Insourcing Authentication

It's appraisal time and the focus is on the performance management system. That's outsourced -- Internet delivered and hosted somewhere in Florida.

The issue that was brought to me was concern that users might be saving their performance management password in the Internet Explorer credential cache. It's never something that's worried me very much -- if you lose control of your workstation session, you've lost a lot more than the right to express an opinion on that annoying support guy with the awkward questions....

But it tied up some ideas that have been rather weakly formed in my mind.

We're outsourcing more and more, and the result is that our users do their jobs with accounts on this system and accounts on that, and I have no real confidence that there's even a consistent list. I'm certain that there are some systems a leaver will retain indefinite access to, simply because the whole service was set up by the business with no IT involvement and the helpdesk will never know to cease the account. This is pretty galling when we've recently put so much work into the Joiners/Leavers/Absentees process and the unused account purge. We're actually getting on top of this, but it's slipping away though a side door. There's certainly no hope of enforcing a consistent account name or password complexity policy.

At the same time, to deal with the many sites like Blogger, Delicious and others that I use all the time from loads of PCs, I've been looking at OpenID, a public authentication system, that allows the administrators of an Internet hosted application to securely trust a logon completed at a different site. I've gone so far as to set up an OpenID on the Verisign test site, even though I've nothing to log in to it with.

So I've been toying with the idea that authentication was a service we could outsource -- to Verisign or perhaps a two-factor supplier. In fact, I had that exactly wrong. Authentication is the one service we can always do better than anyone else because no-one can know better than we do, who works for us. This is true even if we don't know very well ourselves....

So we shouldn't outsource -- we should insource. We should provide an OpenID service as part of our infrastructure support for application outsourcing. Then we become the authority on who works for us, and what tests they have to pass to prove it:

• Log on from inside, and you just need a logged-on Windows session; log on from the Internet and it'll ask for your RSA token.
• The helpdesk can cease your OpenID when you leave, so terminating access to services they don't even know exist.
• The authenticator could decline to recognise remote applications completely or on a per user basis.
• Choices about access to the dodgier stuff like the password reset tool, or remote access can all be made here.

So it would all be fabulous. Just a couple of problems:

• There doesn't seem to be OpenID software with the flexibility and convenience I need, and
• The chances that application hosts can be persuaded to recognise their customers' OpenIDs seems close to zero.

So this frankly rather wonderful approach, which ought by rights be standard, is dead. But I think I'll put OpenID support on the qualification form just to watch them squirm.

Only a year old

First encounter with a Vista installation today -- a factory fresh Compaq.

• Loved UAC -- it's definitely the future (that is, it's as good as sudo, so Windows has caught up with 1985 flavours of Unix.)
• Loved how the compatibility with DOS3.3 is way better than W2K (don't ask.)
• Hated the difficulty of finding where to give the Ethernet adapter a static IP address (got there in the end though)
• Hated that the integrated Intel graphics with an experience index of 3.3 couldn't make Aero look like anything better than Ubuntu with a translucent theme on a mobile Pentium
• Hated -- really hated -- having to wait for a dual-core 1GB laptop to pop up a printer property box or move some files. How sad. Maybe SP1 will sort it out.

In the meantime, the Dell I bought a few weeks ago turns out to be the ideal XP machine. So that's where it's staying.

How policy suceeds, for once

I've been purging out a dying domain. Disabled accounts with a last logon more than three months ago are deleted; enabled accounts with a last logon more than one month ago are disabled with a note in the comment. Do that every week or so. Keep a safe list for genuine service accounts and the domain will be nicely compliant by the time it stops.

The reason I've had to do this myself is a bit sad: the helpdesk, who own all account administration, will go through any distortion to avoid account difficulties. An odd-looking account -- precisely what should be disabled -- won't be touched for fear of breaking something. The policy itself gets re-interpreted to be "disable after ninety days" with no-one able to trace where that decision came from.

