%
%- So what goals are there nowadays regarding all of this?
%   - store everything in one place: easy to look up, single namespace for uids/gids
%   - proper accounting
%   - setting policies&permisssions in one place
%   - SSO (explain what it is)
%
%- introduction: nowadays typical env in corporations:
%  workplaces and servers around, running multiple operating systems,
%  -> many sources of informations, data-sheets with passwords
%  -> passwords to remember for all servers+applications
%  -> many different levels of security in place
%
%- each item: how secure is data transmitted? where is info stored? how easy to
%  maintain? works for what of win/unix/linux? solves which problems? open standard?
%- implementations: how far does openssh/keyagent help?
%
% TODO: freeipa2.0 features, insert real hiragana
%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentclass{beamer}

\usetheme{Darmstadt}
\usefonttheme[onlylarge]{structurebold}
\setbeamerfont*{frametitle}{size=\normalsize,series=\bfseries}
\setbeamertemplate{navigation symbols}{}
\usecolortheme{crane}
% crane wolverine albatross orchid rose beaver dolphin dove

% \usepackage{beamerthemesplit}
\usepackage[english]{babel}
\usepackage{graphics}
%\usepackage[rflt]{floatflt}
%\usepackage{picinpar}
\usepackage{wrapfig}
\usepackage{hyperref}

\usepackage[latin1]{inputenc}
\usepackage{times}
\usepackage[T1]{fontenc}


\usepackage{tikz}
\usetikzlibrary{arrows}
\tikzstyle{block}=[draw opacity=0.7,line width=1.4cm]


%- title: Logon in mixed environments
%- title: Elegant logons in environments with mixed operating systems
%- title: an admins guide to authentication and authorization
%    or: history of logging in
\title{A sysadmins guide to authentication and authorization}
\author{Christian Horn \\ \texttt{chorn@fluxcoil.net}}
\date{\today}

\begin{document}

\frame{\titlepage \begin{flushright}\tiny{v1.45}\end{flushright} }
%\frame{
%	\frametitle{Outline}
%	\tableofcontents[hideallsubsections]
%}

\begin{frame}
  \frametitle{introduction}

  \centering{
    Tom Servo, MST3K: \\
  }
  \vspace{20px}
  \centering{
  ``Okay, what are we looking at and why are we looking at it?''
  }
\end{frame}

\section{glossary}
\subsection{Let's agree on some terms in our environment..}
\begin{frame}
  \frametitle{Authentication}
	What is Authentication?
  \begin{itemize}
  \item Making sure someone is who he claims to be.
  \item Authenticators are something the user 
	\begin{itemize}
	\item has (drivers license, passport, software token)
	\item knows (pin, password, passphrase) 
	\item is or does (fingerprint, DNA sequence, voice recognition)
	\end{itemize}
  \end{itemize}
  	What is strong authentication? 
  \begin{itemize}
	\item >=2 authenticators are used
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{Authorization/Policy}
	What is Authorization?
	\begin{itemize}
	\item<1-> Handling the users permissions \\
	\end{itemize} 
	What are policies?
	\begin{itemize}
	\item<1-> Rules set up at companies, handling password-length etc. \\
	\end{itemize}
	What is a directory?
	\begin{itemize}
	\item<1-> A storage for information, database. I.e. phonebook
	\end{itemize}
\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{stoneage}
\subsection{Computer stoneage}
\begin{frame}
	\frametitle{in the beginning...}
	\centering{
	How was all this solved earlier, in the computer stoneage, \\
	with computers like this Zuse Z3?

