# Presentation: 709607

## Web Site Management

- Dr. Mark Rodekohr
- Energy Information Administration
- January 2000

## Overview

- Introduction
- Owners, groups and other methods of control
- Security
- Monitoring

## Introduction

- For a large site management is likely to be the single largest cost associated with running the site (outside of generating content)
- Hardware can be relatively inexpensive – Sun Sparc 20 machines are going for as low as $2,000
- Almost all software can be obtained for free however free software is free for a reason

## Owners, Groups etc.

- To provide some security (and I would argue job security) every file on a server has a owner (generally that person who created and posted the file)
- Every owner belongs to a group (which you can think of as a common work unit)
-  A system administrator assigns and maintains these designations

## Permissions

- In addition to owners and groups each file has a set of permissions associated with each owner/group.
- There are three types of permissions
- Read permission
- Write permission
- Execute permission

## Example

- Using the ls –1 myfile command:
- -rw-r—r– 1 john1  staff  335  Jan 22 13:23 myfile
- The first (–) tells us that this is a file otherwise a (l) denotes symbolic link, (d) denotes directory
- ( r) the owner has read permission
- (w) the owner has write permission
- (-) the owner does not have execute permission

## Example (continued)

- r—r– 1 john1  staff  335  Jan 22 13:23 myfile
- The next three characters tell us if any member of the group has read, write and execute permission
- The next three characters tell us if anyone has read, write and execute permission.  For all public files on a web site this set of permissions is set to read only.

## Example (continued)

- 1 john1  staff  335  Jan 22 13:23 myfile
- The (1) how many links the file has
- John 1 is the owner
- Staff is the group
- 335 if the file size in bytes
- Jan 22 13:23 was the last time the file was modified.

## Example (continued)

- All of these attributes can be changed using the chmod (change mode) command.
- For example chmod 660 myfile sets the owner permission to read and write, the group to read and write and everyone else can do nothing (not even read the file)
- This structure allows you to hide system, password and other files from the general public

## What’s the Problem

- If you are only dealing with a few files and a small number of owners/groups this system works fine.
- I would characterize the EIA web site as consistent with a mid level size site we have:
- Over 30,000 files
- About 50-60 owners which fall into 7 or 8 groups.

## What’s the Problem (continued)

- Given the fact that our site was constructed with no plan and no documentation from day 1 trying to add some rationality to owner/group/permission structure is taking countless person hours and to this day is still not working well.
- On common problem is that if someone with higher level permissions than the author changes a file then the original owner cannot change it without having someone go back and reset the permissions.
- Don’t think using NT solves this problem it is just as bad if not worse than Unix.  Even Microsoft Certified employees have trouble.

## Security: Overview

- Some security axioms:
- There is never enough security.
- It is expensive.
- Security officials could care less if your customers every get  any information and how long it takes to get it, or if your staff can post anything to your web site in a timely manner.

## Security: Recent Events

- The White House, Justice Department, and many other (including DOE) high profile government sites have been hacked over the last two years.
- At EIA we have had in excess of 700 hundred attempts to break in but only one, rather benign person, got through.
- About 300 attempts were made in the two days after to mistaken bombing of the Chinees embassy.  Most of these came from Hong Kong.

## Security and Statistical Sites

- Problems to worry about:
- The mistaken early release of time sensitive information (the Bureau of Labor Statistics had this happen twice within the same month and each time it made the papers).  Automation played a role in this.
- Someone enters your site, changes some market sensitive data and within a few minutes makes a lot of money.
- Staff post inappropriate information on your web site.

## Security: An Example I

- “The five hackers, aged 15 to 17, hacked 26 Internet service providers (ISPs) in the US and overseas. They had a list of 200,000 user accounts from Pacific Bell and were able to successfully steal the passwords for about 95,000 accounts, the BBC said, adding that the crackers used the accounts to anonymously scan the networks of the Sandia and Oak Ridge National Laboratories, both involved in the nuclear weapons program”

## Security: An Example II

## Security: An Example Email 

- Unfortunately, URLs can contain other items, including parameters that can be transmitted back to the site:
- <A HREF="http://www.stuff.com?u=foo@bar.com">www.stuff.com</A> If I take the bait and visit the site, my e-mail address, foo@bar.com, can be put on a hot list. Of course, the site managers had already obtained my

## Denial of Service Hacking

- Network hackers engage in several sorts of activities. Some, like "denial of service attacks" or "mail bombs," are designed to swamp a computer network's ability to respond and perform its internal functions. For instance, a denial of service attack on a Web server floods it with bogus requests for pages

## Network Invasion

- Another form of network hacking involves penetrating a secure area by subverting its security measures. Network hackers might accomplish this by setting up programs that try millions of passwords until one is accepted. A hacker may set up "sniffers," programs that check data to find encrypted or sensitive information.
- Once hackers get onto the machines that host networks, they can alter or remove files, steal information and erase the evidence of those activities.

## Security: Another View

## Many Tools are on the Net

## Security: What to Do

- Limit the number of staff that have permission to post to your web site and train these staff on correct procedures.
- Give computer generated passwords every three months to these staff do not allow them to change the passwords. Also set up a three try and your out rule.
- Do not put anything on your web site (except for necessary system files) that you don’t want people to see.
- Keep your software up to date with the latest patches.
- Invest in software designed to detect attempts to break into your site.

## Security: Some Other Things to Look At

## Email Can Affect Site Security

- Examples of spoofed email that could affect the security of your site include:
- email claiming to be from a system administrator requesting users to change their passwords to a specified string and threatening to suspend their account if they do not do this
- email claiming to be from a person in authority requesting users to send them a copy of a password file or other sensitive information

## Monitoring: TCP/IP Wrapper

- The TCP/IP wrapper program provides additional network logging information and gives a system administrator the ability to deny or allow access from certain systems or domains to the host on which the program is installed

## Monitoring: ISS (Internet Security Scanner)

- 	ISS is a program that will interrogate all computers within a specified IP address range, determining the security posture of each with respect to several common system vulnerabilities

## Monitoring: Tripwire

- Tripwire checks file and directory integrity; it is a utility that compares a designated set of files and directories to information stored in a previously generated database. Any differences are flagged and logged, including added or deleted entries. When run against system files on a regular basis, Tripwire enables you to spot changes in critical system files and to immediately take appropriate damage control measures

## Monitoring: People Trying to Hack into a Hacking Web Site

## Monitoring: Online Checking

## Summary

- We reviewed the file characteristics with regard to owners/groups/permissions to illustrate why site management is so expensive.
- We looked at security issues including recent events and discussed the various risks.
- We discussed some tools that can be used to monitor your web site for security problems.

## Conclusion

- While this presentation has been fairly technical it illustrates some of the problems associated with maintaining a web site.  It also illustrates the reason for using a ISP if you have a fairly small site as they are responsible for dealing with these technical issues.