Remote Access LAB -490-493

Labs from 490 to 493 is to establisg SSH connection from Linux Machine as a server and XP as client, and because there were some problems setting up an SSH services in Linux box I did the lab using windows based server to be the SSH service server

Remote Access

Two proprietary remote access solutions are the built-in product on Microsoft clients and servers and the VPN products from Cisco systems. An alternative to these is based on Open Source Software (OpenSSH, Putty and VNC).

· Research these 3 Open Source offerings and document the installation steps for them (approx 8 pages including screen captures).

· In your report, include your comments on how secure you believe this remote access solution is.

In this "Case Project" we learned how to use OpenSSH to tunnel VNC traffic. tools used are: Server Side (The machine that you want to make the connection to) OpenSSH: To RUN OpenSSH from local, Press here To see the website: http://sshwindows.sourceforge.net/ UltraVNC: To RUN from local, Press here To see the website: http://www.uvnc.com/download/index.html Client Side (The machine that you want to make the connection from) PuTTY: To RUN from local, Press here To see the website: http://www.chiark.greenend.org.uk/~sgtatham/putty/ UltraVNC Viewer: To RUN from local, Press here PC You Wish to Access Remotely Secure Shell Setup Download OpenSSH for Windows from on the PC you wish to control from a remote location. Run the setupssh.exe executable program from the saved location. Select the defaults until you’re prompted with the following. Only the Server is required for connecting from a remote PC, but the Client may be used to connect to other SSH servers if desired. Use the defaults and you’ll be prompted with the following message. Note: In order to connect from a remote PC you’ll be logging in using your Windows username and password so ensure that it’s a secure one. Open up a command prompt (click Start · Run, type cmd, and press ) and Change Directory (CD) to the OpenSSH installation directory (Program Files\OpenSSH is the default) and then CD into the bin directory by typing cd “\Program Files\OpenSSH\bin” and press . Use mkgroup to create a group permissions file for the local groups by typing mkgroup –l >> ..\etc\group and press . Use mkpasswd to add authorized local users into the passwd file by typing mkpasswd –l –u >> ..\etc\passwd. For example, the following creates a group permissions file and adds the local user Ibrahim. The OpenSSH server listens for traffic on TCP port 22 by default. Start the service as shown in the following screenshot UltraVNC Setup Download UltraVNC from on the PC you wish to control from a remote location. Run UltraVNC-102-Setup.exe . Select the defaults until you’re prompted with the following screenshot. Only the Server is required for connecting from a remote PC. we’ll be using the viewer to check the installation, and the other components may be desired The Viewer is used to connect to other UltraVNC Servers. Select the defaults until you’re prompted with the following screenshot. Select Register UltraVNC Server as a system service, Start or restart UltraVNC service, Configure Admin Properties. Select the defaults and install. Since UltraVNC requires a password and one hasn’t been set yet, the following error will occur. Acknowledge the error and configure the admin properties as follows. Ensure that you assign a VNC Password (up to 8 characters) at this point so you can connect later. Since the OpenSSH server is running on the same machine as the UltraVNC server, we need to Allow Loopback Connections. Select OK and use the defaults for the remaining dialogs. After completing the UltraVNC server installation, test the loopback configuration by connecting using the viewer on the same PC. To do this, click Start · Run, type vncviewer, and press to open the viewer as shown in the following screenshot. To attempt the connection, specify 127.0.0.1 or localhost as the VNC Server and select Connect. After selecting Connect, you will be prompted for the VNC password assigned in the administrative properties section above (not the windows user password). After entering the correct password, you will see the standard UltraVNC window of the local desktop, then disconnect using the Close Connection button (don’t simply close the window). Remote PC PuTTY Setup As a prerequisite to configuring PuTTY to connect to the PC you wish to control from a remote location, OpenSSH needs to be configured as described in the Secure Shell Setup section above. Download PuTTY on the remote PC, use mostly default settings with a few exceptions. one of the settings get a more reliable connection during file transfers by setting the Seconds between keepalives to 15 seconds. Set up the SSH tunnel by setting the Source port to the UltraVNC server’s listening port (5900 is default) and a Destination of 127.0.0.1:5900 and select Add. After selecting Add an item will be added to the Forwarded ports section as L5900 127.0.0.1:5900. In addition, 127.0.0.1 may be replaced by localhost. Define the remote PC’s Host Name or IP address, as shown in the following screen. Once PuTTY has been configured to match your OpenSSH setup, select Open from the preceding dialog. The first time you try to connect you will receive the following warning. . To add it to PuTTY’s cache select Yes. If connection is successful, you will be prompted for your Windows password as shown below. After successfully entering the password you’ll move to the user’s home directory (\Documents and Settings\User). . UltraVNC Viewer Setup As a prerequisite to configuring the UltraVNC Viewer to connect to the PC you wish to control from a remote location, the UltraVNC Server needs to be configured as described in the UltraVNC Setup section above. Download the UltraVNC Viewer from http://sourceforge.net/project/showfiles.php?group_id=63887 on the remote PC. There is no installation required to run the viewer so simply run the vncviewer.exe executable and connect to the local host VNC Server as shown in the following. After selecting Connect, you will be prompted for the VNC password assigned in the administrative properties section above (not the windows user password). After entering the correct password, you will see the standard UltraVNC view of the remote desktop. When you finish your session, ensure that you properly close the UltraVNC connection using the Close Connection button and type exit in the PuTTY window to close out the OpenSSH session (don’t simply close the windows). The communication using SSH is almost secure and can make the transfer of data as it goes through in a safe transmitting using the authentication and encryption

