Table of Contents
Understanding CiscoWorks2000 Security
The CiscoWorks2000 Server software provides some of the security controls necessary for a web-based network management system, but also relies heavily on the end user's own security measures and controls to provide a secure computing environment for CiscoWorks2000 applications. The CiscoWorks2000 Server provides and requires three levels of security to be implemented to ensure a secure environment:
- General Security---partially implemented by the client components of CiscoWorks2000 and by the system administrator.
- Server Security---partially implemented by the server components of CiscoWorks2000 and by the system administrator.
- Application Security---implemented by the client and server components of the CiscoWorks2000 applications.
The following sections describe the general and server security levels. Application security levels are described in the "Setting Up the CiscoWorks2000 Server" chapter.
The CiscoWorks2000 Server provides an environment that allows the deployment of web-based network management applications. Web access provides an easy-to-use and easy-to-access computing model that is more difficult to secure than the standard computing model that only requires a system login to execute applications.
The CiscoWorks2000 Server also provides security mechanisms (authentication and authorization) used to prevent unauthenticated access to the CiscoWorks2000 Server and unauthorized access to CiscoWorks2000 applications and data. However, CiscoWorks2000 applications can change the behavior and security of your network devices. Therefore, it is critical to limit access to applications and servers as followed:
- Limit access to personnel who need access to applications or the data that the applications provide.
- Limit CiscoWorks2000 Server logins to just the systems administrator.
- Limit connectivity access to the CiscoWorks2000 Server by putting it behind a firewall.
The CiscoWorks2000 Server uses the basic security mechanisms of the operating system to protect the code and data files that reside on the server. The following CiscoWorks2000 Server security control elements apply:
The CiscoWorks2000 Server has many dimensions:
- UNIX Systems---CiscoWorks2000 must be installed by a user with root privilege and is installed as the user bin. All files and directories are owned by bin with group also equal to bin. Temporary files are created as the user bin with permissions set to "read-write" for the user bin and "read" for members of group bin. The only exception to this rule is the log files created by the CiscoWorks2000 web server and diskwatcher. The CiscoWorks2000 web server and diskwatcher must be started as "root," therefore, their log files are owned by the user root with "group=bin."
- Windows NT Systems---CiscoWorks2000 must be installed by the administrator and is installed as the user bin. The user bin is created at install time and given a random password.
 |
Caution Do not change the user bin password. If you change it, some important CiscoWorks2000 services will not operate correctly. |
- The CiscoWorks2000 Server uses the password but the bin user is never intended as a general user of the Windows NT system. No user is ever required to log on the Windows NT system as bin. All files and directories are owned by the user bin. Read and write access are restricted to the user bin and the administrator. Temporary files are created as the user bin with permissions set to read-write for the user bin. The CiscoWorks2000 Server relies on the security mechanisms of the NTFS filesystem to provide access control on Windows NT systems. If CiscoWorks2000 is installed on a FAT filesystem, most security assumptions made about controlled access to files and network management data are not valid.
- UNIX Systems---Typically CiscoWorks2000 back-end processes are executed with permissions set to the user ID of the binary file (for example, if user "Joe" owns an executable file, it will be executed by the CiscoWorks2000 daemon manager under the user ID of "Joe"). The exception are files owned by the root user ID. To prevent a potentially harmful program from being executed by the daemon manager with root permissions, the daemon manager will execute only a limited set of CiscoWorks2000 programs that need root privilege. This list is not documented to preclude any user from trying to impersonate these programs.
- All back-end processes are executed with a umask value of 027, which means that all files created by these programs are created with permissions equal to "rwxr-x," with an owner and group of the user ID and group of the program that created it. Typically this will be "bin" and "group=bin."
- CiscoWorks2000 foreground processes (typically cgi-bin programs or servlets) are executed under the control of the web server's children processes or the servlet engine which all run as the user bin.
- CiscoWorks2000 uses standard UNIX tftp and rcp services. CiscoWorks2000 also requires that user bin have access to the directories that these services read and write to.
- The CiscoWorks2000 Server must allow the user bin to run "cron" and at jobs to enable the Resource Manager Essentials Software Management application to run image download jobs.
- Windows NT---CiscoWorks2000 back-end processes are executed with permissions set to the user bin. Some of the special CiscoWorks2000 Server processes are run as a Windows NT service under the "localsystem" user ID.
- These processes include:
- Daemon manager
- Web server
- Servlet engine
- Rcp/rsh service
- Tftp service
- Corba service
- Database engine
- CiscoWorks2000 foreground processes (typically cgi-bin programs or servlets) are executed under the control of the web server and the servlet engine which all run as the user localsystem. The localsystem user has special permissions on the local Windows NT system but has no network permissions.
- CiscoWorks2000 provides several services for RCP, TFTP communication with devices. These services are targeted for use by CiscoWorks2000 applications, but can be used for purposes other than network management.
- The CiscoWorks2000 Server uses the at command to run software update jobs for the Resource Manager Essentials Software Image Manager application. Jobs run by the at command run with system level privileges.
- UNIX Systems---The CiscoWorks2000 daemon manager only responds to requests to start, stop, register, or show status for CiscoWorks2000 back-end processes from the CiscoWorks2000 Server.
- Windows NT Systems---The CiscoWorks2000 daemon manager only responds to requests to start, stop, register, or show status for CiscoWorks2000 back-end processes from the CiscoWorks2000 Server.
- UNIX Systems---Systems used by the CiscoWorks2000 Server as remote sources of device information for importing into the Resource Manager Essentials Inventory Manager application, must allow the user bin to perform remote shell operations on the user that owns the device information.
- Windows NT Systems---Systems used by the CiscoWorks2000 Server as remote sources of device information for importing into the Resource Manager Essentials Inventory Manager application, must allow the user bin to perform remote shell operations on the user that owns the device information.
- UNIX Systems---The UNIX user bin is a user ID that is not typically enabled for login. Using this user ID as the user ID under which to install the CiscoWorks2000 Server software simplifies the installation process and ensures limited access to the CiscoWorks2000 Server. This is because bin is not a valid login ID as there is no password assigned to it. However, the bin user on UNIX systems is capable of performing system and possibly network-wide operations that could be harmful to the system or the network. Therefore, the system administrator should review and adopt the security recommendations provided in the "System Administrator-Imposed Security" section.
- Window NT Systems---The user bin, created as part of the install process, has no special permissions or considerations on a Windows NT system so it is a "safe" user ID under which to execute the CiscoWorks2000 Server and application code. The localsystem user on Windows NT systems can perform harmful system operations. Therefore, consider that by using the localsystem user ID to run some of the backend processes, the localsystem user ID cannot perform network operations. Therefore, the system administrator should review and adopt the security recommendations in the "System Administrator-Imposed Security" section.
To maximize CiscoWorks2000 Server security, follow these security guidelines:
- Do not allow users other than the systems administrator to have a login on the CiscoWorks2000 Server.
- Do not allow the CiscoWorks2000 Server file systems to be mounted remotely with NFS or any other file-sharing protocol.
- Limit remote access (for example, FTP, RCP, RSH) to the CiscoWorks2000 Server to those users who are permitted to log in to the CiscoWorks2000 Server.
- Place your network management servers behind firewalls to prevent access to the systems from outside of your organization.
Posted: Wed Apr 5 14:48:00 PDT 2000
Copyright 1989 - 2000©Cisco Systems Inc.