	\includegraphics[height=3cm]{pics/zuse3_deutsches_museum__1024x768.eps}

 	No different users, only security-barrier is \\
	physical access - same as with calculators nowadays.\\
	}
\end{frame}
\subsection{file replication}
\begin{frame}
	\frametitle{file replication overview}
	Along came networking: \\
	\begin{itemize}
	\item multiple users, multiple computers
	\item data to be moved around while preserving ownerships
	\item gid/uid namespaces appear and span those computers
	\end{itemize}
	\pause
	Easiest solution:
        \begin{itemize}
          \item copy user/group/password information to all computers
        \end{itemize}
\end{frame}
\begin{frame}
	\frametitle{file replication pros/cons}
	\center{
		\includegraphics[height=2.7cm]{pics/history_passwordreplication.eps}
	}
	\begin{flushleft}
	pros: \begin{itemize}\item simple\end{itemize}
	cons:
	\itemize{
	\item	security; all passwords around on all boxes
	\item	you gotta trust root on all those boxes
	\item	doesnt scale well with hundreds of boxes
	\item	doesnt work for OSs hiding those informations
	}
	\end{flushleft}
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{DNS}
\subsection{Domain Name Service}
\begin{frame}
	\frametitle{Overview}
        \begin{itemize}
          \item First widely used directory appeared in 1983: DNS
          \item Initially just for lookups of ips/hosts - can now transport much more
            information, even functions for auth and dynamic modification of datasets
          \item extensions for better security exist (i.e. DNSSEC) but are not widely deployed yet
        \end{itemize}
\end{frame}
\begin{frame}
        \frametitle{pros/cons}
	pros:
	\begin{itemize}
	\item	essential standard, many network services rely on this
	\item	IETF defined, good scalability
	\item	will become even more important with rise of ipv6
	\end{itemize}
	cons:
	\begin{itemize}
	\item	widely used - essential to address flaws really fast
	\end{itemize}
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%\subsection{NIS (+) / radius / NDS}
\section{NIS}
\subsection{Network Information Service}
\begin{frame}
	\frametitle{Overview}
	Next step: SUN develops 'Yellow Pages' in 1985
	\begin{itemize}
	\item because BT owns that name it gets renamed to NIS
	\item first big standard supported by wide variety of 
	OSs like SunOS, AIX and HP-UX in their defaultinstalls
	\item basically a directory: a NIS-master stores map-files; informations 
	like users, groups, userpasswords, hostnames, nfs mounts
        \item on clients: implementations were first in libc, later moved to
          configurable nsslibs and pam (HP-UX's is still strange)
	\end{itemize}
\end{frame}
\begin{frame}
	\frametitle{basics of operation}
	\center{
		\includegraphics[height=2.7cm]{pics/history_nis.eps}
	}
	\begin{flushleft}
	\begin{enumerate}
	\item map-files are modified on NIS-master
	\item after modificaton the whole files are pushed to NIS-slaves
	\item NIS-clients query the informations from Slaves; resolve hostnames
	to ips, authenticate users etc.
	\end{enumerate}
	\end{flushleft}
\end{frame}
\begin{frame}
	\frametitle{pros/cons}
	pros: 
        \begin{itemize}
          \item well understood, widely supported
          \item still more secure than unencrypted ldap ;)
        \end{itemize}
	cons: 
	\begin{flushleft}
	\itemize{
	\item	hashed passwords can be read \& inspected on all slaves
	\item	submission unencrypted (easily spoofable, not secret)
        \item   requires rpc (remote procedure calls)
	\item	doesnt scale well, maps not hashed for lookups, complete maps submitted every time
	}
	\end{flushleft}
\end{frame}
\begin{frame}
	\frametitle{Network Information Service +}
	Some of NIS issues got adressed with NIS+ by SUN
	\begin{itemize}
	\item	Secure RPC now used (clients and servers must authenticate)
	\item	read-only replicas possible
	\item	possible to transmit only diffs instead of full maps
	\item	NIS+ table permissions so users can not access all informations
	\end{itemize}
	pros: \begin{itemize}
	\item	NIS+ made multi-master configurations easier
	\item	brought in security improvements
	\end{itemize}
	cons:
	\begin{itemize}
	\item	no widely adoption outside the sun-world, no IETF standard
	\item	bad reputation for manageability
	\end{itemize}
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Radius}
\subsection{Radius}
\begin{frame}
  	\frametitle{Overview}
	\begin{itemize}
	\item	Radius (Remote Authentication Dial In User Service) gets defined in 1991, since
	1997 its in the RFCs
	\item	Basically a proxy, serving all three of AAA
	\end{itemize}
	\center{
		\includegraphics[height=2.7cm]{pics/history_radius.eps}
	}\\
	\begin{itemize}
	\item	PAP, CHAP or EAP mostly used for communitation with user
	\item	ldap/kerberos/sql/AD in backend
	\end{itemize}
\end{frame}
\begin{frame}
  	\frametitle{pros/cons}
	pros:
	\begin{itemize}
	\item	wide acceptance in the areas ISPs/routers/wlan access points/Voip
	\item	can be used to authenticate users directly for logins
	\end{itemize}
	cons:
	\begin{itemize}
	\item 	uids, gids etc. have to be taken out of directories like NIS/ldap
	\item	passwords do not go over the net in the clear, but radius uses
		md5 for obfuscation which isnt regarded secure any more
	\item	successor in sight: the Diameter protocol
	\end{itemize}
\end{frame}
%TACACS+ - extension to TACACS, primarily controlling access to Cisco hardware. no user information, proprietary.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{NDS}
\subsection{Novell Directory Services / eDirectory}
\begin{frame}
	\frametitle{Overview}
	\begin{itemize}
	\item	in 1993 Novell releases Netware Directory Services (NDS)
	\item	later renamed to eDirectory
	\item	NDS offers directory and authentication services; supports access by
	many OSs like linux, solaris, aix, hp-ux, netware and windows
	\item	based on X.500, the heavy weight set of standards covering directory services
	\item	access via ldap, odbc, soap etc. possible
	\end{itemize}
\end{frame}
\begin{frame}
	\frametitle{pros/cons}
	pros:	
	\begin{itemize}
	\item	first mature, scalable directory
	\item	supports most OSs via netware-protocol or ldap
	\item	hierarchical data storage (think of ldap which is a descendant of X.500)
	\item	fine grained access controls
	\item	servers can carry subsets of data, replication to slaves possible
	\end{itemize}
	cons:
	\begin{itemize}
	\item	only implemented by Novell
	\item	code not open; vendor lock-in
	\end{itemize}
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{ldap}
\subsection{lightweight directory access protocol}
\begin{frame}
	\frametitle{Overview}
	LDAP - developed in 1993	\\

