NuFW

Now User Filtering Works

Netfilter User Filtering Works

Why user filtering ?

NuFW concepts

Functionnalities

NuFW implementation

Perspectives and evolution

Motivation

Enterprise security policies are user based

Build a strict implementation of security policy

Find a cost effective way to manage user differenciation

Bring flexibility

Problem 1 : Group based policy

French school :

Rule : separation between administrative network and pedagogic network

Need : teachers need extended access even on pedagogic VLAN

Hospital :

Difference between : doctor, nurse, cleaner, painter

Different users on same computer

Problem 2 : Mobility

Multi sites entity :

Managing user mobility in the company (ex: admin must have access from all sites to main servers)

Enterprise wide rules : deploy rules for every sites

All full-open VPN must be banished

WiFi protection :

all accesses are authenticated

alternative to a-priori authentication like 802.1x

should work even on multi-user systems

Existing solutions

Mainly IP-based

https authentication

authpf

VPN based

Proxy and socks method

Performance issue

Not “natural” :

network flow is modified

traffic does come from only one host

IP based authentication

(IP == User) is a really bad idea

No multiuser machine support

Insecure :

arp spoofing

no proper timeout

one SNATed host can authenticate on entire network

“A priori authentication”

authentication is done before packet has been sent, so spoofing is always possible via timeout

NuFW main idea

“A posteriori” authentication :

doing authentication after packet has been sent

no spoofing possible

Connection tracking usage :

one authentication per connection

no impact on bandwidth

Method :

“A posteriori” => interaction with client

NuFW main idea

Use userspace queueing feature of Netfilter :

Block a packet

Ask user to prove he has sent this packet

Check if user has permission

Authorize or not the packet

Problems :

How to be sure of the identity

Find a correct mechanism

Basic algorithm

Need a client on user computer that sends authentication for each packet

Authentication server receives packet from firewall and user authentication

Authentication server brings datas together by merging on IPV4 headers

Authentication server takes decision

Components

nufw daemon : kernel->userspace and reverse

nuauth : NuFW authentication server

receives client authentication packets

receives nufw authentication requests

nuclient : Client sending authentication request to nuauth (when it needs to be done)

Poll mode

nufw

Server

nuauth

Delay consideration

Some datas :

treatment delay: бt (15ms)

link latency: бl (LAN: 1ms, WAN: 50ms)

poll interval: бp (100ms)

Value of latency :

Formula: бt+бl+бp/2

LAN: 66ms, WAN : 115ms

Push mode

nufw

Server

nuauth

Push mode latency

Some data :

treatment delay: бt (20ms)

link latency: бl (LAN: 1ms, WAN: 50ms)

Values of latency :

Formula: бt+3бl

LAN: 28ms, WAN : 170ms

Welcome to the real world

Client is not perfect:

Multiple authentication can be done in one check

Push mode:

Authentication prior to message from nuauth

Theory problem

Client DOS: check cost time

Need an minimum interval (or assume bad guys need to suffer)

per-user QoS and routing

Firewall knows user and puts a mark with user id:

ip_queue_vwmark patch for ip_queue

Obtained capabilities :

User based routing

User based quality of service

Works for :

multiuser systems (citrix server, unix server)

distributed users

Application filtering

Software client runs on client :

can find application and OS

Advanced filtering:

Extended logging

Log dropped packets

ip_queue does not log

extended information available at nuauth level

Log all packets:

user activities monitoring

authenticated conntrack

Available methods :

Syslog, MySQL, PostgreSQL

Nulog : log analysis for Netfilter/NuFW

SQL logging

nufw

Server

nuauth

SQL

Single Sign On

Authenticated conntrack:

application knows IPV4 tuple

Unicity at a given time for a given tuple

A protocol independent authentication method

a module on server side

a single SQL request

SSO schema

nufw

Server

nuauth

SQL

Group filtering

User group based policy can be easily achieved

direct authentication on user directory

powerful rules management (directly implement the policy)

Could even :

Filter by application

Set up QoS based on user

Do extensive logging

Authenticate users on internal applications

A mobility solution

A real authentication

more secure : no spoofing

can be used simultaneously with level 2 method

real per-user routing :

one hotspot for multiple firms, NuFW takes care of splitting flows

Unix servers case

Let's have a debian apache server running :

root should only access HTTP for update

www-data should not be able to go out for any protcol

admin user has some right

With NuFW :

root can only do HTTP with /usr/lib/apt/methods/http

www-data is blocked

admin user has separate rules

nufw

A small daemon:

very few dependencies

small memory footprint : 1684ko in action

no CPU intensive tasks

Tasks:

get packets from kernel, send messages to nuauth

receive answers and send them back to the kernel

nuauth

A modular, multithreaded daemon:

several pools of threads (glib pool)

module for all external interaction

Relatively small memory footprint:

whole system runs on linksys router

no huge structure are stored in memory

Available nuauth modules

User authentication:

plaintext, dbm, ldap, PAM

Acl storage:

plaintext, ldap

Logging:

syslog, MySQL, postgreSQL

Implementation tips

User authentication:

permanent communication channel

authentication is performed once

Cache system:

avoid to stress acl storage system

treat correctly HTTP-like case

Simple Benchmark

Use netcat to open a connection to a webserver behind the firewall

Full SSO system is active :

25ms for full request

without NuFW : 4ms

interactivity is correct

1000 parallel connections :

NuFW : 7 secs

Netfilter alone : 6.5 secs

Evolution and perspectives

libnfnetlink_conntrack:

no specific rules for authenticated conntrack

rules expiration capabilities

libnfnetlink_queue :

Be able to work with other projects

Performance improvments

Let's get commercial

All source code for GPL/BSD system is GPL :

NuFW : nufw, nuauth

Nulog : log analysis interface

Nuface : rules management interface

Client for Microsoft Windows is sold under proprietary licence. Why :

Want a free client ? switch to Linux

Microsoft coding is really really not fun

Conclusion

NuFW is :

Advanced filtering :

per user

per application

per OS

Advanced Logging :

SQL storage

Single Sign On

Advanced routing and QoS

The End

NuFW :

http://www.nufw.org

Admin tools :

Nulog : http://www.inl.fr/Nulog.html

Nuface : http://www.inl.fr/Nuface.html

INL :

web : http://www.inl.fr

mail : contact@inl.fr

Questions ?

Eric Leblond (aka Regit)

INL

e.leblond@inl.fr

I will now present NuFW to you which is a authenticating firewall build on top of netfilter

Here are the outlines of my speech.

Firstly, I will present the motivations of the project, and then continue with a description of the concept that NuFW introduces.

These new ideas have induced some interesting functionnalities.

After all these theoritical aspects, I will describe the implementation of the project and eventually, end on perspectives and the upcoming evolution of the software.

In a company or an institution, security policies are about people, they are not about IPs nor computers.

Security can not afford approximation : We want to be able to strictly implement security policy. In this respect, when we are talking about user we should really talk about user.

User separation is often done by VLAN or different material

Mobility is a key point nowadays, users are moving from a site to another, from a computer to another

Why do companies or institutions need a group based security policy. Well, people are different, let's take the example of french school, the rule is ... but teacher have need...

Let's take a second example, in a hospital, there's a big difference from a security point of view between ......

And there is the mobility issue : different users can connect at different time on the same computer.

2005-09-06T22:48:22