It's understandable. The best outcome from good application of the policy is that no-one complains. The likely outcome is senior staff complaining that the helpdesk has broken their account -- and no-one wants to hear that.

So, I've been doing it myself, and that makes everything different. Everyone knows that I break stuff, but everyone also knows that challenging me on what I break can leave them on the wrong side of a clearly distributed policy that they didn't read or understand....

Yes, and in this case I did a blinding job: The account policy allows just two types -- owned, which are subject to the AUP, and service which have to be on my list. The AUP says that owners are responsible for owned accounts, have to log on more often than once a month, and log off after no more than a week. That was carefully chosen to update the last logon time, and to transfer blame.

And it works! Hundreds of users deleted, a few tactful explanations, and no trouble at all. This is the root of the security truism that you start with a policy. You can't act without it -- but it has to be a good'un.

Audits fall with autumn leaves

We've just been visited by one of the many audits to which a regulated firm is subject. We didn't come out as well as I would have hoped but the point for me was different and more worrying.

These were competent people. They were clear about their wants: Evidence that the controls we publish and claim to adhere to are actually working. And they knew what "working" meant -- that the circle is closed with human escalations and choices on exceptions. So that was good (and a lot of work for us) except for one teeny issue.

"Working" also means that the control environment will actually stop trouble. And these guys had essentially no interest in the technical effect of the controls. If I said "this is a report that shows yesterday's changes to all application admin groups", that was the truth. No test that we have the same reporting on all production DCs. No enquiry about alternative ways to get the privilege. No test that our installations actually adhere to the admin group conventions. If I listed a firewall policy, or handed over the perimeter network diagram, that was it. No enquiry about how often I checked the cable patching....

Now I know that they can't check everything. And I wouldn't want them to.... I know that they're at the wrong end of a crushing knowledge asymmetry. But all the same, it reminds me of the drunk searching for his keys under the lamp post: not because he lost them there, but because the light is so much better.

In the mean time, remember:

• A big four signature on a statement of controls -- SAS70 or whatever -- means less than you think.
• Somewhere in the big city, a security guy is neglecting controls that expose trouble in favour of those that'll audit well.

Choice. I hate it.

I bought a new computer last night. Even though I'm not exactly Mr. Desktop I thought I would be able to make a sensible choice. In fact I was so overwhelmed, I nearly bought nothing.

First: supplier. I've bought from Morgan before and had a slightly patchy experience (but nothing unfair, and nothing that couldn't be resolved with my own skills.) This time I was going to avoid trouble by sticking to brand new stock -- retired from shops after going out of date. I liked the look of the HP media PCs with TV tuners and big plug-in HDs -- they were old enough to be packaged with XP Media centre (I really don't want that "which Vista edition" issue until SP1 --maybe not then), they were fully loaded with ports and the more expensive models had Intel dual cores, 2GB memory and GEForce 7600 with 256 MB. I didn't want a screen package because the more mad son has a history of headbutting flatscreens to death: CRTs are tougher and I have them already.

So I thought that was pretty cut and dried. But I can't resist a quick visit to Dell.

First impressions are low price -- Dell include VAT, and Morgan exclude it (which I think is a tad dodgy on consumer kit sold retail). Now I know that Dell charge a shameless £50 for delivery but it turns out it's free until the end of the month. Second thing is that XP is back on offer -- it was Vostro-only in September but now the consumer pages have it too. And it's XP Pro which is a big plus.

So into the configurator to be faced with all those tough choices. Many of the base builds lack 2GB and the prices start notching up as I make those tempting choices. Not all models let me configure "no screen" and if I'm having a screen maybe I should get the posh graphics as well.

I finally settle on a bearable heuristic. I'll only get factory fitted upgrades where I haven't upgraded myself successfully in the past.

I end up with PC Duo 6550, 2GB (I've had problems with dodgy 1GB parts), the base graphics (because no-name GEF8600 will be cheap and good in a years time), the base HD (definitely getting NAS ....) And a screen, which was too good to give up for £80 and I will put on the PC upstairs to keep the less mad son happy until he gets his laptop.

