1 00:00:00,090 --> 00:00:01,080 In this video, 2 00:00:01,080 --> 00:00:03,180 we're going to discuss how you can leverage identity 3 00:00:03,180 --> 00:00:04,890 and access management programs 4 00:00:04,890 --> 00:00:07,320 to automate and streamline access management, 5 00:00:07,320 --> 00:00:09,090 because organizations can really boost 6 00:00:09,090 --> 00:00:12,270 a lot of their operational efficiencies by doing this. 7 00:00:12,270 --> 00:00:14,310 Now, the need for security to protect the data 8 00:00:14,310 --> 00:00:16,170 on the systems and networks that you have 9 00:00:16,170 --> 00:00:18,330 has skyrocketed in recent years. 10 00:00:18,330 --> 00:00:19,500 Cyber security professionals 11 00:00:19,500 --> 00:00:23,070 perform a wide variety of roles, analysis, forensics, 12 00:00:23,070 --> 00:00:25,800 and administration as part of their daily jobs. 13 00:00:25,800 --> 00:00:28,080 And one major dimension of cybersecurity 14 00:00:28,080 --> 00:00:32,189 is known as IAM or Identity and Access Management. 15 00:00:32,189 --> 00:00:34,710 Now, many security teams today are understaffed 16 00:00:34,710 --> 00:00:35,940 and overextended, 17 00:00:35,940 --> 00:00:36,900 and so often, 18 00:00:36,900 --> 00:00:38,640 they're going to ask for system administrators 19 00:00:38,640 --> 00:00:40,530 to help them with IAM, 20 00:00:40,530 --> 00:00:42,060 and that way you can help them manage 21 00:00:42,060 --> 00:00:44,370 and protect the increasing number of devices, 22 00:00:44,370 --> 00:00:46,080 data, users, and systems 23 00:00:46,080 --> 00:00:48,930 by implementing the proper IAM controls. 24 00:00:48,930 --> 00:00:51,480 Now, IAM or Identity and Access Management 25 00:00:51,480 --> 00:00:54,000 is a security process that provides identity, 26 00:00:54,000 --> 00:00:56,580 authentication, and authorization mechanisms 27 00:00:56,580 --> 00:00:59,220 for users, computers, and other entities 28 00:00:59,220 --> 00:01:01,200 to work with organizational assets, 29 00:01:01,200 --> 00:01:05,280 things like networks, operating systems, and applications. 30 00:01:05,280 --> 00:01:07,680 IAM enables you to define the attributes 31 00:01:07,680 --> 00:01:10,050 that are going to comprise the entity's identity. 32 00:01:10,050 --> 00:01:12,870 This includes things like its purpose, its function, 33 00:01:12,870 --> 00:01:15,120 its security clearance, and more. 34 00:01:15,120 --> 00:01:16,770 Now, in most business environments, 35 00:01:16,770 --> 00:01:19,200 IAM is considered a crucial service 36 00:01:19,200 --> 00:01:21,330 for provisioning and managing access, 37 00:01:21,330 --> 00:01:23,370 as well as bolstering the overall security 38 00:01:23,370 --> 00:01:25,440 of your IT infrastructure. 39 00:01:25,440 --> 00:01:28,050 Now, SSH is the first thing we're going to talk about, 40 00:01:28,050 --> 00:01:30,840 and the SSH protocol is used to support 41 00:01:30,840 --> 00:01:33,210 lots of different methods of authentication 42 00:01:33,210 --> 00:01:35,850 when people try to connect to an SSH server. 43 00:01:35,850 --> 00:01:38,940 Now, one of the most important of these is known as PKI 44 00:01:38,940 --> 00:01:41,040 or Public Key Infrastructure. 45 00:01:41,040 --> 00:01:42,840 Now, public key authentication 46 00:01:42,840 --> 00:01:45,180 is used for interactive and automated connections 47 00:01:45,180 --> 00:01:48,720 between different servers or between users and servers. 48 00:01:48,720 --> 00:01:51,120 The motivation for using public key authentication 49 00:01:51,120 --> 00:01:54,990 over using a simple password really comes down to security. 50 00:01:54,990 --> 00:01:56,550 Now, public key authentication 51 00:01:56,550 --> 00:01:58,110 provides cryptographic strength 52 00:01:58,110 --> 00:02:00,060 that is really, really powerful 53 00:02:00,060 --> 00:02:02,700 in comparison to a regular password. 54 00:02:02,700 --> 00:02:03,840 Now, with SSH, 55 00:02:03,840 --> 00:02:06,000 public key authentication is going to be used 56 00:02:06,000 --> 00:02:08,250 to improve the security considerably, 57 00:02:08,250 --> 00:02:09,570 because it frees up the users 58 00:02:09,570 --> 00:02:12,120 from having to remember these long complicated passwords 59 00:02:12,120 --> 00:02:14,970 and it does it in a more secure manner. 60 00:02:14,970 --> 00:02:16,500 Now, in addition to security, 61 00:02:16,500 --> 00:02:20,160 public key authentication can also offer usability benefits, 62 00:02:20,160 --> 00:02:22,890 because it allows users to implement single sign-on 63 00:02:22,890 --> 00:02:25,140 across multiple different SSH servers 64 00:02:25,140 --> 00:02:26,970 that they're going to need to connect to. 65 00:02:26,970 --> 00:02:29,070 Now, by using public key authentication, 66 00:02:29,070 --> 00:02:32,550 you can also have automated passwordless logins available 67 00:02:32,550 --> 00:02:34,350 by logging in with a digital certificate 68 00:02:34,350 --> 00:02:36,030 instead of having to remember a password 69 00:02:36,030 --> 00:02:37,740 each and every time. 70 00:02:37,740 --> 00:02:39,421 Now, there's lots of different files 71 00:02:39,421 --> 00:02:40,290 that you're going to have to touch 72 00:02:40,290 --> 00:02:44,670 when you configure key-based authentication inside of SSH. 73 00:02:44,670 --> 00:02:46,260 These files are going to be included 74 00:02:46,260 --> 00:02:50,190 inside the ~/.shh directory. 