Qilin open-source bastion host network device usage Solution

Qilin open-source bastion host network device usage Solution
Part 1 Project Overview 1.1 Requirement Analysis

Most companies have not yet formed a complete set of management methods for O & M management of network devices. Some companies have established user names and passwords on network devices, the O & M personnel then log on to the network device using the local password for O & M operations. Some companies have established AAA servers and handed over the usernames and passwords to AAA servers for unified management, however, both modes have corresponding risks in O & M management, and the main risks are as follows:

U password leakage: there is no unified password management mechanism, and many people use the same system account together. As a result, the password of the system account is known to many people, the system password is easily disclosed to third-party personnel;

Malicious operations in violation: there is no unified monitoring and audit system for the operator, and the operation process of the operator cannot be traced back, which may result in unauthorized deletion, modification of data, and system configuration by the operator.

U management authorization is chaotic: when there are many network devices and a large number of O & M personnel, management authorization is prone to confusion. no unified system authorizes O & M personnel, permission Revocation Management creates certain O & M risks.

These problems are caused by the absence of a unified O & M management platform, which results in black box O & M management. Therefore, a secure, reliable, and easy-to-use O & M management platform is established, this is an urgent demand for enterprise it o & M in the near future. At the same time, relevant laws and regulations and management regulations, such as CSOX and classified protection regulations, have also been issued by the State and industry, system O & M is required to perform more comprehensive and effective management in terms of access control and operation audit.

 

1.2 Construction Objectives

This solution implements transparent white box O & M management through management of personnel, equipment, and operations, and implements various O & M management rules and regulations in a monitoring manner. The purpose of project construction is mainly to ensure the security and operation management of the O & M process, and to achieve the effective implementation of O & M rules and regulations. Based on these principles, the system construction objectives are described as follows:

 

Unified O & M management: a unified O & M management platform (bastion host system) is established. Users directly access network devices from the past, instead of redirecting from bastion hosts to logon, bastion hosts implement authentication, authorization, auditing, and account management. Centralized management of authentication permissions: the AAA Server is started on the bastion host, and the authentication of network devices is unified on the AAA Server. The password system on the AAA Server can be automatically modified on time, O & M personnel do not need to know the password on the AAA Server. When a user wants to log on to a network device, the O & M platform automatically enters the logon password for the O & M personnel, which ensures the security of the final device password. Strong Authentication management: when a user logs on to the bastion host, he/she must use the dynamic password generated by the token card to log on to the bastion host, which can protect the security of the user's password, audit and Analysis of O & M operations that can be authenticated: After the O & M Personnel log on to the network device to perform operations, the O & M platform records and analyzes the entire operation process, the platform can trace back any operation process. At the same time, the platform can analyze the overall operation status, such as O & M Personnel Inspection and troubleshooting statistics. Audit analysis can visualize the O & M management white box, this allows managers to understand the current O & M operation status at all times, so that the O & M management system can be implemented. Quick problem locating: You must record the original operation process of the operator and provide a flexible query and search mechanism to quickly locate the cause of the fault when the operation fails, on-site recovery operations; compatible operation habits: Try not to change the existing network architecture in the O & M environment, without affecting the operator's original operation habits;

 

1.3 scheme design 1.3.1 Overall Scheme Design

The overall system is based on the effective operation of O & M security management rules and regulations, and the visualization of O & M management white box. The overall design concept of the system is as follows:

Rules and regulations are implemented as principles:O & M management mainly controls human behaviors through rules and regulations to ensure the stable operation of the system. Therefore, the essence of O & M management is the effective implementation of rules and regulations, and the launch of the overall O & M platform, the biggest goal is to change O & M management from invisible black box management to visible white box management. At the same time, the work intensity of O & M personnel is greatly reduced through automatic inspection, automatic password modification, SSO, and other functions.

The implementation of rules and regulations mainly relies on identity authentication, authorization control, and audit analysis.

Identity Authentication is a prerequisiteIdentity management solves the problem of operator identity and work role. Because all operations are initiated by the operator, the Identity Management Mechanism of the operator is the basis for subsequent control and audit of the operator's operation process.

Permission control is a means:By means of access control, legal operators can only access resources legally, effectively reducing the security risks of unauthorized access.

Audit analysis ensures that:The significance of actiontrail is that when an operational accident occurs, you can use audit logs to quickly locate the cause of the problem, restore the operation site, and truly improve the responsibility identification system. Operation Analysis allows the management to effectively grasp the current status of O & M management and achieve compliance of O & M management.