All that choosing left me emotionally committed to the Dell. I matched it to an HP package from Morgan and found it close (screen to placate LMS with graphics upgrade option in the future vs. no screen, and better but obsolete graphics now; no media centre tuner remote & wireless vs. XP pro and the confidence I wouldn't use that stuff; in stock vs two week delivery ouch) but a few pounds less.

So I bought the Dell. But it wasn't easy.

Secure Timestamp

I enjoyed watching the moon race past some bright planet a little above the sunrise last week. I guess it was Jupiter -- a bit too far along the ecliptic to be Venus.

Over the weekend, there was a news feature about the Mahdi army in Iraq. At one point the camera zoomed in on the moon to show this conjunction closer than I ever saw it. For me, that dated the report better than any digital means -- no encryption, no secure timestamp -- just very hard to fake.

Export

Every morning lately, when I've been there to see, a train of twenty or so flatcars each with twelve colossal steel billets heads east, to Ashford and I guess the tunnel. This morning they were behind a class 92. In my mind this question: If the country is so prosperous that the government can offer flexible working hours to every employed parent, how can anyone make money exporting raw steel? Am I that detached from the real world?

Geek Alert

The shed computer has been on my queue for a very long time. It was running an elderly Kubuntu (6.04?) and I've never found it entirely satisfactory -- Konqueror is not supported in Google Docs, I couldn't get Firefox to install and in fact I couldn't get anything to update or install. Well, I can see which way the world is going, so I wanted to put a current Ubuntu, and I've finally done it. It wasn't easy. The PC is a Dell Latitude PIII. It was classy in its day, but I think it has problems, especially with the CD drive. The steps I've had to take to get it installed are these:

• Switch off the Hot-Switchable Floppy option in the BIOS. I don't even have an FD, but with the switch on, the boot was delayed for tens of minutes negotiating /dev/fd0 errors.
• Don't even try to boot the live CD into safe video (forcevesa). It would boot, in an hour or two, but it was continuously frobbing the CD and it would be impossible to get to the fourth screen of the installer. And the bars ar the top and bottom of Gnome were lost.
• And I gave up on the live CD. The text mode install CD (select it with the check box on the Ubuntu download page) installed first time. The live CD install failed at random points copying files to the HD. My burn of that image passes the veracity test, and I exchanged HDs, and the problem was still there. But the text installer just works.

And once it's up, it's pretty good. I was notified of 16 updates, all of which applied even though one was for Firefox which was open at the time. I've added MPEG codecs (which I suspect are excluded from the build to preserve its freehood -- Fraunhofer have some MPEG patents) directly from the player, mc (which I have to have) through apt-get, and Penguin Command (which I've missed ever since I tried Suse 7.2) through the Synaptic package manager. It all works. The only real hiccup was the networking -- it needed a few restarts to work -- I think it wasn't playing nicely with DHCP on the firewall. I've tried tuning the display, but the automatic setting seemed best. Sudo works nicely. It's not quite as responsive as W2k but it is all so much better done than I remember -- and I don't miss KDE at all. Best of all -- malware won't run. I can browse on! Oh -- and on the whole, I don't think it's as stable as Windows. The kernel is better (though the scheduler is cruder) and the management GUI and command-line stuff is fine, but in userland many of the third-party apps can silently disappear.

Die Daylight Saving Die! Die! Die!

Hurrah! The log files make sense again, and the gods of time have punished the impious humans for pretending that the solar zenith is 13:00....

Physical Insecurity

A frisson walking across the fields on my way home this evening -- that lively sound of bullets wheeling past my head. It wasn't a demented assassin emerging from my ugly past -- the faint red light gave it away as an incompetent lamper with a silenced rifle killing rabbits behind Forstal farm. He carried on firing as I walked out of danger even though I was shining my torch at his likely location. Once I'd got to the safety of the lane I walked along to find out what was going on, and encountered a man claiming to be Shay Harbour(?) He knew about the footpath, he said, and thought his line of fire would be OK.