75 00:02:50,190 --> 00:02:51,090 Inside of here, 76 00:02:51,090 --> 00:02:52,503 you're going to find lots of different files 77 00:02:52,503 --> 00:02:55,140 that are related to your SSH keys. 78 00:02:55,140 --> 00:02:58,770 For example, we have the id_rsa file. 79 00:02:58,770 --> 00:03:00,930 This contains the user's private key. 80 00:03:00,930 --> 00:03:03,990 We have the id_rsa.pub file, 81 00:03:03,990 --> 00:03:05,970 which contains the user's public key. 82 00:03:05,970 --> 00:03:08,070 We have the authorized_keys file, 83 00:03:08,070 --> 00:03:09,960 which is located on your remote server, 84 00:03:09,960 --> 00:03:11,670 that's going to list out all the public keys 85 00:03:11,670 --> 00:03:14,970 that that server will accept as a means of authentication 86 00:03:14,970 --> 00:03:17,250 when somebody tries to authenticate their client. 87 00:03:17,250 --> 00:03:19,800 We also have the known_hosts file. 88 00:03:19,800 --> 00:03:21,570 This contains a list of all the public keys 89 00:03:21,570 --> 00:03:23,010 that the client is going to accept 90 00:03:23,010 --> 00:03:25,380 as a means for that client to use that file 91 00:03:25,380 --> 00:03:28,080 to authenticate the servers to try to connect to it. 92 00:03:28,080 --> 00:03:29,850 And we also have the config file, 93 00:03:29,850 --> 00:03:31,140 and this is going to be used to configure 94 00:03:31,140 --> 00:03:33,060 your SSH connection settings, 95 00:03:33,060 --> 00:03:35,160 such as using an identity file directive 96 00:03:35,160 --> 00:03:38,460 to associate multiple keys with specific servers. 97 00:03:38,460 --> 00:03:40,620 Now, there are various commands that are available 98 00:03:40,620 --> 00:03:43,500 that you can use to work with these SSH keys. 99 00:03:43,500 --> 00:03:44,910 The first one we're going to talk about 100 00:03:44,910 --> 00:03:47,790 is the ssh-keygen command. 101 00:03:47,790 --> 00:03:50,520 This is used to generate a public private key pair 102 00:03:50,520 --> 00:03:53,820 using specified asymmetric encryption algorithms. 103 00:03:53,820 --> 00:03:56,910 Now, the ssh-copy-id command 104 00:03:56,910 --> 00:03:59,280 is going to be used to append the user's public key 105 00:03:59,280 --> 00:04:02,430 to the remote server's authorized_keys file. 106 00:04:02,430 --> 00:04:04,110 That way, the server can authenticate 107 00:04:04,110 --> 00:04:07,170 the user's private key whenever they try to connect. 108 00:04:07,170 --> 00:04:09,690 The public key is going to be sent over SSH, 109 00:04:09,690 --> 00:04:12,300 and typically, it requires password authentication 110 00:04:12,300 --> 00:04:13,530 to be enabled. 111 00:04:13,530 --> 00:04:14,520 Now, on the other hand, 112 00:04:14,520 --> 00:04:17,279 we also have the ssh-add command, 113 00:04:17,279 --> 00:04:20,100 and this is going to be used to add the private key identifier 114 00:04:20,100 --> 00:04:22,260 to the SSH key agent. 115 00:04:22,260 --> 00:04:24,330 If the key is protected by a password, 116 00:04:24,330 --> 00:04:26,670 the user only needs to enter the password once 117 00:04:26,670 --> 00:04:29,820 and the agent will automatically authenticate that user. 118 00:04:29,820 --> 00:04:31,530 Another file you're going to look into 119 00:04:31,530 --> 00:04:36,530 is the /etc/ssh/sshd_config file. 120 00:04:37,650 --> 00:04:40,290 And this is used to configure an SSH server 121 00:04:40,290 --> 00:04:41,910 on your Linux system. 122 00:04:41,910 --> 00:04:43,830 Now, some of the settings you're going to configure here 123 00:04:43,830 --> 00:04:46,500 include things like the password authentication setting, 124 00:04:46,500 --> 00:04:47,490 which is used to enable 125 00:04:47,490 --> 00:04:50,040 or disable password-based authentication. 126 00:04:50,040 --> 00:04:52,920 You can also configure the PubkeyAuthentication setting, 127 00:04:52,920 --> 00:04:54,240 which enables or disables 128 00:04:54,240 --> 00:04:56,760 the use of public key-based authentication. 129 00:04:56,760 --> 00:04:58,830 You can also configure the Hostkey setting, 130 00:04:58,830 --> 00:05:00,720 and this is used to reference the locations 131 00:05:00,720 --> 00:05:02,610 of the server's private keys. 132 00:05:02,610 --> 00:05:04,860 You can configure the UsePAM setting, 133 00:05:04,860 --> 00:05:06,930 which is used to enable or disable support 134 00:05:06,930 --> 00:05:09,030 for pluggable authentication modules, 135 00:05:09,030 --> 00:05:11,610 known as PAM or P-A-M. 136 00:05:11,610 --> 00:05:13,080 There's also a Port setting 137 00:05:13,080 --> 00:05:14,880 that's going to be used to change the port number 138 00:05:14,880 --> 00:05:18,060 to buy the SSH service to a particular port. 139 00:05:18,060 --> 00:05:20,730 By default, this will be on port 22, 140 00:05:20,730 --> 00:05:23,160 but you can actually set it to any port you want. 141 00:05:23,160 --> 00:05:25,980 You can also configure your SyslogFacility setting, 142 00:05:25,980 --> 00:05:27,840 and this is used to change the logging level 143 00:05:27,840 --> 00:05:31,260 of the SSH events over to your syslog server. 144 00:05:31,260 --> 00:05:33,960 You can also configure your ChrootDirectory setting, 145 00:05:33,960 --> 00:05:36,810 which is used as a reference point for a chroot jail path 146 00:05:36,810 --> 00:05:38,370 for a giving user. 147 00:05:38,370 --> 00:05:40,410 You can go ahead and set up your AllowUsers 148 00:05:40,410 --> 00:05:41,910 or AllowGroup settings. 