Author Archives: paularquette

Windows Server 2022, IIS Certificate Authentication not working. (Connection Reset)

I was working with a colleague of mine the other day on this issue. If you are using WIndows Server 2022 with IIS to setup a website that will use client certificate authentication and notice that you are not prompted for a certificate….. the issue is probably TLS 1.3.

Windows Server 2022 IIS by default uses TLS 1.3. If you check the box to disable TLS 1.3 which will fall back to TLS 1.2 everything works.

Still not sure at this moment who is to blame, Microsoft, or the web browsers.

EDIT: Update from the Microsoft Article

https://docs.microsoft.com/en-us/answers/questions/654803/err-connection-reset-if-asking-client-certificate.html

Yes, I got answer: Microsoft implemented TLS 1.3 in most secure way by RFC. IIS wants to perform post-handshake authentication. Unfortunately common browsers do not support it in default configuration. You can enable it only with Firefox (when I last checked, maybe samething changed in near past). So, de facto IIS default configuration for two-way SSL with common browsers do not work with IIS when TLS 1.3 only is enabled.

You can enable IIS and TLS 1.3 only configuration by enabling in-handshake method for IIS instead on post-handshake method.

Macbook Pro (16-inch, 2019) Left Side Popping/Cracking Noise

I have a 16-inch Macbook Pro laptop that recently started this popping/cracking noise on the left-hand side, but only when I was using VMware Fusion.

After looking around online this is apparently a thing and it sounds like it has been going on for quite some time. This sounded to me like an actual hardware problem and I was worried I was going to have to get my Mac in for service.

On one of the forums I came across they said it was a software issue and they provided a temporary work-around. I was intrigued.

The Fix:

Launch “Quicktime Player” and click close on the Open File dialog that pops up. Then go up to the top toolbar and select “File -> New Audio Recording”.

Once the Quicktime Player shows up you can simply push the yellow button to minimize it! That’s it! You should notice that your audio issues go away.

This is clearly a software issue and I hope Apple works on getting it fixed soon but at least there is a reliable easy work-around to bypass this annoying popping sound.

Pop OS! 22.04 LTS – Pop Shop Crashing on Installing Apps

If you notice that Pop Shop is crashing when you are trying to install an application check your free space! There is a very real chance that you are running low on space. The OS will not notify you it will just crash the app.

A colleague of mine was running into this problem. His home directory was on a separate partition and there was not enough free space.

You can run Pop Shop in the terminal by running: io.elementary.appcenter 

By running it in the terminal you should be able to see any output if there are errors when you are trying to perform certain tasks.

Django 4.0 Install on Ubuntu 20.04

These are my notes for bringing up Django Install on a Production Server. These notes were written on a fresh install of Ubuntu 20.04. Most of my notes are coming from this Digital Ocean article with a few changes: https://www.digitalocean.com/community/tutorials/how-to-set-up-django-with-postgres-nginx-and-gunicorn-on-ubuntu-20-04

NOTE: Once this step is completed and you make changes you will need to restart gunicorn to see the changes on the production server.

sudo systemctl restart gunicorn

Install Packages for Python3 (Include Git if its not already installed and venv)

sudo apt update
sudo apt install python3-pip python3-dev python3-venv libpq-dev postgresql postgresql-contrib nginx curl git

Create PostgreSQL Database & User

Login to Postgres Session:

sudo -u postgres psql

Create Database & User:

CREATE DATABASE myproject;
CREATE USER myprojectuser WITH PASSWORD 'password';

Change settings for Django:

Set default encoding to UTF-8
Block uncomitted transactions
Set timezone to UTC

ALTER ROLE myprojectuser SET client_encoding TO 'utf8';
ALTER ROLE myprojectuser SET default_transaction_isolation TO 'read committed';
ALTER ROLE myprojectuser SET timezone TO 'UTC';

Grant all privs on database to user:

