Novell Nsure® Audit –
Secure Logging In An Enterprise Environment

Jamie Price

Bedrock Managed Services and Consulting

jprice@bedrock.com

Jason Arrington

Novell, Inc

jarrington@novell.com

Frank Green

VP – Network Administration

Bank Mutual

frank.green@bankmutual.com

Agenda

Secure Logging In An Enterprise Environment

Introductions

Company Background

Why Nsure Audit?

Deployment

Issues

Configuration/Setup

Administration

Non-Repudiation

Future

Background

Bank Mutual Background

Company Facts

72 locations (74 by May 1st)

820 users

IS Staff of 13

Providing financial services for 120,000 households and businesses

$3.4 Billion Asset Size

5th Largest Banking Institution in Wisconsin

NASDAQ symbol BKMU

Company Overview – Audit History

Initially used AuditCon

Was acceptable at time

Progress/development of requirements made it ineffective

New requirements needed monitoring, notification, and non-repudiation

Tried NAAS and LTAuditor

NAAS flawed and cumbersome

LTAuditor not quite up to par (no live log)

Company Overview – Topography

Topology

GREEN BAY

MILWAUKEE

T1 between corporate offices (now T3).

R/W replicas at each remote.

R/W and master at closest corporate office.

ROOT

MS801

NWR

NER

BR71

BR72

BR89

OPER

BR041

BR064

CORP

BR001

BR033

SER

Why Nsure Audit?

Why Nsure Audit?

Corporate Needs

Regulatory compliance (GLBA/SARBOX/OTS)

Member confidence/information protection

Reputation/image protection

Management reporting desires

Technical Needs

Met the requirements

Integrated well not only with environment but with other initiatives in place

Priced competitively

Future development plans fit well into Banks long term IT vision

Deployment

Deployment

Needs Determination

Regulatory compliance

Generation of management reports

Immediate notification of

Admin activity

Intruder lockout

Admin user rights modifications

Server down

File salvage activity

Deployment

Platform

Netware® 6.5

Nsure Audit 1.0.1

MYSQL 4.1

Hardware (x2)

HP Proliant DL380

3 x 72gb HDDs

2gb RAM

Single Processor (No HyperThreading)

641 RAID Controller

Deployment

Considerations

Bandwidth considerations

60% of offices at 64k

T1 between corporate offices

Backup/rollover strategy would need to be created

Rollovers configured through iManager

OSQL currently in use for other MYSQL database backups – only needed to modify script and apply to Naudit MYSQL

Optimization considerations

Optimizing logging compared to replica placement

Inherent issues with multiple logging servers

Nsure Audit Overview

Netware

eDirectory

NSure Audit

•

Lite

-

Server Specific

•

Full

-

Enterprise

SIM and Other

Novell Products

(Full)

-

3rd Party

Products

(Full)

Secure Logging Service

Monitors (Full)

Reports

Logs

Email

SNMP (Full)

SYSLOG (Full)

CVR* (Full)

Storage (Full)

Java (Full)

Notifications

Email

SNMP (Full)

SYSLOG (Full)

CVR* (Full)

Storage (Full)

Java (Full)

Notifications

Event Collector

Pluggable Storage

Storage System

FLAT

SQL

FILE

Oracle

Report

Generator

Deployment

Initial Nsure Audit Design

Main Table

Login/Logout Table

MiscEvent Table

MYSQL Channel to Main Table

MYSQL Channel to Login/Logout Table

MYSQL Channel to MiscEvents Table

SMTP Channel to Internal Mail Server

Notify for Login/Logout to Login/Logout Channel

Notify for MiscEvents to MiscEvents Channel

Notify for account deletes to SMTP Channel

Deployment

Pilot and Demonstration

Piloted on VMWare 4.5

Same versions as deployment

All tables, channels, and notifications (bar SMTP) created and tested

Demonstration before senior management – confidence issues after NAAS experience

Deployment commencement approval obtained

Deployment

Initial Deployment

Deploy to Green Bay first

Placed replicas on Naudit server/relieved DB server

Configured rollover script

Configured DS event logging on Naudit-090

Configured SMTP notifications for critical events

Issues

Issues – login monitoring

Login/Logout Events

Desired central record of login/logout events

Login logout events replicated differently

TID10086452

PA required on server holding replica that user logs into.

All events bar login/logout logged through RW on NAUDIT-090

Login/logout sent on remote servers

Issues – login monitoring

1

2

3

4

5

6

1. User logs into tree. Needs to log in using preferred server that holds a replica of user object.

2. User login activity occurs in replica.

3. Configured eDirectory event-login-is sent to MYSQL database via main MYSQL Channel.

4. Login notification monitors events in database.

5. Login notification sends event notification to Login channel.

6. Login channel configured to populate Login Table and enters events into same.

Login Channel

MYSQL

Main Table

Login Notification

Login Table

Issues - SLP

SLP Configuration

With AUDITDS running on corporate server for login/logout noticed logging of remote user logins.