149 00:05:41,910 --> 00:05:44,160 And this enables user-specific access 150 00:05:44,160 --> 00:05:48,030 to be allowed for specific users or groups over SSH. 151 00:05:48,030 --> 00:05:49,110 In converse to that, 152 00:05:49,110 --> 00:05:52,110 you could set up the DenyUsers or DenyGroup settings, 153 00:05:52,110 --> 00:05:55,200 which is used to restrict or block certain users or groups 154 00:05:55,200 --> 00:05:58,080 from accessing your server using SSH. 155 00:05:58,080 --> 00:05:58,913 And finally, 156 00:05:58,913 --> 00:06:01,560 you can configure the PermitRootLogin setting, 157 00:06:01,560 --> 00:06:03,360 which is used to enable or disable 158 00:06:03,360 --> 00:06:06,660 the ability for the root user to log in over SSH. 159 00:06:06,660 --> 00:06:08,250 As a good security practice, 160 00:06:08,250 --> 00:06:10,830 you usually want to disable the ability for the root user 161 00:06:10,830 --> 00:06:12,360 to log in over SSH, 162 00:06:12,360 --> 00:06:14,550 because that is considered dangerous. 163 00:06:14,550 --> 00:06:16,440 All right, now, in addition to allowing 164 00:06:16,440 --> 00:06:18,240 or denying users and groups, 165 00:06:18,240 --> 00:06:21,570 you can also deny connections to the SSH server itself 166 00:06:21,570 --> 00:06:23,520 that come from specific hosts. 167 00:06:23,520 --> 00:06:25,980 This is done by wrapping the SSH service 168 00:06:25,980 --> 00:06:28,620 in what's known as a TCP Wrapper. 169 00:06:28,620 --> 00:06:29,790 This is going to give you the ability 170 00:06:29,790 --> 00:06:32,970 to check which hosts are explicitly allowed or denied 171 00:06:32,970 --> 00:06:36,390 before permitting that host to connect your SSH service. 172 00:06:36,390 --> 00:06:37,680 To be able to configure this, 173 00:06:37,680 --> 00:06:39,900 you could specify the host that you want to allow 174 00:06:39,900 --> 00:06:43,950 inside the /etc/hosts.allow file 175 00:06:43,950 --> 00:06:45,810 and the host that you want to deny 176 00:06:45,810 --> 00:06:49,263 inside the /etc/hosts.deny file. 177 00:06:50,130 --> 00:06:52,560 Next, let's talk a little bit more about PAM, 178 00:06:52,560 --> 00:06:55,230 the Pluggable Authentication Modules. 179 00:06:55,230 --> 00:06:57,240 Now, Pluggable Authentication Modules 180 00:06:57,240 --> 00:06:59,700 are used to help applications make the proper use 181 00:06:59,700 --> 00:07:02,070 of user accounts inside of Linux. 182 00:07:02,070 --> 00:07:03,630 This is going to separate the standard 183 00:07:03,630 --> 00:07:05,700 and specialized tasks of authentication 184 00:07:05,700 --> 00:07:07,830 from the applications themself. 185 00:07:07,830 --> 00:07:12,830 Programs like Login, GDM, SSHD, and FTPD, and many others, 186 00:07:13,590 --> 00:07:16,380 all want to know that a user is who they say they are, 187 00:07:16,380 --> 00:07:18,570 and there's a lot of different ways to do that. 188 00:07:18,570 --> 00:07:21,360 A user could provide a username and password credential 189 00:07:21,360 --> 00:07:23,160 for each individual service 190 00:07:23,160 --> 00:07:24,810 or they can authenticate remotely 191 00:07:24,810 --> 00:07:27,210 with an LDAP or Kerberos server. 192 00:07:27,210 --> 00:07:28,830 Now, PAM is really pluggable 193 00:07:28,830 --> 00:07:30,900 in the way that it can have different applications 194 00:07:30,900 --> 00:07:32,820 running different tests and modules 195 00:07:32,820 --> 00:07:34,770 in a way that we can now add different methods 196 00:07:34,770 --> 00:07:37,470 with new libraries for authentication. 197 00:07:37,470 --> 00:07:38,340 Now, as I said, 198 00:07:38,340 --> 00:07:40,860 LDAP is one of the common ways we can do this. 199 00:07:40,860 --> 00:07:43,290 And one of the most popular implementations of LDAP 200 00:07:43,290 --> 00:07:45,300 is Microsoft's Active Directory 201 00:07:45,300 --> 00:07:48,090 if you're running a Windows domain environment. 202 00:07:48,090 --> 00:07:50,340 Now, Active Directory is primarily going to be implemented 203 00:07:50,340 --> 00:07:51,360 within Windows, 204 00:07:51,360 --> 00:07:53,730 but Linux systems can still leverage 205 00:07:53,730 --> 00:07:56,820 pass through authentication over to those systems 206 00:07:56,820 --> 00:07:58,860 by forwarding their Active Directory credentials 207 00:07:58,860 --> 00:08:00,210 through PAM. 208 00:08:00,210 --> 00:08:01,140 For example, 209 00:08:01,140 --> 00:08:05,370 you can configure a System Security Services Daemon or SSSD 210 00:08:05,370 --> 00:08:08,160 to cache the credentials provided by Active Directory 211 00:08:08,160 --> 00:08:10,770 or another external authentication mechanism. 212 00:08:10,770 --> 00:08:13,890 And then SSSD can then be used with PAM 213 00:08:13,890 --> 00:08:15,960 to manage those identities. 214 00:08:15,960 --> 00:08:18,360 PAM configuration files are going to be located 215 00:08:18,360 --> 00:08:22,410 inside the /etc/pam.d directory. 216 00:08:22,410 --> 00:08:24,210 And each PAM-aware service or application 217 00:08:24,210 --> 00:08:27,990 is going to have its own file inside that directory. 218 00:08:27,990 --> 00:08:30,630 Now, each of these files are going to include directives 219 00:08:30,630 --> 00:08:33,870 and these directives are formatted as four different things, 220 00:08:33,870 --> 00:08:36,390 the module interface, the control flag, 221 00:08:36,390 --> 00:08:39,030 the module name, and the module arguments. 222 00:08:39,030 --> 00:08:41,580 The module interfaces are going to define the functions 223 00:08:41,580 --> 00:08:44,190 of the authentication and authorization process 224 00:08:44,190 --> 00:08:46,260 that are contained within a given module. 