How we tested password security products

Each product was tested on a gigabit Ethernet switched network containing servers running Windows 2003 Enterprise Edition, FreeBSD 5.0, Red Hat Enterprise Linux 5 and Novell SUSE Enterprise Server 10 (all patched to current revisions). Two products, e-DMZ PAR and Symark PowerKeeper were supplied on appliances, and we installed Quest Privilege Manager for Unix on VMWare ESX Server on a Dell 1950 server and Cyber-Ark on VMware ESX Server on an HP585G2 server. The VMware ESX servers were also used to house target servers under the control of the products.

As our authentication methods for this test, we used RSA's SecureID, applicable 802.1X and RADIUS systems (specifically a Linux host running OpenRadius), and as well as Microsoft's Active Directory running on Windows 2003 Enterprise Server and OpenLDAP. We used numerous groups of users, and tested cross-group membership if the groups were importable into the specific PAM under test.

As our test applications, we also used Microsoft Exchange Server, SQL Server 2005, open source Procmail/Sendmail, and Oracle 7 on Linux.

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

Each product was tested on a gigabit Ethernet switched network containing servers running Windows 2003 Enterprise Edition, FreeBSD 5.0, Red Hat Enterprise Linux 5 and Novell SUSE Enterprise Server 10 (all patched to current revisions). Two products, e-DMZ PAR and Symark PowerKeeper were supplied on appliances, and we installed Quest Privilege Manager for Unix on VMWare ESX Server on a Dell 1950 server and Cyber-Ark on VMware ESX Server on an HP585G2 server. The VMware ESX servers were also used to house target servers under the control of the products.

As our authentication methods for this test, we used RSA's SecureID, applicable 802.1X and RADIUS systems (specifically a Linux host running OpenRadius), and as well as Microsoft's Active Directory running on Windows 2003 Enterprise Server and OpenLDAP. We used numerous groups of users, and tested cross-group membership if the groups were importable into the specific PAM under test.

As our test applications, we also used Microsoft Exchange Server, SQL Server 2005, open source Procmail/Sendmail, and Oracle 7 on Linux.

We used packet traces to watch samples of authentication requests through three stages: request submission, request authentication and password issuance. We ran this test to make sure the requests were not clear text-readable. None were, however, we were unable to verify the authentication encryption methods used.

We also checked to see if network TCP ports were able to be relocated from standard numbers (so as to thwart programs that normally scan for specific port communications, for example ports 20 and 443), and we noted which were 'hard-wired' (ports could not be changed from standard to thwart port eavesdroppers) and which PAMs were able to alter ports from standard TCP configurations.

We checked how well each product was able to be setup against our test host operating system platforms, the ease of importation of server/host candidates or discovery of existing infrastructure that would be controlled by the product under test, and how well each product was able to be managed in three categories, password accessibility by users and groups, integration with a directory service (Active Directory or OpenLDAP), and administrative controls applied to the process of issuing passwords as well as the 'quality/security' of the passwords themselves.

We also checked to see if logon activities left any trails in browser cache, checked to see if SSH or https was correctly encrypting conversations, and determined how flexible in communications each product was with both client access, and with password access through the use of a Fluke OptiView III Network Analyzer and WireShark protocol analyzer.

< Return to main story: Review: New tools control access by privileged users >

Read more about security in Network World's Security section.