Choosing a Bastion Host by gqz18849


									Choosing a Bastion Host
Chapter 8
Learning Objectives
  Understand the general requirements for
  installing a bastion host
  Select the attributes—memory, processor
  speed, and operating system—of the bastion
  Evaluate different options for positioning
  the bastion host, both physically and within
  the network

Learning Objectives

  Configure the bastion host
  Provide for backups of the bastion host
  operating system and data
  Establish a baseline performance level and
  audit procedures
  Connect the bastion host to the network
Bastion Host

  An application server that has been
  specially hardened and configured to
  function on a network perimeter with an
  interface on the Internet
  A particularly secure point in the network
  Typically provides only one service
Installing a Bastion Host: General

  Your own level of comfort with the system
  Its security
  Its reliability
Steps for Securing a Bastion

1. Obtain a machine with sufficient memory
   and processor speed
2. Choose and install the operating system
3. Determine where the host will fit in the
   network configuration; put it in a safe and
   controlled physical environment
4. Enable the host to defend itself

Steps for Securing a Bastion
5. Install the services you want to provide, or
   modify existing services
6. Remove services and accounts that aren’t
7. Back up the system and all data on it,
   including log files
8. Run a security audit
9. Connect the machine to the network
Selecting the Host Machine

  Number of machines
  Memory considerations
  Processor speed
  Choosing the operating system
How Many Machines?

  Ideal to have only one service on each
  bastion host
  Conduct a threat assessment that identifies
  your most valuable information
  Get as many bastion hosts as you can afford
  to maximize security; combine services on
  one host if you need to save money
Memory Considerations

  Should have multi-gigabytes of hard disk
  storage space
     Vast quantities of log files
     Create a page file
  Not likely to need multi-gigabytes worth of
Processor Speed

  Get the fastest processor you can afford
Choosing the Operating System

  Most important consideration is your
  familiarity with the system:
     UNIX and Linux hosts
     Windows 2000/XP hosts
  Keep the operating system updated
Positioning the Bastion Host

  Sits on the perimeter of the network;
  provides a buffer between the Internet and
  the internal network
  Physical options
  Logical options
Physical Location

  Separate room (or locked server cabinet)
  with proper ventilation, adequate cooling,
  and a backup power system
  Co-locate Web servers and other bastion
  hosts off-site
  Use a hosting service
Co-Locating a Server
Network Location
Securing the Machine Itself

  Aspects of a disaster recovery plan
      Availability of spare equipment
      Frequency of backup
      Secure off-site data storage
      Temporary office space
      Hardware/software insurance
      Frequency of testing the disaster program
Securing the Machine Itself

  Select a secure location
  Install the operating system securely
  Document your work
Select a Secure Location

  Limited access
  Protection with an alarm system with
  battery backup
  Physical computer lock and cable
  Password-protected screen saver and short
  time delay
Install the Operating System
  Reinstall OS with minimum configuration
  Create two partitions on Windows 2000/XP
  bastion host
      One for the OS (C: drive)
      One for other software that will run on the host (eg,
       Web server or DNS server)
  Use only NTFS file system for file storage
  Include virus protection software
  Configure DNS server located on a bastion host in
  DMZ to prohibit unauthorized zone transfers
Document Your Work
  Name and location of bastion host
  Bastion host’s IP address and domain name
  Bastion host’s operating system
  Location of backup files
  What to do in case the system crashes
  Levels of patches that have been made to bastion
  host’s operating system
  Customized scripts that have been developed to
  support the host
Configuring Your Bastion Host

  Make the host defend itself
  Select services to be provided
  Disable accounts
  Disable unnecessary services
  Limit ports
Making the Host Defend Itself

  Set up a honey pot server
  Set up an Intrusion Detection System (IDS)
  on the bastion host
     Place a host-based IDS system directly on the
      host itself, or
     Place a network-based IDS on the firewall or
      router that protects bastion hosts in the DMZ
Selecting Services to Be

  Use latest version of server software
  Install available security patches or updates
  Install a system patch to guard against an
  application that can be subject to buffer
URLs for Latest Versions
Special Considerations for UNIX

  Security_patch_check utility
     Automates process of analyzing security
      patches already on the system and reporting on
      patches that should be added
  Trusted Computing Base (TCB) Check
     Makes sure that software you run is trusted
  System logging
Special Considerations for
Windows Systems

  Run Microsoft Baseline Security Analyzer
  Use IIS Lockdown Tool
  Delete unneeded files in
  %SystemRoot%\system32 folder
Special Considerations for
Windows Systems
Disabling Accounts
  Delete all user accounts from the bastion host
  Rename Administrator account to deter hackers
  Keep a “dummy” account called Administrator to
  serve as a honey pot account
  Use passwords that are 6-8 alphanumeric
Disabling Unnecessary Services

  Disable services that enable the host to do
  routing or IP forwarding
  Take out hardware features you won’t use
  Do not disable any dependency services
  Each time a service is stopped, test the
  Document every single change you make
Limiting Ports

  Stop traffic on all but the ports you actually
  need to provide services on the network
  Scan the system for active ports and close
  any that are being used by “unknown” or
  unneeded services
Limiting Ports
Handling Backups

  Binary drive image backup
     Best kind of backup
     Includes all information, including OS,
      applications, and individual files
  Copy all relevant files to disk
  Use system’s built-in back-up utility
Auditing the Bastion Host

  Test for vulnerabilities and evaluate
      How well does bastion host protect itself from
      How well does it protect internal LAN behind it
       from attack?
  Establish a baseline for system performance
Connecting the Bastion Host

  Test system and check it against baseline
  level of performance to make sure it still
  functions correctly
  IPSentry can be used to monitor network
  performance and send alerts in case of
  Audit the host periodically
Monitoring the System with
Chapter Summary
  Proper configuration of a bastion host
  General requirements that apply to most
  bastion hosts
  Factors to consider when selecting a host
  Possible locations for a bastion host
  Deciding what functions the host should

To top