225 00:08:46,260 --> 00:08:48,570 The control flags indicate what should be done 226 00:08:48,570 --> 00:08:51,480 upon a success or failure of that module. 227 00:08:51,480 --> 00:08:53,880 And the module name is going to find the module 228 00:08:53,880 --> 00:08:55,740 that the directive is going to apply to. 229 00:08:55,740 --> 00:08:58,170 While the module arguments are additional options 230 00:08:58,170 --> 00:09:00,420 that you can pass into that module. 231 00:09:00,420 --> 00:09:02,190 For example, let's say I was setting up 232 00:09:02,190 --> 00:09:04,110 a password policy directive. 233 00:09:04,110 --> 00:09:04,943 I would set that up 234 00:09:04,943 --> 00:09:07,410 by using four different pieces of information. 235 00:09:07,410 --> 00:09:12,410 Password required pam_cracklib.so retry=5. 236 00:09:13,980 --> 00:09:17,220 Notice here, the module interface is known as password. 237 00:09:17,220 --> 00:09:18,750 This indicates that this directive 238 00:09:18,750 --> 00:09:20,910 is pertaining to changing passwords. 239 00:09:20,910 --> 00:09:22,440 The required control flag 240 00:09:22,440 --> 00:09:25,470 means that the result of the module must be successful, 241 00:09:25,470 --> 00:09:29,010 otherwise, the authentication process is not going to continue. 242 00:09:29,010 --> 00:09:33,360 The pam_cracklib.so module contains the functionality 243 00:09:33,360 --> 00:09:35,280 that prompts a user for a password, 244 00:09:35,280 --> 00:09:37,710 and then test that password to see if it's easily cracked 245 00:09:37,710 --> 00:09:39,240 in a dictionary attack. 246 00:09:39,240 --> 00:09:42,990 And the retry=5 argument gives the user five chances 247 00:09:42,990 --> 00:09:46,350 to fail this dictionary test before locking them out. 248 00:09:46,350 --> 00:09:49,440 Now, there are four module interfaces inside of PAM 249 00:09:49,440 --> 00:09:51,000 that we need to discuss. 250 00:09:51,000 --> 00:09:53,310 The first one is the account module. 251 00:09:53,310 --> 00:09:54,710 Now, the account module interface 252 00:09:54,710 --> 00:09:56,310 is going to check to see if a user 253 00:09:56,310 --> 00:09:58,170 is allowed access to something. 254 00:09:58,170 --> 00:10:01,530 For example, it might check if a user account is expired 255 00:10:01,530 --> 00:10:04,827 or is allowed to log in at a particular time of day. 256 00:10:04,827 --> 00:10:06,360 Auth is our second one. 257 00:10:06,360 --> 00:10:08,280 Now, auth is used to verify passwords 258 00:10:08,280 --> 00:10:10,950 and set credentials such as Kerberos tickets. 259 00:10:10,950 --> 00:10:13,170 The password interface is our third one, 260 00:10:13,170 --> 00:10:16,020 and this is used to change and verify passwords. 261 00:10:16,020 --> 00:10:16,920 On the other hand, 262 00:10:16,920 --> 00:10:18,960 the session interface is going to configure 263 00:10:18,960 --> 00:10:20,820 and manage user sessions. 264 00:10:20,820 --> 00:10:22,380 Modules with this interface 265 00:10:22,380 --> 00:10:23,880 can also perform additional tasks 266 00:10:23,880 --> 00:10:25,290 that are needed to allow access, 267 00:10:25,290 --> 00:10:27,120 like mounting a user's home directory 268 00:10:27,120 --> 00:10:29,730 and making the user's mailbox available. 269 00:10:29,730 --> 00:10:32,460 Now, all PAM modules are going to generate a success 270 00:10:32,460 --> 00:10:34,680 or failure result when they're called. 271 00:10:34,680 --> 00:10:38,070 The control flags tell PAM what to do with that result. 272 00:10:38,070 --> 00:10:41,040 Since the modules can be stacked up in a particular order, 273 00:10:41,040 --> 00:10:43,350 control flags need to decide how important 274 00:10:43,350 --> 00:10:46,020 the success or failure is of a particular module 275 00:10:46,020 --> 00:10:48,510 in the overall goal of authenticating the user 276 00:10:48,510 --> 00:10:49,950 to a given service. 277 00:10:49,950 --> 00:10:52,440 Now, there are four predefined control flags, 278 00:10:52,440 --> 00:10:56,790 these are optional, required, requisite, and sufficient. 279 00:10:56,790 --> 00:10:58,230 The optional control flag 280 00:10:58,230 --> 00:11:00,570 shows that the module result is ignored. 281 00:11:00,570 --> 00:11:02,100 A module flagged as optional 282 00:11:02,100 --> 00:11:04,860 only becomes necessary for successful authentication 283 00:11:04,860 --> 00:11:08,370 when there are no other modules referencing that interface. 284 00:11:08,370 --> 00:11:10,200 When you're using a required flag, 285 00:11:10,200 --> 00:11:12,420 this module result must be successful 286 00:11:12,420 --> 00:11:14,730 for the authentication to continue. 287 00:11:14,730 --> 00:11:16,800 If a required module result fails, 288 00:11:16,800 --> 00:11:18,420 the user is not going to be notified 289 00:11:18,420 --> 00:11:20,280 until the results on all modules 290 00:11:20,280 --> 00:11:23,280 that reference that interface have been completed. 291 00:11:23,280 --> 00:11:25,740 The requisite flag is going to be considered the same 292 00:11:25,740 --> 00:11:26,573 as required, 293 00:11:26,573 --> 00:11:29,340 however, the requisite module, if it fails, 294 00:11:29,340 --> 00:11:31,380 is going to notify that user immediately 295 00:11:31,380 --> 00:11:33,390 with a message reflecting the first failed 296 00:11:33,390 --> 00:11:35,460 required or requisite modules. 