Cygnus Network Security Microsoft Windows Client User's Guide January 1995

John Gilmore Pat McGregor

CNS includes documentation and software developed at the Massachusetts Institute of Technology, which includes this copyright information:

Copyright © 1989 by the Massachusetts Institute of Technology.

     Export of software employing encryption from the United States of America is assumed to require a specific license from the United States Government.  It is the responsibility of any person or organization contemplating export to obtain such a license before exporting.

WITHIN THAT CONSTRAINT, permission to use, copy, modify, and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of M.I.T. not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission.  M.I.T. makes no representations about the suitability of this software for any purpose. It is provided ``as is'' without express or implied warranty.

Copyright © 1991, 1992, 1994, 1995  Cygnus Support

Permission is granted to make and distribute verbatim copies of this manual provided the copyright notice and this permission notice are preserved on all copies.

Permission is granted to copy and distribute modified versions of this manual under the conditions for verbatim copying, provided also that the entire resulting derived work is distributed under the terms of a permission notice identical to this one.

Permission is granted to copy and distribute translations of this manual into another language, under the above conditions for modified versions.

Cygnus Network Security
***********************

Introduction
************

This is the preliminary user's guide to Cygnus Network Security for Microsoft Windows(TM).  Cygnus Support developed Cygnus Network Security (CNS) to provide strong system access security, with minimal impact on users' ease of access.  Using Kerberos Version 4 encryption and client-server technology, CNS assures that user identities can be checked securely without transmitting passwords in clear over the network.

This guide is intended as a companion volume to the main CNS documentation.  It does not contain a complete introduction to CNS nor the Kerberos protocol suite used by CNS.  If you want more information about CNS, please see those documents, available from your systems administrator.

CNS is intended to provide a handy desktop accessory for Windows users who need to securely access network resources and services.  It allows secure authentication via a familiar interface, and is accessible from the basic Windows program manager.

This preliminary guide, like CNS itself, is in development.  We welcome helpful comments and critiques of this guide as well as the dialogue boxes, the menus, and the accompanying help.  If you would like to give us comments on this program, please contact us at:

support@cygnus.com

Installing CNS
**************

Note: Your local systems administrator may have already installed the CNS on your machine.  In that case, skip this section and go on to the next.  Your systems administrator may also want you to use a different working directory for installing the CNS.  Check before you begin installation.

To use CNS for Microsoft Windows, you must have a CNS Kerberos server on your network, and your Kerberos ``principal name'' (user name) on the server.  Your network administrator can tell you if these are in place. To use Telnet to authenticate yourself for remote logins, you also need a login account (that matches your principal name) on the remote login machine.  That machine must run a Kerberized Telnet server which is included in the Unix version of this Cygnus Network Security release.

The CNS system is delivered in two forms---a floppy containing the CNS system or a cns95q1.zip file containing the CNS system.

If you have a cns95q1.zip file:

     C:\> md c:\cns
     C:\> copy cns95q1.zip c:\cns
     C:\> pkunzip cns95q1.zip

If you have a floppy disk (The following example assumes you have CNS on a floppy in your `A' drive and you are installing to your `C' hard drive. If this is not the case, modify your commands accordingly.):

     C:\> md c:\cns
     C:\> copy a:\*.* c:\cns

Continue the installation by starting Windows, opening the Program Manager and creating a `CNS' program group.

     Pull down `File' and click `New'.
     Select `Program Group' and click `OK'.
     In the `Description' field type `CNS'.
     In the `Group File' field, type `cns.grp'.
     Click `OK'.

Create program items for CNS and telnet.

     Pull down `File' and click `New'.
     Select `Program Item' and click `OK'.
     In the `Description' field, type `CNS Telnet'.
     In the `Command Line' field, type in `telnet'.
     In the `Working Directory' field, type in `c:\cns'.

     Pull down `File' and click `New'.
     Select `Program Item' and click `OK'.
     In the `Description' field, type `CNS'.
     In the `Command Line' field, type in `cns'.
     In the `Working Directory' field, type in `c:\cns'.

     Start CNS by double-clicking on the CNS icon you created.
     Select `Options...' from the `File' menu.
     Enter c:\cns\krb.con for the `conf' file.
     Enter c:\cns\krb.rea for the `realms' file.
     Click `OK'.

Next, you must edit the sample krb.rea and krb.con files provided and modify them to reflect your local configuration. Instructions on the syntax of these files can be found in krb.conf---Kerberos configuration file (Cygnus Network Security---User and Administrator Documentation for CNS Version 1), and krb.realms---host to Kerberos realm translation file (Cygnus Network Security---User and Administrator Documentation for CNS Version 1), respectively.  (The longer Unix forms have been shortened here because of suffix length limitations imposed by DOS.)

