Software Defined Network

Software Defined Network (SDN)

A Software defined network or SDN is a technology for virtualizing the network layer and network management systems. Basically, it is a centralized architecture and useful at Data Centre devices, wide area network devices and large campus networks. 

We can virtualize a network so that can break the direct connection between our applications and virtual servers as well as our physical network. It is possible to manage a virtualized network infrastructure by providing the tools to configure virtual network objects and policies. We have the network controller which provides centralized management, configuration, monitoring, and troubleshooting of both our virtual and physical network infrastructure. The SDN Applications or programs explicitly, directly, and programmatically communicate their network requirements and desired network behaviour to the SDN Controller via a northbound interface (NBI). The SDN Controller is nothing but one software or application to manage the SDN.

The Hyper-V Network Virtualization which helps to extract applications and capacities from the underlying physical network by using virtual networks. Hyper-V Virtual Switch which offers the ability to connect virtual machines to both the virtual networks and the physical networks as well as security, isolation and service level policy enforcement. 

It is an advanced architecture and is manageable, cost-effective, and dynamic. It is ideal for today’s applications due to its high bandwidth.

If we discuss about CISCO, it comes with Cisco ACI and industry leading SDN solution for Data Centres. It provides automation, consistency, multi cloud acceleration, container integration and zero trust network protect. In addition to those it also provides Data Centre Network assurance and Insights. 

In SDN technology, open flow protocol is used for communication that gives access to the forwarding plane of a network switch or router over the network. 

The SDN architecture can be;

• Directly programmable
• Centrally managed
• Open standard

Some of the SDN Controller features:

SDN controller have many important features which needs to be considered while deployed. Here are some of the features mentioned below;

• The SDN solution shall support centralized management through Declarative Policy Engine or SDN Controller and it shall program all the networking policies consistently across any workload in physical and virtual environments.
• The SDN Solution shall automate networking policies and service overlay provisioning for the Bare metals, Virtual Machines.
• The SDN Solution shall support Overlay VXLAN, Geneve or equivalent tunnel.
• The solution shall provide integration with cloud management systems using open interfaces like RESTAPI or equivalent.
• Centralized management appliance or SDN Controller must support multi tenancy from management perspective and provide Role Based Access Control per tenant for the tenant management.
• SDN Controller shall provide dynamic device inventory of the Fabric as well as current network topology of the fabric. It must also validate the cabling connectivity and generate alarms in case of wrong or faulty connectivity.
• The SDN solution shall support granular role-based access control policies and support AAA using Local User authentication/ External RADIUS/External TACACS+ protocols.

-DR

 

Cyber Security | 20 ways to harden your server

20 ways to harden your server

Server hardening

Server hardening a technique to making it harder to break into the servers or systems. This is very important aspects to keep your critical data and device secure. Below are the 20 points a server or system administrator should take care of it.

1. Uninstall any unneeded or unused services from your system. Because every extra service becomes your extra vulnerability.
2. Disable unwanted communication ports.
3. Similarly, do not install unnecessary software and applications in your server or system. Because the extra applications depend upon on additional services and additional ports and that’s means presence of some additional vulnerabilities.
4. Keep your device security patches up to date. This is very crucial one. Whenever one OEM or vendor announces their security patch released information, the hackers behind the screen notices it as that announcement was gone on public domain. So immediately the hacker checks who have not patched till and penetrates those systems. 
5. The organization should disable any unneeded hardware and physical ports or devices.
6. Implement BIOS password, so when someone gains access to your server and attempt to reboot the server, then no changes will be there.
7. The wake on feature should be disabled in the server. So that no one can wake on server from network or outside of network.
8. Avoid using insecure protocols that send your information or passwords in plain text and use data encryption for all your communication to and from server.
9. When using Linux, SELinux should be considered. Linux server hardening is a primary focus for the web hosting industry, however in web hosting SELinux is probably not a good option as it often causes issues when the server is used for web hosting purposes.
10. User Accounts should have very strong passwords and user should change the password on a regular basis and same passwords should not be reused. Implement strong password policy. Lock accounts after too many login failures. Often these login failures are illegitimate attempts to gain access to your system. Do not permit empty passwords.
11. Implement SSH Hardening such as: set idle time out interval, limit the maximum authentication attempts, Disable X11 forwarding, disable empty passwords, etc.
12. Disable direct root logins and switch to root from a lower level account only when necessary. Can Install Root Kit Hunter an unix-based tool that scans for rootkits, backdoors and possible local exploits.
13. Configure the system firewall (Iptables) or get a software installed like CSF or APF. Proper setup of a firewall itself can prevent many attacks.
14. Disable unwanted binaries and hide BIND DNS Sever Version and Apache version.
15. Maintain server logs; mirror logs to a separate log server.
16. You can Install Logwatch and review logwatch emails daily. Investigate any suspicious activity on your server.
17. Use brute force and intrusion detection systems.
18. Install Mod security as Webserver Hardening as well harden the php installation. Refer to (https://www.hardened-php.net/)
19. Install Linux Socket Monitor to Detects/alerts when new sockets are created on your system, often revealing hacker activity in the network.
20. Maintain regular back up of your server and system.