297 00:11:35,460 --> 00:11:37,410 And the final one we have is sufficient. 298 00:11:37,410 --> 00:11:38,670 The sufficient control flag 299 00:11:38,670 --> 00:11:40,800 means that the module result is going to be ignored 300 00:11:40,800 --> 00:11:42,450 upon a failure. 301 00:11:42,450 --> 00:11:44,910 Now, in addition to the prior dictionary test example 302 00:11:44,910 --> 00:11:46,200 I gave you with passwords, 303 00:11:46,200 --> 00:11:49,050 there's other examples of PAM password policy directives 304 00:11:49,050 --> 00:11:50,370 that we can look at. 305 00:11:50,370 --> 00:11:51,960 For example, if we type, 306 00:11:51,960 --> 00:11:56,960 password requisite pam_pwquality.so local_users_only, 307 00:11:59,160 --> 00:12:01,410 this would allow a module to require the user 308 00:12:01,410 --> 00:12:03,690 to enter a strong password. 309 00:12:03,690 --> 00:12:05,760 This means we want a high password quality, 310 00:12:05,760 --> 00:12:07,140 which means we're going to have to have a long, 311 00:12:07,140 --> 00:12:10,080 strong password for it to meet this requirement. 312 00:12:10,080 --> 00:12:12,060 Another one we might have would be something like, 313 00:12:12,060 --> 00:12:17,060 password requisite pam_pwhistory.so remember=90. 314 00:12:18,810 --> 00:12:21,030 This would actually enforce a password history 315 00:12:21,030 --> 00:12:23,190 so that users don't reuse old passwords 316 00:12:23,190 --> 00:12:24,390 when they're changing theirs. 317 00:12:24,390 --> 00:12:26,580 In this case, the password must be remembered 318 00:12:26,580 --> 00:12:28,290 for at least 90 days, 319 00:12:28,290 --> 00:12:30,690 because we're having this 90-day lockout history 320 00:12:30,690 --> 00:12:33,570 being applied by this requisite requirement. 321 00:12:33,570 --> 00:12:34,470 Now, conversely, 322 00:12:34,470 --> 00:12:37,440 if we wanted a module to not do any password checks, 323 00:12:37,440 --> 00:12:38,610 we can do that too 324 00:12:38,610 --> 00:12:39,840 by pulling in the password 325 00:12:39,840 --> 00:12:42,180 that's already been checked for a prior module. 326 00:12:42,180 --> 00:12:43,290 We can do this by using, 327 00:12:43,290 --> 00:12:48,290 password sufficient pam_unix.so sha512 use_authtok. 328 00:12:50,880 --> 00:12:54,000 Now, there's also two PAM modules you should be aware of 329 00:12:54,000 --> 00:12:56,340 that can actually trigger a temporary user lockout 330 00:12:56,340 --> 00:12:58,560 if multiple authentication attempts are attempted 331 00:12:58,560 --> 00:12:59,790 and they fail. 332 00:12:59,790 --> 00:13:04,470 These are known as pam_tally2 and pam_faillock. 333 00:13:04,470 --> 00:13:06,960 Now, pam_faillock is a module 334 00:13:06,960 --> 00:13:08,310 that we're recommending you use, 335 00:13:08,310 --> 00:13:09,810 because it's a newer module 336 00:13:09,810 --> 00:13:13,080 that improves upon the older pam_tally2 337 00:13:13,080 --> 00:13:14,850 by supporting user lockouts, 338 00:13:14,850 --> 00:13:16,350 even if they're trying to authenticate 339 00:13:16,350 --> 00:13:19,050 over a screensaver on newer systems. 340 00:13:19,050 --> 00:13:21,240 To be able to place these user lockout directives 341 00:13:21,240 --> 00:13:22,380 into your files, 342 00:13:22,380 --> 00:13:24,330 you need to put them in two places. 343 00:13:24,330 --> 00:13:29,157 The first is /etc/pam.d/password-auth 344 00:13:29,157 --> 00:13:34,157 and the second one is /etc/pam.d/system-auth, 345 00:13:34,410 --> 00:13:36,570 because you want to make sure you're applying this 346 00:13:36,570 --> 00:13:38,400 against both password authentications 347 00:13:38,400 --> 00:13:41,280 and system-based password authentications. 348 00:13:41,280 --> 00:13:43,110 If somebody has locked themselves out 349 00:13:43,110 --> 00:13:45,450 because they've logged in wrong too many times, 350 00:13:45,450 --> 00:13:48,420 you can unlock that user and reset their failure count 351 00:13:48,420 --> 00:13:53,420 by issuing the command, pam_tally2 -r -u and their username. 352 00:13:54,810 --> 00:13:57,330 Now, you can also configure PAM to use LDAP 353 00:13:57,330 --> 00:14:00,240 by leveraging the pam_ldap module. 354 00:14:00,240 --> 00:14:02,280 And so if you're integrating this Linux system 355 00:14:02,280 --> 00:14:04,350 in a Windows-based domain environment, 356 00:14:04,350 --> 00:14:08,280 then you're going to want to use the pam_ldap module. 357 00:14:08,280 --> 00:14:09,600 By using this module, 358 00:14:09,600 --> 00:14:11,100 you can specify other directives 359 00:14:11,100 --> 00:14:13,110 that restrict what users can log into 360 00:14:13,110 --> 00:14:16,110 and how they can access different resources on the network. 361 00:14:16,110 --> 00:14:18,840 If they meet the criteria that you set up in the module, 362 00:14:18,840 --> 00:14:22,440 then the pam_ldap module can authenticate the user 363 00:14:22,440 --> 00:14:24,180 with the LDAP service. 364 00:14:24,180 --> 00:14:25,440 You can add these directives 365 00:14:25,440 --> 00:14:30,060 into the /etc/pam.d/common file. 366 00:14:30,060 --> 00:14:32,040 Now, I mentioned before that you don't want people 367 00:14:32,040 --> 00:14:34,407 to log in as the route user over SSH, 368 00:14:34,407 --> 00:14:36,990 and this is because anytime somebody can operate 369 00:14:36,990 --> 00:14:38,220 as the root user, 370 00:14:38,220 --> 00:14:42,090 either over SSH or into a terminal directly on the system, 371 00:14:42,090 --> 00:14:44,040 this can be a huge security risk, 372 00:14:44,040 --> 00:14:45,840 because if they have root access, 373 00:14:45,840 --> 00:14:48,210 they can essentially issue any command on the system 374 00:14:48,210 --> 00:14:50,010 and the system is going to do it. 375 00:14:50,010 --> 00:14:51,240 To help prevent this, 376 00:14:51,240 --> 00:14:56,240 you're going to go into the file known as /etc/securetty. 