Unit 5 - Designing Internet Systems and Servers - IT
- 1. Designing Internet Systems and Servers Unit 5 By Deep Raj Bhujel
- 2. Designing of Internet System Network Architecture: • The term ”network architecture” is commonly used to describe a set of abstract principles for the technical design of protocols and mechanisms for computer communication. • Network architecture is a set of high-level design principles that guides the technical design of the network, especially the engineering of its protocols and algorithms.
- 3. A network architecture must typically specify: • Where and how state is maintained and how it is removed. • What entities are named • How naming, addressing, and routing functions inter- relate and how they are performed. • How communication functions are modularized, e.g., into “layers” to form a “protocol stack”. • How network resources are divided between flows and how end-systems react to this division, i.e., fairness and congestion control. • Where security boundaries are drawn and how they are enforced. • How management boundaries are drawn and selectively pierced. • How differing QoS is requested and achieved.
- 4. Requirements of Internet Architecture • Internetworking: existing networks must be interconnected. • Robustness: Internet communication must continue despite loss of networks or routers. • Heterogeneity: The Internet architecture must accommodate a variety of network • Distributed management: The Internet architecture must permit distributed management of its resources • Cost: The Internet architecture must be cost effective. • Ease of Attachment: The Internet architecture must permit host attachment with a low level of effort. • Accountability: The resources used in the internet architecture must be accountable.
- 5. Components of Internet Network Architecture: • Satellite: • Network Adapters: • Routers: • Access Points: • Clients: • Bridges:
- 6. Building Blocks of Internet Architecture • Data Formatting: packet encapsulation, IP header formats, packet fragmentation and reassembly etc. • Addressing: Port number, IP address, MAC address, DNS, DHCP, Subnetting , NAT etc. • Dynamic Routing: Static Routing. Then, as the size of the Internet grew, dynamic routing became necessary as the topology of the network constantly changed. <network prefix>, <next hop>, <metric> • Resource Allocation: Latency or loss sensitive applications, throughput, packet delay, packet loss rate, quality of services (QoS) etc. Traffic engineering, Differentiated services model, Integrated services model, Multiprotocol level switching. • Security: firewall, virtual private network (VPN), transport layer security, secure email, and public key infrastructure (PKI) etc.
- 7. Choice of Platforms Software Platforms for servers: • Choose a network operating system (NOS) that fits the size, needs and resources of your business. E.g. Microsoft Windows Server 2003, Microsoft Windows Server 2008,UNIX, Linux, Mac OS X, Novell NetWare, BSD etc. • Pick a file server platform that's reliable and secure to protect your company's data. • Use web server platform software that can handle the amount of traffic you'll get and that has the functionality you want.
- 8. The most popular platforms and web servers are: 1. UNIX and Linux running Apache web server 2. Window NT/2000 running Internet Information Server (IIS) How do you choose your web server platform?
- 9. • Software Development Platforms/ Frameworks: 1. IIS 2. AMP Platforms LAMP WAMP MAMP 3. Cross Platform XAMPP Zend Server Community • Hardware Platform for servers:
- 10. Server Concepts: • Web server • Proxy server • RADIUS server • Mail server
- 11. Web Server: • HTML: Markup language for formatting hypertext documents • URI: Uniform notation scheme for addressing accessible resources over the network • HTTP: Protocol for transporting messages over the network
- 12. At any time web servers can be overloaded because of: • Too much legitimate web traffic. E.g., Slashdot effect. • Distributed Denial of Service (DDoS) attacks. • Computer worms • XSS viruses can cause high traffic because of millions of infected browsers and/or web servers. • Internet bots. Traffic not filtered/limited on large web sites with very few resources (bandwidth etc.); • Internet (network) slowdowns. • Web servers (computers) partial unavailability. This can happen because of required or urgent maintenance or upgrade, hardware or software failures, back-end (e.g., database) failures, etc.; in these cases the remaining web servers get too much traffic and become overloaded.
- 13. Mail Server: • Mail Transfer Agent (MTA): • Mail User Agent (MUA): • SMTP • POP3 • IMAP
- 14. Proxy Server: • In computer networks, a proxy server is a server (a computer system or an application) that acts as an intermediary for requests from clients seeking resources from other servers. • A client connects to the proxy server, requesting some service, such as a file, connection, web page, or other resource available from a different server.
- 15. • A proxy server receives a request for an Internet service (such as a Web page request) from a user. • If it passes filtering requirements, the proxy server, assuming it is also a cache server, looks in its local cache of previously downloaded Web pages. If it finds the page, it returns it to the user without needing to forward the request to the Internet. If the page is not in the cache, the proxy server, acting as a client on behalf of the user, uses one of its own IP addresses to request the page from the server out on the Internet. When the page is returned, the proxy server relates it to the original request and forwards it on to the user.