-DR

NAS Protocols | SMB and CIFS

NAS Protocols

There are many NAS protocols such as SMB, FTP, NFS, SFTP, CIFS, HTTP. Lets overview the important one's below;

Server Message Block (SMB)

SMB is a network file sharing protocol and is used at windows machine, known as Server Message Block. SMB was originally designed by Barry Feigenbaum at IBM in 1983 and later it was modified by Microsoft. SMB works in a client server architecture, where a client sends specific requests and the server responds consequently. One unit of the SMB protocol precisely deals with access to filesystems, such that clients may make requests to a file server. The SMB protocol sometimes called as a response request protocol, that means it communicates several messages between the client and server to establish a link. It operates in Layer 7 and over TCP/IP protocol. 

The latest SMB 3.1.1 released in 2015 with windows 10 and windows server 2016 with enhancement in adding advanced encryption and preauthorization integrity.

Securing the SMB protocol

It is known that the SMB shares typical file in some Windows Sever are not encrypted and can be viewed by Microsoft Message Analyzer. However later the end to end encryption option was introduced in windows 8 and windows server 2012. 

As we heard the popular and most critical ransomware attack was happened link to early versions of the SMB protocol that were exploited during the WannaCry ransomware attack through a zero-day exploit called EternalBlue with CVE code CVE-2020-0796 and was a critical severity level.

There is a flaw in the new SMBv3 compression mechanism potentially allows an attacker to take down or take over a Windows system. Example of some operating system which were vulnerable to SMB based attack were, 

• Windows 10 Version 1903 for 32-bit Systems
• Windows 10 Version 1903 for 64-bit Systems
• Windows 10 Version 1909 for 32-bit Systems
• Windows 10 Version 1909 for 64-bit Systems

To address the above vulnerability, one need to patch the operating system, or someone can disable the SMB with following PowerShell command;

Set-ItemProperty-Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force

SMB uses either port no 139 or 445. So, to protect the SMB ports we can use firewalls and strong policies. We need to keep enabled of the firewall or endpoint protection. VPN can also be good option to encrypt and protect the network traffic. If you want to isolate the network traffic, then a VLAN configuration is also advisable.

If any windows system does not play as server and client role, then some steps can be taken to secure the SMB port such as;

• Block all the inbound TCP traffic at SMB port no 445
• Disable the inbound connections: File and Printer sharing (SMB-In), Netlogon Service (NP-in), Remote event log management and remote service management.
• Can restrict access from trusted IP ranges and devices.
• Need to configure a security rule for the outbound firewall rule with exceptions for the "Allow the connection if it is secure" and "Allow the connection to use null encapsulation" settings.
• Configure windows defender firewall.
• Configure servers for isolation from network such as; Security group filters, WMI filters, configure IPsec, configure key exchange, configure data protection and authentication etc. 

CIFS

There is another protocol called CIFS stands for Common Internet File System was an earlier version of SMB.  It is a network file system protocol used for providing shared access between printers and system. It also works as client server model. This protocol is a low scalable but reliable protocol. It uses TCP port number 139 and 445 and UDP port number 137 and 138.

• A client sends a request to a server.
• The server acknowledges and fulfils the request.
• Then the server sends a response back to the client.

Presently most Operating system use SMB instead of CIFS whereas, CIFS is used at NAS (Network Attached Storage) and SAN (Storage Area Network). There are some other Features of CIFS includes not limited to easy file access, resource access, flexible connectivity, safe caching, proper notification etc. 

We will discuss SAN protocols later in another post. 

-DR