Matrix security section

From Linux NFS

(Difference between revisions)
Jump to: navigation, search
m
m (Reverted edits by UvrPe3 (Talk); changed back to last version by BryceHarrington)
 
Line 1: Line 1:
-
[http://helmed.info/topic/calendari-lesbo/ calendari lesbo] [http://kinunia.cn/hotel-san.htm hotel san marco] [http://saibso.org/parma-fc.htm parma fc] [http://amohseni.info/img/styles/voli-low/ voli low cost alghero venezia] [http://davte.info/library/html/decoder-falcon.htm decoder falcon ci 6600] [http://nobinters.org/numeri-telefonici.htm numeri telefonici di myami] [http://helmed.info/topic/rivenditori-caschi/ rivenditori caschi da moto] [http://kinunia.cn/la-croce.htm la croce gloriosa] [http://amohseni.info/img/styles/guida-alla/ guida alla muscolazione] [http://amohseni.info/img/styles/villa-pini/ villa pini] [http://bloprofeldi.info/lib/foto-montagna.htm foto montagna] [http://bloprofeldi.info/lib/vogliosa-di.htm vogliosa di cazzo] [http://amohseni.info/img/styles/volo-los/ volo los angeles] [http://nobinters.org/azardo.htm azardo] [http://ustall.org/web/immagine-drago.htm immagine drago] [http://nobinters.org/beach-girl.htm beach girl] [http://psisemiya.com/images/small/navigatori-gps/ navigatori gps palmari] [http://ustall.org/web/schlick-arnolt.htm schlick, arnolt] [http://saibso.org/carnet-di.htm carnet di ballo] [http://nobinters.org/himno-nacional.htm himno nacional del per] [http://amohseni.info/img/styles/kancelarya/ kancelarya] [http://chaba.info/huntington-park/ huntington park] [http://bloprofeldi.info/lib/televisore-lcd.htm televisore lcd 15 e radio] [http://helmed.info/topic/stampanti-con/ stampanti con scanner lexmark] [http://bloprofeldi.info/lib/sony-wireless.htm sony wireless home theatre] [http://chaba.info/estetista-corsi/ estetista corsi] [http://kinunia.cn/game-boy.htm game boy advance sp artic blue] [http://nobinters.org/la-guerra.htm la guerra dei gavettoni] [http://davte.info/library/html/sentiero-solitario.htm sentiero solitario] [http://amohseni.info/img/styles/s-paulu/ s paulu] [http://ashythro.info/library/html/adidas-zip/ adidas zip] [http://nobinters.org/sony-dcrhc.htm sony dcr-hc 30e] [http://saibso.org/regali-idea.htm regali idea regalo] [http://helmed.info/topic/scacchiere/ scacchiere] [http://ashythro.info/library/html/ci-vuole/ ci vuole un attimo aleandro baldi] [http://helmed.info/topic/mappa-berlino/ mappa berlino] [http://davte.info/library/html/video-de.htm video de decapitation de paul jonson] [http://helmed.info/topic/plasma-panasonic/ plasma panasonic 37] [http://chaba.info/tetra/ tetra-] [http://ustall.org/web/bagutti-midi.htm bagutti midi] [http://psisemiya.com/images/small/www-bahia/ www bahia it] [http://saibso.org/laser-hp.htm laser hp stampante] [http://psisemiya.com/images/small/pelletterie-in/ pelletterie in firenze] [http://amohseni.info/img/styles/hard-disk/ hard disk con lettori di schede] [http://davte.info/library/html/video-esecuzioni.htm video esecuzioni in irak] [http://ustall.org/web/www-ea.htm www ea games it] [http://amohseni.info/img/styles/telefono-rovigo/ telefono rovigo] [http://bloprofeldi.info/lib/vermilion.htm vermilion] [http://ustall.org/web/nokia-.htm nokia 3510 telefonino] [http://ustall.org/web/la-torre.htm la torre del mangia] [http://nobinters.org/salt.htm salt] [http://psisemiya.com/images/small/un-gioco/ un gioco di sparatutto] [http://helmed.info/topic/udo-thundervision/ u.d.o. thundervision] [http://ustall.org/web/never-stop.htm never stop] [http://amohseni.info/img/styles/lumix/ lumix 8] [http://psisemiya.com/images/small/maracaibo-colombo/ maracaibo colombo] [http://ashythro.info/library/html/hp-officejet/ hp- officejet 7210] [http://saibso.org/nuovi-zombies.htm nuovi zombies sui nostri schermi] [http://nobinters.org/seca.htm seca] [http://helmed.info/topic/residenza/ residenza] [http://saibso.org/teo-mammuccari.htm teo mammuccari cd] [http://ustall.org/web/quartetto-pazzo.htm quartetto pazzo] [http://kinunia.cn/stafania-orlando.htm stafania orlando] [http://kinunia.cn/testo-my.htm testo my heart will go on] [http://psisemiya.com/images/small/ventose-bagno/ ventose bagno] [http://davte.info/library/html/archivio-estrazione.htm archivio estrazione lotto] [http://psisemiya.com/images/small/tastiera-e/ tastiera e mouse per