060-063.html

入侵检测的相关教程

			<option value="/reference/dir.middleware.html">Middleware
			<option value="/reference/dir.multimediaandgraphicdesign1.html">Multimedia
			<option value="/reference/dir.networkservices1.html">Networks 
			<option value="/reference/dir.operatingsystems.html">OS
			<option value="/reference/dir.productivityapplications1.html">Prod Apps
			<option value="/reference/dir.programminglanguages.html">Programming
			<option value="/reference/dir.security1.html">Security	
			<!-- <option value="/reference/dir.ewtraining1.html">Training Guides -->
			<option value="/reference/dir.userinterfaces.html">UI
			<option value="/reference/dir.webservices.html">Web Services
			<option value="/reference/dir.webmasterskills1.html">Webmaster
			<option value="/reference/dir.y2k1.html">Y2K
			<option value="">-----------
			<option value="/reference/whatsnew.html">New Titles
			<option value="">-----------
			<option value="/reference/dir.archive1.html">Free Archive		
			</SELECT>
			</font></td>
	</tr>
	</table>
	</form>
<!-- LEFT NAV SEARCH END -->

		</td>
		
<!-- PUB PARTNERS END -->
<!-- END LEFT NAV -->

<td rowspan="8" align="right" valign="top"><img src="/images/iswbls.gif" width=1 height=400 alt="" border="0"></td>
<td><img src="/images/white.gif" width="5" height="1" alt="" border="0"></td>
<!-- end of ITK left NAV -->

<!-- begin main content -->
<td width="100%" valign="top" align="left">


<!-- END SUB HEADER -->

<!--Begin Content Column -->

<FONT FACE="Arial,Helvetica" SIZE="-1">
To access the contents, click the chapter and section titles.
</FONT>
<P>
<B>Intrusion Detection: Network Security beyond the Firewall</B>
<FONT SIZE="-1">
<BR>
<I>(Publisher: John Wiley & Sons, Inc.)</I>
<BR>
Author(s): Terry Escamilla
<BR>
ISBN: 0471290009
<BR>
Publication Date: 11/01/98
</FONT>
<P>
<form name="Search" method="GET" action="http://search.earthweb.com/search97/search_redir.cgi">

<INPUT TYPE="hidden" NAME="Action" VALUE="Search">
<INPUT TYPE="hidden" NAME="SearchPage" VALUE="http://search.earthweb.com/search97/samples/forms/srchdemo.htm">
<INPUT TYPE="hidden" NAME="Collection" VALUE="ITK">
<INPUT TYPE="hidden" NAME="ResultTemplate" VALUE="itk-full.hts">
<INPUT TYPE="hidden" NAME="ViewTemplate" VALUE="view.hts">

<font face="arial, helvetica" size=2><b>Search this book:</b></font><br>
<INPUT NAME="queryText" size=50 VALUE="">&nbsp;<input type="submit" name="submitbutton" value="Go!">
<INPUT type=hidden NAME="section_on" VALUE="on">
<INPUT type=hidden NAME="section" VALUE="http://www.itknowledge.com/reference/standard/0471290009/">

</form>


<!-- Empty Reference Subhead -->

<!--ISBN=0471290009//-->
<!--TITLE=Intrusion Detection: Network Security Beyond the Firewall//-->
<!--AUTHOR=Terry Escamilla//-->
<!--PUBLISHER=John Wiley & Sons, Inc.//-->
<!--IMPRINT=Wiley Computer Publishing//-->
<!--CHAPTER=2//-->
<!--PAGES=060-063//-->
<!--UNASSIGNED1//-->
<!--UNASSIGNED2//-->