Any more of that sort of thing, and I'm getting a 50mW green laser and a night vision scope -- after this shone down his bins he'd be hard put to tell up from down, let alone fire his weapon.

Read a Text File with Comments

This is a little Perl idiom to open a text file and read all the non-comment lines.

Key parts are

• <LINELIST> yields all the lines in the filehandle into the default scalar $_
• s/^\s*//; s/\#.*$//; s/\s*$//; removes (==substitutes nothing in place of) first any space at the front of the line second any trailing comment and third any trailing space in $_
• chomp strips the newline from $_
• next if /^$/ skips past the rest of the loop processing if $_ is empty (it matches beginning of line immediately followed by end of line)

All of this could be directed to a named scalar variable, but using the default pays off in compact code that can be cut and pasted elsewhere.

my $listfn="linelist.txt";
open LINELIST, "<$listfn" or die "Open $listfn $!";
while (<LINELIST>) {
    s/^\s*//; s/\#.*$//; s/\s*$//; chomp; next if /^\s*$/;
    print "$_\n"; # Or whatever else you want to do.....
}

Obviously printing is a bit dull -- instead you could drop the lines into an array:

push @linelist, $_;

Use grep to search it:

@results = grep((/$mypatt/i), @linelist);

The i after the pattern makes for case insensitivity, and you have to

use locale;

to get it right for all character sets.

NMAP

This is a perl script that shows what perl does well. It takes a couple of programs which provide useful output -- nmap and nbtstat -- and combines them into a single daily archive showing what's on your network. Key features are:

• The input is a list of named IP ranges.
• The output is written to hosts.txt and yyyy-mm-dd.hosts.txt automatically building an archive of what's up in the networks you care about.

To run it

1. Install nmap and make sure it's in the path. nbtstat is part of any Windows installation.
2. Install Perl, which means Active State.
3. Create a range file that's just a text file with a few lines like these: (Obviously with your network ranges. You can use any range specification that nmap will accept.)

     # my range.txt 
   servers    192.168.10.0/24 
   perimeter  192.168.12.0/24 

4. Make sure your reverse DNS is working, or you won't get any DNS names.
5. Run it with a command like c:\perl\bin\perl nmap.pl range.txt
6. check the output in hosts.txt to see server names, and, for windows servers, domain and server names.

To get the benefit, set it to run every day using a scheduled task (I find this is easiest with a .CMD file containing full path names for everything) and in a few months you'll have some worthwhile history.

# Start of nmap.pl by umacf24
# This program takes a single parameter -- a file containing  pairs.
# Example (but leave off the #)
# servers    192.168.10.0/24
# perimeter 192.168.12.0/24
#
use strict;
use warnings;

# NBTSTAT codes from Jim Halfpenny
my %group  = (  hex("00"), "00 Dom",
  hex("01"), "01 M Browser",
  hex("1C"), "1C Domain Controller",
  hex("1E"), "1E S Browser", # Browser Elections
);
my %unique = (  hex("00"), "00 WS",    # Workstation service
  hex("01"), "01 Msgr", # Messenger Service
  hex("03"), "03 Msgr", # Messenger Service
  hex("06"), "06 RAS Server Service",
  hex("1B"), "1B Domain Master Browser",
  hex("1D"), "1D Master Browser",
  hex("1F"), "1F NetDDE Service",
  hex("20"), "20 SVR", # File Server Service
  hex("21"), "21 RAS Client Service",
  hex("22"), "22 MS EXC Interchange(MSMail Connector)",
  hex("23"), "23 MS EXC Store",
  hex("24"), "24 MS EXC Directory",
  hex("30"), "30 Modem Sharing Server Service",
  hex("31"), "31 Modem Sharing Client Service",
  hex("43"), "43 SMS Clients Remote Control",
  hex("44"), "44 SMS Administrators Remote Control Tool",
  hex("45"), "45 SMS Clients Remote Chat",
  hex("46"), "46 SMS Clients Remote Transfer",
  hex("4C"), "4C DEC Pathworks TCPIP service on Windows NT",
  hex("42"), "42 McAfee AV",
  hex("52"), "52 DEC Pathworks TCPIP service on Windows NT",
  hex("87"), "87 MS EXC MTA",
  hex("6A"), "6A MS EXC IMC",
  hex("BE"), "BE Netmon Agent",
  hex("BF"), "BF Netmon Application",
);