apple] [http://saibso.org/maria-rosa.htm maria rosa] [http://helmed.info/topic/mare-vacanza/ mare vacanza puglia] [http://bloprofeldi.info/lib/aereoporto-linate.htm aereoporto linate] [http://ustall.org/web/aesop-banner.htm aesop banner maker] [http://saibso.org/designer-scaffale.htm designer scaffale] [http://helmed.info/topic/designjet-/ designjet 130 nr] [http://bloprofeldi.info/lib/rich-jeans.htm rich jeans] [http://ustall.org/web/microsoft-windows.htm microsoft windows xp media] [http://bloprofeldi.info/lib/ipod-speaker.htm ipod speaker jbl] [http://helmed.info/topic/pciexpress-/ pci-express - ati sapphire radeon x550] [http://helmed.info/topic/immagini-diddl/ immagini diddl desktop] [http://bloprofeldi.info/lib/www-alberghi.htm www alberghi mestre] [http://amohseni.info/img/styles/sborrate-con/ sborrate con noi] [http://kinunia.cn/linch.htm linch] [http://ustall.org/web/senza-cravata.htm senza cravata] [http://kinunia.cn/foto-carolina.htm foto carolina total request live mtv] [http://davte.info/library/html/il-teschio.htm il teschio di londra] [http://ustall.org/web/inuyasha-e.htm inuyasha e kagome] [http://amohseni.info/img/styles/barche-in/ barche in vetroresina] [http://ashythro.info/library/html/cineriz/ cineriz] [http://ustall.org/web/li-jon.htm li jon] [http://helmed.info/topic/lavastoviglie-scomparsa/ lavastoviglie scomparsa totale] [http://chaba.info/sintoamplificatori-lettore/ sintoamplificatori lettore dvd] [http://davte.info/library/html/jamie-pressley.htm jamie pressley] [http://kinunia.cn/publicinvasion.htm publicinvasion] [http://davte.info/library/html/semolei.htm semolei] [http://amohseni.info/img/styles/la-fiamma/ la fiamma] [http://kinunia.cn/the-doctor.htm the doctor] [http://psisemiya.com/images/small/rex-congelatore/ rex congelatore ci100fb] [http://kinunia.cn/attrezzatura-bar.htm attrezzatura bar] [http://bloprofeldi.info/lib/ariete-toast.htm ariete toast] [http://helmed.info/topic/mezzora-dei/ mezzora dei zero assoluto] [http://bloprofeldi.info/lib/vendita-quadri.htm vendita quadri] [http://saibso.org/altoparlanti-ipod.htm altoparlanti ipod lansing] [http://chaba.info/noi-siamo/ noi siamo angeli. vol. 02] [http://bloprofeldi.info/lib/softice.htm softice] [http://davte.info/library/html/carmen-di.htm carmen di pietro video] [http://bloprofeldi.info/lib/fotocamera-per.htm fotocamera per hp ipaq] [http://ustall.org/web/biebl-konstantin.htm biebl, konstantin] [http://amohseni.info/img/styles/halmahera/ halmahera] [http://ashythro.info/library/html/porno-film/ porno film] [http://psisemiya.com/images/small/il-primo/ il primo cerchio] [http://nobinters.org/interfaccia-pioneer.htm interfaccia pioneer] [http://bloprofeldi.info/lib/sakmann-bert.htm sakmann, bert] [http://bloprofeldi.info/lib/il-pilota.htm il pilota del danubio] [http://ashythro.info/library/html/video-free/ video free gay] [http://bloprofeldi.info/lib/heart-rata.htm heart rata monitor] [http://amohseni.info/img/styles/pc-siemens/ pc siemens] [http://psisemiya.com/images/small/deskstar-tk/ deskstar t7k250] [http://saibso.org/nomi-di.htm nomi di cantanti di cartoons] [http://kinunia.cn/dawnload-gioco.htm dawnload gioco gratis] [http://nobinters.org/fortuna-clip.htm fortuna clip] [http://amohseni.info/img/styles/stato-patrimoniale/ stato patrimoniale] [http://chaba.info/kojiro-shout/ kojiro shout] [http://davte.info/library/html/honda-gold.htm honda gold wing] [http://amohseni.info/img/styles/zubair/ zubair] [http://psisemiya.com/images/small/sigla-di/ sigla di contro campo] [http://saibso.org/frajese.htm frajese] [http://ustall.org/web/ricetrasmettitori-alan.htm ricetrasmettitori alan 777] [http://psisemiya.com/images/small/pescare/ pescare] [http://ustall.org/web/egitto-sharm.htm egitto sharm vacanze] [http://amohseni.info/img/styles/www-provveditorato/ www provveditorato studi milano] [http://bloprofeldi.info/lib/anitra.htm anitra] [http://chaba.info/bengali/ bengali] [http://nobinters.org/elion.htm elion] [http://kinunia.cn/dizionario-della.htm dizionario della lingua italiana] [http://kinunia.cn/videocamere-digitali.htm videocamere digitali canon mvx300] [http://helmed.info/topic/wallpaper-gratis/ wallpaper gratis] [http://davte.info/library/html/congresso-kyoto.htm congresso kyoto 1997] [http://kinunia.cn/motori-stradali.htm motori