Symark Software Solution Notes
A series of short papers describing the application of our software
To Unix performance and system security issues

Controlling, Delegating, Logging and Auditing Root Actions
With Symark PowerBroker

Summary

This document discusses the use of Symark PowerBroker software to address some of the security and audit problems inherent in Unix.  The purpose of the document is to demonstrate the value of Symark PowerBroker as a tool for eliminating or reducing risk in environments where information security and risk avoidance are considered important.

Symark Software
5716 Corsa Avenue, Suite 200
Westlake Village, California 91362
Phone:	(818) 865-6100
FAX:	(818) 889-1894
Email:	info@symark.com
Web:	www.symark.com

Copyright © 2001, Symark Software
Symark PowerBroker is a trademark of Symark Software.  Other trademarks and registered trademarks are property of their respective owners.
Introduction

Symark PowerBroker is a suite of programs that provides important functionality not otherwise available on Unix systems. The suite encompasses two areas.  First, it allows the full administrative powers of the root and other administrative accounts to be shared selectively among many users without having to share the root password.  Secondly, it provides a full and indelible audit trail of all actions occurring in important accounts such as root.  An indelible audit trail is one so structured that it cannot be modified subsequent to being created and thus does not permit anyone to conceal or obfuscate what has happened.  Until Symark PowerBroker, no tools existed to provide this functionality in Unix networks.  As a result, companies running Unix have been limited in their ability to share administrative power and have been open to risk from the essentially unauditable actions of system administrators.

Having the ability to share access to the root account selectively without sharing the root password allows system administration to be safely delegated among many users.  Each user can be given the power to perform only those administrative actions that fall under that user’s responsibility.  Without Symark PowerBroker, any user requiring even the slightest amount of administrative power must be given the root password, which gives them access to the full power of root.  Thus a person who should only be responsible for mounting disks and tapes would in fact be able to modify corporate databases, reboot machines, add users, and so on.  Similarly, someone who should only have access to add or delete users to the system would have full access to killing other user’s jobs, impersonating other users, etc.  Symark PowerBroker prevents these abuses from occurring, while still allowing people access to the administrative power that they need for the legitimate functions they are to perform.

Maintaining a full and complete audit trail of administrative actions allows sites to track exactly which actions have been undertaken by which people, when, and on which machines.  Symark PowerBroker’s audit logs are sufficiently complete to contain a full record of the working environment of each administrative program.  Included with Symark PowerBroker are programs to query, extract, and present information selectively from the log files.  Log files may also be viewed using a standard Web Browser and therefore, if required, can be viewed by the administrator from any location convenient for him/her.  Further, Symark PowerBroker can record keystrokes and replay an entire root session, allowing an after-the-fact look at exactly what a user typed and what was seen on the screen during a session.  Without Symark PowerBroker, no way of creating such an indelible record of administrative actions exists in Unix.

Generally speaking, Symark PowerBroker increases the level of control and accountability surrounding the root account on a Unix system, with the goal of allowing Unix sites to better make use of their systems.  In particular, Symark PowerBroker is designed to add the following functionality to Unix so that safe, accountable system administration procedures can be implemented:

Selective Access to Administrative Power
   provides the ability to selectively assign administrative powers to specified users.

Generation of Indelible Audit Trails
   provides the ability to log indelibly (for audit purposes) all administrative actions.

•	provides the ability to record and replay administrative sessions to obtain an accurate
      record of everything typed and seen during such sessions.

Protection Against Viruses
   provides a mechanism to protect system administrators from viruses and Trojan horses.

Central Management of Heterogeneous Networks
•	provides all of these functions across a (possibly heterogeneous) network, with central 
      configuration and management, and with full fault tolerance (no single point of failure).

How Symark PowerBroker Works

Symark PowerBroker is a set of programs, daemons, and configuration files for Unix systems.  Users ask Symark PowerBroker to run programs for them, usually as root.  Symark PowerBroker consults one or more central machines to determine if the user’s request should be accepted or rejected.  If accepted, the program is run, and the user can interact with it in a normal manner.  If rejected, the program is not run, and the user is informed that the request is not allowed under the site’s policies.  In either case, a full log of the request and its outcome is stored on a specified machine.