- 16. A proxy server has a variety of potential purposes, including: • To keep machines behind it anonymous, mainly for security. • To speed up access to resources (using caching). Web proxies are commonly used to cache web pages from a web server. • To apply access policy to network services or content, e.g. to block undesired sites. • To access sites prohibited or filtered by your ISP or institution. • To log / audit usage, i.e. to provide company employee Internet usage reporting. • To bypass security / parental controls. • To circumvent Internet filtering to access content otherwise blocked by governments. • To scan transmitted content for malware before delivery. • To scan outbound content, e.g., for data loss prevention. • To allow a web site to make web requests to externally hosted resources (e.g. images, music files, etc.) when cross-domain restrictions prohibit the web site from linking directly to the outside domains.
- 17. Types of Proxy server • Forward proxy • Open proxy • Reverse proxy
- 18. Forward proxy
- 19. Open proxy
- 20. Reverse proxy
- 21. There are several reasons for installing reverse proxy servers: • Encryption / SSL acceleration: • Load balancing: • Serve/cache static content: • Compression: • Spoon feeding: • Security: • Extranet Publishing:
- 22. Use of Proxy servers: • Filtering: • Caching: • DNS Proxy: • Gateways to private networks: • Accessing services anonymously:
- 23. RADIUS server • Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for computers to connect and use a network service. • Because of the broad support and the ubiquitous nature of the RADIUS protocol, it is often used by ISPs and enterprises to manage access to the Internet or internal networks, wireless networks, and integrated e-mail services. These networks may incorporate modems, DSL, access points, VPNs, network ports, web servers etc.
- 24. RADIUS serves three functions: to authenticate users or devices before granting them access to a network, to authorize those users or devices for certain network services and to account for usage of those services. • RADIUS servers use the AAA concept to manage network access in the following two-step process, also known as an "AAA transaction". • AAA stands for “authentication, authorization and accounting”.
- 25. Authentication and Authorization: – The user or machine sends a request to a Remote Access Server (RAS) – Using Point-to-Point Protocol (PPP), HTTPS secure web form etc. – Uses credentials, e.g. username and password or security certificate – Also its network address or phone number, and information regarding the user's physical point of attachment to the RAS etc. • The RADIUS server checks that the information is correct using authentication schemes – E.g. PAP, CHAP or EAP. – Modern RADIUS servers can do this, or can refer to external sources- commonly SQL, Kerberos, LDAP, or Active Directory servers—to verify the user's credentials.
- 26. The RADIUS server then returns one of three responses to the RAS ; Access Reject Access Challenge Access Accept.
- 27. • Access Reject - The user is unconditionally denied access to all requested network resources. Reasons may include failure to provide proof of identification or an unknown or inactive user account. • Access Challenge - Requests additional information from the user such as a secondary password, PIN, token or card. Access Challenge is also used in more complex authentication dialogs where a secure tunnel is established between the user machine and the Radius Server in a way that the access credentials are hidden from the RAS. • Access Accept - The user is granted access. Once the user is authenticated, the RADIUS server will often check that the user is authorized to use the network service requested. A given user may be allowed to use a company's wireless network, but not its VPN service, for example. Again, this information may be stored locally on the RADIUS server, or may be looked up in an external source like LDAP or Active Directory.
- 28. • Authorization attributes are conveyed to the RAS stipulating terms of access to be granted. • For example: the following authorization attributes may be included in an Access-Accept. – The specific IP address to be assigned to the user – The address pool from which the user's IP should be chosen – The maximum length that the user may remain connected
- 29. • Accounting: When network access is granted to the user by the NAS, an Accounting Start (a RADIUS Accounting Request packet containing an Acct- Status-Type attribute with the value "start") is sent by the NAS to the RADIUS server to signal the start of the user's network access. "Start" records typically contain the user's identification, network address, point of attachment and a unique session identifier.
- 30. RADIUS is commonly used to facilitate roaming between ISPs, for example: – by companies which provide a single global set of credentials that are usable on many public networks; – by independent, but collaborating, institutions issuing their own credentials to their own users, that allow a visitor from one to another to be authenticated by their home institution,
- 31. Cookies: • A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is usually a small piece of data sent from a website (web server) and stored in a user's web browser while a user is browsing a website. • Other than being set by a web server, cookies can also be set by a script in a language such as JavaScript, if supported and enabled by the Web browser.
- 32. • Cookies can contain authentication information, both user-related and host-related. • Using cookies for authentication treats them as tokens supplied by the browser to validate (or state and validate) an identity. • Depending on the sensitivity of the interactions with the server, protecting the confidentiality of these cookies may be critical.
