Guide to Operating Systems Security



Guide to Operating Systems Security

Chapter 5 Solutions

Answers to the Chapter 5 Review Questions

1. One of the server operators in your organization seems to have problems accessing folders containing programs he needs to run. What tool might help diagnose the problem most quickly?

Answer: d. Effective Permissions in a folder’s properties

2. Which of the following are examples of extended attributes in NTFS? (Choose all that apply.)

Answer: b. and c.

3. Which command is used to change permissions using the Red Hat Linux 9.x command line?

Answer: a. chmod

4. Which operating system uses domain local security groups? (Choose all that apply.)

Answer: d. Windows Server 2003

5. You have discovered that for some reason two groups in Red Hat Linux 9.x share the same GID. Is this a problem?

Answer: b. Yes, because security may be compromised, since the groups have access to different resources.

6. The FLAG command in NetWare 6.x can be used to _________________________________.

Answer: a. view at one time how attributes are set on several folders

7. Generally, in an operating system, the account used to create an object, such as a folder, ____________________________________.

Answer: c. initially has ownership of the object

8. Which of the following are NTFS permissions that can be set in Windows 2000 Server and Windows Server 2003? (Choose all that apply.)

Answer: a. and c.

9. You are consulting for a doctor’s office consisting of 18 networked workstations and one Windows 2003 server that is used to share folders. The office has a demo of a new medical database, but the licensing requires that not more than two people access it at the same time. How can you accommodate this requirement most easily?

Answer: b. Set up the database in a shared folder and set the user limit to 2.

10. When you set permissions in Red Hat Linux 9.x using the command line, the _________________ option applies those permissions to users, groups, and others.

Answer: b. a

11. How can you control access to shared resources in Red Hat Linux 9.x when using NFS? (Choose all that apply.)

Answer: d. Specify who can access NFS via the /etc/hosts.allow file.

12. Which of the following are permissions that you can configure for a folder in Mac OS X? (Choose all that apply.)

Answer: a., b., and d.

13. Which type of group would typically be use primarily to house user accounts in Windows 2000 Server and Windows Server 2003 when Active Directory is installed?

Answer: a. global group

14. The Mac OS users on your NetWare 6.x server often copy files from the server that are not compatible with Mac OS AppleTalk Filing Protocol. This practice causes you to receive telephone queries about what has gone wrong. What can you do?

Answer: c. Use the Ci attribute on these files.

15. In Windows XP Professional, share permissions work for which of the following file systems? (Choose all that apply.)

Answer: b., c., and d.

16. In Windows 2000 Server, you can hide a shared folder by _________________________.

Answer: b. placing a dollar sign ($) after the name of the shared folder when you configure it

17. A(n) ___________________________________ is associated with a folder or file to show which users or groups have what kind of permissions or rights to that folder or file.

Answer: c. access control list

18. The more /etc/group command-line command can provide information about groups in which of the following operating systems? (Choose all that apply.)

Answer: c. and d.

19. The accounting supervisor in your firm wants you to examine, once a week, the security for all files in the Data folder for the accounting system on a Red Hat Linux 9.x server. This new precaution is necessary because recently there have been problems with unauthorized people accessing these files. Which command-line command can you use to monitor the security settings?

Answer: d. ls -l

20. In NetWare 6.x, a user’s access to resources in a search drive is controlled through which of the following? (Choose all that apply.)

Answer: a. and c.

21. From which file menu option for a folder in Mac OS X can you configure ownership and permissions?

Answer: c. Get Info

22. For security, files in the SecretResearch directory on your NetWare 6.x server must be immediately discarded after they are deleted, so that they cannot be recovered. How is this possible?

Answer: b. Use the Purge attribute on the SecretResearch directory.

Hands-On Projects Tips and Solutions for Chapter 5

Project 5-1

Students learn how to configure attributes in Windows 2000/XP/2003 in this project. They create a folder, copy a file to the folder, and then encrypt the folder’s contents.

Students should make sure that they are accessing a drive formatted for NTFS, or they cannot encrypt a folder or file. If the encrypting option is not available, this means that the drive is formatted for FAT. Consider discussing this in class with students as a reminder about how to troubleshoot an encryption problem.

In Step 2, on a newly created folder, students are likely to find that the Read-only attribute in the General tab is already selected by default.

In Step 3, when students click the Advanced button on the General tab, they will find two sets of two attributes:

▪ Archive and Index attributes

▪ Compress or Encrypt attributes

Of the four attributes, only one is checked by default: For fast searching, allow Indexing Service to index this folder.