Investigation found SE region and NE region users randomly logging into Milwaukee corporate.

SLP had not been fully or optimally deployed.

Configured SLP with multiple DA's as per coolsolutions article

Once deployed ran Naudit queries to check – all users logging into correct replicas.

Issues - SLP

Client Workstation

DA-10.10.10.10

DA-20.20.20.20

SCOPE

090_ndap.090_bindery,090_excl

034_ndap,034_bindery,034_excl

NAUDIT090-SLPDA

Server Parameters

SLP ENABLE UA MULTICAST=OFF

SLP ENABLE DA GENERAL MULTICAST=OFF

SLP SCOPE LIST 090_EXCL,034_EXCL

SLP STATIC SCOPE LIST=OFF

SLP MULTICAST RADIUS=1

SLP DA DISCOVERY OPTIONS=4

SLP BROADCAST=OFF

Startup.ncf

SET SLP SCOPE LIST 090_EXCL,034_EXCL

SLP.CFG

REGISTER TYPE “ndap.novell” to SCOPE “090_NDAP,034_NDAP”

REGISTER TYPE “bindery.novell” to SCOPE”090_BINDERY,034_BINDERY”

DA IPV4, 10.10.10.10

DA IPV4, 20.20.20.20

OTHER SERVERS – SA's

Server Parameters

SLP ENABLE UA MULTICAST=OFF

SLP ENABLE DA GENERAL MULTICAST=OFF

SLP SCOPE LIST 090_EXCL,034_EXCL

SLP STATIC SCOPE LIST=OFF

SLP MULTICASDT RADIUS=1

SLP DA DISCOVERY OPTIONS=4

SLP BROADCAST=OFF

Startup.ncf

SET SLP SCOPE LIST 090_EXCL,034_EXCL

SLP.CFG

REGISTER TYPE “ndap.novell” to SCOPE “090_NDAP,034_NDAP”

REGISTER TYPE “bindery.novell” to SCOPE”090_BINDERY,034_BINDERY”

DA IPV4, 10.10.10.10

DA IPV4, 20.20.20.20

Client Workstation

DA-20.20.20.20

DA-10.10.10.10

SCOPE

034_ndap,034_bindery,034_excl

090_ndap.090_bindery,090_excl

NAUDIT034-SLPDA

Server Parameters

SLP ENABLE UA MULTICAST=OFF

SLP ENABLE DA GENERAL MULTICAST=OFF

SLP SCOPE LIST 034_EXCL,090_EXCL

SLP STATIC SCOPE LIST=OFF

SLP MULTICAST RADIUS=1

SLP DA DISCOVERY OPTIONS=4

SLP BROADCAST=OFF

Startup.ncf

SET SLP SCOPE LIST 034_EXCL,090_EXCL

SLP.CFG

REGISTER TYPE “ndap.novell” to SCOPE “034_NDAP,090_NDAP”

REGISTER TYPE “bindey.novell” to SCOPE”034_BINDERY,090_BINDERY”

DA IPV4, 20.20.20.20

DA IPV4, 10.10.10.10

OTHER SERVERS – SA's

Server Parameters

SLP ENABLE UA MULTICAST=OFF

SLP ENABLE DA GENERAL MULTICAST=OFF

SLP SCOPE LIST 034_EXCL,090_EXCL

SLP STATIC SCOPE LIST=OFF

SLP MULTICAST RADIUS=1

SLP DA DISCOVERY OPTIONS=4

SLP BROADCAST=OFF

Startup.ncf

SET SLP SCOPE LIST 034_EXCL,090_EXCL

SLP.CFG

REGISTER TYPE “ndap.novell” to SCOPE “034_NDAP,090_NDAP”

REGISTER TYPE “bindery.novell” to SCOPE”034_BINDERY,090_BINDERY”

DA IPV4, 20.20.20.20

DA IPV4, 10.10.10.10

Issues – Bandwidth Consumption

Event Flow Optimization

Care necessary due to the impact of excessive events crossing the wire.

File level monitoring desired for remote locations but could not be utilized due to bandwidth restrictions (Naudit 2.x).

DS event logging at remote sites necessary but would result in duplicate events.

Minimal initial install due to the soon to be released 1.0.2 “Do Not Send Replicated Events” feature.

1.0.2 deployed and granular DS logging turned on.