- 33. Types of cookie • Session cookie • Persistent cookie • Secure cookie • HttpOnly cookie • Third-party cookie • Supercookie • Zombie cookie
- 34. • Session cookie: A user's session cookie for a website exists only while the user is reading and navigating the website. When an expiry date or validity interval is not set at cookie creation time, a session cookie is created. Web browsers normally delete session cookies when the user exits the browser. • Persistent cookie: A persistent cookie will outlast user sessions. If a persistent cookie has its Max-Age set to 1 year, then, within the year, the initial value set in that cookie would be sent back to the server every time the user visited the server. This could be used to record a vital piece of information such as how the user initially came to this website. For this reason persistent cookies are also called tracking cookies.
- 35. • Secure cookie: A secure cookie has the secure attribute enabled and is only used via HTTPS, ensuring that the cookie is always encrypted when transmitting from client to server. This makes the cookie less likely to be exposed to cookie theft via eavesdropping. • HttpOnly cookie: The HttpOnly cookie is supported by most modern browsers. On a supported browser, an HttpOnly session cookie will be used only when transmitting HTTP (or HTTPS) requests, thus restricting access from other, non-HTTP APIs (such as JavaScript). This restriction mitigates but does not eliminate the threat of session cookie theft via cross-site scripting (XSS). This feature applies only to session-management cookies, and not other browser cookies.
- 36. • Third-party cookie: First-party cookies are cookies set with the same domain (or its subdomain) in your browser's address bar. Third-party cookies are cookies being set with different domains from the one shown on the address bar (i.e. the web pages on that domain may feature content from a third-party domain - e.g. an advertisement run by www.advexample.com showing advert banners). (Privacy setting options in most modern browsers allow you to block third-party tracking cookies). • For example: Suppose a user visits www.example1.com, which sets a cookie with the domain ad.foxytracking.com. When the user later visits www.example2.com, another cookie is set with the domain ad.foxytracking.com. Eventually, both of these cookies will be sent to the advertiser when loading their ads or visiting their website. The advertiser can then use these cookies to build up a browsing history of the user across all the websites this advertiser has footprints on.
- 37. • Supercookie: A "supercookie" is a cookie with a public suffix domain, like .com, .co.uk or k12.ca.us. Most browsers, by default, allow first-party cookies—a cookie with domain to be the same or sub-domain of the requesting host. For example, a user visiting www.example.com can have a cookie set with domain www.example.com or .example.com, but not .com. A supercookie with domain .com would be blocked by browsers; otherwise, a malicious website, like attacker.com, could set a supercookie with domain .com and potentially disrupt or impersonate legitimate user requests to example.com. The Public Suffix List is a cross- vendor initiative to provide an accurate list of domain name suffixes changing. Older versions of browsers may not have the most up-to-date list, and will therefore be vulnerable to certain supercookies. • The term "supercookies" is sometimes used for tracking technologies that do not rely on HTTP cookies. Two such "supercookie" mechanisms were found on Microsoft websites: cookie syncing that respawned MUID cookies, and ETag cookies
- 38. • Zombie cookie: A zombie cookie is any cookie that is automatically recreated after a user has deleted it. This is accomplished by a script storing the content of the cookie in some other locations, such as the local storage available to Flash content, HTML5 storages and other client side mechanisms, and then recreating the cookie from backup stores when the cookie's absence is detected.
- 39. Uses of Cookies: • Session Management: • Personalization: • Tracking:
- 40. Load Balancing: Proxy Arrays • Load balancing is a computer networking methodology to distribute workload across multiple computers or a computer cluster, network links, central processing units, disk drives, or other resources, to achieve optimal resource utilization, maximize throughput, minimize response time, and avoid overload.
- 41. Why is load balancing of servers needed? • Load balancing is especially important for networks where it's difficult to predict the number of requests that will be issued to a server. • If there is only one web server responding to all the incoming HTTP requests for your website, the capacity of the web server may not be able to handle high volumes of incoming traffic once the website becomes popular.
- 42. • Proxy Server Arrays are way to handle loads in internet Proxy Server provides a feature called proxy arrays. • An array is a peer-to-peer configuration of proxy servers instead of a hierarchy. • A proxy array is a solution whereby one or multiple proxy servers operate as a single cache for client requests.
- 43. Each Proxy Server that belongs to the proxy array performs the following functions: Maintains membership information for the proxy array. Uses a hash algorithm to perform routing decisions. The hash algorithm uses the following factors: – List of current available servers. – URL of client request. – Load factor.
- 44. Arrays have the following benefits: • Users and application sessions are load- balanced across the array. • With more than one server, there is no single point of failure. • Configuration information, including all the objects in your organizational hierarchy, is replicated to all array members. All array members have access to all information.
