Novell Security Manager
powered by Astaro Configuring Security Manager

Gert Hansen

Chief Software Architect, Astaro

ghansen@astaro.com

Rob Sabey

Product Manager, Novell Inc.

rsabey@novell.com

Agenda

Novell Security Manager Overview

Security Applications

Installation Requirements

Demonstration

Basic Configuration

Remote VPN Access

Authentication

Upcoming Features

Q&A

Novell Security Manager Overview

Novell Security Manager
powered by Astaro

Six critical network security applications

Firewall

VPN Gateway

Virus Protection

Intrusion Protection

Spam Protection

Surf Protection (URL Filtering)

Integrated management platform

Management

Platform

Surf

Protection

(URL Filtering)

Virus

Protection

Firewall

VPN

Intrusion

Protection

Spam

Protection

Linux

Kernal

Built on a Hardened Linux Kernel

Novell SUSE LINUX

Hardened

Installed and updated automatically

Administrator needs no knowledge of Linux

Protects all networks and systems

Management

Platform

Surf

Protection

(URL Filtering)

Virus

Protection

Firewall

VPN

Intrusion

Protection

Spam

Protection

Linux

Kernal

Designed for Security

SuSE8 platform

Minimalistic approach (includes only software that is needed)

Chroot concept for all applications communicating with the outside

Uses Posix capabilities

Very simple update concept that keeps all parts of the system at the latest patchlevel.

Software Installation

Runs on Intel systems

Performance scales in a linear fashion with the CPU

Novell Security Manager is a “Software Appliance” that installs in one seamless process from a CD

Security Applications

Firewall

Stateful Packet Inspection

Packet filtering – inspects packet headers, applies rules on source, destination and service

Stateful packet inspection – tracks events across a session to detect violations of normal processes

Application-Level Deep Packet Filtering

Scans packet payloads to enforce
protocol-specific rules

Security proxies to simplify management

HTTP, DNS, Socks, POP3, Ident, SMTP

NAT (Network Address Translation) and
masquerading DoS (Denial of Service Attack) protection

DMZ

External

users

Internet

Internal

Networks

Firewall

Email

Database

Web

WAP

Virtual Private Network (VPN) Gateway

Encrypts data to create a secure private
communications “tunnel” over the public Internet

Supports multiple architectures

Net-to-Net, Host-to-Net, Host-to-Host

Advanced encryption

Supports all major encryption methods

Supports IPSec, L2TP, and PPTP VPNs

Native Windows, IPSec, and MacOS x clients

Many authentication methods

Internal certificate authority

Full Public Key Infrastructure (PKI) support

Remote

Office

Main Office

Road

Warrior

Home Office

VPN

Gateway

VPN

Gateway

Internet

Intrusion Protection

Identifies and blocks application- and protocol- related probes and attacks

Database of over 2,000 patterns and rules

Probing, port scans, interrogations, host sweeps

Attacks on application vulnerabilities

Protocol exploitations

Messaging, chat and peer-to-peer (P2P) activities

Intrusion detection and prevention

Notify administrator, or block traffic immediately

Powerful management interface

One click to enable and disable rules, change between detection and prevention

Easy to add and customize rules

External

users

Internet

Internal Users and Resources

Email

Database

Web

Intrusion

Protection

Rules

Secure Email Subscription

Virus scanning for SMTP and POP3 traffic

Multiple virus detection methods

Virus signatures, heuristics (similarities), emulation (execute code in a protected environment)

Database of 100,000 virus signatures

Multiple methods to identify spam

Sender address verification, Realtime Blackhole Lists, header and text analysis, whitelists, blacklists

Flexible management

Can specify file formats and text strings to block

Emails and attachments can be dropped, rejected with message to sender, passed with a warning, quarantined