In Step 8, to verify that a folder is encrypted or that files within a folder are encrypted, view the properties of the folder or file, click the General tab, click the Advanced button, and make sure that Encrypt contents to secure data is checked. A folder or file can be decrypted by removing the checkmark in front of Encrypt contents to secure data.

Project 5-2

In this project, students set permissions on a folder in Windows 2000/XP/2003.

In Step 3, the default groups that have permissions will depend on the operating system but some examples of groups students will see include:

▪ Administrators (Allow for all permissions)

▪ CREATOR OWNER (No permissions configured).

▪ SYSTEM (Allow for all permissions)

▪ Users (Allow for Read & Execute, List Folder Contents, and Read

▪ Power Users (in Windows XP—Allow for all permissions except Full Control)

Consider using this step to discuss why it is important for a server administrator to know what permissions are set up automatically.

In Step 6, the Backup Operators group has the following permissions checked for Allow by default:

▪ Read & Execute

▪ List Folder Contents

▪ Read

Project 5-3

This project enables students to configure special permissions in Windows 2000/XP/2003.

In Step 6, students should discover that a new permission is added, that is called “Special Permissions.”

Project 5-4

In this project, students create a Red Hat Linux file, view its default permissions, give only the owner access to the file, and view the permissions again to make sure their changes have taken effect.

In Step 3. the default permissions are: -rw-rw-r--.

In Step 5, students should report that the permissions have changed to: -rw-------

In Step 7, the permissions are now: -rwx------

Project 5-5

Students use the Nautilus tool in Red Hat Linux 9.x to configure permissions on the file they created in Hands-on Project 5-4.

In Step 4, the Text view line interactively changes to reflect the changes made to the permissions.

Project 5-6

In this project, students create a subdirectory (you will need to tell them where to create it) for NetWare and configure its attributes and trustee access rights.

In step 7, students should report seeing the attributes:

▪ Delete Inhibit

▪ Hidden

▪ Immediate Purge

▪ Rename Inhibit

▪ System

▪ Don’t Migrate

▪ Immediate Compress

▪ Don’t Compress

In Step 11, the default access rights are:

▪ Read

▪ File Scan

In Step 14, on the Facts tab students should notice that the account they used to create the directory is the owner. They can change ownership by changing the account in the Owner box.

Project 5-7

In this project, students configure the ownership and security on a Mac OS X folder.

In Step 7, when students click the lock, it unlocks so that ownership can be changed. After clicking the lock, you can simply enter a different owner.

In Step 8, the default permissions are:

▪ Owner: Read & Write

▪ Group: Read only

▪ Others: Read only

Project 5-8

.

This project enables students to create domain local and global security groups.

In Step 4, the defaults for the group are:

▪ Global for the scope

▪ Security for the group type

In Step 5, the pre-Windows 2000 group name is the same as the name the student entered in the Group name: box.

In Step 13, students should report that there are no members by default.

In Step 17, there should be no members in the domain local group, by default.

Project 5-9

In this project students use the command line to create a new group in Red Hat Linux 9.x, to modify the name of the group, and then to delete the group.

Project 5-10

This project enables students to create a group in NetWare 6.x. Before they start, you’ll need to provide them with the names of two accounts that they can add to the group they create. Also, provide them with the name of an organizational unit in which to create the group.

In Step 5, the other options that can be configured are:

▪ Define additional properties

▪ Create another Group

Solutions to the Case Project Assignments

International Integrated Circuits (IIC) manufactures specialized circuits and power chips for cell phones, portable computers, handheld computers, CD players, and other popular electronic devices. The IIC headquarters are in Cambridge, Massachusetts and there are manufacturing sites in Ontario, Canada, and Stockholm, Sweden. Because IIC already makes electronic parts for cell phones, it has just purchased Speech Dynamics, which is a company that makes speech simulation and recognition software to fit on a specialized chip. Speech Dynamics is located in Durham, North Carolina.

IIC and Speech Dynamics are both concerned about folder and file security on their servers and client workstations, because there are highly secret design documents and new research documents contained on their systems. Their sensitive information is of great interest to competitive corporations, to governments, and to others. The systems that contain these design plans are:

▪ Nine Red Hat Linux 9.x servers and 42 Red Hat Linux 9.x workstations

▪ Seven Windows Server 2003 computers

▪ 48 Windows XP Professional workstations

▪ Seven NetWare 6.x servers

▪ Five Mac OS X workstations

IIC has hired Aspen IT Services and retained you as a consultant to the company review its security needs and to troubleshoot specific security problems.