377 00:14:56,370 --> 00:14:57,840 By configuring this file, 378 00:14:57,840 --> 00:15:01,440 you can leverage the pam_securetty module 379 00:15:01,440 --> 00:15:03,210 to determine what controlling terminals 380 00:15:03,210 --> 00:15:05,760 the root user is allowed access to. 381 00:15:05,760 --> 00:15:07,290 This means you can allow root 382 00:15:07,290 --> 00:15:10,200 to only log in on a certain workstation or server 383 00:15:10,200 --> 00:15:11,820 and not on the other ones. 384 00:15:11,820 --> 00:15:13,860 And this gives you a higher level of security 385 00:15:13,860 --> 00:15:15,780 by using least privilege. 386 00:15:15,780 --> 00:15:18,630 Now, the next thing we're going to talk about is PKI. 387 00:15:18,630 --> 00:15:20,220 And I mentioned Public Key Infrastructure 388 00:15:20,220 --> 00:15:21,053 a little bit earlier, 389 00:15:21,053 --> 00:15:23,040 but we're going to dive a little deeper now. 390 00:15:23,040 --> 00:15:25,530 Now, a PKI or Public Key Infrastructure 391 00:15:25,530 --> 00:15:27,210 is really just a system that's composed 392 00:15:27,210 --> 00:15:30,120 of certificate authorities, certificates, software, 393 00:15:30,120 --> 00:15:32,610 services, and other cryptographic components 394 00:15:32,610 --> 00:15:34,740 for the purpose of enabling authenticity 395 00:15:34,740 --> 00:15:37,500 and validation of data and entities. 396 00:15:37,500 --> 00:15:39,150 The PKI system can be implemented 397 00:15:39,150 --> 00:15:41,040 using various hierarchical structures 398 00:15:41,040 --> 00:15:42,330 and can be publicly available 399 00:15:42,330 --> 00:15:45,330 or maintained privately by your organization. 400 00:15:45,330 --> 00:15:47,130 Now, you learned a lot about PKI 401 00:15:47,130 --> 00:15:48,840 back in your security plus studies, 402 00:15:48,840 --> 00:15:51,510 so we're not going to focus on how PKI works, 403 00:15:51,510 --> 00:15:52,590 but in this lesson, 404 00:15:52,590 --> 00:15:55,140 we're going to talk more about how you can implement PKI 405 00:15:55,140 --> 00:15:57,060 using your Linux system. 406 00:15:57,060 --> 00:15:59,040 Now, there are many cryptographic components 407 00:15:59,040 --> 00:16:01,050 that make up the PKI system, 408 00:16:01,050 --> 00:16:02,730 and some of the most important components 409 00:16:02,730 --> 00:16:05,430 include digital signatures, digital certificates, 410 00:16:05,430 --> 00:16:08,700 certificate authorities, and certificate signing requests. 411 00:16:08,700 --> 00:16:10,920 A digital signature is a message digest 412 00:16:10,920 --> 00:16:13,650 that has been encrypted with the user's private key. 413 00:16:13,650 --> 00:16:15,450 Asymmetric encryption algorithms 414 00:16:15,450 --> 00:16:17,400 can also be used with hashing algorithms 415 00:16:17,400 --> 00:16:19,470 to create these digital signatures. 416 00:16:19,470 --> 00:16:21,810 A digital certificate is an electronic document 417 00:16:21,810 --> 00:16:24,330 that associates credentials with the public key. 418 00:16:24,330 --> 00:16:27,420 Both users and devices can hold these certificates. 419 00:16:27,420 --> 00:16:28,980 Now, the certificate is going to validate 420 00:16:28,980 --> 00:16:30,720 the certificate holder's identity 421 00:16:30,720 --> 00:16:32,280 through a digital signature. 422 00:16:32,280 --> 00:16:34,860 It's a way to distribute the holder's public key 423 00:16:34,860 --> 00:16:36,780 in a safe and secure manner. 424 00:16:36,780 --> 00:16:38,640 Now, certificate authority is the server 425 00:16:38,640 --> 00:16:41,250 that's going to issue the digital certificates for entities 426 00:16:41,250 --> 00:16:42,690 and it maintains the associated 427 00:16:42,690 --> 00:16:44,640 public and private key pairs. 428 00:16:44,640 --> 00:16:47,430 Now, a certificate signing request or CSR 429 00:16:47,430 --> 00:16:49,500 is a message that you're going to send to the CA 430 00:16:49,500 --> 00:16:50,970 or certificate authority 431 00:16:50,970 --> 00:16:54,180 in which the entity is going to apply for their certificate. 432 00:16:54,180 --> 00:16:56,340 Typically, this is going to include the information 433 00:16:56,340 --> 00:16:58,410 that should go into the entity's certificate, 434 00:16:58,410 --> 00:17:00,360 like it's public key, digital signature, 435 00:17:00,360 --> 00:17:02,640 and other identifying information. 436 00:17:02,640 --> 00:17:05,550 Now, OpenSSL is an open-source implementation 437 00:17:05,550 --> 00:17:07,890 of the SSL and TLS protocol 438 00:17:07,890 --> 00:17:09,869 and it's used for securing data in transit 439 00:17:09,869 --> 00:17:11,490 using cryptography. 440 00:17:11,490 --> 00:17:14,609 On Linux, the OpenSSL command is an interface 441 00:17:14,609 --> 00:17:17,880 to accessing a variety of OpenSSL features. 442 00:17:17,880 --> 00:17:19,710 It's also one of the most common tools 443 00:17:19,710 --> 00:17:23,520 for generating and managing components of a PKI system. 