GRANT ALL PRIVILEGES ON DATABASE myproject TO myprojectuser;

Quit PostgreSQL:

\q

Create Home Directory for Django Apps & Install Django

mkdir djangoweb
mkdir djangoweb/myprojectdir
python3 -m venv /home/<user>/djangoweb/myprojectdir/env

Activate Virtual Environment & Install Django/Gunicorn

source ~/djangoweb/myprojectdir/env/bin/activate
pip install django gunicorn psycopg2-binary

Start Django Project

django-admin startproject myproject ~/djangoapps/myprojectdir

Edit settings.py

Add DNS Name(s), IP(s), and localhost to the “ALLOWED_HOSTS” area. Put in single quotes:

ALLOWED_HOSTS = ['dns1.dns.org','xxx.xxx.xxx.xxx.','localhost']

Add PostgreSQL Database Information

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.postgresql_psycopg2',
        'NAME': 'myproject',
        'USER': 'myprojectuser',
        'PASSWORD': 'password',
        'HOST': 'localhost',
        'PORT': '',
    }
}

Add static file location, needed for nginx (bold items). This tells django to place them in a directory called static in the base project directory:

STATIC_URL = '/static/'
import os
STATIC_ROOT = os.path.join(BASE_DIR, 'static/')

Complete Project Setup

#Create Default Database Migrations
python manage.py makemigrations
python manage.py migrate

#Create Administrative User
python manage.py createsuperuser

#Collect All Static Material into Defined Static Folder
python manage.py collectstatic

#Deactivate your virtual instance
deactivate

Configure GUnicorn

Create a GUnicorn systemd socket

sudo nano /etc/systemd/system/gunicorn.socket

/etc/systemd/system/gunicorn.socket

[Unit]
Description=gunicorn socket

[Socket]
ListenStream=/run/gunicorn.sock

[Install]
WantedBy=sockets.target

Create GUnicorn systemd service file

sudo nano /etc/systemd/system/gunicorn.service

/etc/systemd/system/gunicorn.service

[Unit]
Description=gunicorn daemon
Requires=gunicorn.socket
After=network.target

[Service]
User=<user>
Group=www-data
WorkingDirectory=/home/<user>/myprojectdir
ExecStart=/home/<user>/myprojectdir/myprojectenv/bin/gunicorn \
          --access-logfile - \
          --workers 3 \
          --bind unix:/run/gunicorn.sock \
          myproject.wsgi:application

[Install]
WantedBy=multi-user.target

Start and enable GUnicorn Socket. This will create the socket file at: /run/gunicorn.sock now and at boot time. When a connection is made it will automatically start the service.

sudo systemctl start gunicorn.socket
sudo systemctl enable gunicorn.socket

Configure Nginx to Proxy Pass to Gunicorn

sudo nano /etc/nginx/sites-available/myproject

/etc/nginx/sites-available/myproject

server {
    listen 80;
    server_name server_domain_or_IP;

    location = /favicon.ico { access_log off; log_not_found off; }
    location /static/ {
        root /home/<user>/myprojectdir;
    }

    location / {
        include proxy_params;
        proxy_pass http://unix:/run/gunicorn.sock;
    }
}

Enable File by linking it to sites-enabled

sudo ln -s /etc/nginx/sites-available/myproject /etc/nginx/sites-enabled

Check for Errors

sudo nginx -t

If no errors restart nginx

sudo systemctl restart nginx

Punch a hole in UFW for Nginx

sudo ufw allow 'Nginx Full'

Forcing ADFS 3.0 to run TLS 1.2

If you haven’t already forced ADFS to run on TLS 1.2 you are behind the curve. Activating TLS 1.2 on ADFS and turning off all other vulnerable services is relatively easy.

Step 1: Disable SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1, RC4 & Enable Strong Auth for .NET

The first step that always goes unsaid is to snapshot your Virtual Machines or get a solid backup state before making any changes to a running production environment. The next unsaid step is to perform these activities on a test/dev environment before taking down Production!

