# Presentation: 506525

## Using the BRO IDS in Conjunctionwith GSI Authentication

**January 22, 2004**

## Overview

- What is Bro?
- Bro at NERSC, an Example
- Current Implementation
- Future Work

## What is Bro?

**High performance intrusion detection system developed at LBNL and ACRI**
**Vern Paxson primary developer**
**Based on operational experience with high performance networks**
**Grew out of tools developed to optimize and analyse network traffic**
**Bro Development Goals**
**High speed network monitoring**
**Low packet loss rate**
**Mechanism separate from policy**

## Why Use Bro?

- Stable and extendable platform.
- Able to operate on connection after initial handshake.
- Infrastructure currently in place.
- Works in conjunction with other solutions.

## Use of Bro Within NERSC

**ESNet**

**NERSC**

**Filtering Border**
**Router**

**Tap**

**Multiple Bro Systems**

**ACL Insertion**

** ****Real Time Analysis**
** ****Redundant Backup **
** ****Test Box**
** ****Bulk Traffic Recorder**

** ****Snort**
** ****Bro Heavyweight Protocol Analysis**
** ****Bro GRID / SSL Analysis**

**Tap**

** ****Internal Traffic Bro Monitor**

**Tap**

## Current Implementation

- Current Operational Protocols:
- 	GSIFtp
- 	Gatekeeper
- Generic GSI Authentication Layer
- CRL Compatible

## Design Overview

## GSI Component Overview

- Bro Application Interface: GAPI(connection, data, length, brand, passback)

- _GSI Component Operation_
- 1) Buffer input.
- 2) Parse into messages based on SSL boundaries.
- 3) Process messages, extracting X509 data.
- 4) Process X509 data:
- 	4.1) Sanity check cert data.
- 	4.2) Make sure certs valid (dates etc).
- 	4.3) Check w/ CRL* .
- 	4.4) Process extensions* .
- 	4.5) Record copy of cert.
- 5) Log authentication data based on “brand”.
- 6) Pass back SSL Application Data if requested.

## GSIFtp Example

- Logging Looks Like:
- (server authenticating)
- #5 128.55.128.37/64800 > 198.35.1.21/gsiftp start
- #5 X509_ISSUER RESP /C=US/O=Globus/CN=Globus Certification Authority
- #5 X509_SUBJECT RESP /O=Grid/O=Globus/CN=host/gridn0.pppl.gov
- #5 X509 Extensions: , Netscape Cert Type F
- #5 X509_ISSUER RESP /C=US/O=Globus/CN=Globus Certification Authority
- #5 X509_SUBJECT RESP /C=US/O=Globus/CN=Globus Certification Authority
- #5 X509 Extensions: , Netscape Cert Type F
- #5 X509_ISSUER RESP /C=US/O=Globus/CN=Globus Certification Authority
- #5 X509_SUBJECT RESP /O=Grid/O=Globus/CN=host/gridn0.pppl.gov
- #5 X509  ERROR MSG X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY
- 	(self signed certificate in certificate chain)
- #5 ADAT - (335 -)

## GSIFtp Cont.

- (Client Authenticating)
- #5 X509_ISSUER RESP /O=doesciencegrid.org/OU=People/CN=Xxxxx Xxxxxx ######
- #5 X509_SUBJECT RESP /O=doesciencegrid.org/OU=People/CN=Xxxxx
- 	Xxxxxx ######/CN=proxy
- #5 X509_ISSUER RESP /DC=net/DC=es/OU=Certificate
- 	Authorities/OU=DOE Science Grid/CN=pki1
- #5 X509_SUBJECT RESP /O=doesciencegrid.org/OU=People/CN=Xxxxx Xxxxxx ######
- #5 X509_ISSUER RESP /O=DOE Science Grid/OU=Certificate 	Authorities/CN=Certificate Manager
- #5 X509_SUBJECT RESP /DC=net/DC=es/OU=Certificate
- 	Authorities/OU=DOE Science Grid/CN=pki1
- #5 X509_ISSUER RESP /O=DOE Science Grid/OU=Certificate   	Authorities/CN=Certificate Manager
- #5 X509_SUBJECT RESP /O=DOE Science Grid/OU=Certificate 	Authorities/CN=Certificate Manager
- #5 X509_ISSUER RESP /O=doesciencegrid.org/OU=People/CN=Xxxxx Xxxxxx XXXXXX
- #5 X509_SUBJECT RESP /O=doesciencegrid.org/OU=People/CN=Xxxxx
- 	Xxxxxx XXXXXX/CN=proxy
- #5 X509 hot ERROR MSG X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE
- 	(unable to get local issuer certificate)
- #5 ADAT - (335 -)

## Notes On Example

- In this case a particular SSL error condition was defined
- so that it is pathological (hot) and the connection is terminated.
- This response can be granulated depending on error condition and
- available tools.
- Logging can be increased or decreased based on preferences,
- including storing copies of all certs.
- Can make 'good vs. bad' decision based on cert information, or data
- within the control channel (ex “SITE EXEC ...”).

## Future Plans?

- Current plans include:
- Version 3 compatibility (XML/SOAP).
- More Applications.
- Possible on the fly decryption to deal with
- encrypted control channels (all the data, except
- for end private cert is available in SSL handshake).