444 00:17:23,520 --> 00:17:25,079 Using OpenSSL, 445 00:17:25,079 --> 00:17:27,180 you can generate public and private keys, 446 00:17:27,180 --> 00:17:29,010 generate self-signed digital certificates 447 00:17:29,010 --> 00:17:30,450 in various formats, 448 00:17:30,450 --> 00:17:32,520 generate digital certificates for other entities 449 00:17:32,520 --> 00:17:35,610 based on CSRs or Certificate Signing Requests, 450 00:17:35,610 --> 00:17:37,290 as well as calculating the hash values 451 00:17:37,290 --> 00:17:38,640 using various functions, 452 00:17:38,640 --> 00:17:41,730 encrypting and decrypting data using various algorithms, 453 00:17:41,730 --> 00:17:44,520 managing keys and certificates in a certificate authority, 454 00:17:44,520 --> 00:17:45,870 and much more. 455 00:17:45,870 --> 00:17:48,870 The OpenSSL command can be used interactively 456 00:17:48,870 --> 00:17:50,730 through one of several sub-commands 457 00:17:50,730 --> 00:17:52,740 or you could provide these sub-commands 458 00:17:52,740 --> 00:17:55,290 and any options non-interactively. 459 00:17:55,290 --> 00:17:57,420 To open up the OpenSSL command, 460 00:17:57,420 --> 00:18:00,750 simply type in openssl, the sub command you want to use, 461 00:18:00,750 --> 00:18:02,730 and the options you want to use. 462 00:18:02,730 --> 00:18:04,350 Now, in order to authenticate clients 463 00:18:04,350 --> 00:18:05,880 and encrypt data in transit, 464 00:18:05,880 --> 00:18:08,262 we often are going to use VPNs. 465 00:18:08,262 --> 00:18:11,580 VPNs employ many different types of tunneling protocols, 466 00:18:11,580 --> 00:18:13,890 depending on how you configure your system. 467 00:18:13,890 --> 00:18:16,260 One of the most prominent and most used protocols 468 00:18:16,260 --> 00:18:19,170 for site-to-site connections is known as IPsec 469 00:18:19,170 --> 00:18:21,390 or Internet Protocol Security. 470 00:18:21,390 --> 00:18:25,080 Now, IPsec is a set of open and non-proprietary standards 471 00:18:25,080 --> 00:18:26,310 that can be used to secure data 472 00:18:26,310 --> 00:18:29,640 as it travels across the network or across the internet. 473 00:18:29,640 --> 00:18:31,830 It's going to use different protocols and services 474 00:18:31,830 --> 00:18:34,290 to provide data authenticity and integrity, 475 00:18:34,290 --> 00:18:36,900 anti-replay protections, non-repudiation, 476 00:18:36,900 --> 00:18:39,660 and protection against eavesdropping and sniffing. 477 00:18:39,660 --> 00:18:42,390 IPsec a has two primary modes of operation, 478 00:18:42,390 --> 00:18:44,520 transport mode and tunnel mode. 479 00:18:44,520 --> 00:18:45,510 In transport mode, 480 00:18:45,510 --> 00:18:48,150 only the packets contents are going to be encrypted, 481 00:18:48,150 --> 00:18:50,040 but the header itself is not. 482 00:18:50,040 --> 00:18:51,690 When you're using transport mode 483 00:18:51,690 --> 00:18:54,810 is typically going to be used for remote access to VPNs. 484 00:18:54,810 --> 00:18:56,970 Now, when you use tunnel mode, on the other hand, 485 00:18:56,970 --> 00:18:59,970 both the packet and its header are going to be encrypted. 486 00:18:59,970 --> 00:19:01,410 Tunnel mode is typically used 487 00:19:01,410 --> 00:19:03,870 when you're doing site-to-site VPNs. 488 00:19:03,870 --> 00:19:06,960 Now, one popular utility for implementing IPsec tunnels 489 00:19:06,960 --> 00:19:10,050 for VPN clients is known as StrongSwan, 490 00:19:10,050 --> 00:19:13,320 and you can download this using the StrongSwan package. 491 00:19:13,320 --> 00:19:14,520 With StrongSwan, 492 00:19:14,520 --> 00:19:17,460 you can set up user names and password authentication 493 00:19:17,460 --> 00:19:19,470 or you can generate a digital certificate 494 00:19:19,470 --> 00:19:21,750 as a method of authenticating as well. 495 00:19:21,750 --> 00:19:24,180 The main configuration file for StrongSwan 496 00:19:24,180 --> 00:19:29,180 is located in the /etc/strongswan/ipsec.C-O-N-F file. 497 00:19:29,760 --> 00:19:32,130 And the user accounts are going to be configured 498 00:19:32,130 --> 00:19:37,130 inside the /etc/strongswan/ipsec.secrets file. 499 00:19:37,523 --> 00:19:40,770 SSL and TLS is another method you can use 500 00:19:40,770 --> 00:19:42,690 to create a VPN connection. 501 00:19:42,690 --> 00:19:44,640 By using SSL or TLS, 502 00:19:44,640 --> 00:19:46,800 you can handle the authentication and encryption 503 00:19:46,800 --> 00:19:49,350 using the SSL or TLS tunnel, 504 00:19:49,350 --> 00:19:52,440 and this is primarily used for remote access connections. 505 00:19:52,440 --> 00:19:54,173 Now, unlike IPsec, 506 00:19:54,173 --> 00:19:57,090 SSL and TLS is considered an application-layer 507 00:19:57,090 --> 00:19:59,940 or layer-seven protocol in the OSI model, 508 00:19:59,940 --> 00:20:00,773 and therefore, 509 00:20:00,773 --> 00:20:02,970 it's dependent on the applications you're using 510 00:20:02,970 --> 00:20:04,650 to make it work properly. 511 00:20:04,650 --> 00:20:07,260 Now, on Linux, the most popular one we're going to use 512 00:20:07,260 --> 00:20:08,260 is known as OpenVPN. 513 00:20:09,510 --> 00:20:12,540 OpenVPN supports password-based, certificate-based, 514 00:20:12,540 --> 00:20:14,850 and smart card-based authentication mechanisms 515 00:20:14,850 --> 00:20:16,590 for your Linux clients. 516 00:20:16,590 --> 00:20:18,409 For certificate-based authentication, 517 00:20:18,409 --> 00:20:21,000 OpenVPN can generate self-signed certificates 518 00:20:21,000 --> 00:20:22,800 or it can leverage certificates 519 00:20:22,800 --> 00:20:25,793 that are issued from an existing certificate authority. 