SSL 2.0 and SSL 3.0 should already be disabled, if they are not disable them immediately! The following link from Microsoft provides the registry keys and powershell needed to disable all of these services. Make sure these changes are being made on all Web Application Proxies (WAPs) and ADFS servers.

  • Disable SSL 2.0
  • Disable SSL 3.0
  • Disable TLS 1.0
  • Disable TLS 1.1
  • Disable RC4
  • Enable Strong Authentication for .NET Applications

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/manage-ssl-protocols-in-ad-fs

Step 2: Reboot all Virtual Machines / Servers

This step is pretty self explanatory.

Step 3: ADFS is Br0ken, Oh Noes!!

Disabling TLS 1.0 will break ADFS 3.0, more specifically it breaks the connection between the WAPs and the ADFS servers. This is easy to fix though.

Following this article on re-establishing the trust: https://blog.rmilne.ca/2021/11/16/ad-fs-web-application-proxy-re-establish-proxy-trust/

Quick Recap: Change this registry value on the primary Web Application Proxy:

HKLM\Software\Microsoft\ADFS\ProxyConfigurationStatus –> 1

This value normally has a value of 2 (which means configured), change it back to 1, and this change does not even require a reboot.

Open up Server Manager and launch “Remote Access Manager”, select “Web Application Proxy” and put in the required information to re-establish the trust.

You may need to reboot the WAPs one more time, I had to.

Step 4: Verify SSL Services are Correct

Once all services come back up, it would be a good time to verify that all the services you think you turned off are actually off. A SSL Server Test tool would be great for that, like the one by SSL Labs: https://www.ssllabs.com/ssltest/

Step 5: You may need to correct internal .NET Applications pointing to ADFS

Internal .NET Applications may start failing. If you start to receive error messages like “Authentication failed because the remote party has closed the transport stream”, it just means you are not specifying TLS 1.2.

There is a great article on Microsoft Docs here that explains the situation and the fix: https://docs.microsoft.com/en-us/answers/questions/400152/authentication-failed-because-the-remote-party-has.html

The developers will just need to specify the SecurityProtocol in their application.

GrrCon Early Bird Tickets on Sale March 1, 2022

I attended the GrrCon Cyber Security Summit & Hacker Conference for the first time last year. Although it was kind of overwhelming I learned a lot and had a great experience. I’m planning to be back at the conference this year.

GrrCon put out a tweet last week stating that the early bird tickets would be going on sale March 1, 2022.

This year’s conference is scheduled to take place October 13th & 14th at DeVos Place in Grand Rapids, Michigan.

Re-Joining Twitch.TV In The Hopes of Further Knowledge Sharing

I have changed my username on Twitch, and I’m hoping to start being more active on the platform. While I have gathered a lot of knowledge from high school and college, most of my recent knowledge has come from colleagues and/or other prominent folks in the IT Community that give back.

I’m hoping to start using the channel once a week and plan out what the topics of discussion will be at the end of the month for the next month. If I can get going fast enough, I’m hoping to start this in February and will be posting a schedule for February soon! I’m tentatively thinking Thursday nights in the Eastern Time Zone, USA. I’m hoping to maybe try to fill at least a half-hour of content. I’ll plan to let Twitch record so if you can’t make it you can watch the recording.

Topics for discussion will range anywhere from:

  • Lessons Learned From Working in IT
  • VMware Administration
  • Active Directory Administration
    • Federated Services
    • Certificate Services
    • Group Policy
    • Security
  • Powershell Concepts & Scripting
  • Information Security Concepts
  • Palo Alto PanOS
  • Windows Server Concepts
  • Linux Server Concepts
  • The art of Googling to keep your technology job
  • Cool projects I am working on or have worked on
  • Locking down your home network

Feel free to join me over on Twitch at BlameTheFirepaul

Windows Server 2022 Core – Failed to release DHCP lease

There appears to be a bug in Server Core 2022 in regards to changing the network settings through “sconfig”.

