Operating Systems Security - Chapter 2



Operating Systems Security - Chapter 5

File, Directory, and Shared Resource Security

Chapter Overview

In this chapter, students will learn how to configure directory, folder, and file security for Windows, Linux, NetWare, and Mac OS X. You will learn how to fine-tune this security for both common and unique circumstances. You will also learn about the specialized share permissions for Windows-based systems, used when folders are shared across a network through the FAT16/32 and NTFS file systems. Managing access to shared resources means learning how to configure and use security groups, which is another topic of this chapter. Some operating systems offer complex security group options and others, such as Mac OS X, offer automated options. Finally, you will learn how to use the effective permissions and effective rights tools in Windows and in NetWare to ensure that directory, folder, and file security is properly set and that there are no security holes.

Chapter Objectives

After reading this chapter and completing the exercises, students will be able to:

□ Implement directory, folder, and file security

□ Configure shared resource security, using share permissions in Windows

□ Use groups to implement security

□ Troubleshoot security

Lecture Notes

Directory, Folder and File Security

Operating systems and directory services offer techniques to protect directories, folders, files, and other objects so that only the owners of the objects or specified accounts or groups can access them. This is accomplished through a collection of security properties sometimes cumulatively called a security descriptor in a directory service.

In an operating system, a security descriptor, also referred to as an access control list (ACL) contains all information about access to a particular object. In a directory service, there are two components to an ACL or security descriptor; a discretionary access control list and a system access control list. A discretionary access control list (DACL) is a partial access control list of users, groups, and computers that are allowed or denied some form of permission to access an object. A system access control list (SACL) is a partial access control list that determines which, if any, events associated with an object are to be audited.

Each ACL for an object typically contains four categories of information:

□ The user account(s) (or account groups) that can access the object

□ The rights and permissions that determine the level of access

□ The ownership of the object

□ Whether specific events associated with an object are to be audited

Each user account or group of accounts is assigned a type of access to an object, called a right or permission. Windows 2000, Windows XP, Windows Server, Linux, and Mac OS X use permissions, which involve privileges to access and manipulate resource objects.

Also, in Windows 2000/XP/2003/2008, there are standard permissions and special permissions. In these systems, a standard permission is most frequently used and consists of the object permissions that are available by default. Special permissions are used when the default settings do not provide enough customization for the current security need.

Windows Folder and File Security

Windows and Windows Server can use attributes and permissions (S, H, A, & R) to control access to folders and files. The specific attributes and permissions are related to the file system used. When FAT16/32 is used, security is not as strong as with NTFS.

From the standpoint of security and reliability, NTFS is a much better choice than FAT16/32 for any use, but especially for a system connected to a network. NTFS offers the ability to set standard and special permissions on folders and files for user accounts and for groups. NTFS supports the use of the Encrypting File System (EFS), and it enables disk quotas to be set on users and groups.

FAT Folder & File -Attributes (SHAR)

In FAT16 and FAT32, attributes are stored as header information with each folder and file, along with other characteristics including volume label, designation as a subfolder, date of creation, and time of creation. The folder and file attributes available in FAT16/FAT32-formatted disks are System, Hidden, Archive, and Read-only.

NTFS Folder & File -Attributes and Security

Folders and files on an NTFS-formatted disk also have the System, Hidden, Archive, and Read-only attributes, plus the Index, Compress, and Encrypt attributes. When you make a change to one of the attributes in the Advanced Attributes dialog box in a folder’s properties, you have the option to apply that change to only the folder and the files in that folder, or to apply the changes to the folder, its files, and all sub-folders and files within the folder.

Index Attribute

The NTFS index attribute is used to index the folder and file contents so that text, creation date, and other properties can be quickly searched, using the Search button in My Computer or Windows Explorer.

Encrypt Attribute

A Windows encrypted folder or file uses Microsoft’s Encrypted File System (EFS), which sets up a private encryption key that is associated with the user account that encrypted the folder or file. Encrypted folders are listed in green within explorer.

Configuring Folder and File Permissions

In Windows, NTFS permissions control access to an object. To modify permissions, use the Add and Remove buttons on the folder properties Security tab. See Figure 5-3 on page 201 of the text to see how to change which users and groups have permissions to a folder.