	\begin{wrapfigure}{r}{0cm}
		\includegraphics[height=2.7cm]{pics/ldap_datastructure.eps}
	\end{wrapfigure}

	- to access a directory with data about people and other objects, 
		extended with authentication/encryption/groups etc.

	\begin{itemize}
	\item	Open standard protocol on how to access directory services, published in RFCs by the IETF 
	\item	data hierarchically structured, support for replication to slaves
	\end{itemize}
\end{frame}
\begin{frame}
        \frametitle{ldap replication/slaves setup}
          \begin{center}
             \vspace{-14pt}
		\includegraphics[width=7cm]{pics/ldap_replication.eps}
          \end{center}
\end{frame}
\begin{frame}
	\frametitle{pros/cons}
	pros:
	\begin{itemize}
	\item	widely supported, many server implementations: OpenLDAP, Fedora Directory
		Server, SunONE (form. iPlanet), NDS, AD
	\item	authentication of OSusers supported natively on linux, solaris, aix and hp-ux,
		using additional opensource software (pgina) also on windows
	\item	authentication of the server possible with x509-certificates or 
		with kerberos
	\item	communication can be secured with ssl/tls, enterprise ready (multimaster)
	\end{itemize}
	cons:
	\begin{itemize}
	\item	without ssl/tls passwords go in the clear on the network
	\end{itemize}
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{kerberos}
\subsection{kerberos}
\begin{frame}
	\frametitle{the history}
	... pure authentication protocol \\
        ... developed at the Project Athena (IBM, MIT, DEC)\\
	... version 4 from late 1980s still in some use\\
        ... version 5 from 1993 is current