Notes:

• If the PC you wish to access does not have a static IP address assigned by your internet service provider (which is typically the case for a home PC) you may want to sign up for a free DynDNS account so you can connect to your home network using a host name that will automatically track your dynamic public IP address.
• Refer to http://the.earth.li/~sgtatham/putty/0.59/htmldoc/Chapter4.html#config for a full explanation of the PuTTY configuration.
• Copy the vncviewer.exe, UnZip32.dll and Zip32.dll files from the UltraVNC server PC if these were installed above. The DLL-files are required only for the file transfer capability.

Hands-On Project 497: Installing and configuring certificate services

Install the CA Service

To install the CA service perform the following steps:

Click Start > Control Panel > Add or Remove Programs.
In Add or Remove Programs, click Add/Remove Windows Components.
Under Components, select Certificate Services.



You will get a warning about domain membership and computer renaming constraints, and then click Yes.

On the CA Type page, click Enterprise root CA, and then click Next.

On the CA Identifying Information page, in the Common name for this CA box, type the name of the server, and then click Next.

On the Certificate Database Settings page, accept the defaults in the Certificate database box and the Certificate database log box, and then click Next.

You will get a prompt to stop Internet Information Services, click Yes.

Enable Active Server Pages (ASPs), by clicking Yes.
When the installation process is completed click Finish.

Hands-on Project 117 Encryption and decryption

Encryption Process Summary

The following list summarizes the steps EFS performs to encrypt a file:

1. The user profile is loaded if necessary.

2. A log file is created in the System Volume Information directory with the name Efsx.log, where x is a unique number (for example, Efs0.log). As subsequent steps are performed, records are written to the log so that the file can be recovered in case the system fails during the encryption process.

3. Base Cryptographic Provider 1.0 generates a random 128-bit FEK for the file.

4. A user EFS private/public key pair is generated or obtained. HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\EFS\CurrentKeys\CertificateHash identifies the user's key pair.

5. A DDF key ring is created for the file that has an entry for the user. The entry contains a copy of the FEK that has been encrypted with the user's EFS public key.

6. A DRF key ring is created for the file. It has an entry for each Recovery Agent on the system, with each entry containing a copy of the FEK encrypted with the agent's EFS public key.

7. A backup file with a name in the form Efs0.tmp is created in the same directory as the file to be encrypted

8. The DDF and DRF key rings are added to a header and augment the file as its EFS attribute.

9. The backup file is marked as encrypted, and the original file is copied to the backup.

10. The original file's contents are destroyed, and the backup is copied to the original. This copy operation results in the data in the original file being encrypted because the file is now marked as encrypted.

