--
It's long been known to expert network administrators that most nefarious software and malware infiltrate your production network not through holes in your firewall, or brute-force password attacks or anything else that might occur at your corporate headquarters or campus.
Rather, they gain access to your wires through your mobile users when they try to connect to your business network while on the road. There's a big problem with remote users, and it hinges on the unpredictability of the machines from which they're connecting.
Most remote users are authenticated and allowed access to your network only on the basis of their identity. They can prove that they are who they say they are, and that's good enough for a lot of deployments. But problematically, no effort is made to verify that their hardware and software on their machines meets a certain baseline requirement. Remote users could, and do every day, fail any or all of the following common-sense guidelines for very basic computer security:
- The latest service pack and the latest security hot fixes are installed.
- The corporation-standard antivirus software is installed and running and the latest signature files are being used.
- Internet or network routing is disabled.
- Windows XP's ICF, or any other approved firewall, is installed, enabled and actively protecting ports on the computer.
- You would expect your business desktops to comply with policy, particularly because of the excellent tools that are now available for distributed management.
But mobile users have typically been either overlooked or grudgingly accepted as exceptions to the rule. Luckily, Windows Server 2003 includes a new feature in its Resource Kit, or with Service Pack 1, known as Network Access Quarantine Control (NAQC). In a nutshell, NAQC prevents unhindered access to a network for a remote user connecting to a secured endpoint until after the machine at the endpoint has verified the connecting computer's configuration meets certain requirements and standards.
Under NAQC, when a client establishes a connection to a remote network's endpoint (a machine running the Routing and Remote Access Service included in Windows Server 2003), the destination DHCP server gives the remote, connecting computer an IP address, but a server running Microsoft's Internet Authentication Service (also included in Windows Server 2003) establishes a "quarantine mode." In quarantine mode, the following restrictions are in effect:
A set of packet filters is enabled that restricts the traffic sent to and received from a remote access client.
A session timer is enabled that limits the duration of a remote client's connection in quarantine mode before being terminated.
The standards with which connecting remote computers must comply are solely defined by the network administrator, and compliance is checked with a script that the administrator creates based on these guidelines.
To use NAQC, the remote machines connecting to your NAQC-enabled endpoint need to be running Windows 98 Second Edition, Windows Millennium Edition, Windows 2000 Professional or Server, or Windows XP Home or Professional. These versions of Windows support a Connection Manager "connectoid," or profile, located in the Network Connections element in the user interface. The profile enables dial-up or VPN connectivity and contains three essential elements:
- Connection information: the remote server IP address, encryption requirements, and so on
- The baseline script: a simple batch file or executable used to assess the condition of the connecting client
- A notifier: a component that talks to the secure endpoint and negotiates a lift of the client's quarantine once the baseline script is satisfied the connecting computer is secure
- Once the remote computer is in quarantine mode, the client computer automatically executes the baseline script. If Windows runs the script and is satisfied with the result, it contacts the listening service running on the Windows Server 2003 backend machine and reports this result. Then quarantine mode is removed and normal network access is restored. Otherwise, the client eventually is disconnected when the session timer reaches the configured limit, as described earlier.
There are six steps to a proper deployment of NAQC:
- Create the resources that will be available to your users in quarantine mode. You'll want users to have access to certain sites and downloads on a specially hardened server so they can fix themselves and reconnect.
- Write the script that performs the baseline checks on remote clients attempting a connection.
- Install the listening service on your Windows Server 2003.
- Create a Connection Manager profile with the properties of a quarantined connection.
- Distribute that profile to remote users, through Group Policy, e-mail, or via CD or FTP.
- Configure the actual quarantine policy using packet filters in IAS.
Jonathan Hassell is an author, consultant and speaker on a variety of IT topics. His published works include RADIUS, Hardening Windows, Using Windows Small Business Server 2003 and Learning Windows Server 2003. His work appears regularly in such periodicals as Windows IT Pro, PC Pro and TechNet Magazine. He also speaks worldwide on topics ranging from networking and security to Windows administration. He is currently an editor for Apress, a publishing company specializing in books for programmers and IT professionals.