	\center{
		\includegraphics[height=3.5cm]{pics/kerberos_realm.eps}
	}\\
\end{frame}
\begin{frame}
  \frametitle{Setup of the principals in a realm}
    \begin{center}
      \includegraphics[width=9cm]{pics/kerberos_exchanging_principals.eps}
    \end{center}
    \begin{enumerate}
      \item admin sets up his admin-principal using a password
      \item user sets up a user-principal using a password
      \item service-principal gets created w/ random input
    \end{enumerate}
\end{frame}
\begin{frame}
  \frametitle{SSO, details, simplified}
          \begin{center}
		\includegraphics[width=9cm]{pics/kerberos_simple_basics.eps}
          \end{center}
        (1) getting the TGT, i.e. kinit\\
        (2,4,6) getting servicetickets\\
        (3,5,7) usage of service\\
\end{frame}
\begin{frame}
  \frametitle{realm trusts: bigger realm environments}
  \center{
    \includegraphics[height=6cm]{pics/kerberos_realmtrust.eps}
  }\\
\end{frame}
\begin{frame}
  \frametitle{pros/cons}
	% symetric keys, extensions exist for asymetric keys
        click here: \href{http://fluxcoil.net/files/sso_crossrealm_kerberos.htm}{http://SSO Crossrealm Kerberos Demo} \\
	pros:
	\begin{itemize}
	\item	known for good security (mutual auth.), mature, scalable
	\item	biggest protocol providing SSO
	\item	wide support in industry from sun, google, apple, redhat, (microsoft) etc.
	\item	many implementations: MIT, heimdal, commercial
	\item	follows unix principle: does only auth -- but that well
        \item   apps: nfsv4, ssh, ftp, vpn, afs, jabber, apache, browsers..
	\end{itemize}
	cons:
	\begin{itemize}
	\item	infrastructure requirements: timesynced hosts, dns
	\item	if KDC gets compromised all keys have to be replaced
	\item	compromised userkey allows everything the user is allowed to
	\end{itemize}
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{AD}
\subsection{Active Directory}
\begin{frame}
  \frametitle{AD overview}
  \begin{exampleblock}{Chuck Yerkes @sage-member list}
    There's a new tool that MS has recently retroactively invented:
    Kerberos. It came out last year, and I've used it since 1993 or so.
  \end{exampleblock}
  \begin{itemize}
    \item appeared in 1999 for win2k
    \item extended with releases of win2k3 and win2k8
    \item provides authentication, authorization, policies, delivery of critical updates
    \item employs ldap + kerberos + dns
    \item naming update: realm -> AD domain
    \item naming update: realms with trusts -> tree/forest
  \end{itemize}
\end{frame}
\begin{frame}
  \frametitle{pros/cons}
  pros:
  \begin{itemize}
    \item easy \& fast to deploy in pure windows environments
    \item tight integration with microsoft software like exchange
  \end{itemize}
  cons:
  \begin{itemize}
    \item focused on windows domainmembers
    \item modified kerberos is used, making interaction with protocol-compliant environments difficult
    \item AD software requires Windows, costs money
    \item sources not freely available -> no security auditing, no unrestricted
       improving/extending possible, vendor can enforce soft-releasechange in refusing delivery of updates
    \item debugging of problems awkward for unixers
  \end{itemize}
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{CrossRealm}
\subsection{CrossRealm setup}
\begin{frame}
  \frametitle{CrossRealm setup Kerberos <-> AD-domain}
  problems with solutions seen so far:
  \begin{itemize}
    \item nothing can provide SSO for everyone (unix, linux, mac, windows clients)
    \item solutions involve too much pain for the admin
    \item full support is needed (important in some places)
  \end{itemize}
  crossrealm setup contains:
  \begin{itemize}
    \item a Kerberos realm (I used MIT) with KDC and services
    \item an AD-domain with Server and clients
    \item exchanged principals + crossrealm trust
  \end{itemize}
\end{frame}
\begin{frame}
  \frametitle{CrossRealm overview graphical}
          \begin{center}
             \vspace{-14pt}
		\includegraphics[width=7cm]{pics/crossrealm_overview.eps}
          \end{center}
        (1) getting TGT ..  (2) referral ticket\\
        (3) getting serv.ticket .. (4) using serv. ticket
\end{frame}
\begin{frame}
  \frametitle{CrossRealm pros/cons}
  pros:
  \begin{itemize}
    \item solution fits many needs: security, SSO
    \item works for all kinds of clients
    \item can be fully supported by vendors (think MIT)
  \end{itemize}
  cons:
  \begin{itemize}
    \item see ldap/kerberos cons: infrastructure needs working DNS, ntp
    \item additionally solution to provide auth-data for the unix-servers needed (i.e. ldap)
