My Research Notes and other usefull documentation

Troubleshooting HTTP Filtering in ISA Server

TechNet Archive — Thu, 30 Apr 2009 10:54:24 GMT

Most of the time you create a HTTP Filter in ISA but sometimes it does not work the way you would have wanted it to. Let's see a simple example and try to see what could be the possible problems.

I have a Created a HTTP Filtering to block www.fabrikam.com

Search in: Request URL
Pattern: www.fabrikam.com

I will try opening www.fabrikam.com from my client machine which is configured as SecureNAT Client which means that the internal IP of ISA is the Default Gateway for this machine.

Request from the Client Machine

Frame: Number = 46, Captured Frame Length = 408, MediaType = ETHERNET

+ Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[00-15-5D-B2-45-06],SourceAddress:[00-15-5D-B2-45-05]

+ Ipv4: Src = 192.168.0.175, Dest = 39.1.1.10, Next Protocol = TCP, Packet ID = 20628, Total IP Length = 394

+ Tcp: Flags=...AP..., SrcPort=6504, DstPort=HTTP(80), PayloadLen=354, Seq=2794349469 - 2794349823, Ack=1140043069, Win=32850 (scale factor 0x2) = 131400

- Http: Request, GET /

Command: GET

+ URI: /

ProtocolVersion: HTTP/1.1

Accept: */*

Accept-Language: en-us

UA-CPU: x86

Accept-Encoding: gzip, deflate

If-Modified-Since: Thu, 07 Aug 2008 18:55:57 GMT

If-None-Match: "a686da39bff8c81:1d9"

UserAgent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506)

Host: www.fabrikam.com

Connection: Keep-Alive

HeaderEnd: CRLF

ISA forwards the response from the Web Server (of-course the request and response are NAT'd)

Frame: Number = 48, Captured Frame Length = 365, MediaType = ETHERNET

+ Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[00-15-5D-B2-45-05],SourceAddress:[00-15-5D-B2-45-06]

+ Ipv4: Src = 39.1.1.10, Dest = 192.168.0.175, Next Protocol = TCP, Packet ID = 5425, Total IP Length = 351

+ Tcp: Flags=...AP..., SrcPort=HTTP(80), DstPort=6504, PayloadLen=311, Seq=1140043069 - 1140043380, Ack=2794349823, Win=65181 (scale factor 0x0) = 65181

- Http: Response, HTTP/1.1, Status Code = 304, URL: /

ProtocolVersion: HTTP/1.1

StatusCode: 304, Not modified

Reason: Not Modified

ProxyConnection: Keep-Alive

Connection: Keep-Alive

Via: 1.1 ISA

Date: Thu, 30 Apr 2009 14:28:52 GMT

Content-Location: https://www.fabrikam.com/index.htm

ETag: "a686da39bff8c81:1d9"

Server: Microsoft-IIS/6.0

Last-Modified: Thu, 07 Aug 2008 18:55:57 GMT

Accept-Ranges: bytes

HeaderEnd: CRLF

ISA logged it as

Allowed Connection

Log type: Web Proxy (Forward)

Status: 200 OK.

Rule: Internet Access Rule

Source: Internal (192.168.0.175)

Destination: External (www.fabrikam.com 39.1.1.10:80)

Request: GET https://39.1.1.10/

Filter information: Req ID: 0734fb7f; Compression: client=No, server=No, compress rate=0% decompress rate=0%

Protocol: http

User: anonymous

So what went wrong? The client resolved the www.fabrikam.com from the local DNS Server and got the IP as 39.1.1.10. Since he now has the destination address it sent a packet directly marked for the destination 39.1.1.10 with HOST: www.fabrikam.com. ISA checked the URI "/" and added the destination IP to complete the URL https://39.1.1.1. Since we have a HTTP Filter for www.fabrikam.com it mismatches with the https://39.1.1.1

Resolution:

Make the client machines as Web proxy clients. This will make users send the right URL to the ISA Server. Web proxy clients depend on ISA to resolve the public names.

See the below request which came from the web proxy client, as compared to the request came from SecureNAT Client. The request was sent to ISA (192.168.0.254) and not to the destination directly. And the client machine gave the URL to ISA for resolving.