Configuration/Setup

Configuration/Setup

System Functions

Logging

Reporting

Monitoring and Notification

System Components

Software

Configuration/Setup

Netware Event Logging

Configuration/Setup

File System Event Logging

Configuration/Setup

eDirectory™ Event Logging

Configuration/Setup

Functions

Logging

Tables

Channels

Selection screens in iManager

Transaction Grouping

Monitoring

Heartbeats – monitors for things that don't happen

Filtered Notifications – monitors for things that do happen

CVR – Critical Value Reset

Configuration/Setup

Functions cont'd

Notification

SMTP

Event Variables

Reporting

Queries

Wizard or Standard SQL

Crystal Decisions software

Configuration/Setup

Event Field Variables

Variables are constructed by specifying an $ character, followed by a two character code representing the variable format and value. For example:

$FV

Characters representing the format (F) can be one of the following:

T – Time (UTC	S – String	i – Ipv4 Internet Address (host

localized)

D – Date (UTC	X – Hexidecimal Number	B – Boolean (Yes/No)

localized)

N – Number (32bit	R – RFC822 format date/time	b – Boolean (True/False)

unsigned)

n – Number (32bit	I – Ipv4 Internet Address (network

signed)	order)

Configuration/Setup

R – Source IP Address

C – Platform Agent Date

A – Adult Service Date

B – Originator

H – Originator Type

U – Target

V – Target Type

SE – Description

Y – Sub Target

1 – Numerical value 1

2 – Numerical value 2

3 – Numerical value 3

S – Text 1

To use the $$ variable in the SMTP Channel object's Recipient field, this value must be an e-mail address. For more information, see SMTP Channel Object.

T – Text 2

To use the $T variable in the SMTP Channel object's Recipient field, this value must be an e-mail address. For more information, see SMTP Channel Object.

F – Text 3

O – Component

I – Event ID

L – Log Level

M – MIME Hint

X – Data Size

D – Data

G - Grouping

This variable returns the value of the Notification object's Description field. The value is unique in that it is not provided by the logging application, but by the Notification object that directed the event to the current Channel driver. The Notification object's description is sent with the event to the Channel driver. For more information on Notification object's Descriptino field, see Application Objects or Heartbeat Objects.

Table Rollover Configuration

Table “Expiration”

$T= Default Table Schema

$e= Create Table Options

$l= Table name defined in

Channel Object configuration

$n=now

Security Rights Change Notification

SMTP Channel

Resulting Message

MySQL Control Center

Configuration/Setup

Components

iManager Plug-in

Nsure Audit Reporting Tool

MySQL ODBC driver and DSN

MySQL Control Center

Crystal Decisions (Optional)

Configuration/Setup

ODBC setup: http://dev.mysql.com/downloads/connector/odbc/3.51.html

Queries

Queries

iManager

MySQL Control Center

Nsure Audit Reporting Tool

Wizard or Standard SQL

Export to text, html or CSV file

iManager Query Configuration

Queries

Sample Query

Queries

Sample Query

MySQL Control Center

Administration

System Administration

MySQL Command-Line Utilities

Scripts

NLMs on Netware, EXEs on Windows

Can be complex and error-prone

MySQL Control Center

MySQL Administrator

GUI

Backup/Restore

Health Monitor

MySQL Control Center

MySQL Administrator

Backup Configuration

Backup Configuration

Backup Configuration

MySQL Health Monitor

Non-Repudiation

Non-Repudiation

Non-Repudiation

Applications are authenticated through the use of digital certificates and application id's.

Events are digitally signed.

Events can then be chained.

Auditor assessment post Nsure Audit install proved positive.

Non-Repudiation

First Event Failure

Future

Nsure Audit – New Features

Nsure Audit 1.0.3 – released with OES

Mostly a bugfix release

Plugin support for iManager 2.5

Backwards compatible with iManager 2.0.2

Platform Agent SLS Failover

One primary and multiple secondary SLS configured

Fails over to cache only if no SLS can be contacted

Available with both Java and Native Platform Agents

Nsure Audit – New Features

Nsure Audit 2.0 – Scheduled Summer 2005

Platform Agent Filtering

Windows Event Instrumentation

Extended iManager 2.5 support

Enhanced Monitoring

Telephony Driver

JMS Driver

Legacy application log parser

Syslog

Groupwise® POA / MTA

Zen Application Logs

Challenges:

Complexity, Regulatory Mandates, Threats—Inside and Out

GLBA, SOX, OTS, HIPAA, Good practices

Penalties – Loss of Reputation, Loss of Customers, Financial Penalties

SEC has received $776 Million in appropriated funds

Filed 199 Financial fraud and reporting cases in 2003

350 enforcement actions from late 2003 to mid-2004

Suspended 32 companies from trading

Barred 110 executives from working again

We have to know what's happening on our networks.

BUS245-Nsure Audit

2003-12-08T12:43:39