    \item complex setup, gotta train your admins on that
  \end{itemize}
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{others}
\subsection{other solutionparts}
\begin{frame}
  \frametitle{Samba 4/7/franky)}
  \begin{itemize}
    \item samba-teams approach to provide free AD-implementation
    \item that code is now included in usual samba 3.x tarball
    \item uses customized kerberos, ldap, ntp code
    \item already there with samba 3.5.x, i.e. in RHEL6:
      \begin{itemize}
        \item windows/samba-boxes can join the samba-hosted domain
        \item windows can be used as additional domaincontrollers in a samba-hosted domain
        \item password-changes of domainmembers, smb encryption
      \end{itemize}
    \item todos: readonly DCs, multi domain forests, ..
    \item samba4 making progress, full AD replication
    \item samba 4.0.0 release planned for 2011
  \end{itemize}
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}
  \frametitle{Commercial solutions: vintella authentication services}
  Basically interfacing AD-domains to other protocols
          \begin{center}
             \vspace{-10pt}
		\includegraphics[width=8cm]{pics/vintella_overview.eps}
          \end{center}
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}
  \frametitle{Likewise Enterprise}
  \begin{itemize}
    \item specialized to connect linux/unix-boxen onto AD-domains
    \item credential cache allows userlogins also while KDC unreachable, i.e. laptops
    \item policy handling also on linux-boxen possible: i.e. enforce after what time
      an idle desktop activates the screensaver
    \item commercial product, free trialversions available
  \end{itemize}
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}
  \frametitle{pGina}
          \begin{center}
             \vspace{-14pt}
		\includegraphics[width=5cm]{pics/pgina_overview.eps}
          \end{center}
          \begin{itemize}
            \item OpenSource login-module for windows (kind of PAM)
            \item enables authentication via NIS, POP3, IMAP, LDAP, MySQL, OpenAFS, PAM, 
            PostgreSQL, RADIUS etc.
%    * RSA SecurID    * Slashdot    * Symbol Modifier    * URI/Bluesocket    * SSH
            \item unclear if Kerberos-ticket can be grabbed after userlogin
          \end{itemize}
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{RH}
\subsection{Red Hat}
\begin{frame}
  \frametitle{389DS / RedHat Directory Server}
  \begin{itemize}
    \item UMICH slapd -> Netscape Directory Server NDS \\ -> forked to (SunONE, FDS) -> 389DS
    \item features: enterprise focus, multi-master replication, scalable, codebase 
      around for long time, ssl, passwd policy, virtual views, plugin interface, 
      resource limits, mostly online operations (reconfigs etc.)
    \item syncing of user/group/password with AD or NT-domain controller
    \item GUI to manage users/groups etc.
    \item backend berkley db (others via plugin), non openssl ssl-implementation 
      used: Mozilla NSS
  \end{itemize}
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}
  \frametitle{FreeIPA}
  \begin{itemize}
    \item free Identity Policy Audit, freeipa.org
    \item approach from RedHat to create open security information management solution
    \item opensource
    \item backend-storage for everything is fedora directory server
    \item status: 1.2.x is stable, 2.x available as alpha
    \item features in stable: kerberos, ldap (users, groups, hosts, hostgroups), 
      ntp, webfrontend/commandline for administration
  \end{itemize}
\end{frame}
\begin{frame}
  \frametitle{FreeIPA cont'd}
  \begin{itemize}
    \item IPA 2.0 will be shipped with RHEL 6.1
    \item features of version2: DNS, CA (request/approve/revoke certs), NIS,
      policy engine (via PolicyKit), audit log collection
    \item upcoming: SSSD, System Security Services Daemon, pam+nss on steroids.
      providing opensource credential cache (KDC can be unreachable), support of
      multiple different identity sources and policies (enforce GNOME-settings etc.)
    \item can be used in crossrealm setups
    \item freeIPA for everyone, as part of RHEL later supported by RedHat
  \end{itemize}
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{end}
\subsection{closing words}
\begin{frame}
  \begin{center}
  \begin{Huge}
    Questions? \\
  \end{Huge}
    \vspace{15px}
    \includegraphics[width=4cm]{pics/arigato_kausaimachta2.eps} \\
    \vspace{20px}
  \url{http://fluxcoil.net} - my site\\
  \vspace{10px}
  chorn@fluxcoil.net % / xmpp://chhorn@jabber.ccc.de\\
  \end{center}
  \vspace{30px}
  [1] Thank you.
\end{frame}

\end{document}
