2002 - cesnet

19 Security of Local CESNET2NetworksCESNET2 consists of a number of standalone local networks containing computerswith various operating systems. Ensuring the security of a large heterogeneousnetwork brings about great demands for the work capacity of theiradministrators, and it is known that especially large university networks oftenhave insufficiently secured machines. The objective of the second year of thisproject was to make the unenviable job of administrators easier by providingthem with the access to the security audit technology, a system for detectingunauthorized accesses to the network, and a system for an unconventional fightagainst network viruses and hackers.19.1 Security AuditDuring 2001, we started running the NESSUS program, which can be freely distributedwithin the GNU licence, under the Linux operating system (kernel 2.4,Debian, RedHat, and SuSE distributions) at all three workplaces. The programperforms the actual network security audit – in the graphical or line mode(running the program in the graphical mode is more user-friendly). NESSUS allowsselection of the audit category (only safe or also potentially unsafe tests),detailed selection of individual security tests, scanning of TCP and UDP portsincluding the range, specification of the maximum number of simultaneouslytested machines, etc. New security tests are published regularly on the NESSUSFTP server (ftp.nessus.org) and can be downloaded from this location automatically.All machines that are to be tested within one NESSUS session have a commonconfiguration file. If the machines need to be tested using different types oftests, the tested machines can be divided into several groups and their auditscan be run separately. To facilitate the program control and distribution of results,we have added the following functions:• inspection of machines in a protected network and reporting of differencesfrom the last detected status (Front End program)• distribution of the audit results to appropriate persons (PTS, BackEnd)• other auxiliary functions (results sending – REP, results decoding – DEC)Based on the requirements of administrators of the CESNET network in Dejvice,the WebBackEnd (WBE) was created, as well. This program significantly simplifiedaccess to the audit results: the results are no longer sent to individualadministrators by e-mail as in the BE program, but they are published by theHigh-speed National Research Network and its New Applications 2002193