1 / 6

Le mode transport IPSec face à netfilter un autre “cheval de Troie”?

Le mode transport IPSec face à netfilter un autre “cheval de Troie”?. Yoann ALLAIN Stagiaire au Security Lab Encadrants : Olivier Courtay et Nicolas Prigent. Protéger les communications. Les outils de Linux 2.6. Le problème. Security Association. Alice. Bob. Netfilter. Telnet. Telnet.

willa
Download Presentation

Le mode transport IPSec face à netfilter un autre “cheval de Troie”?

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Le mode transport IPSec face à netfilterun autre “cheval de Troie”? Yoann ALLAIN Stagiaire au Security Lab Encadrants : Olivier Courtay et Nicolas Prigent

  2. Protéger les communications Les outils de Linux 2.6

  3. Le problème Security Association Alice Bob Netfilter Telnet Telnet SMTP IPSec IPSec SMTP Telnet SMTP Telnet • Bob: 2 serveurs • spdadd ip_alice ip_bob[25] tcp -P in ipsec esp/tranport//require; • iptables –A INPUT –p tcp –dport 23 –j DROP • Alice peut-elle atteindre le serveur Telnet ? • => OUI !

  4. Pourquoi ? Petit tour dans la stack IP Linux ESP (transport) ESP (tunnel) Netfilter contrôle Le paquet DROP ! PRE_ROUTING Point d’entrée Décision de routage Mode Tunnel ? INPUT IPSEC IP FORWARD IP Noyau Linux Processus utilisateur Serveur Telnet

  5. Des solutions ? • Filtrage simple par IPSec, mais pas de suivi de connexion possible : spdadd ip_alice ip_bob[25] tcp -P in ipsec esp/transport//require;spdadd ip_alice ip_bob any -P in discard; • Patch du noyaumais problèmes liés au NAT.Imitation du mode tunnel ? Non conseillé par les développeurs du noyau. • Utiliser le mode tunnel tout le temps ?Pose des problèmes de sécurité et de performances.

  6. Association Netfilter/IPSec risquée sans connaissance de leurs limitationsQuestions ?yoann.allain@thomson.net This document is for background informational purposes only. Some points may, for example, be simplified. No guarantees, implied or otherwise, are intended

More Related