Each network includes one or more Symark PowerBroker master daemons, which accept or reject requests according to policies in a configuration file.  These policies are specified using a very powerful yet easy to use policy specification language.  This language allows a system administrator to control who is allowed to run which programs, on what machines, during what times of the day, as what user, and with what runtime environment.  Due to the wide variation of site needs, the policy language is flexible, allowing fine-grained control of all policy parameters if needed.

Preventing Exposure to Risk from System Administration

Due to the historical lack of emphasis in Unix on secure system administration, Unix sites are exposed to a number of risks from system administration.  Symark PowerBroker provides additional functionality for networks of Unix machines that allows either elimination or reduction of these risks.  To a large extent, those that cannot be eliminated or reduced can at least be made subject to logging for audit purposes, such that they may be discovered and resolved after the fact.

This section enumerates system administration risks, and describes how Symark PowerBroker may be used to counter them.

Preventing the Dissemination of root’s Password

Problem:  If more than one person is to be able to perform system administrative duties, each such person must know the password to the root account (under which virtually all system administration actions are performed).  The more people that know the root password, the harder it is to manage the password and the higher the risk that the password will become known by unauthorized people.  This can happen in a number of ways: some people will write the password down where others can read it; some will store it on-line where it can be viewed by other users; some users may be able to watch over an administrator’s shoulder as it is being typed in; some will speak the password over the phone to other administrators, and the conversation may be overheard; some will require temporary access to the root account and will therefore be given the password, but the only way to revoke that user’s access to root is to change the password, which requires informing every system administrator that it has changed - often it will not be changed, and the users will retain their “temporary” access permanently.  For the same reason, administrators who have moved on to other positions may continue to have root access long after they have changed jobs.

Solution:  By allowing people to acquire access to root level functionality without knowing the root password, Symark PowerBroker provides the required functionality (i.e.: access to root) without the associated password management problems.  Since the root password is never given out, it will never become freely available.  Access to root level functionality may be allowed or revoked at any time without concern as to the status of the root password.

Providing a Record of Administrative Actions

Problem: Unix provides no selective mechanism for indelibly recording the programs that are run in the root account.  It is possible to turn on Unix accounting, but this records every activity on the system, not just root actions, and creates a huge amount of raw data.  Even then, since root has the ability to modify or delete any file on the system (including the accounting file), it is an easy task for someone with root access to erase from the accounting logs any traces of actions that they wish to conceal.  In addition, the Unix accounting logs only provide a record of the programs that were run, not of the input and output that was typed into those programs.  Thus it is not possible to examine exactly what actions a user undertook while accessing the root account.  So, the only mechanism that Unix provides to log the actions of its users cannot provide a reliable log of system administrative actions.

Solution: When using Symark PowerBroker, all system administrative actions being undertaken by users can be logged to a separate logging machine to which those users do not have ready access.  Since the location of the logs is separate from the machines on which the users have power, the logs are protected against attempts to alter or delete their contents, and are thus reliable indicators of actions carried out.  Each site can choose the level of detail of logging that occurs, and can decide on which machine(s) the logs reside.  In addition to logging system administrative events and actions, Symark PowerBroker can generate a record of all input and output typed and seen by users performing administrative actions.

Ensuring Accountability of Administrators using the root Account

Problem:  If many people require access to the root account, Unix provides no good way of discerning which root action was undertaken by which administrator.  Even when full Unix accounting is turned on, actions occurring in the root account are not distinguishable according to which user initiated the action.  The result is that it is impossible to assign responsibility for any root action.

Solution:  Symark PowerBroker records complete detailed information about each administrative action, including the name of the user who initiated the action, the date and time, the machine on which it was initiated, the directory, the environment, and so on.  As a result, it is possible to attribute any such action to the account that initiated it, and through that, to the person responsible.

Providing a Detailed Log for Analyzing Each root Action 

Problem: Unix provides no way to indelibly record the actions occurring in a program running in the root account.  Thus even if it is known who initiated an action, and which program was run, it is impossible to tell exactly what was done by that program.  The result is that an after-the-fact analysis of a root session cannot determine exactly what occurred in that session.  Thus it is generally not possible to determine what somebody did to the system during a root session.        