- 45. An array contains the following: • One primary server. This server is the authoritative source for global SGD information, and maintains the definitive copy of the organizational hierarchy, called the local repository. • One or more secondary servers. The primary server replicates information to these servers.
- 46. Load Balancing Approaches • Random Allocation • Round-Robin Allocation • Weighted Round-Robin Allocation • Dynamic Round Robin
- 47. Server Setup and Configuration Guidelines • Some Points • Security and System Administration Issues – Security Issues – Administration Issues
- 48. Security Issues Examples of common security threats to servers: • Malicious entities • Denial of service (DoS) attacks • Unauthorized individuals • Unencrypted or weakly encrypted between the server and the client may be intercepted.
- 49. CIA triad: • The classic model for information security defines three objectives of security: maintaining confidentiality, integrity, and availability. – Confidentiality refers to protecting information from being accessed by unauthorized parties. – Integrity refers to ensuring the authenticity of information—that information is not altered, and that the source of the information is genuine. – Availability means that information is accessible by authorized users. • Each objective addresses a different aspect of providing protection for information.
- 50. General information security principles: • Simplicity • Fail-Safe • Complete Mediation • Open Design • Separation of Privilege • Least Privilege • Psychological Acceptability • Least Common Mechanism • Defense-in-Depth • Work Factor • Compromise Recording
- 51. Administration Issues • The Server administration includes designing, installing, implementing, maintaining, administering, and optimizing servers and related components. • The Server Administrator will assist in overseeing the physical security, integrity, and safety of the data center/server farm. • The Vital activities include – handling and analyzing log files – performing regular server backups – recovering from server compromises – testing server security regularly – and performing remote administration securely.
- 52. • Logging – Alerts to suspicious activities that require further investigation – Tracking of an attacker’s activities – Assistance in the recovery of the server – Assistance in post-event investigation – Required information for legal proceedings. • Server Backup Procedures – Regular backup of data • Security Testing Servers – Periodic testing – Identifying vulnerabilities – Verifying whether the existing security measures are effective – Penetration testing • Vulnerability Scanning – identify out-of-date software versions, – missing patches, – system upgrades
- 53. Firewalls • Firewall is hardware device or software applications that act as filters between a company’s private network and the internet.
- 54. Firewalls provide several types of protection: • They can block unwanted traffic. • They can direct incoming traffic to more trustworthy internal systems. • They hide vulnerable systems, which can’t easily be secured from the Internet. • They can log traffic to and from the private network. • They can hide information like system names, network topology, network device types, and internal user ID’s from the Internet. • They can provide more robust authentication than standard applications might be able to do.
- 55. What does a firewall do? • It can be used to log all attempts to enter the private network and trigger alarms when hostile or unauthorized entry is attempted. • Firewalls can filter packets based on their source and destination addresses and port numbers. This is known as address filtering. • Firewalls can also filter specific types of network traffic. This is also known as protocol filtering because the decision to forward or reject traffic is dependent upon the protocol used, for example HTTP, ftp or telnet. • Firewalls can also filter traffic by packet attribute or state.
- 56. Different types of firewalls available in today’s world: • Packet Filters • Circuit Level Gateways • Application Gateways • Stateful Multilayer Inspection Firewall
- 57. Packet Filters (related to IP addresses, port addresses, packets) Works at Network Layer
- 58. Circuit Level Gateways (monitor TCP handshaking between packets to determine legitimate session) Works at Session Layer / TCP Layer
- 59. Application Gateways (also called proxies, application specific) Works at Application Layer
- 60. Stateful Multilayer Inspection Firewall • It combines the aspects of the other three types of firewalls.
- 61. Content Filtering • Content filtering is the technique whereby content is blocked or allowed based on analysis of its content, rather than its source or other criteria. It is most widely used on the internet to filter email and web access. • Content filtering is used by corporations as part of Internet firewall computers and also by home computer owners, especially by parents to screen the content their children have access to from a computer.
- 62. Filters can be implemented in many different ways: • Browser based filters: • Client-side filters: • Content-limited (or filtered) ISPs: • Network-based filtering: • Search-engine filters:
- 63. There are four options for content filtering: • Client based software • server based software • stand-alone appliances (hardware) • managed service
- 64. Email Filtering • It is the processing of email to organize it according to specified criteria. • SMTP Proxy: • With an SMTP proxy filter, you can: – Adjust timeout, maximum email size, and line length limit to make sure the SMTP proxy does not use too many network resources and can prevent some types of attacks. – Customize the deny message that users see when an email they try to receive is blocked. – Filter content embedded in email with MIME types and name patterns. – Limit the email addresses that email can be addressed to and automatically block email from specific senders.