Disclaimer

Any opinions expressed here are my own and not necessarily those of my employer (I'm self-employed).

Sep 2, 2010

Hardening Windows Server 2003 SSL/TLS configuration

Though Windows Server 2003 has been around for a while, we'll still see them around the Internet for many years to come. Despite their usefulness, there are some important security considerations to make when running an Internet facing 2003 server.

SSL/TLS and the 2003 server
Windows Server 2003 was developed in a different era in terms of both security threats and the maturity of software security practices. In 2002, Bill Gates distributed his note on trustworthy computing internally at Microsoft. Since then Microsoft has made extensive efforts to produce more secure software — manifested in their SDL process. Among other tings, "secure by default" is an important principle in Microsoft's recent software. The 2003 server is not, so we'll discuss how to tighten up the SSL/TLS configuration. But first a quick primer on SSL/TLS.

The SSL/TLS protocols
SSL (Secure Sockets Layer), and its successor TLS (Transport Layer Security) are security protocols used to secure many types of Internet services, such as web, FTP, e-mail and so on. In their traditional use they ensure confidentiality and integrity for communication channel. SSL/TLS also offers server authentication in the most widely used setup. Find more information on the SSL/TLS protocols and their evolution on wikipedia.

SSL/TLS support is implemented in the schannel.dll in 2003 server. Many software packages rely on the native SSL/TLS support in Windows, e.g. Internet Explorer, the IIS (Microsoft's webserver software), and Google Chrome. It's therefore important to tighten up the SSL/TLS configuration.

To verify the current SSL/TLS configuration of a webserver, check out my previous blog post.

Disable weak encryption
A default configured 2003 server supports 40-bit encryption, and also the SSL 2.0 protocol. 40-bit encryption is subject to brute force attacks due to the short keylength. Why SSL 2.0 is supported is a mystery, as it was superseded by SSL 3.0 in 1996 due to critical security flaws.

Disabling the weak crypto requires registry changes, followed by a reboot. One can either take the tedious approach and edit the registry for hand, or the more efficient approach and put the required registry keys in a reg-file.

An example is included below, these are settings I have successfully loaded into registry on a Windows 2003 Server. A disclaimer is called for here, as editing the registry is not for the faint hearted. If something goes wrong the Windows installation might end up severely corrupted. Use the settings below at your own risk!

Copy the text (not including the horizontal lines), save it to a a file, e.g. sslsettings.reg, and double-click the file to load the settings into registry.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Null]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 128/128]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
"Enabled"=dword:00000000


After the settings are loaded to registry, a reboot is required for the changes to take effect. That's it! Any attempt to setup a SSL/TLS connection using SSL 2.0 or weak encryption will fail.

Mitigate MitM vulnerability
In November 2009 a vulnerability facilitating a Man-in-the-Middle attack on the SSL/TLS protocols was disclosed. Microsoft discusses the issue in a security advisory: SSL/TLS MitM vulnerability. Being the single most important security protocol on the Internet, TLS needed an update. Since 2009, various SSL/TLS implementations have been updated. Finally, last month (August 2010) Microsoft released an update through their Microsoft Update. The update implements RFC 5746, which solves the problem.

Add stronger crypto?
Since the 2003 server does not support AES cipher suites, there have been some interoperability issues with other systems. To cope with this, Microsoft released a hotfix adding support for the AES cipher. However, as the changes included in the latest TLS update are considerable, I would not risk installing the AES hotfix. Instead, consider upgrading to the 2008 server instead!

31 comments:

  1. I tried to do this and now its screwed up my registry and now I cannot run Regedit to restore the backup registry as it will now not run regedit or even explorer , this is critical we cannot affor dto have this server be down

    ReplyDelete
  2. Thanks for useful post. I also think you might be interested in topic on whatsapp spy apps.

    ReplyDelete
  3. To get started, restart your computer and load the registry cleaner. registry repair

    ReplyDelete
  4. In your life you need of free robux generator online for get free robux online

    ReplyDelete
  5. This comment has been removed by the author.

    ReplyDelete
  6. Your music is stunning. You have some extremely capable craftsmen. I wish you the best of accomplishment. system healer virus removal process

    ReplyDelete
  7. card games solitaire has variety of online solitaire card games that are available on our website for download and also with the option to play online directly without downloading

    ReplyDelete
  8. Get the best Assignment Help Australia  by the expert assignment writers at Make My Assignments. Our experts are fluent in writing assignments without missing the deadlines as they have earned their degrees from the renowned colleges and universities around the world.

    ReplyDelete
  9. If you want to get good business research topic ideas then come at Students Assignment Help and meet all your needs. Our experts will make your experience best academic writings at a cheap price. We deliver all our work within the deadline.

    ReplyDelete
  10. When you have discovered a window cleaner whether in London or anyplace else, you ought to dependably have the capacity to have your seals cleaned. best solar information online

    ReplyDelete
  11. I am a content writer and editors at MyAssignmenthelp.co.uk. MyAssignmenthelp is a leading reputable dissertation help and writing services company in UK. MyAssignmenthelp provides best dissertation help, best dissertation writing services and best dissertation proposal writing service in UK. We have 4000+ professional academic writers. All writers of always updated, professional and experienced.

    ReplyDelete
  12. Amazing website to peruse and share,each and each line in your blog is special and mind blowing exceptionally hard to compose such sort of article on the grounds that so much data is accessible on web and to discover great one among them is a troublesome undertaking.

