Upload File

lawrence livermore national laboratory a system for strong local account management. slam david frye...

  • Home
  • Documents
  • Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box
15
Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box 808, Livermore, CA 94551 This work performed under the auspices of the U.S. Department of Energy by Lawrence Livermore National Laboratory under Contract DE-AC52-07NA27344.

Upload: opal-stevens

Post on 12-Jan-2016

224 views

Category:

Documents


0 download

Report

Tags:

TRANSCRIPT

Page 1: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

Lawrence Livermore National Laboratory

A system for strong local account management.

SLAM

David Frye

Lawrence Livermore National Laboratory, P. O. Box 808, Livermore, CA 94551

This work performed under the auspices of the U.S. Department of Energy by Lawrence Livermore National Laboratory under Contract DE-AC52-07NA27344.

Page 2: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

The Subject: Local Accounts

All computers have a local account database Allows people or code to authenticate locally Enable access to resources locally At least 1 administrator (full permissions) Maintained independently• No linkage to Active Directory• No centralized management

UCRL: LLNL-PRES-413302

Page 3: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

The Problem: Common Passwords

Admin Password typically set build time Typically the same on all machines (imaging) Password is seldom if ever changed Often neglected when joined to Domain

UCRL: LLNL-PRES-413302

Page 4: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

The Problem: Illustrated

• Typical AD Environment• Machines built from images• Local Administrator enabled• Password is common

UCRL: LLNL-PRES-413302

Page 5: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

The Problem: Illustrated

• Machine hack = site hack• AD is immune• AD can’t help

Hacker

UCRL: LLNL-PRES-413302

Page 6: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

Disable Local Accounts?

Offline without cached credentials Temporary administration• Scientists on travel w/ need to install sw.

Dropped from domain• OS Virtualization

Re-enable via Recovery Console requires physical access.

UCRL: LLNL-PRES-413302

Page 7: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

The Options:

Disable all local accounts • Best option• Not feasible in most environments

Deny “Access This Computer From The Network”• Force physical login• Kills remote management capability

Enabled accounts with common static passwords• Most typical• Most dangerous

Other options• Commercial solutions (expensive)

UCRL: LLNL-PRES-413302

Page 8: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

Strong Local Admin Manager (SLAM)

Dynamic/Unique Passwords

Centralized Recovery

No Centralized Password Storage

No Specialized Authorization

No Dedicated Infrastructure*

UCRL: LLNL-PRES-413302

Page 9: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

Dynamic/Unique Passwords

Unique Computer AD Attribut

e

Master Key

Strong Uniqu

e Value

How it works:

Computer Last Password Change

Date + GUID

SHA-256 HMAC

• Crypto-Random 256 bits• RSA 1024 bit encrypted

Local Administrator Password

UCRL: LLNL-PRES-413302

Page 10: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

Centralized RecoveryHow it works:

• OU Administrator uses AD Users & Computers (ADUC)• Custom Context Menu Option for SLAM Recovery• ADUC connects to Web Service & returns password

UCRL: LLNL-PRES-413302

Page 11: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

No Centralized Password Storage

How it works:• Passwords are NOT random• Passwords are calculated• Only the master hashing key & computer password change dates are stored

No Specialized Authorization

How it works:• SLAM Recovery leverages existing authorization in AD• Permissions Required: Full Control of computer object

UCRL: LLNL-PRES-413302

Page 12: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

SLAM InfrastructureSLAM Client AD OU

Administrator• Small .NET app• Daily process• Requests new Local Admin Pwd• Creates local account if needed

Computer Password Change

Date

Master Key

ADUC

• Checks for recently expired Computer pwd• Checks for recently recovered Admin pwd• Validates Authorization• Calculates and returns password

SSL

Web Service

SSL

• Copy to clipboard• Historical passwords• Print

UCRL: LLNL-PRES-413302

Page 13: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

SLAM Rollout @ LLNL

Developed in April 2008 by David Frye and Joe Taitt Started deployment in June 2008 Became mandated in 2009 for all unclassified Windows

computers (except DCs) ~9,000 Total SLAM Clients ~200 Password Recoveries per Month

UCRL: LLNL-PRES-413302

Page 14: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

SLAM Next Steps

SLAM Client for MAC (Daniel Hoit)• Client is developed & currently in test

Remove/Disable non-SLAM local accounts• Necessary next step to gain full benefit• Need exception policies and procedures• Need to be careful

UCRL: LLNL-PRES-413302

Page 15: Lawrence Livermore National Laboratory A system for strong local account management. SLAM David Frye Lawrence Livermore National Laboratory, P. O. Box

Questions on SLAM?