Table 5-1 on page 202 of the text, lists the folder & file permissions supported by NTFS.

Notice in Figure 5-3 that all of the Allow boxes for permissions are checked and deactivated (grayed out). These are inherited permissions, which mean that the same permissions on a parent object(the Program Files folder, in this case(apply to the child objects, such as files and subfolders within the parent folder.

|Quick Reference |Discuss the general steps used to change the inherited permissions as listed on pages 202 and 203 |

| |of the text. |

Table 5-2 on page 204 of the text lists the NTFS special permissions.

|Quick Reference |Discuss the general steps you would use to take ownership of a folder, using an account with |

| |Administrator privileges shown on pages 205-206 of the text. |

UNIX/Linux Directory and File Security (-rwxrwxrwx) u g o [a]

UNIX/Linux files are assigned a combination of three sets of three permissions: read, write, and execute (rwx). Executable files can have a special set of permissions called Set User ID (SUID) and Set Group ID (SGID). When either of these is associated with an executable file, the group or other members who run it have same access as the user(owner).

Permissions (u, g, o, [a]) are granted on the basis of four criteria: ownership (user), group membership, other, and all. Permissions are set up using the chmod command in UNIX & Linux. The chmod command has two different formats, symbolic and octal. In the symbolic format, you specify three parameters: (1) who has the permission (u, g, o, a), (2) the actions to be taken on the permission (+ or -), and (3) the permission (r, w, x).

Example: chmod ug+x file.ext adds execute permission to user and group accounts.

The octal permission format is more complex, because it assigns a number on the basis of the type of permission and on the basis of user(owner), group, and other all is omitted from this scheme. Each permission setting is calculated as: read = 4, write = 2, and execute = 1. For example the command; chmod 754 file.ext (gives rwx (4+2+1=7) user(owner) permissions, r-x (4+1=5) group permissions, and r-- (4) to all other(s).

Use the ls –l command to view the permissions for a group of files in a directory. Figure 5-5 on page 208 shows the permissions in /etc directory (ls –l /etc), which contains configuration files used by the system, including the passwd and shadow files. Table 5-3 on page 209 of the text lists system directories used in Linux. Ownership of a folder or file can be changed by using the chown command from the root account.

NetWare Directory and File Security

In NetWare, access to files and directories is controlled through:

□ Attributes associated with files and directories

□ Access rights granted to trustees

Netware attributes follow the same principle as the attributes used in Windows-based systems, in that they are flags associated with a directory or file that manage access and other properties, such as information showing that a directory or file needs to be backed up. Table 5-4 on page 211 lists the attributes used for files and Table 5-5 on page 212 of the text shows the attributes used for directories.

NetWare access rights are similar to permissions in Windows and UNIX/Linux systems. NetWare access rights give privileges to access directories and files. Access rights are associated with specific users or groups, called trustees, through a directory’s or file’s discretionary access control list. Table 5-6 on page 213 of the text lists the access rights that you can configure for a directory or folder using the ConsoleOne tool.

|Quick Reference |Discuss the general steps for adding an inherited rights filter as illustrated on page 214 of the |

| |text. |

Mac OS X Folder and File Security

There are two ways to configure folder and file permissions in Mac OS X: through command-line commands and through setting the Get Info properties of a file. You configure permissions through a terminal window, using the same commands and settings that apply to Linux. (Mac OS X is a variant of Free BSD Linux) Both the chmod and the chown commands apply equally well to Mac OS X. Figure 5-9 on page 215 of the text illustrates using the

ls –l command to view permission settings, and then using chmod to change those settings. Table 5-7 on page 216 of the text shows the permissions that can be set for each of these categories.

Discussion Questions

1) Discuss the advantages and/or disadvantages of using the NTFS file system over

FAT16 or FAT32.

2) Discuss the similarities of creating groups in UNIX/Linux and Windows (if any).

Additional Activities

1) Compare the methods for sharing printers in UNIX/Linux, Windows, and Mac OS X and chart the differences.

2) Compare the methods used for creating groups in UNIX/Linux, Windows, and Mac OS X and chart the differences.

................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download