stradali] [http://davte.info/library/html/charlotte-church.htm charlotte church. dream a dream] [http://nobinters.org/dinerdash.htm dinerdash] [http://bloprofeldi.info/lib/enz.htm enz] [http://ustall.org/web/luna-park.htm luna park - impianti] [http://bloprofeldi.info/lib/turu-turu.htm turu turu] [http://helmed.info/topic/condizionatore-auto/ condizionatore auto] [http://ustall.org/web/european-society.htm european society cardiothoracic surgery] [http://kinunia.cn/televisori-lcd.htm televisori lcd da 15 pollici] [http://psisemiya.com/images/small/charrito-negro/ charrito negro] [http://psisemiya.com/images/small/navarra/ navarra] [http://helmed.info/topic/mario-camerini/ mario camerini] [http://psisemiya.com/images/small/wratchild/ wratchild] [http://bloprofeldi.info/lib/la-passionaria.htm la passionaria] [http://nobinters.org/camera-brindisi.htm camera brindisi] [http://bloprofeldi.info/lib/panche-da.htm panche da inversione] [http://amohseni.info/img/styles/games-girl/ games girl] [http://ustall.org/web/swallow.htm swallow] [http://psisemiya.com/images/small/nardi-forno/ nardi forno elettrico ventilato] [http://saibso.org/fucile-cressi.htm fucile cressi] [http://nobinters.org/freakys.htm freakys] [http://davte.info/library/html/mobile-porta.htm mobile porta tv plasma] [http://saibso.org/da-ethernet.htm da ethernet a wireless] [http://saibso.org/www-coppaitalia.htm www coppaitalia it] [http://amohseni.info/img/styles/officejet-all/ officejet all in one] [http://psisemiya.com/images/small/shame-shame/ shame shame shame] [http://psisemiya.com/images/small/trick-me/ trick me wav] [http://saibso.org/scheda-audio.htm scheda audio esterna usb creative] [http://amohseni.info/img/styles/un-albero/ un albero di] [http://psisemiya.com/images/small/triple-seven/ triple seven] [http://ustall.org/web/copertina-album.htm copertina album keane] [http://amohseni.info/img/styles/masterizzatori-usb/ masterizzatori usb lightscribe] [http://bloprofeldi.info/lib/pny-geforce.htm pny geforce 7800gtx 256 mb pci express] [http://saibso.org/francesca-duranti.htm francesca duranti] [http://amohseni.info/img/styles/porno-negre/ porno negre nude] [http://amohseni.info/img/styles/the-blus/ the blus brothers] [http://amohseni.info/img/styles/acer-alwm/ acer al2032wm] [http://chaba.info/foto-nide/ foto nide donne gratis] [http://ashythro.info/library/html/cucardas/ cucardas] [http://nobinters.org/erogatore-pesca.htm erogatore pesca] [http://ustall.org/web/otro-dia.htm otro dia mas sin verte] [http://bloprofeldi.info/lib/sanyo-plv.htm sanyo plv z3] [http://ustall.org/web/orologio-gucci.htm orologio gucci] [http://saibso.org/scopa-elettrica.htm scopa elettrica hoover a batteria] [http://kinunia.cn/sit-per.htm sit per sole donne] [http://chaba.info/nvidia-fx/ nvidia fx540] [http://psisemiya.com/images/small/anker-nini/ anker, nini roll] [http://davte.info/library/html/heredia.htm heredia] [http://amohseni.info/img/styles/www-fica/ www fica] [http://chaba.info/nikkor-af/ nikkor af 50mm f 1 8 d] [http://helmed.info/topic/registratore-cd/ registratore cd tascam] [http://helmed.info/topic/immobili-in/ immobili in zona ponte di nona roma] [http://saibso.org/viata-omului.htm viata omului] [http://nobinters.org/saint-john.htm saint john (isola delle picco...] [http://kinunia.cn/gf.htm gf6600 256] [http://ashythro.info/library/html/cartomanzia-cartomante/ cartomanzia cartomante consulto] [http://ashythro.info/library/html/radio-fan/ radio fan] [http://davte.info/library/html/cartoni-porno.htm cartoni porno] [http://ustall.org/web/lettore-richmond.htm lettore richmond dvx] [http://saibso.org/team.htm team] [http://ashythro.info/library/html/gli-scarafaggi/ gli scarafaggi] [http://bloprofeldi.info/lib/brother-mfc.htm brother mfc] [http://davte.info/library/html/www-latinchad.htm www latinchad] [http://nobinters.org/mediterraneo-colonna.htm mediterraneo colonna sonora film] == Code Audit ==
+
== Code Audit ==
{|border="1" width="100%" cellpadding="1" cellspacing="0" style="font-size: 85%; border: gray solid 1px; border-collapse: collapse; text-align: center; width: 100%
{|border="1" width="100%" cellpadding="1" cellspacing="0" style="font-size: 85%; border: gray solid 1px; border-collapse: collapse; text-align: center; width: 100%
!style="background: #ececec;"|'''ID
!style="background: #ececec;"|'''ID