520 00:20:25,793 --> 00:20:29,130 OpenVPN is available by downloading the OpenVPN package 521 00:20:29,130 --> 00:20:30,780 and installing it on your system. 522 00:20:30,780 --> 00:20:31,800 To configure it, 523 00:20:31,800 --> 00:20:35,670 you can go into /etc/openvpn as a directory 524 00:20:35,670 --> 00:20:38,160 and you'll find the configuration files there. 525 00:20:38,160 --> 00:20:41,100 The next thing we need to talk about is DTLS. 526 00:20:41,100 --> 00:20:45,270 Now, DTLS is the Datagram Transport Layer Security protocol, 527 00:20:45,270 --> 00:20:49,710 and essentially, this implements SSL or TLS over datagrams, 528 00:20:49,710 --> 00:20:52,620 which means we're using UDP instead of TCP 529 00:20:52,620 --> 00:20:54,600 as our transmission protocol. 530 00:20:54,600 --> 00:20:57,510 Now, because we're using UDP instead of TCP, 531 00:20:57,510 --> 00:21:00,390 this means that DTLS traffic is not susceptible 532 00:21:00,390 --> 00:21:03,750 to the same delays that TCP traffic normally has. 533 00:21:03,750 --> 00:21:05,490 This will give you a better overall performance 534 00:21:05,490 --> 00:21:08,250 than using a VPN over a TCP connection, 535 00:21:08,250 --> 00:21:11,130 because UDP does tend to be much faster. 536 00:21:11,130 --> 00:21:12,990 Now, when you're setting up remote access, 537 00:21:12,990 --> 00:21:15,300 there's a couple of issues that you may run into 538 00:21:15,300 --> 00:21:18,000 where your users cannot successfully authenticate. 539 00:21:18,000 --> 00:21:18,900 When this happens, 540 00:21:18,900 --> 00:21:19,770 you need to make sure 541 00:21:19,770 --> 00:21:21,840 that these users have set up the proper credentials 542 00:21:21,840 --> 00:21:22,950 for their accounts 543 00:21:22,950 --> 00:21:24,570 and that they're transmitting those credentials 544 00:21:24,570 --> 00:21:26,370 to the server they're trying to connect to, 545 00:21:26,370 --> 00:21:28,290 whether that's SSH, VPN, 546 00:21:28,290 --> 00:21:31,050 or some other external authentication server. 547 00:21:31,050 --> 00:21:33,270 For example, if you're using a public key 548 00:21:33,270 --> 00:21:35,340 SSH authentication environment, 549 00:21:35,340 --> 00:21:37,140 users have to have the correct key pair 550 00:21:37,140 --> 00:21:38,400 in their home directory, 551 00:21:38,400 --> 00:21:40,200 as well as place the SSH server 552 00:21:40,200 --> 00:21:41,970 in their list of known hosts. 553 00:21:41,970 --> 00:21:44,640 If they don't do that, they're going to get connection errors. 554 00:21:44,640 --> 00:21:45,720 You should also check to see 555 00:21:45,720 --> 00:21:47,220 if their remote connection attempts 556 00:21:47,220 --> 00:21:49,230 are triggering a policy violation. 557 00:21:49,230 --> 00:21:51,450 For example, if they're trying to use a password 558 00:21:51,450 --> 00:21:52,830 when your configuration file says 559 00:21:52,830 --> 00:21:55,530 you must use public key authentication only, 560 00:21:55,530 --> 00:21:57,570 that's going to cause an error for them. 561 00:21:57,570 --> 00:21:59,970 If remote access is still having issues, 562 00:21:59,970 --> 00:22:01,920 try signing on to the account locally 563 00:22:01,920 --> 00:22:03,420 to see if it's a service issue 564 00:22:03,420 --> 00:22:05,910 or if it's some other kind of networking issue. 565 00:22:05,910 --> 00:22:08,490 Also, you can test to see if it's a local issue 566 00:22:08,490 --> 00:22:11,100 by ensuring the account is active and not expired 567 00:22:11,100 --> 00:22:13,410 and that their password is still valid. 568 00:22:13,410 --> 00:22:16,110 If the users are authenticating through an external service 569 00:22:16,110 --> 00:22:18,960 like a Kerberos or RADIUS or TACACS server, 570 00:22:18,960 --> 00:22:20,910 you should always ensure the user entities 571 00:22:20,910 --> 00:22:22,950 are correctly configured in those services 572 00:22:22,950 --> 00:22:24,630 and those servers as well 573 00:22:24,630 --> 00:22:26,640 and that they're available over the network. 574 00:22:26,640 --> 00:22:29,820 These days, remote access is a huge attack vector 575 00:22:29,820 --> 00:22:31,110 against our organizations. 576 00:22:31,110 --> 00:22:33,000 So you want to make sure that you're protecting 577 00:22:33,000 --> 00:22:35,880 all of your privilege access management in some way. 578 00:22:35,880 --> 00:22:37,320 There's lots of violations 579 00:22:37,320 --> 00:22:39,360 of privileged access management policies, 580 00:22:39,360 --> 00:22:41,070 such as failures to configure the account 581 00:22:41,070 --> 00:22:44,280 with a suitably strong password or other things like that. 582 00:22:44,280 --> 00:22:47,220 Remember, if you have lax PAM policies, 583 00:22:47,220 --> 00:22:48,600 this is going to be a leading cause 584 00:22:48,600 --> 00:22:51,150 of unauthorized users accessing your resources 585 00:22:51,150 --> 00:22:52,920 that they really shouldn't have access to. 586 00:22:52,920 --> 00:22:53,790 And this indicates 587 00:22:53,790 --> 00:22:55,860 that you need to tighten up your policies. 588 00:22:55,860 --> 00:22:57,990 It's critical that you really put some importance 589 00:22:57,990 --> 00:23:00,000 on your privileged access management 590 00:23:00,000 --> 00:23:02,160 and use your PAM modules properly 591 00:23:02,160 --> 00:23:03,870 to ensure that you have a tight and secure network 592 00:23:03,870 --> 00:23:06,003 that can be used by your authorized users.