<CENTER>
<TABLE BORDER>
<TR>
<TD><A HREF="057-060.html">Previous</A></TD>
<TD><A HREF="../ewtoc.html">Table of Contents</A></TD>
<TD><A HREF="063-065.html">Next</A></TD>
</TR>
</TABLE>
</CENTER>
<P><BR></P>
<P>Having received both SK<SUB>x,y</SUB> and T<SUB>y</SUB> from the TGS, <I>X</I> now can start the dialogue with <I>Y</I> as before. One detail that needs to be mentioned is that the initial message <I>X</I> sends to <I>Y</I> includes T<SUB>y</SUB> and an <I>authenticator</I>. An authenticator is used for <I>X</I> and <I>Y</I> to prove that they are who they claim to be. Principal <I>Y</I> decrypts T<SUB>y</SUB> and obtains the session key SK<SUB>x,y</SUB>. The authenticator was encrypted by <I>X</I> using this session key and therefore can be decrypted by <I>Y</I> only through using the same session key. The authenticator includes the sending principal&#146;s name <I>X</I> and the current timestamp. <I>Y</I> verifies the identify of <I>X</I> by comparing the decrypted timestamp with its own synchronized timestamp. Because the timestamp only can be decrypted with the same session key used for encryption, <I>Y</I> verifies <I>X</I>.</P>
<P>If bilateral authentication is required, <I>X</I> can request this of <I>Y</I>. To meet this requirement, <I>Y</I> takes the timestamp from the authenticator, increments the timestamp by one, encrypts this value with the session key, and sends the result back to <I>X</I>. The incremented timestamp can be decrypted and verified by <I>X</I> using the session key. Figure 2.4 provides a graphical simplification of how two parties use a KDC to begin a secure session.</P>
<P><A NAME="Fig4"></A><A HREF="javascript:displayWindow('images/02-04.jpg',500,393 )"><IMG SRC="images/02-04t.jpg"></A>
<BR><A HREF="javascript:displayWindow('images/02-04.jpg',500,393)"><FONT COLOR="#000077"><B>Figure 2.4</B></FONT></A>&nbsp;&nbsp;Interacting with a Kerberos KDC to initiate a secure communications session.</P>
<P>To summarize, Kerberos provides for two-way, third-party authentication. The key points are as follows:
</P>
<DL>
<DD><B>&#149;</B>&nbsp;&nbsp;A KDC shares a secret with each principal.
<DD><B>&#149;</B>&nbsp;&nbsp;Each principal authenticates to the KDC using this shared secret or password-derived value.
<DD><B>&#149;</B>&nbsp;&nbsp;When an originating principal wants to securely communicate with a receiving principal, the originating principal obtains a new random session key from the KDC.
<DD><B>&#149;</B>&nbsp;&nbsp;The KDC also sends the originator a ticket that is the session key encrypted with the secret of the receiving principal.
<DD><B>&#149;</B>&nbsp;&nbsp;The originating principal sends the ticket and an authenticator to the receiving principal.
<DD><B>&#149;</B>&nbsp;&nbsp;The receiving principal decrypts the ticket and obtains the session key. This key is used to decrypt the authenticator and to verify the identity of the originator.
<DD><B>&#149;</B>&nbsp;&nbsp;If bilateral authentication is required, the receiver can demonstrate knowledge of the shared session key by encrypting a modified timestamp from the authenticator and returning this value to the originator.
</DL>
<P><FONT SIZE="+1"><B><I>Integrating Kerberos and UNIX Login</I></B></FONT></P>
<P>This login process identifies and authenticates the user <I>X</I> into the Kerberos environment, but what does this have to do with a login session on UNIX or NT? Recall from the previous discussions that in UNIX, for example, your UID and GIDs determine who you are on the system and what you can do. In the Kerberos login described, your identity is based on your principal name and your Kerberos password. Environments that integrate UNIX or NT with Kerberos can be confusing because you can have two identities. Because both Kerberos and UNIX implement their own security models, a separate identity is used in both security domains depending on the situation.</P>
<P>Consider the following scenario. If you have a personal UNIX workstation, you will have an account on that system. When you login and start running programs, the UID and GIDs assigned to you form your credentials. All of the programs on that system look at your UID and GIDs to decide what you are permitted to do on the system. Kerberos is a completely different environment. In order for a program to take advantage of the features in Kerberos, that program must be <I>instrumented to</I> or <I>enabled for</I> Kerberos. For you to interact with a Kerberos enabled program, you must have a Kerberos credential. The only way to obtain a credential is to authenticate to the Kerberos server. None of the programs delivered with your UNIX system will by default be able to do anything with your Kerberos credential unless they have been modified to do so. Although, Solaris provides some UNIX network applications that are enhanced to work with Kerberos.</P>
<P>Because the operating system security kernel does not make decisions based on Kerberos credentials, think of Kerberos as an <I>application level</I> framework. Applications are written specifically to work with Kerberos, and these applications sit on top of the operating system. Many of these applications are servers that run with root or special privileges on the operating system. To show you how confusing this can be, the Kerberos enabled application understands and interacts with Kerberos security internally, but the application itself is running within the security context of the UNIX operating system! When you remember that Kerberos is made of several different programs running on various operating systems, this concept does not seem so hard to grasp. Still, it&#146;s an interesting dichotomy that surfaces with security products. Using terminology from Chapter 1, Kerberos augments the security of most operating systems, rather than replacing operating system components. Because Kerberos was designed to improve distributed systems security, it&#146;s not surprising that this is the case.</P>
<P>Operating systems that have been integrated with Kerberos rely on modified login programs or procedures. If the change is transparent to the user, then login will create a shell with your credentials <I>and</I> obtain your Kerberos credentials from the server. In this way, programs that make access control decisions based on your UID and GIDs will work as usual, and any programs needing your Kerberos credentials can obtain these where they are stored on the local system. If integrated properly, the authentication step will not rely on finding your password in /etc/password (or the shadow file), but will use the Kerberos server to verify identity. In this way, the integrated system is taking advantage of a centralized store for user passwords. A word of caution is needed, though. Unless all login paths to the operating system have been modified to query the Kerberos server for authentication, leftover entry points into the system will exist. These leftover paths will use the information in /etc/passwd and might introduce weaknesses into your system.</P><P><BR></P>
<CENTER>
<TABLE BORDER>
<TR>
<TD><A HREF="057-060.html">Previous</A></TD>
<TD><A HREF="../ewtoc.html">Table of Contents</A></TD>
<TD><A HREF="063-065.html">Next</A></TD>
</TR>
</TABLE>
</CENTER>


