Upload File

lawrence livermore national laboratory a system for strong local account management. slam david frye...

  • Home
  • Documents
  • Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box
15
Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box 808, Livermore, CA 94551 This work performed under the auspices of the U.S. Department of Energy by Lawrence Livermore National Laboratory under Contract DE-AC52-07NA27344.

Upload: opal-stevens

Post on 12-Jan-2016

224 views

Category:

Documents


0 download

Report

Tags:

TRANSCRIPT

Page 1: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

Lawrence Livermore National Laboratory

A system for strong local account management.

SLAM

David Frye

Lawrence Livermore National Laboratory, P. O. Box 808, Livermore, CA 94551

This work performed under the auspices of the U.S. Department of Energy by Lawrence Livermore National Laboratory under Contract DE-AC52-07NA27344.

Page 2: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

The Subject: Local Accounts

All computers have a local account database Allows people or code to authenticate locally Enable access to resources locally At least 1 administrator (full permissions) Maintained independently• No linkage to Active Directory• No centralized management

UCRL: LLNL-PRES-413302

Page 3: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

The Problem: Common Passwords

Admin Password typically set build time Typically the same on all machines (imaging) Password is seldom if ever changed Often neglected when joined to Domain

UCRL: LLNL-PRES-413302

Page 4: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

The Problem: Illustrated

• Typical AD Environment• Machines built from images• Local Administrator enabled• Password is common

UCRL: LLNL-PRES-413302

Page 5: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

The Problem: Illustrated

• Machine hack = site hack• AD is immune• AD can’t help

Hacker

UCRL: LLNL-PRES-413302

Page 6: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

Disable Local Accounts?

Offline without cached credentials Temporary administration• Scientists on travel w/ need to install sw.

Dropped from domain• OS Virtualization

Re-enable via Recovery Console requires physical access.

UCRL: LLNL-PRES-413302

Page 7: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

The Options:

Disable all local accounts • Best option• Not feasible in most environments

Deny “Access This Computer From The Network”• Force physical login• Kills remote management capability

Enabled accounts with common static passwords• Most typical• Most dangerous

Other options• Commercial solutions (expensive)

UCRL: LLNL-PRES-413302

Page 8: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

Strong Local Admin Manager (SLAM)

Dynamic/Unique Passwords

Centralized Recovery

No Centralized Password Storage

No Specialized Authorization

No Dedicated Infrastructure*

UCRL: LLNL-PRES-413302

Page 9: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

Dynamic/Unique Passwords

Unique Computer AD Attribut

e

Master Key

Strong Uniqu

e Value

How it works:

Computer Last Password Change

Date + GUID

SHA-256 HMAC

• Crypto-Random 256 bits• RSA 1024 bit encrypted

Local Administrator Password

UCRL: LLNL-PRES-413302

Page 10: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

Centralized RecoveryHow it works:

• OU Administrator uses AD Users & Computers (ADUC)• Custom Context Menu Option for SLAM Recovery• ADUC connects to Web Service & returns password

UCRL: LLNL-PRES-413302

Page 11: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

No Centralized Password Storage

How it works:• Passwords are NOT random• Passwords are calculated• Only the master hashing key & computer password change dates are stored

No Specialized Authorization

How it works:• SLAM Recovery leverages existing authorization in AD• Permissions Required: Full Control of computer object

UCRL: LLNL-PRES-413302

Page 12: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

SLAM InfrastructureSLAM Client AD OU

Administrator• Small .NET app• Daily process• Requests new Local Admin Pwd• Creates local account if needed

Computer Password Change

Date

Master Key

ADUC

• Checks for recently expired Computer pwd• Checks for recently recovered Admin pwd• Validates Authorization• Calculates and returns password

SSL

Web Service

SSL

• Copy to clipboard• Historical passwords• Print

UCRL: LLNL-PRES-413302

Page 13: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

SLAM Rollout @ LLNL

Developed in April 2008 by David Frye and Joe Taitt Started deployment in June 2008 Became mandated in 2009 for all unclassified Windows

computers (except DCs) ~9,000 Total SLAM Clients ~200 Password Recoveries per Month

UCRL: LLNL-PRES-413302

Page 14: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

SLAM Next Steps

SLAM Client for MAC (Daniel Hoit)• Client is developed & currently in test

Remove/Disable non-SLAM local accounts• Necessary next step to gain full benefit• Need exception policies and procedures• Need to be careful

UCRL: LLNL-PRES-413302

Page 15: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

Questions on SLAM?

