HP-NonStop Security
Secure your HP-NonStop system with security software and privileged system products and tools from
GreenHouse Software & Consulting
REPRIEVE
Overview
REPRIEVE - makes SAFEGUARD PCI compliant in regard to the management of frozen users, and prevents a Denial-of-Service attack, caused by the AUTHENTICATE_FAIL_FREEZE setting in SAFEGUARD
The PCI paper discusses under point 8.5.13 the need to lock out a user when six authentication attempts have failed. Under Point 8.5.14, the lock-out time is specified: Set the lockout duration to thirty minutes or until the administrator re-enables the user ID.
These requirements cannot be satisfied with current SAFEGUARD features.
Actually, SAFEGUARD supports two different penalty schemes:
- The process of performing authentication is terminatedfor a configurable time period. This was a successful strategy when a user had one terminal and was connected by a dedicated line. With TELNET and its windows, the number of terminals a user has access to is nearly unlimited. A 'hanging' process is re-started from a new Telnet window, and a new authentication attempt can be started.
- SAFEGUARD can be configured to freeze a user after sixfailed logon attempts. This is what PCI requires. However, activating this setting can easily result in a denial-of-service (DoS) attack, where a malicious user intentionally logs on to all available IDs with wrong passwords, freezing all users of the system, including SUPER.SUPER. The result is a running system, where nobody can logon.
The current change request is to be able to configure:
- those users who have to be frozen, for example aftersix failed attempts, and to automatically thaw them after 30 minutes
- to define the freeze time on a 'by user' basis
- to report FREEZE and THAW events to the EMS system
- to have these activities logged in the SAFEGUARD audit trails
The solution is REPRIEVE from GreenHouse:
REPRIEVE is a program controlled by the $ZZKRN process. It keeps an eye on the user-ID files and recognizes any change of a user. When a user becomes frozen, REPRIEVE starts a timer for this user, and thaws her/him automatically when the timer times out. All variables, such as
- users, their freeze time, and EMS action type (information, critical, action needed)
- EMS collector process
- REPRIEVE cycle time
can be configured.
The configuration is done through a small EDIT type file (standard), or can be done through the REPRIEVE module of iWAMS, the web based management system from GreenHouse.
The configuration can be changed at run time.