 

1.3.2 detailed design

Unified bypass Entry Mode for centralized management

The O & M operation management system adopts the "unified bypass entry" Mode for centralized management. This deployment mode does not require any agent or plug-ins to be installed on the managed device during deployment, there is no need to adjust the original network architecture between devices, which will have almost no impact on the user's current O & M environment. The physical deployment diagram of the device is as follows:

Deployment description:

1. The deployment method is bypass deployment;

2. The deployment condition is that the O & M management platform can reach the IP address of the managed device, the Protocol can be accessed, the O & M terminal can reach the IP address of the O & M management platform, and the protocol can be accessed;

3. All managed network devices refer to AAA authentication on the bastion host, and create a Radius account for all devices on the bastion host. When logging on to these devices, the authentication is performed on the bastion host.

4. Create an O & M account for all O & M personnel on the bastion host and create a permission list for the O & M account, that is, specify which network devices can be logged on to the O & M account.

5. logon Process: All users must use the bastion host to log on to the network device. the user logs on to the O & M operating system with a unique user account, then, the O & M operation management system prompts the user to select the target device and corresponding system account that can be accessed according to the access control rules pre-set by the configuration administrator. After the user selects the device, the system automatically logs on to the target device, when you log on to the bastion host, you must use the dynamic token card to generate a dynamic password for logon to ensure the security of authentication.

6. All operations performed after a user logs on will be recorded

7. The system uses the Active-Standby Hot Standby deployment mode.

 

Part 2 function implementation 1.4 system module

This system is mainly built around O & M security and manageability. It mainly needs to implement six functions, including unified entry management, unified authorization, unified authentication, unified audit, unified analysis, and timely alarm, for these six basic functions, the system module is divided into the following parts:

Unified access module:

The unified access module provides centralized Portal management, including the O & M management logon Portal, dual-proxy module, and VPN mobile user access.

The O & M management logon Portal provides users with a unified logon Portal address. After the user logon Portal is unified, targeted management can be performed. The unified Portal mode is a logon Web interface, after logging on to the Web page, you can view all your permissions and connect to the corresponding server by authorizing the corresponding permissions.

The two-way proxy module allows you to log on to a self-starting Client. In the two-way proxy mode, you can click WebPortal to log on directly using any tools such as SecureCRT and Mstsc, compared with the WebPortal mode, the dual-proxy module mode does not change user operation habits, making it more suitable for users.

The VPN Module is used to provide remote access for O & M users. From the management perspective, the O & M business system is a proprietary system different from office and finance systems. Therefore, generally, the O & M platform should have the VPN access function, so that O & M personnel can have a dedicated VPN access interface separated from other parts.

 

Authentication and authorization module:

The authentication and authorization module provides four functions: Dynamic Password, Single Sign-On, permission management, and password management.

Dynamic passwords are used to solve various drawbacks of current static passwords. They can thoroughly implement security issues such as password loss, weak passwords, and password scanning, A standard O & M system dynamic port is a required functional module.

Single Sign-On is used to allow users to log on to the O & M platform, that is, they can directly log on to the authorized system without entering the passwords of other systems. This allows users to block passwords and facilitate logon.

Permission management is used to specify the user's operation permissions, including the devices that the user can log on to, available device accounts, and operation commands that can be executed on the device.

Password Management is used to help users execute password modification policies in password rules and regulations. After the password modification policy is launched, the password management software can automatically modify the system password according to the password policy to implement the management system.

 

Audit analysis module:

The audit module is used to record and analyze operations performed by operators. After you log on to the business system through the O & M management platform, all operations performed are recorded on the O & M management platform, analyzes the detailed operations of a user, including the commands run by the user, the typed keyboard, the files uploaded and downloaded, the database commands, and the data retrieved by the database operations. Through audit analysis, you can judge the operation process of an operator to determine whether the operation is against the rules and malicious operations. In addition, if a misoperation occurs, you can trace back the operation to restore the original normal state of the system.

In addition, the audit analysis module also provides the real-time audit function. Managers can switch the screens of any operator to their own screens for monitoring anywhere.

Log correlation module:

In O & M management, log system analysis and association are an important part. Without log association, it is difficult to associate system events with O & M operations, the O & M Association module can centrally associate system events such as user logon, running commands, and system logs, this eliminates the need for managers to analyze the cause of events through scattered logs, network management, and bastion host systems, greatly improving the O & M efficiency and accuracy of event analysis.

Alarm module:

The alarm module is used to notify the corresponding management personnel in real time via SMS, email, SYSLOG, Console, etc. in case of malicious or illegal operations, so that the management personnel can handle such events in a timely manner.