 1812 *UDP*

36. Apache Radius Example con't Enter this into your apache2.conf: <location> Options Indexes FollowSymlinks AuthType Basic AuthName "WiKID RADIUS authentication" AuthBasicAuthoritative Off AuthBasicProvider radius AuthRadiusAuthoritative on AuthRadiusActive On Require valid-user </location> Restart Apache!

37.

38.

39.

40.

41.

42. Pretty Lame Diagram VPN, SSH, HTTPS Gateway Desktop, Mail, Web Auth/Radius Server RADIUS, LDAP, etc SSH, RDP, VNC, HTTPS

43.

44.

45.

46. Any questions? [email_address] @wikidsystems