# results stored in an array for re-use
my @nmapout;

my $ofn='hosts.txt';
my $opath='.\\ip\\';

my $header = "Key\t++ Up but unnamed, \n\t** Named but not responding to ping.\n\t?? Improper NBT names\n";
$header .= "Ping scan run between ".localtime(time())." ";

my $ipall; my $ipup; my $ipdown; # Address counters

# Process the file of network names. Run NMAP against the network spec (iprange).
while (<>)
{
  next if (/^\s*#/) ;
  my @line = split /\s+/;
  if (2==@line)
  {
      my $ipname = sprintf "%-15.15s ", $line[0]; # Fixed width
      my $iprange = $line[1];      

      my $cmd = ".\\bin\\nmap -sP -R -oG - $iprange |";    # local nmap
      print STDERR "$cmd\n";
    
      open (NMAP, $cmd);
      while ()
      {
          chomp;
          next if /Smurf/;
          if (/^Host: /)
          {
              $ipall++;
              my $hostline=$_;
              $ipdown++ if ($hostline =~ /Status: Down$/);
              $ipup++ if ($hostline =~ /Status: Up$/);
              my $flag ='   ';
              $flag = '++ ' if ($hostline =~ /\(\)\tStatus: Up/) ;# Un-named
              $flag = '** ' if ($hostline =~ /\([^)]+\)\tStatus: Down/) ;# Named, but not responding
              my $hostip = $1 if ($hostline =~ /^Host: ([0-9\.]+) .+ Up$/);
              my $prefix=$ipname . $flag;
              my $postfix=nbtstat($hostip) if ($hostip);
              $hostline =~ s/^Host: /$prefix/;
              $hostline =~ s/Status: Up$/NBT: $postfix/ if ($postfix);
              # print STDERR "Host Line $hostline | $postfix | $hostip\n";
              push @nmapout, $hostline;
          }
      }
  }
}
$header .= "and ".localtime(time())."\n";

if ($ipall)
{    # Some addresses seen
  $header .= "$ipall addressses pinged:- Up: $ipup, Down: $ipdown\n";
}
else
{
  $header .= "No addresses scanned. NMAP in path?\n";
}

# Preserve an archive Version
my ($sec, $min, $hr, $day, $mon, $yr, $wday, $yday, $isdst) = localtime(time());
$yr = $yr + 1900;
$mon = $mon + 1;
my $prefix = sprintf "%04d-%02d-%02d.", $yr, $mon, $day ;
my $afn="$opath$prefix$ofn";
my $hfn="$opath$ofn";

#Don't overwrite existing hosts file until we have finished scanning.
open (AHOSTS, ">$afn") or die "could not open $afn $!";
open (HOSTS, ">$hfn") or die "could not open $hfn $!";
print AHOSTS $header; print HOSTS $header;
foreach my $hostline (@nmapout)
{
  print HOSTS "$hostline\n";print AHOSTS "$hostline\n";
}
close HOSTS; close AHOSTS;

sub nbtstat
{
  my ($hostip) = @_;
  my $cmd = "nbtstat -a $hostip |";
  my %survey; my $ret;
  my $domain; my $server;

