Upload
nelson-henry-jennings
View
216
Download
0
Embed Size (px)
Citation preview
©Copyright 1999 Peter Shipley
LDAP Security
Peter ShipleyChief Security Architect
+1 650 404 3292
©Copyright 1999 Peter Shipley
Outline
What is a LDAP Why do we need LDAP What uses dose it have What are the potential dangers Methods of attacks
©Copyright 1999 Peter Shipley
What Is a LDAP
X.500 is a model for Directory Services in the OSI model. The DAP (Directory Access Protocol) runs over the OSI network protocol stack.It’s fairly "heavyweight".
Therefore, University of Michigan developed the "lightweight” version of DAP and called it LDAP.
©Copyright 1999 Peter Shipley
What Is a LDAP
A directory is essentially a database but tends to contain more descriptive, attribute based information. The information in an LDAP directory tends to be read more than it is written so LDAP has been designed to be more read-optimized
©Copyright 1999 Peter Shipley
What kind of information can be stored in the directory?
The LDAP directory service model is based on entries. An entry is a collection of attributes that have a name, called a DN (distinguished name).
©Copyright 1999 Peter Shipley
What kind of information can be stored in the directory?
The DN is used to refer to the entry unambiguously. Each of the entry's attributes has a type and one or more values. The types are typically mnemonic strings, like "cn" for common name, or "mail" for email address. The values depend on what type of attribute is it.
©Copyright 1999 Peter Shipley
What Operating Systems support it ?
Since many of these packages come with source, its really available underany operating system.
©Copyright 1999 Peter Shipley
What software is out there
OPENLDAP UMICH's original LDAP server Netscape Directory Server Sun's LDAP server
and even Microsoft is jumping on the LDAP bandwagon with Win2000 and Active Directory
©Copyright 1999 Peter Shipley
What applications are there
Not only are there are a lot of servers out there, there are also a lot of applications that are LDAP-enabled.
Being LDAP-enabled essentially means that the application is able to retrieve information via LDAP.
©Copyright 1999 Peter Shipley
What applications are there
Examples of LDAP-enabled applications would be:
Netscape Messaging Server Netscape Calendar Sun's SIMS mail server sendmail (with ldapx extensions)
©Copyright 1999 Peter Shipley
What are people using LADP for?
Personal directory services Mail routing login / password authentication PKI IP address distribution (linking with the
DNS and DHCP protocols)
©Copyright 1999 Peter Shipley
What are people using LADP for
Because of the push for centralization of information, don't be surprised if nearly every new network application that comes to market in the near future will support LDAP.
©Copyright 1999 Peter Shipley
What are people using LADP for
Within companies like Intel and Motorola, which are based around X.500 and DAP, there is a big push for having DAP->LDAP gateways put in place and, ultimately, relying on LDAP for everything.
This includes HR records, badging systems, etc.
©Copyright 1999 Peter Shipley
What are the Dangers?
Eggs in one basket
New/Untested technology
Inexperienced administrators / contractors
History repeating itself (YP/NIS, DNS (v2), “Registry” services etc..)
©Copyright 1999 Peter Shipley
What are the Dangers?
Because of DAP being in a lot of places, there are very insecure and poorly coded DAP->LDAP gateways out there.
Default permissions for LDAP are very insecure. (ACL's etc)
Single "control all" Directory Manager user that, in all of the current API's, is there in plain text. Very little work on real authentication methods.
©Copyright 1999 Peter Shipley
What are the Dangers?
Code exploits are already being discovered and published.
DOS attacks are coming into use• Flooding the server with (simple) queries• Flooding the server with (expensive
operations) The service is only as secure as the server it
runs on.
©Copyright 1999 Peter Shipley
What are the Dangers?
Data Harvesting• Spammers harvesting email addresses• System crackers harvesting account names and
passwords Data Modification
• There are no automated data/content integrity auditing tools (yet)
• Commercial auditing products to not address LDAP (yet)
©Copyright 1999 Peter Shipley
How one can locate a LDAP server
portscan:
nmap -P0 -p 636,389 192.168.0.0/24
Firewalling the best protection as does log monitoring.
©Copyright 1999 Peter Shipley
How one can locate a LDAP server
DNS:
SVR records (rfc 2052)
ldap.<domain>.com
companies seem to name servers after there purpose
A large number of sites are beginning to use rfc 2052
©Copyright 1999 Peter Shipley
How one can locate a LDAP server
Referals:
URLs and x.500 server links
By doing a file tree walk a “bot” can search and locate external referrals for later data harvesting
©Copyright 1999 Peter Shipley
How Bad is it?
A random survey of ldap enabled sites on the Internet found a relatively large number had sensitive information available via anonymous authentication.
©Copyright 1999 Peter Shipley
How Bad is it?
The same survey of ldap enabled sites on the Internet found a relatively large number did not utilize SSL secured connections. And thus utilized “simple Passwords” as a primary authentication method.
Do to the high transaction speed of LDAP servers one can attempt a dictionary attack with relatively high speed.
©Copyright 1999 Peter Shipley
How Bad is it?
Data found on such systems were email access passwords (cleartext), Full usernames and semi-personal info such as office and home phone numbers, postal addresses, employee status, encrypted login passwords.
This personal information led to the speedy cracking of most of the encrypted login passwords.
©Copyright 1999 Peter Shipley
What can be done
Use strong authentication.
Dedicate a server (don’t bundle services )
©Copyright 1999 Peter Shipley
What can be done
LDAP generally comes with several authentication methods for securing data:• Anonymous Authentication• Simple Passwords• SSL (with simple passwords)• SSL (with certificate authentication)• Kerberos
©Copyright 1999 Peter Shipley
Anonymous Authentication
This method of authentication refers to non-authenticated connections and is useful for data making non-restricted data available (e.g.: phone/office numbers, finger information, et el.)
©Copyright 1999 Peter Shipley
Simple Passwords
This authentication method relies on the use of simple clear-text passwords (similar to telnet).
This is considered the most insecure authentication method, is it also the most used.
©Copyright 1999 Peter Shipley
SSL (with simple passwords)
This authentication method relies on the use of simple passwords over a secured/encrypted link).
This is a most secure authentication method, but it is also simple to attack with brute force methods.
©Copyright 1999 Peter Shipley
SSL (with certificate authentication)
This is one of the more secure methods since the user cryptographically authenticates themselves with a digital certificate.
The down point for this method is cost and scalability.
©Copyright 1999 Peter Shipley
Kerberos
Kerberos is also a certificate based authentication scheme, that provides for scalability as well as cost effective.
Kerberos can be the most complex to setup.
©Copyright 1999 Peter Shipley
Other References
“Understanding and Deploying LDAP Directory Services”Howes, Smith and Good, ISBN 1-57870-070-1
“LDAP Programming Directory-Enabled Application with Lightweight Directory Access Protocol”Howes and Smith, ISBN 1-57870-000-0`
©Copyright 1999 Peter Shipley
Other References
http://www.geek-girl.com/bugtraq• Bugtraq searchable archives
RFC 2052 - “A DNS RR for specifying the location of services” - Paul Vixie
LDAP related RFCs 1777-1779 and 2251-2256
RFC 2222 - “Simple Authentication and Security Layer”
©Copyright 1999 Peter Shipley
LDAP Security
Peter ShipleyChief Security Architect
+1 650 404 3292