11. The backup file is deleted.

12. The log file is deleted.

13. The user profile is unloaded (if it was loaded in step 1).

If the system crashes during the encryption process, either the original file remains intact or the backup file contains a consistent copy. When Lsasrv initializes after a system crash, it looks for log files under the System Volume Information subdirectory on each NTFS volume on the system. If Lsasrv finds one or more log files, it examines their contents and determines how recovery should take place. Lsasrv deletes the log file and the corresponding backup file if the original file wasn't modified at the time of the crash; otherwise, Lsasrv copies the backup file over the original, partially encrypted file and then deletes the log and backup. After Lsasrv processes log files, the file system will be in a consistent state with respect to encryption, with no loss of user data.

The Decryption Process

The decryption process begins when a user opens an encrypted file. NTFS examines the file's attributes when opening the file and then executes a callback function in the EFS driver. The EFS driver reads the $EFS attribute associated with the encrypted file. To read the attribute, the driver calls EFS support functions that NTFS exports for EFS's use. NTFS completes the necessary steps to open the file. The EFS driver ensures that the user opening the file has access privileges to the file's encrypted data (that is, that an encrypted FEK in either the DDF or DRF key rings corresponds to a private/public key pair associated with the user). As EFS performs this validation, EFS obtains the file's decrypted FEK to use in subsequent data operations the user might perform on the file.

EFS can't decrypt an FEK and relies on Lsasrv (which can use CryptoAPI) to perform FEK decryption. EFS sends an LPC message by way of the Ksecdd.sys driver to Lsasrv that asks Lsasrv to obtain the decrypted form of the encrypted FEK in the $EFS attribute data (the EFS data) that corresponds to the user who is opening the file.

When Lsasrv receives the LPC message, Lsasrv executes the Userenv.dll (User Environment DLL) LoadUserProfile API function to bring the user's profile into the registry, if the profile isn't already loaded. Lsasrv proceeds through each key field in the EFS data, using the user's private key to try to decrypt each FEK. For each key, Lsasrv attempts to decrypt a DDF or DRF key entry's FEK. If the certificate hash in a key field doesn't refer to a key the user owns, Lsasrv moves on to the next key field. If Lsasrv can't decrypt any DDF or DRF key field's FEK, the user can't obtain the file's FEK. Consequently, EFS denies access to the application opening the file. However, if Lsasrv identifies a hash as corresponding to a key the user owns, it decrypts the FEK with the user's private key using CryptoAPI.

Because Lsasrv processes both DDF and DRF key rings when decrypting an FEK, it automatically performs file recovery operations. If a Recovery Agent that isn't registered to access an encrypted file (that is, it doesn't have a corresponding field in the DDF key ring) tries to access a file, EFS will let the Recovery Agent gain access because the agent has access to a key pair for a key field in the DRF key ring.

Decrypted FEK Caching

Traveling the path from the EFS driver to Lsasrv and back can take a relatively long time—in the process of decrypting an FEK, CryptoAPI uses results in more than 2000 registry API calls and 400 file system accesses on a typical system. The EFS driver, with the aid of NTFS, uses a cache to try to avoid this expense.

Decrypting File Data

After an application opens an encrypted file, the application can read from and write to the file. NTFS calls the EFS driver to decrypt file data as NTFS reads the data from the disk and before NTFS places the data in the file system cache. Similarly, when an application writes data to a file, the data remains in unencrypted form in the file system cache until the application or the cache manager uses NTFS to flush the data back to disk. When an encrypted file's data writes back from the cache to the disk, NTFS calls the EFS driver to encrypt the data.

As stated earlier, the EFS driver performs encryption and decryption in 512-byte units. The 512-byte size is the most convenient for the driver because disk reads and writes occur in multiples of the 512-byte sector.

Hands-on-project 48 -- Encrypting a File

How to Encrypt a File

1. From Windows Explorer or My Computer, navigate and select the folder you want encrypted. In this example, a folder "Encrypted Folder" will be encrypted so that any file placed inside this folder will be encrypted.
   
   
   
   
2. Right click the folder and choose properties and then click the Advanced... button.
   
   
   
   
3. Check the Encrypt contents to secure data attribute. Note that a folder may be compressed or encrypted, but not both. Click OK again when done.
   