  # print STDERR "survey $cmd\n";
  open (NBTSTAT, $cmd) or die "can't run $cmd $!";
  while ()
  {
      # print STDERR;
      # The meat of the NBTNAME command is in this format: name  type
      if (/^\s+(\S+)\s*<([0-9A-F]{2})>\s+(GROUP|UNIQUE)/i )
      {
          my $nbtname = $1;
          my $nbtclass = $2;
          my $nbttype = $3;
          if ('00' eq $nbtclass)
          {
              $domain = $nbtname if ('GROUP' eq $nbttype);
              $server = $nbtname if (('UNIQUE' eq $nbttype) && ($nbtname !~ /(\~)|(MSBROWSE)/));
          }
          my $desc = ('GROUP' eq $nbttype)? $group{hex($nbtclass)} : $unique{hex($nbtclass)};
          $desc = "$nbtclass $nbttype Unknown" unless $desc;
          # print STDERR "$nbtname $nbtclass $nbttype $desc \n";
          push (@{$survey{$nbtname}}, $desc);
      }
  }
  close NBTSTAT;
  # We should have a good domain name and a good server if we have anything
  if (%survey)
  {
      $ret = ($domain and $server) ?  "$domain\\$server" : '??';
  }
  foreach my $nbtname (keys %survey)
  {
      $ret .= " $nbtname: ("  . join (', ', @{$survey{$nbtname}} ). ")" unless ($nbtname =~ /(\~)|(MSBROWSE)/) ;
  }
  return $ret;
}
# End of nmap.pl

Swirl/Unswirl

Here's the Interpol (rare to see a .int domain) release on operation Vico. That's impressive work by the image experts, but I think the credit lies with the investigator who had the imagination to see that information was still there and the thing was worth trying. That's the leap I would have failed to take, and it's the difference between a proper investigator and the guy who looks at proxy logs.

After red-eye reduction, obscuring faces is probably the second most popular use for home image processing, the home porners generally botch it, and I've often wondered why packages don't include a better tool. Perhaps they can't find a suitably euphemistic name. Anyway, I suppose we'll now see a slew of unswirl tools.

The Approver as a Conceptual Bottleneck

I'm looking at a list of domains groups which control access to removable devices and media through Pointsec Protector (which used to be Reflex Magnetics Disknet Pro). We've had groups for various types of devices and now I'm trying to simplify -- to operate a much cruder level of control.

I'd prefer to leave it as it is, but the membership of the current groups is a mess. The technology is fine, but the control environment stinks. At present we allow or deny access to the groups based on a managers approval: "he has a business need to use a USB key" -- and that makes a good deal of sense. Who else can make that choice?

Who else indeed? Because the managers aren't technical -- so they don't understand what they're approving -- and they don't see any downside from insecure access. Essentially every request gets approved. And in six months time when the the lists have to be recertified, it's probably a different manager, or the original justification is forgotten, and it's easier just to agree. We've got adequate technology, and a process that the auditors think is just fine, and there's no real control at all.

Of course, this isn't just a problem for USB devices. It very easy to fail at this last hurdle by asking approvers to use a discretion that they just can't understand.

I've thought about making these accesses part of the permissions attached to the job description global groups. But that doesn't reduce the problem unless IT security can engage with the role definition approvers, and we don't.

So this is my plan: I'm going to name the groups after the risk, with alarming group names and descriptions:
Risk In -- "Trusted to read data from unknown sources"
Risk Out -- "Trusted to send corporate data to unknown destinations"
Device Risk -- "Trusted to attach untrusted and untested devices"

Let's see whether that gets the message across.

War Against the Aliens

In Arthur C. Clarke's Rendevous With Rama, the world of the 23rd century prepares for a visit by potentially hostile aliens. A minor character, a general, justifies military preparations by claiming that even though humans have complete dominion over a wasps nest, we still leave it alone if we possibly can. So even though the aliens may be vastly more powerful than we are, they would still care enough about nuclear missiles to leave us alone.

I suppose that's comforting. But it's not very comforting. The wasps nest I destroyed on Sunday afternoon had little idea who I was, and no idea why I was attacking. Alas! they didn't know I was afraid of their stings and I would have left them alone if only they weren't so dangerous. Even worse, the means chosen by the superior alien -- me -- was an organophosphorus agent: nerve gas. We might be better off without our stings.