<!-- all of the reference materials (books) have the footer and subfoot reveresed -->
<!-- reference_subfoot = footer -->
<!-- reference_footer = subfoot -->

<!-- BEGIN SUB FOOTER -->
		<br><br>
		</TD>
    </TR>
	</TABLE>

		
	<table width="640" border=0 cellpadding=0 cellspacing=0>
		<tr>
		<td align="left" width=135><img src="/images/white.gif" width=100 height="1" alt="" border="0"></td>
		
		
<!-- END SUB FOOTER -->

<!-- all of the books have the footer and subfoot reveresed -->
<!-- reference_subfoot = footer -->
<!-- reference_footer = subfoot -->

<!-- FOOTER -->
			
		<td width="515" align="left" bgcolor="#FFFFFF">
<font face="arial, helvetica" size="1"><b><a href="/products.html"><font color="#006666">Products</font></a>&nbsp;|&nbsp; <a href="/contactus.html"><font color="#006666">Contact Us</font></a>&nbsp;|&nbsp; <a href="/aboutus.html"><font color="#006666">About Us</font></a>&nbsp;|&nbsp; <a href="http://www.earthweb.com/corporate/privacy.html" target="_blank"><font color="#006666">Privacy</font></a> &nbsp;|&nbsp; <a href="http://www.itmarketer.com/" target="_blank"><font color="#006666">Ad Info</font></a> &nbsp;|&nbsp; <a href="/"><font color="#006666">Home</font></a></b>
		<br><br>
		
		Use of this site is subject to certain <a href="/agreement.html">Terms &amp; Conditions</a>, <a href="/copyright.html">Copyright &copy; 1996-1999 EarthWeb Inc.</a><br> 
All rights reserved.  Reproduction whole or in part in any form or medium without express written permision of EarthWeb is prohibited.</font><p>
</td>
		</tr>
</table>
</BODY>
</HTML>

<!-- END FOOTER -->