You will also need to set the current time and timezone. CNS requires that the time on the client be within 5 minutes of the time on the server. Most Windows systems run with the system clock set to current local time. If you are on the East Coast of the USA, you will need to enter

     set TZ=EST5EDT

at your DOS prompt, before starting windows. (You probably want to add this setting to your AUTOEXEC.BAT file.) Valid choices within the continental United States are:

  * EST5EDT

  * CST6CDT

  * MST7MDT

  * PST8PDT

(If you didn't set TZ you would need to set your local clock to UTC.)

Starting CNS
************

Double-click on the CNS Icon.  The CNS Kerberos Login window appears. Logging in allows you to get a special ticket called the ``ticket-granting ticket.''  The ticket-granting ticket provides authentication to CNS itself and permits users to get more tickets without having to enter their passwords repeatedly.  After the ticket-granting ticket, subsequent tickets are issued automatically by CNS at the request of CNS applications.

The CNS window prompts you for user name and password.  Enter them, and press enter.  An hour glass is displayed while CNS gets the ticket.  Press Esc to cancel the operation while the hour glass is displayed.  (Bugs in some FTP and NetManage libraries cause this not to work.)  The ticket cache is cleared when the new ticket is obtained. Pressing delete deletes all Kerberos tickets and initialize the ticket cache.

The past five successful login attempts are always remembered by CNS. To recall one of them, select it from the bottom of the File menu.  All items, except for the password, are filled in for you.

One of the primary purposes of CNS is to keep the user informed of the life cycle of their Kerberos tickets.  To accomplish this, CNS displays an entry for each ticket present in the ticket cache.  The issue time and expiration time of each ticket is displayed as a scrolling list, in addition to the service for which the ticket was issued, the service instance and the realm in which the ticket was granted.

Clocks or ticket icons are displayed beside each granted ticket to give you an intuitive feel for how much time each ticket has left.  When more than an hour of ticket life remains, a ticket icon is displayed.  When less than an hour remains, a countdown clock icon is displayed showing the portion of the last hour remaining in green and the expended portion of the last hour in red.  Times are rounded down to the nearest 5 minute interval.  Hence, 59 minutes left would display as 55 minutes left.  The icon is updated every 30 seconds.  When minimized, the clock or ticket icon for the ticket-granting ticket is displayed.  In addition, the time remaining is displayed numerically in hours until the last hour, at which point it is displayed in minutes.  If no tickets exist, the CNS icon is displayed.

CNS Options
***********

Changing Your Password
======================

The CNS password can be changed by clicking ``Change Password'' and filling in the name, instance, realm, old password and new password desired.  Click ``OK'' on the ``Change Password'' dialog to begin the change.  An hourglass is displayed while CNS gets the ticket.  Press Esc to cancel the operation while the hourglass is displayed. (Bugs in some FTP and NetManage libraries cause this not to work.)  Like most password utilities, you must confirm the new password by typing it in a second time.  None of your typing shows when you type your passwords in; your typing is replaced by stars.  Your password is not replaced until you click ``OK.''

The Command Line
================

CNS may be invoked using a variety of command line parameters to modify its behavior.  These parameters may simply be appended to the command line when the icon is created.  The command syntax is as follows:

     cns [/exit | /minimize] [principal]

/exit
-----

If supplied, /exit causes CNS to exit immediately after a successful login occurs.  The purpose of this option is to allow other programs to invoke CNS temporarily to perform a login.

/minimize
---------

If supplied, /minimize causes CNS to minimize to an iconic state immediately after a successful login occurs.  The purpose of this option is to provide a non-invasive way of invoking CNS during Windows startup. This allows you to put a CNS icon in the Program Managers startup group. This feature facilitates user authentication during Windows startup.

principal
---------

This optional field allows a Program Manager icon to be created which invokes CNS with the specified user, instance and realm already entered into the main dialog.  If one copy of CNS is already running, it is restored from a minimized state and the user, instance and realm are filled in.

Kerberos Options
================

You may select the Options dialog from the File menu.  The following options are available:

Location of the krb.realms file: The default location for this file is c:\cns\krb.rea assuming that you installed CNS into the C:\CNS directory.  You can change this location by entering the new location on the Options dialog.

Location of the krb.conf file: The default location of this file is \windows\krb.con assuming that you installed CNS into the C:\CNS directory.  This location can be changed by entering the new location on the Options dialog.

