ing. | gopas a.s. | ondrej@sevecek.com | | certificates and cryptography · 2019-07-23 · windows...
Post on 18-Jan-2020
0 Views
Preview:
TRANSCRIPT
CERTIFICATES AND CRYPTOGRAPHY
Ing. Ondřej Ševeček | GOPAS a.s. | MCM: Directory Services | MVP: Enterprise Security | Certified Ethical Hacker |ondrej@sevecek.com | www.sevecek.com |
MOTIVATIONAdvanced Windows Security
Motivation for encryption
Ethernet/WiFi prone to ARP poisoning and other attacks
Public internet is insecure
Motivation for Certificates
SASL/GSSAPI Windows protocols NTLM/Kerberos symmetric generated keys
TLS (SSL) encryption HTTPS, SMTPS, RDP, LDAPS, FTPS, POP3S, IMAP4S, SSTP VPN, IP-HTTPS
TLS (SSL) authentication 802.1x for Ethernet, 802.1x for WiFi, EAP-TLS for VPN, SSL Client Authentication
for HTTPS
IPSec
Smart Card Logon
Encrypting File System
Digital Signing documents, macros, scripts, executables
Secure Email (S/MIME) signed and/or encrypted
SASL encryption
# by default SASL encrypted
Enter-PSSession gps-data
# by default SASL signed only
gwmi win32_logicaldisk -computer gps-wks10 -
Authentication PacketPrivacy
Motivation for Certificates
Better than simple user passwords
RSA 2048 + SHA-1 comparable with 12 characters complex password
RSA 2048 + SHA256 comparable with 16 characters complex password
Can be stored in smart card
hardware item
cannot be copied
multifactor authentication and access with PIN
SMB SIGNING AND ENCRYPTION
Advanced Windows Security
SMB signing
Data integrity only no encryption
Requires Kerberos/NTLM authentication
Prevents SMB reflection attack in case of NTLMv2 session security
Compatibility Windows 2000+
SAMBA?
SMB signing
SMB encryption
Encrypts with session keys from Kerberos/NTLM
Compatibility
Windows 8/2012+ (SMB v3)
Access denied for older clients
SMB encryption
SMB encryption error from Windows 2008 R2 (SMBv1 and SMBv2 clients)
LDAP signing
LDAP signing requirements
SASL client (TCP 389)
Windows, ...
TLS Server Authentication certificate + TLS client (TCP 636)
any
CERTIFICATION AUTHORITY
Advanced Windows Security
Certification Authority
Certificate Issuer
Must be trusted by users and servers
May construct hierarchies
CA Hierarchy
CA Types
Enteprise CA AD integrated
automatically trusted by domain members
issues certifcates online
autoenrollment
Standalone workgroup computer
receives requests in .REQ files and issues .CER files
manual copy/download
Enterprise CA Installation
User must be member of Enterprise Admins
Choose
public key lenght: RSA 2048
signature: SHA-1 or SHA256 (only 2008/Vista+)
Lab: Installing CA
Log on to server GPS-POLICY as domain-admin
Add role: role: Active Directory Certificate Services
type: Enteprise
public key: RSA 2048
signature: SHA-256
name: GOPAS Root Online CA
After installation open Certification Authority console and remove all Certificate Templates
Lab: Veryfying CA Installation
Log on to GPS-WKS as Kamil
Update Group Policy with GPUPDATE
Start MMC
Add Certificates snap-in for Local Computer
Verify that the GOPAS Root Online CA is present in the Trusted Root Certification Authorities
CERTIFICATE TEMPLATESAdvanced Windows Security
Certificate Templates
Certification Policies
Define certificate parameters
Versions Windows 2000 – cannot be modified
Windows 2003 – can be used by XP, 2003 and newer
Windows 2008 – can be use by Windows 2008/Vista and newer, with exceptions!
Windows 2012 – can be used by all clients according to its compatibility settings
Certificate Templates
Certificate Template Options
Subject Name
Manually defined by requester
Automatically filled in by CA from Active Directory
Subject Name
Enhanced Key Usage
Defines uses of the certificate
KDC Authentication certificate for Domain Controllers
Server Authentication TLS/SSL server
Remote Desktop Authentication RDP/TS server
Client Authentication TLS/SSL user authentication
Encrypting File System file encryption
Code Signing code file signing such as .EXE, .PS1, .VBS, macros in .XLSM
Document Signing document files such as .DOC, .TXT, .XLS
Secure Email digitally signed and/or encrypted email
Enhanced Key Usage (EKU)
Permissions
Read read the definition of the template
Write modify template
Enroll manually ask for the certificate
submit the request to CA
Autoenroll client computers can automatically ask for the
certificates without user interaction
Permissions
Lab: Define basic certificate templates On GPS-POLICY open Certificate Templates console
Duplicate Computer template: name: GOPAS TLS Server private key: exportable application policies: Server Authentication permissions: GPS-WFE – Enroll, Autoenroll
Duplicate User template: name: GOPAS User Logon private key: non-exportable application policies: Client Authentication, Smart Card Logon permissions: Domain Users – Enroll, Autoenroll
Publish certificate templates in AD CS: Kerberos Authentication, GOPAS TLS Server, GOPAS User Logon
AUTOENROLLMENT
Advanced Windows Security
Autoenrollment
Automatic management of certificates
Automatic enrollement
if Autoenroll permission is granted
Renews expiring certificates
Archives expired/revoked certificates
Occured at logon and every 8 hours
CERTUTIL -pulse
CERTUTIL -user -pulse
Autoenrollment Group Policy
Autoenrollment Group Policy
Lab: Autoenrollment
On GPS-DC create a new GPO called Autoenrollment
Enable autoenrollment both for users and computers
On GPS-WKS pulse autoenrollment for user GPUPDATE CERTUTIL -user –pulse
Verify that Kamil has received a logon certificate MMC, Certificates, Current User
On GPS-WFE pulse autoenrollment for computer GPUPDATE CERTUTIL –pulse
Verify that the server has receive a TLS server certificate MMC, Certificates, Local Computer
TLS CERTIFICATE APPLICATIONS
Advanced Windows Security
Why TLS and Certificates?