Spam

Protection

Internal

Users

Email

Server

Email

Spam

Secure Web Subscription

Virus scanning for HTTP traffic

Multiple virus detection methods

Database of 100,000 virus signatures

URL Filtering to enforce policies on appropriate use of the web

Administrators can define web use policies based on 58 categories of web sites

Checks against the largest URL database available - 20 million categorized web addresses

New! -Gateway spyware protection

Blocks downloads of spyware software

Prevents infected systems from sending information back to the spyware server

Internal

Users

Database

of

Classified

URLs

Web Sites

Cache of

Classified

URLs

Intercepts

Spyware Messages

From

Infected PCs

Novell Security Manager Demonstration

Typical Environment

Users on LANs

DMZ with e-mail server and web server

Remote users

External Network

Internet

Router

Internal Network

Web

Server

FTP

Server

Email

Server

DMZ

Heterogeneous Environment

Novell

Security

Manager

Basic Configuration

Setup System

Configure basic settings (admin email, log in)

Configure NICs (external, DMZ)

Configure DNS

Update to latest version

Allow internal Network to access the internet via HTTP

Configure masquerading for internal network

Add packet filter rule for HTTP

Allow Internet to access WebServer in DMZ

Configure NAT settings

Add packet filter rule

Configure Remote VPN Access

Configure PPTP access

Configure L2TP over IPsec access

Configure Certificate based IPsec tunnel (using Novell IPSec Client)

Create Certificate Authority

Create Firewall Certificate and assign it

Create User Certificate and export it

Configure Roadwarrior Tunnel

Show firewalling on ipsec user objects

Authentication

Supported authentication methods

Local user database

Radius

LDAP

Applications to authenticate

WebGui

SMTP-proxy

HTTP-Proxy

SOCKS proxy

PPTP Server

L2TP Server

More configuration samples

SMTP (virus and spam scanning)

HTTP (Virus, URL and Spyware blocking)

Intrusion Protection configuration

Backup and Restore

Reporting

Log files

A

Virus protection is a critical weapon in any security arsenal. It is essential to block viruses, worms, and similar threats before they reach email servers and user desktops.

Astaro is one of a handful of companies that offer two types of virus protection – virus protection for conventional email, and virus protection for files and emails downloaded from a web browser.

Astaro’s virus protection utilizes several virus detection methods to maximize the number of viruses blocked. The methods include scanning emails and attachments for code known to be associated with a virus, using heuristic methods to spot code that is similar to known virus patterns, and emulation – letting code execute in a protected environment where problems can be detected without allowing infection.

Astaro Security Linux checks suspicious code against a database of 80,000 virus signatures.

You also get a lot of management flexibility. You can specify file formats and text strings to block, and you can have suspicious emails and attachments dropped, rejected with a message sent to the sender, passed through to the user with a warning, or quarantined so that the administrator can examine the email later and take an appropriate action.

The gateway virus scanning provided by Astaro allows you to react very quickly to new viruses before they can reach your internal systems. It therefore provides a critical supplement to desktop virus scanners, which typically are difficult to update rapidly across an entire organization.

Excessive web surfing by employees can be a major drain on productivity. Employees who download inappropriate or copyrighted material can create legal liability for the organization as a whole.

Surf Protection lets you measure web activity to create a web usage policies, and then block access to web sites that violate that policy.

You can define web usage policies based on 58 categories of web sites, including those associated with nudity, gambling, criminal activity, and legal but inappropriate activities like surfing web sites for shopping, auctions, entertainment, and job searching.

Astaro Security Linux uses a database of 20 million categorized web addresses – the largest URL database commercially available. This database was compiled using extremely sophisticated classification techniques, including text analysis, visual recognition of symbols and logos, and the calculation of how much flesh on a web page comes from faces versus other parts of the body.

You can create your own whitelist and blacklist to override or extend the URL database. Separate whitelists and blacklists can be created for different groups of users.

And you can simply measure and report on web activities, to help identify problems and set priorities, or you can block URLs so they are inaccessible to users.

2003-12-08T12:43:39