Ticket Lifetime: This field controls the ticket lifetime requested while using CNS.  If you select a lifetime of less than five minutes, CNS produces a ticket with a five minute lifetime.

Action when login expires: This field controls the behavior of CNS when the ticket-granting ticket is five minutes from expiration.  If ``Alert'' is checked, CNS is made the top window.  In addition if the window was minimize, it is restored.  Note that the focus is not changed, so user keyboard activity is not interrupted.  If ``Beep'' is checked, CNS issues an exclamation sound five minutes before ticket expiration.

TELNET Program
==============

TELNET is a modified version of NCSA telnet.  The modifications made include a variety of bug fixes which improve the robustness of the software and the addition of Kerberos 4 authentication support.  As Kerberos authentication is initiated by the TELNET server daemon, Kerberos support has been achieved without modification to the user interface.  When the Kerberos server requests authentication, TELNET attempts mutual authentication if possible.  TELNET takes the user name from either the command line or the pop-up dialog which requests the system name.  The required syntax is as follows:

     username@system

For example, you could telnet to JMR on majipoor at Cygnus by entering the command line telnet jmr@majipoor.cygnus.com. TELNET also operates properly with non-Kerberized daemons.

The source and executables of the telnet system are contained within the telnet.zip file.  The file telnet.zip should be unpacked by issuing a command of the form pkunzip -d telnet.zip. The executable is found in the file:

telnet\source\wintel\wintel.exe.  The system may be rebuilt using the nmake files telnet\source\screen\makefile and telnet\source\wintel\wintel.mak.

CNS MS-Windows Application Programmer Interface
***********************************************

Overview
========

The following paragraphs cover the specifics of Kerberos for Windows. Once the Kerberos libraries have been built, an application program may gain access to the Application Programmer Interface (API) by linking with kerberos.lib and placing kerberos.dll on the path. Your system must also find winsock.dll on the path to work properly.

The Ticket Cache
================

Kerberos for Windows maintains a single ticket cache in the Heap segment of the kerberos.dll.  Whenever a ticket is present in the cache, the DLL is locked in memory with a call to LoadLibrary.  As a result the cache remains in memory even after the last program which uses kerberos.dll has exited.  Only when all tickets are deleted and all programs which called kerberos.dll have exited, is the kerberos.dll library allowed to be unload.

Note that the kerberos.dll file remains in use while the ticket cache contains tickets, making it impossible to overwrite or delete the file.

The KERBEROS.INI file
=====================

All user specified permanent information associated with the Kerberos system is stored in the kerberos.ini file in the Windows directory.  Following is a description of each section and field which may be found in that file:

Defaults

  * USER--The default user name.  Updated by successful CNS logins as well as with the krb_set_default_user API.

  * INSTANCE--The default CNS instance.  Updated by successful CNS logins.

  * REALM--The default CNS realm.  Updated by successful CNS logins.

  * POSITION--x, y, cx, cy location of CNS main dialog, saved on CNS exit.

Expiration

  * ALERT--`Yes' if an alert is to be displayed when the ticket-granting ticket has five minutes left, `No' otherwise.

  * BEEP--`Yes' if CNS is supposed to beep when the ticket-granting ticket has five minutes left, `No' otherwise.

Files

  * krb.realms--Location of a file with identical syntax to the UNIX krb.realms file.  If this field is not specified, krb.rea in the Windows directory is assumed.

  * krb.conf--Location of a file with identical syntax to the UNIX krb.con file.  If this field is not specified, krb.rea in the Windows directory is assumed.  This file contains the local realm as returned by the krb_get_lrealm call.

Options

  * DURATION--Number of minutes used for CNS ticket lifetime requests.

Recent Logins

  * LOGIN1...LOGIN5---contain the user.instance@realm entry for a recent successful login, as displayed at the bottom of the File menu.  This field is updated on CNS exit.

Telnet

  * WIDTH--The width of the TELNET window in characters.  This field is updated when the user resizes the TELNET window.

  * HEIGHT--The height of the TELNET window in lines.  This field is updated when the user resizes the TELNET window.

  * BACKSPACE--The default backspace setting for new host systems. The values must be `BS' or `DEL'.  This field is updated by TELNET when the user changes the backspace setting.

Telnet Hosts

  * Host0 ... Host9 Each field contains the hostname of a recent login.  Either `,BS' or `,DEL' may be appended to the hostname to control the backspace setting for that host.  This field is updated by TELNET when a login occurs.

Font

Items in this section describe the font used by telnet.

  * FaceName

  * Height

  * Width

  * Escapement

  * CharSet

  * PitchAndFamily