Client Attacker Server
Client Server
Attacker
Passive eavesdropping
Active MITM
Key Key
Key A Key A Key B Key B
LDAPS (LDAP over TLS)
Protects LDAP Simple Bind credentials
VPN gateways and network devices
NAS devices
VMWare VSphere
Enforce TLS for Simple Bind in GPO
LDAP Server Signing Requirements: Require Signing
Usually must import internal CA into the device
Testing LDAPS
Testing LDAPS and Simple Bind
IIS (HTTPS)
EKU: Server Authentication
SAN: manual or DNS name
Enroll: Web Servers
IIS (HTTPS)
IIS (HTTPS)
Remote Desktop over TLS
Available since Windows 2003 SP1
Authenticates server identity
RDP Security Layer only establishes encryption keys with D/H
prone to MITM attacks
Remote Desktop
EKU: Server Authentication or EKU: Remote Desktop Authentication
1.3.6.1.4.1.311.54.1.2 SAN:
DNS name (autoenrollment) short name (manual) IP address (manual)
Autoenrollment Enroll: Domain Computer + Domain Controllers GPO: Server Authentication Certificate Template
RDP with Server Authentication
RDP with Remote Desktop Authentication
RDP with Remote Desktop Authentication
Remote Desktop
Kerberos for RDP alias(required for /RemoteGuard)
Require RDP server identity authentication
Two access types
User access - Terminal Servers
problem - must type password every time
implement SSO
mstsc /remoteGuard (Credential Guard)
Admin access - servers/workstations
problem - sending full-text password to unsecure systems
use /restrictedAdmin
ssl encrypted
secondhop server
The default scenario
clientRDP
serversecond
hop serversecond
hop server
secondhop server
secondhop server
secondhop server
Kerberos NLApre-authentication
full password
cert
ssl encrypted
secondhop server
The default scenario
clientRDP
serversecond
hop serversecond
hop server
secondhop server
secondhop server
secondhop server
Kerberos NLApre-authentication
full password
TGT
TGS
TGS
cert
Single sign on to RDPCredentials delegation
SSO and TERMSRV SPN for RDP
ssl encrypted
secondhop server
RDP SSO for limited users (2012R2/8.1 and older)
clientRDP
serversecond
hop serversecond
hop server
secondhop server
secondhop server
secondhop server
Kerberos NLApre-authentication
full password
TGT
TGS
TGS
certfull
password
ssl encrypted
secondhop server
Remote Guard for limited users (2016/10 and newer)
clientRDP
serversecond
hop serversecond
hop server
secondhop server
secondhop server
secondhop server
Kerberos NLApre-authentication
TGS
TGS
certTGT
RDP RestrictedAdmin mode
Higher security account to lower security machine
No plain-text password into RDP session only Kerberos authentication
no double-hop credentials (as machine$)
RDP server update 7/2008r2 and newer RDP client Windows 8.1/2012 R2 and newer
mstsc /RestrictedAdmin user must be member of Administrators on RDP
side
Enabling RestrictedAdmin mode in registry
ssl encrypted
secondhop server
Restricted Admin mode (Windows 2012 R2/8.1 and update for 2008 R2/7 and newer)
clientRDP
serversecond
hop serversecond
hop server
secondhop server
secondhop server
secondhop server
Kerberos NLApre-authentication
cert
Authentication Policies (DFL 2012 R2)+ Kerberos Armoring (client 2012/8+)
Authentication Policies
Authentication Policies
IP SECURITY
Advanced Windows Security
Motivation
TLS must be supported by the application
TLS must be manually configured and enabled
SMB encryption must be supported by SMB3 clients and servers
IPSec protects generic IP traffic
Central policy based rules
may provide firewall/identity filters but it is not the primary goal
Brief IPSec Terminology
AH - authentication header
signs IP header plus data
does not work over NAT
ESP - encapsulating security payload
may encrypt or just sign but data only
may work over NAT with NAT-T
IPSec
EKU: Client Authentication + IPSec IKE Intermediate + Server Authentication
SAN: DNS name
Autoenroll: Domain Computers + Domain Controllers
IPSec Policies
IPSec Policies
IPSec Policies
IPSec SA Auditing
IPSec Modes
Main Mode
mutually authenticates remote endpoint
establishes keys to protect Quick Mode exchange
single SA per host-host
Quick Mode
ESP/AH/AES/3DES/SHA1/SHA2 and PFS for particular IP/TCP policy rule
single SA per IP/TCP policy rule
IPSecSAAuditing
Enterprise Implementation Risks
Client without or with an invalid certificate