UCRL: LLNL-PRES-413302


BlueGene/L - Lawrence Livermore National Laboratory...BlueGene/L: the next generation of scalable supercomputer Lawrence Livermore National Laboratory , P. O. Box 808, Livermore, CA

Lawrence Livermore National Laboratory · Lawrence Livermore National Laboratory Overview • Project provides fundamental research to support DOE/ industry fuel technology projects

Lawrence Livermore National Laboratory Matthew LeGendre [email protected] LLNL-PRES-481072 Lawrence Livermore National Laboratory, P. O. Box 808, Livermore,

Pressure Safety Program Lawrence Livermore National Laboratory

Beam Research Program Lawrence Livermore National Laboratory High Gradient Dielectric Wall Accelerators*,# Yu-Jiuan Chen Lawrence Livermore National Laboratory

Lawrence Livermore National Laboratory€¦ · Lawrence Livermore National Laboratory Scientific method still must ultimately guide our ... Lawrence Livermore National Laboratory

Lawrence Livermore National Laboratory

Review - Lawrence Livermore National Laboratory · April 1995 University of California Lawrence Livermore National Laboratory Creating Microsphere Targets for Inertial Confinement

Lawrence Livermore National Laboratory Livermore

Lawrence Livermore National Laboratory Lee Neely CISSP, MSP ISSO LLNL-PRES-412835 Lawrence Livermore National Laboratory, P. O. Box 808, Livermore, CA

Steven M. Lund Lawrence Livermore National Laboratory (LLNL)dleitner/USPAS_2016_Fundamental_Of... · Lawrence Livermore National Laboratory (LLNL) ... Nicholson, Intro to Plasma Theory,

CASE STUDY Lawrence Livermore National Laboratory

LAWRENCE LIVERMORE NATIONAL LABORATORY Engineering

Lawrence Livermore National Laboratory Nicholas Scielzo Physics Division, Physical and Life Sciences LLNL-PRES-408002 Lawrence Livermore National Laboratory,

Lawrence Livermore National Laboratory Scattering of light nuclei LLNL-PRES-XXXXXX Lawrence Livermore National Laboratory, P. O. Box 808, Livermore, CA

Lawrence Livermore National Laboratory Livermore Site ... · Lawrence Livermore National Laboratory Livermore Site Annual Storm Water Monitoring Report for WDR 95-174 ... Summary

Lawrence Livermore National Laboratory August 2, 2004

Lawrence Livermore National Laboratory SciDAC Reaction Theory LLNL-PRES-488272 Lawrence Livermore National Laboratory, P. O. Box 808, Livermore, CA 94551

Facilities and Technologies - Lawrence Livermore National Laboratory · 2019. 4. 11. · LAWRENCE LIVERMORE NATIONAL LABORATORY. As a premier national laboratory, LLNL’s nondestructive

Seismic 101 - Lawrence Livermore National Laboratory

Lawrence Livermore National Laboratory - Parallel Programming

Lawrence Livermore National Laboratory Livermore, CA · Liquid Hydrogen Infrastructure Analysis Guillaume Petitpas, A.J. Simon Lawrence Livermore National Laboratory. Livermore, CA

amipnl6 - Lawrence Livermore National Laboratory

Lawrence Livermore National Laboratory Norm Tubman Jonathan DuBois, Randolph Hood, Berni Alder Lawrence Livermore National Laboratory, P. O. Box 808, Livermore,

Lawrence Livermore National Laboratory Computation Directorate

July 8, 1999 - Lawrence Livermore National Laboratory

Neil Hodge, Lawrence Livermore National Laboratory

Lawrence Livermore National Laboratory UCRL-XXXX-12345 Lawrence Livermore National Laboratory, P. O. Box 808, Livermore, CA 94551 This work performed under

Lawrence Livermore National Laboratory and Oversight... · Lawrence Livermore National Laboratory ... ISM Volume II Technical Appendices ... FRAM Functions, Responsibilities, and

Joshua White, Lawrence Livermore National Laboratory

LAWRENCE LIVERMORE NATIONAL LABORATORY · LAWRENCE LIVERMORE NATIONAL LABORATORY • University of California • Livermore, California • 94550 ^F * Contents List of Volumes of

INERTIAL CONFINEMENT Lawrence Livermore National Laboratory

March 2007 - Lawrence Livermore National Laboratory · March 2007 National Nuclear Security Administration’s Lawrence Livermore National Laboratory ... center’s director, Ralph

Lawrence Livermore National Laboratory Gary Kumfert UCRL-PRES-235389 Lawrence Livermore National Laboratory, P. O. Box 808, Livermore, CA 94551 This work

Lawrence Livermore National Laboratory Pianola: A script-based I/O benchmark Lawrence Livermore National Laboratory, P. O. Box 808, Livermore, CA 94551