Case Project 5-1: Windows Server 2003 Groups

Speech Dynamics uses four of the Windows Server 2003 computers. The company's initial server administrator was not familiar with the use of groups, and so did not configure any groups beyond those that are configured by default when Windows Server 2003 is installed. He did, however, install Active Directory and create a domain containing these four servers. The security committee at Speech Dynamic asks you to prepare a discovery paper they can use to learn about the capabilities of groups for Windows Server 2003.

Answer:

In their discovery paper, students can note that there are two broad types of groups used in Windows 2000/XP/2003: security and distribution. Security groups are of most interest in this context, although distribution groups might be valuable to the company for e-mail purposes.

The security groups that students should discuss include:

▪ Local security groups, which are used on standalone and member servers and also are used in Windows 2000 Professional and Windows XP Professional. The scope of this type of group does not go beyond the local computer on which it is defined. This type of group would consist of accounts and be used in DACLs.

▪ Domain local security groups are used when there is a single domain or used to manage resources in a particular domain so that global and universal groups can access those resources. This type of group usually does not contain accounts, because its main purpose is to provide global and universal groups access to resources in its domain.

▪ Global security groups are used to manage group accounts from the same domain so that those accounts can access resources in the same and in other domains. Typically, you add users to a global security group and then you make the global security group a member of one or more domain local security groups.

▪ Universal security groups are used to provide access to resources in any domain within a forest. These groups usually contain accounts and are made members of domain local security groups, but they are also used to generally provide access to all resources in a domains in a forest.

Case Project 5-2: Configuring Directory Security in Red Hat Linux 9.x

The engineering group at IIC has just hired a new engineer who has used UNIX and Linux computers for writing programs, but who never learned how to use the security features. Her workstation runs Red Hat Linux 9.x and she also stores her more polished programs on one of the Red Hat Linux 9.x servers. She has already created two working directories, one called Notes and one called Designs. The Notes directory is on her workstations and she wants to secure that directory so that only her account can access it. The Designs directory on the server contains only programs that all users who access the server need to be able to run. Create a set of notes that she can use as a reference, showing how to configure security for these needs.

Answer:

Students might begin with a general set of information about Red Hat Linux 9.x security options to include:

▪ u for user

▪ g for group

• o for others or world

• a for ugo

• r for read

• w for write

• x for execute

The command to secure the Notes directory only for her account is:

chmod go-rwx /home/username/Notes

The command to enable users to execute files in the Design directory is:

cd /Design (depending on the path to the directory)

chmod a+x *

Case Project 5-3: A NetWare 6.x Directory Security Problem

Two engineering groups that have access to the NetWare 6.x servers are able to read and change files in the Accounting and Sales directories, but they are not supposed to have this access. In fact, the financial auditors for IIC have expressed concern about this problem. What tool can be used to help track down the problem? Develop a short document that explains the tool and how to use it.

Answer:

The tool that can be used by an administrator to track down the problem is the effective rights tool available through ConsoleOne. The general steps for using this tool are:

1. Open ConsoleOne.

2. Navigate to the Accounting directory (and next to the Sales directory after finishing Step 8) on which to evaluate the effective rights.

3. Right-click the directory and click Properties.

4. Click the Trustees tab.

5. Click the Effective Rights tab.

6. Click the button for the Trustee box and navigate to the user or group to check.

7. Select the user or group and click OK.

8. Examine the effective rights.

9. Cancel out of the Properties dialog box.

10. Repeat steps 2 through 9 for the Sales directory.

11. Close ConsoleOne

Case Project 5-4: NetWare 6.x Attributes and Access Rights

In the merger of the two companies, one of the Speech Dynamics network analysts was reassigned as a server manager for the NetWare 6.x servers. He has no experience with NetWare, and currently needs to be taught about attributes and access rights. Create a document that explains how these are used in NetWare 6.x.

Answer:

The students’ responses should first define attributes and access rights. For example, attributes are flags set on directories and files for activities, such as archiving and compressing. Access rights are granted to specific trustees in ACLs for security, such as the ability to read and modify the contents of folders and files.

Next, students might create tables showing or comparing attributes and access rights. Below are reproductions of Tables 5-4, 5-5, and 5-6 from the text.

