New tools control access by privileged users

As our authentication methods for this test, we used RSA's SecureID, applicable 802.1X and RADIUS systems (specifically a Linux host running OpenRadius), and as well as Microsoft's Active Directory running on Windows 2003 Enterprise Server and OpenLDAP. We used numerous groups of users, and tested cross-group membership if the groups were importable into the specific PAM under test.

As our test applications, we also used Microsoft Exchange Server, SQL Server 2005, open source Procmail/Sendmail, and Oracle 7 on Linux.

We used packet traces to watch samples of authentication requests through three stages: request submission, request authentication and password issuance. We ran this test to make sure the requests were not clear text-readable. None were, however, we were unable to verify the authentication encryption methods used.

We also checked to see if network TCP ports were able to be relocated from standard numbers (so as to thwart programs that normally scan for specific port communications, for example ports 20 and 443), and we noted which were 'hard-wired' (ports could not be changed from standard to thwart port eavesdroppers) and which PAMs were able to alter ports from standard TCP configurations.

We checked how well each product was able to be setup against our test host operating system platforms, the ease of importation of server/host candidates or discovery of existing infrastructure that would be controlled by the product under test, and how well each product was able to be managed in three categories, password accessibility by users and groups, integration with a directory service (Active Directory or OpenLDAP), and administrative controls applied to the process of issuing passwords as well as the 'quality/security' of the passwords themselves.

We also checked to see if logon activities left any trails in browser cache, checked to see if SSH or https was correctly encrypting conversations, and determined how flexible in communications each product was with both client access, and with password access through the use of a Fluke OptiView III Network Analyzer and WireShark protocol analyzer.

Henderson and Dvorak are researchers with ExtremeLabs. They can be reached at thenderson@extremelabs.com.