I’m deploying a new server from template in vCenter and by default it drops onto a private network with DHCP. The first thing I will do is go edit the settings of the VM and drop it on the proper network. After the VM is properly configured I will then go through “sconfig” to reset the IP to a static IP.

In “sconfig” you punch in number “8” for “Network Settings” and select “1” for the only NIC in the machine and you will be at the following prompt:

Here you will select “1” for 1) set network adapter address.

Then select “S” for (S)tatic IP Address.

Follow the on-screen prompts to enter IP, Subnet Mask, and Default Gateway. It is here you may be prompted with the error.

Setting NIC to static IP…

Failed to release DHCP lease.

Result code: 83

Method name: ReleaseDHCPLease

If you run into this issue you can enter “15” on sconfig and drop to Powershell. You can then run the following commands:

Get-NetAdapter

This will provide the NICs and more importantly the “Name” field which will be needed below

Remove-NetIPAddress -InterfaceAlias Ethernet0 -confirm:$False

Even after getting this far you may still not be able to assign the IP through “sconfig” in which case you can do it with Powershell.

New-NetIPAddress -InterfaceAlias Ethernet0 -IPAddress 172.16.1.2 -PrefixLength 24 -DefaultGateway 172.16.1.1

You can now launch “sconfig” go back to “8” Network Settings and configure your DNS servers.

Monitoring Domain Controller Windows Firewall Logs (Part of Active Directory Hardening Series)

The first step before you can monitor the local DC firewall logs is to make sure you have properly setup your domain controllers to log firewall activity. If you have not already turned on firewall logging and increased the log size to the maximum you can configure that by looking at my prior post: https://paularquette.com/lock-down-your-active-directory-domain-controllers-internet-access-part-of-my-active-directory-hardening-series/

I have shared a new script on GitHub to do some basic monitoring of dropped traffic on your Domain Controllers. https://github.com/paularquette/Active-Directory/blob/main/AD_Monitor_DC_Firewall_Logs.ps1

I currently run this script every hour and I get plenty of overlap for logs. The logs roll relatively quick but not that quick. I’m also logging all allows and I may change that in the future to only log drops.

In order to see dropped traffic outbound you would have to have outgoing firewall rules in place. By default traffic is not blocked going out. You can reference my previous post linked above.

In the example below you can see I’m limiting all TCP/UDP outbound traffic on Non HTTP ports to a certain subset of IP ranges:

If this Domain Controller tries to send any NON-HTTP(s) traffic outside of the organization it will show up in the DC firewall logs.

Example of HTML Report:

If your IT Security group has the hardware firewalls super locked down you may not see much if any traffic being dropped on the local DCs, but it still isn’t a bad idea to have another layer of security around such a high profile service!

Changing vCenter Authentication [AD over LDAP(s)]

For reference we already had our linked vCenter talking to Active Directory over LDAPS. However, we are currently in the process of migrating all of our VMs over to new hardware. When we tried to move the main Active Directory server providing authentication to vCenter, lets just say it was not happy.

Upon trying to enter into the Identity Sources and update the server(s) manually on the Identity Source that was already being used we received the following message: “Check the network settings and make sure you have network access to the identity source”.

It was not found until after doing some Googling that you have to remove your current running Identity Source in order to make changes. In other words delete the current identity source and add a “new” one in order to make the changes you want to make.

This just seems bad.

However, after doing a lot of testing in our TEST environment I could not seem to run into any snags. If you login with administrator@vsphere.local and delete and then immediately re-add the identity source back with the same domain name, alias, etc, there does not seem to be any issues. All of your permissions on objects defined with AD groups will remain.

I used the method listed in this VMware KB for grabbing the certificates I needed for both the Primary and Secondary Active Directory Servers. (https://kb.vmware.com/s/article/2041378).