Solution: Symark PowerBroker provides the ability to record all keystrokes and output generated during a root session.  Since this session record is generally stored on a secure logging machine, the person whose session is being recorded cannot modify it.  Symark PowerBroker also provides a replay program that allows certain people to replay a recorded session, seeing exactly what was typed, and exactly what appeared on the screen during the session.  The record contains complete information about the session, including who initiated it, when and where it was initiated, what environment it operated under, what was typed, and what appeared on the screen.  It is also possible to determine when each line of input was typed.  This record of root sessions provides sufficient evidence to determine not only who was responsible for a root action, but also exactly what was done, when it was done, and what its immediate effect was.

Allowing root Powers to be Shared in a Selective Way

Problem: If more than one person is to have administrative responsibility for parts of a Unix system, it is desirable to assign to each person only those privileges that are necessary to complete that person’s tasks.  For example, one person might need privileges to add and delete users, another person to maintain a corporate database and a third to kill errant processes and line printer jobs.  Unfortunately, without a great deal of effort, Unix provides no safe way to assign only some root privileges to each person.  Instead, many sites grant full root privileges to each person, and in doing so expose themselves to risks of accidental or deliberate actions by each person.  For example, a person responsible for adding users might accidentally or deliberately modify or delete a database file.     

Solution: Symark PowerBroker allows each site to set up policies which stipulate exactly which programs each user can execute as root.  In addition, Symark PowerBroker allows the policies to specify on which machines the programs may run, from which machines they may be requested, during what times of day and what days of the week they may be initiated, and so on.  Further, Symark PowerBroker allows the full run-time environment of all such programs to be fully specified, eliminating any risk that a flawed run-time environment might allow root actions other than those that have been foreseen to be undertaken by a user. 

Guarding Against Viruses in the root Account

Problem: Unix does not provide a mechanism to automatically check that a program being run with root privileges is unmodified, and thus in particular that it has not been modified by a virus, or that it has not been replaced with a Trojan horse program.  The result is that a system cracker might hope to gain access to root power by modifying or replacing a program, and then waiting until someone with authorization to access root power runs the modified file.

Solution: Symark PowerBroker allows the a priori calculation of a checksum for each program to be run in the root account (and indeed in any other specified account).  At run-time, if the current checksum does not match the previously computed one, the program is rejected, and a log entry is generated.  This checksum mechanism provides a good level of protection against running virus-modified programs.

Automatically Logging Out Idle Terminal Sessions

Problem:  Someone who is legitimately accessing the privileges of the root account may temporarily abandon a workstation or terminal, perhaps to take a phone call or go to a meeting.  While away from the terminal, the person may forget to terminate the root session before leaving for an extended period, perhaps overnight or over a weekend.  While the legitimate user is away, unauthorized people may access the power of root by merely sitting at the terminal and beginning to type in commands.  In this way, unauthorized users can gain access to root power even without knowing the root password.

Solution: Symark PowerBroker allows each site to set up idle-time timers, which automatically terminate a root session if nothing has been typed for more than the specified amount of time.  As a result, the problem of unauthorized use of a privileged user’s terminal is diminished.

Preventing Actions Occurring After Normal Office Hours

Problem: Unix provides no convenient mechanism of granting access to root privileges during certain times of the day (such as regular office hours), and denying access outside those hours.  As a result, there is no method of preventing the after-hours abuse of a computer system by someone with legitimate administrative privileges.

Solution: Symark PowerBroker can be easily configured to grant or restrict access to root privileges at certain times of the day, or on certain days of the week.  Each user can be restricted in the hours during which root privilege is available, according to the site’s policies.  As a result, after-hours usage of administrative privileges can be eliminated.