    I invest hours on web and after an excessive amount of diligent work I arranged a blog which will shaken you mind on the off chance that you read it.please see my page:- What is Love

    ReplyDelete
  13. As a student I prefer to read the blogs I am learning ASP.NET and I am on a beginner level and having difficulties while performing any task, I have a client's project https://vidnado.com.au and they need it on asp.net but I am struggling hard to achieve this task.

    ReplyDelete
  14. Thank you so much for sharing this great blog.Very inspiring and helpful too. Hope you continue to share more of your ideas. I will definitely love to read. Assignment help online

    ReplyDelete
  15. Such a nice blog post on this topic. According to the assignment experts, the next step will be to get the outline of the assignment help checked by the professor. This will help the experts to follow the project outline being given. Moreover, it will also reduce the risk of change in the outline after the completion of the assignment.

    ReplyDelete
  16. Computer software is held in the storage of computers for a very specific purpose and performs the function of the program it implements, either by directly providing instructions to the computer hardware or by serving as an input to another piece of software.innovative apps in Modesto

    ReplyDelete
  17. I admire people who keep sharing valuable stories through great writing. I'm glad to have read this blog. Thanks and hope to read more soon. Check out Lawrence Todd Maxwell's page to learn more about real estate.

    ReplyDelete
  18. Thank you! I'm glad to find the information here.
    gmail email login

    ReplyDelete
  19. The experts of this company always understand the students and their homework issues. So, they provide best primary homework help service in doing their assignment in numerous subjects. The service not only helps the students in resolving their issues of academic assignment, but also provides some time for meditation and relaxation.You can complete you academic study in much easier way with academic study assist from the best experts. Students just require stretching their hands asking for help in their assignments. The experts are always ready to provide best academic Study Help to help you in bringing A+ grade in your examination. Apart from feeding the students with ready assignments, the experts of this company also help them in writing their assignments by their own.

    ReplyDelete
  20. Sample Assignment is one of those reliable academic websites from where you can get online help with assignment at the most affordable rates. Students can go through a huge list of full-length assignment samples which can be found on their website. This online assignment service provider has three teams who work together to produce and deliver high-quality assignments to the client’s doorstep. Customer care executives, subject experts, and the quality assurance team provide all kinds of university assignments such as dissertations, essays, reports, literature reviews, and more. We also have a 24-hour online assignment help service, which students can avail of via WhatsApp, Messenger, and email. Simply let us know your assignment’s requirements and our teams will bring you the best assignment help written by them.

    ReplyDelete
  21. Thanks for providing such valuable information. There is one such company that goes by the name of Online Assignment Expert that caters to the needs of students in universities around the world. We provide Computer Science Assignment Help with our exceptional team of writers who are experts in their corresponding disciplines and cover numerous amounts of related topics.

    You can do a lot by efficiently delivering java programming assignment help that is a part of the discipline of computer science. Our value-added services cover one-to-one sessions with the experts of python assignment help, proofreading, and quality checking free of cost! Moreover, assignments written by us are plagiarism-free provided with a set of Turnitin report. We guarantee 100% customer satisfaction through our services. Contact our services now!

    ReplyDelete
  22. This is a very great post and the way you express your all post details that is too good. Stressed with the approaching deadline of your Assignment work? Having sleepless nights? Give all your worries to the genius experts of CMA anytime. Australia assignment writing services.

    ReplyDelete
  23. Great suggestions! I have truly enjoyed surfing around your blog posts. Just continue composing this kind of post. Recently I found one of a good website for Free Tarot Guide for Future . Hope you would like this too.

    ReplyDelete

  24. Many of the people are depressed about the problems of essay writing. Well, don’t worry about that because we are providing this service at a very reasonable price.
    Do My Homework
    Do My Assignment

    ReplyDelete
  25. I loved the article, keep updating interesting articles. I will be a regular reader I am offering assignment help to students over the globe at a low price.
    Article Assignment Help
    Essay Assignment Helper
    Essay writing
    Essay writing service
    Dissertation help
    Thesis writing help
    Write My Essay
    Do My Essay
    Hire Cheap Essay Writer
    College Essay Help

    ReplyDelete
  26. Thanks for sharing this information. I have shared this link with other keep posting such information to provide best in class law assignment help online at very affordable prices.
    Assignment Help
    Assignment Helper
    Essay writing
    Essay writing service
    Dissertation help
    Thesis writing help
    Write My Essay
    Computer Science Assignment Help
    Assignment Help South Africa
    Assignment Writing Service

    ReplyDelete
  27. Many of the people are depressed about the problems of essay writing. Well, don’t worry about that because we are providing this service at a very reasonable price.
    Essay Writer
    seo writing service
    Essay writing service
    Essay writing help
    Write My Essay
    hire seo writer
    hire writer
    Write my essay cheap
    hire article writer

    ReplyDelete
  28. Sample Assignment is a renowned for assignment writing help and has assisted thousands of international students with their academics. Our dedicated team of experts has been providing full-fledged assignments to students pursuing their courses at various colleges and universities, and found to be avidly googling networking assignment help across the continent. While Australia is among the most preferred destinations for individuals from around the world, Assignment Experts has also won the trust of a vast pool of students here. The Australia Assignment help, such as Sample Assignment, can be easily contacted via WhatsApp and Messenger too. With our 24-hour online academic assistance, any student can reach out to us whenever he or she is in the need of help of a other subject expert like Psychology assignment help expert.

    ReplyDelete

Copyright notice

© André N. Klingsheim and www.dotnetnoob.com, 2009-2018. Unauthorized use and/or duplication of this material without express and written permission from this blog’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to André N. Klingsheim and www.dotnetnoob.com with appropriate and specific direction to the original content.

Read other popular posts