UCRL: LLNL-PRES-413302


Lawrence Livermore National Laboratory Lawrence Livermore National Laboratory, P. O. Box 808, Livermore, CA 94551 This work performed under the auspices

INERTIAL CONFINEMENT Lawrence Livermore National Laboratory

Joshua White, Lawrence Livermore National Laboratory§ Joshua A. White Lawrence Livermore National Laboratory [email protected] . Created Date: 20160926185358Z

Beam Research Program Lawrence Livermore National Laboratory High Gradient Dielectric Wall Accelerators*,# Yu-Jiuan Chen Lawrence Livermore National Laboratory

LAWRENCE LIVERMORE NATIONAL LABORATORY · LAWRENCE LIVERMORE NATIONAL LABORATORY • University of California • Livermore, California • 94550 ^F * Contents List of Volumes of

Lawrence Livermore National Laboratory Pianola: A script-based I/O benchmark Lawrence Livermore National Laboratory, P. O. Box 808, Livermore, CA 94551

Lawrence Livermore National Laboratory Livermore, CA · Liquid Hydrogen Infrastructure Analysis Guillaume Petitpas, A.J. Simon Lawrence Livermore National Laboratory. Livermore, CA

Lawrence Livermore National Laboratory SciDAC Reaction Theory LLNL-PRES-488272 Lawrence Livermore National Laboratory, P. O. Box 808, Livermore, CA 94551

July 8, 1999 - Lawrence Livermore National Laboratory

Lawrence Livermore National Laboratory Livermore

Lawrence Livermore National Laboratory Nicholas Scielzo Lawrence Fellow Physics Division, Physical Sciences LLNL-PRES-408002 Lawrence Livermore National

LAWRENCE LIVERMORE NATIONAL LABORATORY SITE 300

Lawrence Livermore National Laboratory€¦ · Lawrence Livermore National Laboratory Scientific method still must ultimately guide our ... Lawrence Livermore National Laboratory

National Ignition Facility Lawrence Livermore National Laboratory Livermore, CA

Ye Zhou Lawrence Livermore National Laboratory, Livermore, California

Lawrence Livermore National Laboratory UCRL-XXXX-12345 Lawrence Livermore National Laboratory, P. O. Box 808, Livermore, CA 94551 This work performed under

Seismic 101 - Lawrence Livermore National Laboratory

Pressure Safety Program Lawrence Livermore National Laboratory

Lawrence Livermore National Laboratory Lee Neely CISSP, MSP ISSO LLNL-PRES-412835 Lawrence Livermore National Laboratory, P. O. Box 808, Livermore, CA

amipnl6 - Lawrence Livermore National Laboratory

Lawrence Livermore National Laboratory Scattering of light nuclei LLNL-PRES-XXXXXX Lawrence Livermore National Laboratory, P. O. Box 808, Livermore, CA

Lawrence Livermore National Laboratory (LLNL) Laboratory ... · Lawrence Livermore National Laboratory Laboratory Directed Research and Development Policies and Procedures Manual

Lawrence Livermore National Laboratory Gary Kumfert UCRL-PRES-235389 Lawrence Livermore National Laboratory, P. O. Box 808, Livermore, CA 94551 This work

Review - Lawrence Livermore National Laboratory · April 1995 University of California Lawrence Livermore National Laboratory Creating Microsphere Targets for Inertial Confinement

Lawrence Livermore National Laboratory Nicholas Scielzo Physics Division, Physical and Life Sciences LLNL-PRES-408002 Lawrence Livermore National Laboratory,

Lawrence Livermore National Laboratory

Lawrence Livermore National Laboratory · Lawrence Livermore National Laboratory Overview • Project provides fundamental research to support DOE/ industry fuel technology projects

LAWRENCE LIVERMORE NATIONAL LABORATORY Engineering

Lawrence Livermore National Laboratory - Gordon Bellgordonbell.azurewebsites.net/tcmwebpage/CHMfiles... · University of California Lawrence Livermore National Laboratory have made

Lawrence Livermore National Laboratory Denise Sumikawa CIAC Program Leader LLNL-PRES-403246 Lawrence Livermore National Laboratory, P. O. Box 808, Livermore,

March 2007 - Lawrence Livermore National Laboratory · March 2007 National Nuclear Security Administration’s Lawrence Livermore National Laboratory ... center’s director, Ralph

Lawrence Livermore National Laboratory Livermore Site ... · Lawrence Livermore National Laboratory Livermore Site Annual Storm Water Monitoring Report for WDR 95-174 ... Summary

Facilities and Technologies - Lawrence Livermore National Laboratory · 2019. 4. 11. · LAWRENCE LIVERMORE NATIONAL LABORATORY. As a premier national laboratory, LLNL’s nondestructive

Steven M. Lund Lawrence Livermore National Laboratory (LLNL)dleitner/USPAS_2016_Fundamental_Of... · Lawrence Livermore National Laboratory (LLNL) ... Nicholson, Intro to Plasma Theory,

Joshua White, Lawrence Livermore National Laboratory