Latest revision as of 02:21, 19 August 2007

Contents

Code Audit

ID test tool test status owner notes
V.A.1 Audit the NFSv4 server code New
V.A.2 Audit the NFSv4 client code New
V.A.3 Audit the rpcbind / portmap code New
V.A.4 Audit the krb5 code DONE Assuming MIT krb5 libs are already reviewed
V.A.5 Audit the idmapd code New
V.A.6 Audit the mountd New
V.A.7 Audit the RPC authentication code (gssd, authsys, etc.) New

Security regression testing

ID test tool test status owner notes
V.B.1 Run Stanford/Coverity Checker periodically New
V.B.2 Run SMATCH as regression test periodically New
V.B.3 Run FlawFinder as regression test periodically New
V.B.4 Run Sparse as regression test periodically In Progress OSDL Data is reported for CITI kernels; need to understand how to analyze it

Administration tools

ID test tool test status owner notes
V.C.1 Verify that only administrative users can access admin tools and config files New Perhaps run this in a test suite

Security features design review

ID test tool test status owner notes
V.D.1 Review Authentication/ACL feature design New U Mich has done some NFS2/3 ACL testing 10/04
V.D.2 Review each security flavor feature design

Krb5
Spkm3

New
V.D.3 Review security negotiation feature design New Still needs some implementation work
V.D.4 Review named attributes feature design New Still needs some implementation work
V.D.5 Review supporting advanced security flavors on the callback channel design New Still needs some implementation work
V.D.6 Penetration testing for client callback implementation New

Security feature testing

ID test tool test status owner notes
V.E.1 Ensure a functionality test sufficiently tests Authentication/ACL New
V.E.2 Ensure a functionality test sufficiently covers each security flavor

Krb5
Spkm3

New
V.E.3 Ensure a functionality test sufficiently covers security negotiation New
V.E.4 Ensure a functionality test sufficiently covers named attributes New
V.E.5 Ensure a functionality test sufficiently covers advanced security flavors on callback channel New
V.E.6 Ensure a functionality test sufficiently covers penetration testing for client callback implementation New

Attack and penetration security review

ID test tool test status owner notes
V.F.1 Identify security issues assuming attack from client-side Open Bull Bull planning on creating a list of issues in 2005

NFSv4 client Denial of service Userland daemons Mount and other nfs utils

V.F.2 Identify security issues assuming attack from server-side Open Bull Bull planning on creating a list of issues in 2005
V.F.3 Identify security/privacy issues assuming listening by an active or passive third party Open' Bull Bull planning on creating a list of issues in 2005

Cross realm

ID test tool test status owner notes
V.G.1 Two v4 domains; kerberos, ACLs in one realm; file system in another New Still experimental

Documentation for testing/auditing

ID test tool test status owner notes
V.H.1 Ensure there is high level design documentation of NFSv4 security

Start with Bruce's paper
Security mechanisms
Client responsibilities
Server responsibilities

New
V.H.2 Ensure there is inline documentation for security related code in kernel New
V.H.3 Ensure there is inline documentation for GSS API (libgssapi, librpcsecgss) New
V.H.4 Ensure there is inline documentation for nfsv4 libraries New

Security use case

ID test tool test status owner notes
V.I.1 Verify proper functionality/security correctness of NFSv4 in a VPN environment New Venkat will write use case
Personal tools