Providing Safe Access to Group Accounts

Problem: Sometimes it is useful to create a group account - an account shared by several people.  Such accounts are useful for storing shared data or programs.  However, Unix provides no way of linking the use of a group account back to the user accessing it.  Even when Unix accounting is turned on, actions occurring in a group account will not be associated with the original user who is using the account.  Thus there is no way of assigning accountability for actions occurring in group accounts back to the users initiating actions in the account.  In addition, the group account’s password must be shared by all of the users using the account, since they must specify the password when accessing the account.  As a result, revoking a user’s access to the account is a nuisance, since the account’s password must be changed, and all other users must be informed of the change.

Solution: Symark PowerBroker can be configured to grant or deny access to a group account in a similar way that it grants or denies access to the root account.  When using Symark PowerBroker, all usage of the group account is logged, including information as to which user initiated all actions occurring in the account.  In addition, since the group account’s password does not have to be specified when accessing the account, revoking a user’s access can accomplished without having to inform or inconvenience other users.  All that is required is to remove the user from the segment of Symark PowerBroker’s configuration file that controls access to the group account.

Defeating Network Monitoring of Passwords

Problem: When users access accounts on many machines across a local or wide area network, they typically have to send their passwords across the network so that the remote machine can validate their access request.  The passwords are sent across the network in plain, unencrypted form.  Anyone with access to a PC or Macintosh computer on the network can monitor these passwords as they are sent across, resulting in an unintended leak of one user’s password to another user.  This can be particularly devastating if it is the root account’s password that is sent over the network.  Public Domain programs exist for PC, Macintosh, and Unix computers that allow this kind of network monitoring or snooping.  Thus no programming expertise is required to gain a user’s password in this way.

Solution: Symark PowerBroker can optionally encrypt all user input and control messages sent over the network, so that anyone using a network monitoring program will see encrypted gibberish rather than unencrypted passwords and data.   Symark PowerBroker’s encryption algorithms include DES and Triple DES, which provide a high degree of security.

Providing a Record for Post Mortems 

Problem: Many system problems occur after a mistake has made by a system administrator.  File access permissions can be changed while in the wrong directory, commands executed on the wrong machine, command arguments mistyped, and so on.  Unix provides some tools (e.g. the script program) for recording sessions, but none of these allow you to examine what was typed, when it was typed, and so on during a session.  As a result, it is difficult to examine what actions precipitated a system problem after the fact.

Solution: Symark PowerBroker can store a complete record of a session, including what as typed, and when it was typed.  This record is typically stored on a secure machine that is different from the machine on which the session is executing.  As a result, even if the machine on which the session was executing has now crashed, it is possible to examine the exact sequence of commands or actions that caused the problem.  The insight gained from this information can be extremely useful for avoiding such problems in the future.

Use of Centralized Repositories (e.g. LDAP)

Problem: Keeping policies up to date can be difficult when the required data changes frequently or is kept in a central repository.

Solution: Symark PowerBroker can access databases using the Lightweight Directory Access Protocol, LDAP, for up-to-date data.  This would typically be data stored on secure machine or central site that allows access through the LDAP V2 API. Access to such a data base allows policies to use current data  without the need to continually update policies on the PowerBroker primary and failover master machines.

Dynamically restricting Users

Problem: Sometimes it is necessary to grant a user access to a program to perform their jobs, but that program may have some functionality beyond what the user needs.

Solution: Symark PowerBroker can allow the user to run programs, while monitoring for specific keystroke sequences.   The administrator then has the choice of forbidding these sequences and terminating the user’s job, or allowing the job to continue but logging the suspicious sequences to the system logs.

Account Control for Other Products

Problem: Many products require account control over sensitive data.  It is important that only the appropriately authorized individuals be allowed access to the account control programs.  In some cases, programs themselves may have a division of responsibility between individuals and thus it is important to limit people to perform only the tasks that they are authorized to perform.

Solution: Symark PowerBroker can be set up with policies to restrict users to have access only to the subset of account control programs for individual products (e.g. Oracle etc.)  In this way responsibilities for the various products can be delegated as appropriate without the concern that someone can make changes which are not within their area of responsibility.

Symark PowerBroker is provided by Symark Software, a software development company specializing in performance and system software for Unix computers.  To evaluate Symark PowerBroker, please contact Symark Software at (818) 865-6100, or send electronic mail to info@symark.com.  Symark’s fax number is (818) 889-1984.