Table 5-4 File attributes

|Attribute (Abbreviation) |Description |

|Archive Needed (A) |Indicates the file has not been backed up since being created or modified |

|Can’t Compress (Cc) |Prevents the file from being compressed (and the attribute cannot be changed by an administrator |

| |or user) |

|Copy Inhibit (Ci) |Prevents Mac OS users from copying a file (because the format is not compatible with AppleTalk |

| |Filing Protocol) |

|Delete Inhibit (Di) |Keeps a file from being deleted, but the file can be renamed or the contents can be changed |

|Don’t Compress (Dc) |Prevents the file from being compressed (but the attribute can be applied or removed by an |

| |administrator or user) |

|Don’t Suballocate (Ds) |Prevents files from being suballocated so they are compatible with specific applications and |

| |databases |

|Execute Only (X) |Enables an executable file (.exe or .com) to be executed, but the file cannot be copied (to |

| |protect against software licensing and pirating); once set, this attribute cannot be changed |

|Hidden (H) |Hides files, but only from command line utilities, the files can still be viewed using |

| |Windows-based and NetWare utilities |

|Immediate Compress (Ic) |Instantly compresses a large file, such as one just copied to the system or downloaded; is used |

| |to ensure that space is saved |

|Migrated (M) |Indicates that a file has been migrated from a hard disk, such as to a tape or CD-R/CD-RW |

|Purge (P) |Immediately purges a file after it is deleted (so that disk space is released and the file cannot|

| |be restored using the SALVAGE command) |

|Read Only (Ro) |Enables a file to be read, but prevents the file’s contents from being altered plus the file |

| |cannot be deleted |

|Read Write (Rw) |Enables a file’s contents to be modified (set by default when a file is created) |

|Rename Inhibit (Ri) |Prevents the renaming of a file (such as when a program relies on a specific file) |

|Sharable (Sh) |Enables a file to be opened by more than one person simultaneously (by default, only one person |

| |can open a file) |

|System (Sy) |Flags the file as one that is used by the operating system and hides the file (from command-line |

| |utilities only) |

|Transactional (T) |Applies the transaction tracking system when a file is used, such as a database file, so that if |

| |an update is interrupted in the middle, the update is completely backed out as a way to protect |

| |the integrity of the data |

Table 5-5 Directory attributes

|Attribute (Abbreviation) |Description |

|Delete Inhibit (Di) |Keeps a directory from being deleted (although the contents of the directory can be deleted) |

|Don’t Compress (Dc) |Prevents files in the directory from being compressed |

|Don’t Migrate (Dm) |Keeps files in the designated directory from being migrated to tape or CD-R/CD-RW |

|Normal (N) |Clears all attributes previously set |

|Hidden (H) |Hides the folder, but only from command line utilities, the folder can still be viewed using |

| |Windows-based and NetWare utilities |

|Immediate Compress (Ic) |Compresses files stored in the directory |

|Purge (P) |Immediately purges any file in the directory as soon as that file is deleted, so that the file |

| |cannot be salvaged and disk space used by the file is returned to use for storing other files |

|Rename Inhibit (Ri) |Prevents the renaming of the directory (but does not apply to its subdirectories and files) |

|System (Sy) |Flags the directory to show it contains operating system files |

Table 5-6 Access rights

|Right (Abbreviation) |Description |

|Supervisor (S) |Can grant all rights to directories, subdirectories, and files |

|Read (R) |In a directory, permits all files to be read and/or executed; for a file, enables that file to be|

| |read or executed regardless of whether the directory has read access |

|Write (W) |For a directory, enables the contents of files to be modified; for a specific file it enables |

| |that file’s contents to be modified |

|Create (C) |For a directory, enables new files and subdirectories to be created; for a file, it enables the |

| |file to be salvaged |

|Erase (E) |For a directory, means that files and subdirectories can be deleted; for a file, it means that |

| |file can be deleted |

|Modify (M) |When applied to a directory, gives permission to change attribute settings for the directory |

| |contents and to rename files and subdirectories; for a file it permits the file’s attributes to |

| |be changed and enables renaming of the file |

|File scan (F) |When applied to a directory, enables the contents to be viewed; for a file, allows viewing the |

| |file name whether or not the file scan right is given at the directory level |

|Access control (A) |When applied to a directory, gives permission to change access rights for that directory; for a |

| |file, grants permission to change the rights assigned to the file, regardless of whether access |

| |control is granted at the directory level |

Case Project 5-5: Protecting a Design Folder in Mac OS X

A graphics design artist has a folder on her Mac OS X workstation that contains graphic renditions of chip designs currently under evaluation. She needs to set up security on this folder so that no other account on her workstation can access this folder. Develop a document that explains how to set up this type of security. (Note that her workstation is sometimes shared with two other people who are part-time design artists, each of whom has a account on the workstation.)

Answer:

Students can suggest using the chmod go-rwx command via a terminal window on the folder that must be secured, but for general users, it is helpful to teach them how to do the same thing in the GUI tools in Mac OS X.

The GUI alternative is to:

1. Find the folder from the Macintosh HD icon on the desktop.

2. Highlight the folder.

3. Click the File menu and click Get Info.

4. Open Ownership & Permissions.

5. Set the access for Group and for Others to No Access.

................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download