must be able to obtain a new one from CA
Public/Domain network switchover
how would client determine domain network if it could not connect to a DC
Registry settings
HKLM\System\CCS\Services\PolicyAgent\Oakley
Windows XP and Windows 2003
HKLM\System\CCS\Services\IKEEXT\Parameters
Disable AuthIP
IKEFlags = DWORD = + 0x40
Disable CRL checking
IKEFlags = DWORD = + 0x8000
CREDENTIALS ROAMING
Advanced Windows Security
Credential Roaming
Private keys are stored in user profile
on individual workstations
in case of non-roaming profiles it would not roam
Credentials Roaming
upload/download certificates with private keys into user account in AD
roams smoothly with user
secures keys against profile loss
Credentials Roaming Policy
Lab: Credentials Roaming
On GPS-DC create a new GPO called Credentials Roaming
Enable credentials roaming
Update policy on GPS-WKS and GPS-DATA
gpupdate
Log off Kamil from GPS-WKS and log Kamilon GPS-DATA and verify that his certificates has been roamed to his new profile
EFS
Advanced Windows Security
Encrypting File System
Encrypts individual files
one ore more user certificates
EKU: Encrypting File System
Folders can be marked to encrypt all new files inside them
AES 256
Public key
Storage encryption
Symmetric encryption key (random)
Symmetric key
Document
Public key (Judit)Public key (Judit)Public key (Judit)
Symmetric key
Public key (My)
Storage encryption (sharing)
Symmetric encryption key (random)
Symmetric key
Document
Public key (Kamil)
Symmetric key
Features and Limitations
Cannot encrypt system files
En/Decrypted locally on file servers
No group certificates
No simple GUI to share more files at once
Can use smart cards since Windows Vista
Private keys may be backed up on CA
EFS on File Servers
File Servers must be trusted for delegation
either enroll the EFS certificate
or roam the certificates from AD
Data transferred in clear
EFS Group Policy
Lab: Preparing for EFS
Define new certificate template as duplicate of the default User template name: GOPAS EFS
EKU: Encrypting File System
Enroll: Domain Users
On GPS-DC create new GPO called EFS EFS: allow
self/signed certificate: disabled
certificate template: GOPAS EFS
Update group policy on GPS-WKS and
Lab: EFS on a File Server
On GPS-DC open Active Directory Users and Computers Console
Find GPS-DATA computer object, open its properties on the Delegation tab
Enable Trust this computer to any service Create and encrypt a file on \\GPS-DATA\Doc
shared folder Log off from GPS-WKS and log on again and
verify that the credentials roaming uploaded you the newly created certificate from the GPS-DATA file server
CODE SIGNINGAdvanced Windows Security
certutil -hashfile
any file type
just an unsigned hash
Motivation
Prevent own scripts or third-party code from being tempered
security analysis after an attack
Restrict running unsigned code
.PS1, .VBS, .JS, .EXE, .MSI
Sign .EXE/.PS1 with PowerShell
Timestamping
The signature is not trusted after certificate expires "Required certificate is not within its validity period"
You must use trusted timestamp to verify it was valid at the time of signing (RFC 3161 timestamp protocol) http://timestamp.verisign.com/scripts/timstamp.dll
http://timestamp.digicert.com
http://timestamp.globalsign.com/scripts/timestamp.dll
http://www.startssl.com/timestamp
Sign .VBS/.JS with PowerShell
Signing .NET assemblies, installers etc.
T:\WindowsSDK\signtool.exe
much more powerful
Set-AuthenticodeSignature
easier, simpler
Trusted Publisher
App whitelisting
Software Restriction Policies
XP+, all corporate editions
Application Control Policies (AppLocker)
Vista+, Enterprise edition
Server 2008+, all editions
Software Restriction Policies
Available since Windows XP
all professional version
AppLocker in Enterprise/Ultimate Windows 7+
Block all with exceptions
or allow all with block rules
Rules
path
hash
certificate
Implementing SRP
Implementing SRP
Implementing SRP
Implementing SRP
Enforce PowerShell execution policy
Recap
Recap
GPRESULT gps-wks or all GPO report
$dc = Get-ADDomainController -Discover -Service PrimaryDC
Get-GPOReport -All -Domain gopas.virtual -Server $dc -
ReportType HTML -Path \\10.2.20.63\e$\goc175\ReportAll.html
top related