   
   
   If there are already files and or subfolders inside this folder, an additional pop up dialog will appear, otherwise you are done (go to step 4). This additional dialog (Figure 4) will present two options for you:
   
   • Apply changes to this folder, subfolders and files - Choose this to encrypt the folder so that everything inside this folder is encrypted, and this includes files and folders that are later moved to or created inside this folder.
   • Apply changes to this folder only - Choose this to encrypt only the folder so that all files/folders subsequently moved or created in this folder will be encrypted. Existing files and folders are not encrypted.
     
   Choose one radio button and then click OK.
   
   
   
   
4. Notice the folder name turns green when the folder has an encrypt attribute set. New files and folder placed inside will also have green names (encrypted). When you copy or move a file out of an encryption folder, the green color of a file/folder name means encryption has been preserved. If the color is black, it means the file has been decrypted.
   
   

EFS File Sharing - Sharing Your Encrypted Files

You may share an encrypted file with additional users after you have encrypted the file. You can only do this on a per file basis. EFS file sharing allows other users you designate with the ability to decrypt and encrypt your original encrypted file. These users may also move, copy, or delete the encrypted file if they have such file permissions.

Once a file has been initially encrypted, file sharing is enabled through a new button. After right clicking and selecting the Advanced Properties of an encrypted file, a user may be added by selecting the new Details... Button.

You will be presented with a window showing who has EFS access to this file.

Click the Add... button to add more users.

You may add other users (not groups) from the local machine or from the Active Directory, provided the user has a valid EFS certificate. Users without a valid EFS certificate will not be shown. A valid EFS certificate is automatically created whenever a user encrypts a file, and the user can simply encrypt a file to have one created automatically. Select a user you want to add. If the user is in active directory, you can find the user via the Find User... button. Click OK to return and view the user has been added to the EFS file share list. Click OK again (3 times) and you are done.

Backing Up Your EFS Certificate and Keys

It is important to back up your EFS certificate and keys in the event your user account profile may become corrupted or deleted, in which case you will not have the private key to decrypt your files. If did not backup your keys, but have permitted other users to EFS share your encrypted files, those users can recover your data. You should back up your certificate and keys to an external storage media (floppy, USB mini drive) and have it locked away.

To export your EFS keys and certificate from your computer for backup purposes, do the following:

• Launch Microsoft Internet Explorer web browser.
• From the Tools menu, click Internet Options.
• On the Content tab, in the Certificates section, click Certificates.
• Click the Personal tab.
• Notice there may be several certificates present, depending on whether you have installed these certificates for other purposes.
  
  
  
  
• Select one certificate at a time until the Certificate Intended Purposes field shows Encrypting File System (Red highlighted area on image). This is the certificate that was generated when you encrypted your first file/folder.
• Choose the Export button to start the Certificate Export Wizard, and click Next.
• Choose Yes to export the private key, and then click Next.
• Choose Enable Strong protection, and then click Next.
• You will be prompted to type a password to protect your private key. Do not forget this password. Reconfirm the password and click Next.
• Specify where you want to save the certificate and key into a single file with a .pfx extension. You can specify this path to a storage media such as a floppy disk or USB mini drive and click Next.
• Choose Finish and you are done. Move the media to safe storage.

Class Note

class note

prim number is divided by itself or 1
relativley prime
modualar
find the additive inverse 22 mod 47
find the additive inverse 12 mod 100

multiplicative inverse of
9 mod (10)
17 mod (23)

Homework:
from the net research: ECB electronic code book - CBC - one round of DES - RSA

class excersie

Vigenere cipher
the gold is buried under the plane tree
6-9-12-15-22

A B C D EFGHIJKLMNOPQRSTUVWXYZ

Class notes

Security in IT Network:

• response
• eduction
• authentication
• non-repudution
• disastor recovery
• threats
• attacks
• integrity
• firewall
• policy
• risk management
• physical security

type of cryptography:

Classic Cryptography

• Transpositions
• Double Transpositions
• Pig-Latin
• Grille
• Vigenere (taken in the class)
• Caesar Substitution (taken in the class)
• Atbash
• Playfair
• Bifid

Monoalphabetic Substitution (taken in the class)

• Pig Pen
• Map Cipher
• Diagraphic Substitution
• Jefferson Cipher
• Polybius Chequerboard