Request from Web proxy Client

Frame: Number = 29, Captured Frame Length = 455, MediaType = ETHERNET

+ Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[00-15-5D-B2-45-06],SourceAddress:[00-15-5D-B2-45-05]

+ Ipv4: Src = 192.168.0.175, Dest = 192.168.0.254, Next Protocol = TCP, Packet ID = 17248, Total IP Length = 441

+ Tcp: Flags=...AP..., SrcPort=6474, DstPort=Multiling HTTP(777), PayloadLen=401, Seq=4199678470 - 4199678871, Ack=2627683601, Win=32850 (scale factor 0x2) = 131400

- Http: Request, GET https://www.fabrikam.com/

Command: GET

+ URI: https://www.fabrikam.com/

ProtocolVersion: HTTP/1.1

Accept: */*

Accept-Language: en-us

UA-CPU: x86

Accept-Encoding: gzip, deflate

If-Modified-Since: Thu, 07 Aug 2008 18:55:57 GMT

If-None-Match: "a686da39bff8c81:1d9"

UserAgent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506)

Host: www.fabrikam.com

ProxyConnection: Keep-Alive

Pragma: no-cache

HeaderEnd: CRLF

ISA's Response to the above web proxy request

Frame: Number = 30, Captured Frame Length = 1514, MediaType = ETHERNET

+ Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[00-15-5D-B2-45-05],SourceAddress:[00-15-5D-B2-45-06]

+ Ipv4: Src = 192.168.0.254, Dest = 192.168.0.175, Next Protocol = TCP, Packet ID = 5032, Total IP Length = 1500

+ Tcp: Flags=...A...., SrcPort=Multiling HTTP(777), DstPort=6474, PayloadLen=1460, Seq=2627683601 - 2627685061, Ack=4199678871, Win=65134 (scale factor 0x0) = 65134

- Http: Response, HTTP/1.1, Status Code = 502, URL: https://www.fabrikam.com/

ProtocolVersion: HTTP/1.1

StatusCode: 502, Bad gateway

Reason: Proxy Error ( The request was rejected by the HTTP filter. Contact your ISA Server administrator. )

Via: 1.1 ISA

Connection: close

ProxyConnection: close

Pragma: no-cache

Cache-Control: no-cache

ContentType: text/html

ContentLength: 4076

HeaderEnd: CRLF

+ payload: HttpContentType = text/html

ISA Logs it as below

Denied Connection

Log type: Web Proxy (Forward)

Status: 12217 The request was rejected by the HTTP filter. Contact your ISA Server administrator.

Rule: Internet Access Rule

Source: Internal (192.168.0.175)

Destination: External (192.168.0.254:777)

Request: GET https://www.fabrikam.com/

Filter information: Req ID: 0734fb82; Compression: client=No, server=No, compress rate=0% decompress rate=0% ; Blocked by the HTTP Security filter: URL contains sequences which are disallowed

Protocol: http

User: anonymous

So, next time you configure the HTTP filtering in ISA, make sure you do NetMon traces to make sure you are doing it correctly.

Cheers !!

Error: "Authentication over SSL encrypted channel with the Configuration Storage Server could not be verified"

TechNet Archive — Wed, 08 Oct 2008 14:40:00 GMT

ISSUE:

When installing the ISA Server in workgroup with CSS you may encounter the above mentioned error if you try to change the Authentication method between CSS and other ISA Servers in the same Array.

Configuration:

Node1: ISA01
Roles: CSS + ISA Services

RESOLUTION:

Remove any Certificates which you tried to associate with ADAM_ISASTGCTRL service or under any of the local stores.
Close all ISA Server consoles and run the setup from the ISA Installation CD
Select Repair and proceed
Select "I am deploying in a workgroup or domains without trust relationship" and provide the .PFX file path by browsing. Also, provide the password for the .PFX file.
Proceed by clicking Next and verify the name of the CSS and provide the username / password
Under Authentication options, select "Authentication over SSL encrypted channel" and select the "Use an Existing trusted Root CA certificate". If you have a root certificate file then select the second option.
Click Next and Now, you can install the CSS without any problem

CONSIDERATIONS:

Back up your configuration before repairing the ISA Server. It will not delete any rules but to be on safer side, backup is helpful
Get a .PFX file for your certificate. The certificate name should be of you ISA machine which has CSS on it.

Installing the FCS Server in Single Server Architecture

TechNet Archive — Thu, 02 Oct 2008 17:42:00 GMT

FCS with Single Server Architecture

System Requirements for FCS as mentioned in https://www.microsoft.com/forefront/clientsecurity/en/us/system-requirements.aspx depends on the type of topology to be deployed.

Install IIS and ASP.NET (requires .Net Framework 2.0)
Install the SQL Server 2005 (Minimum requirement is Windows Server 2003 SP1)
Run the setup.exe from the installation CD
SQL Server setup will install the required pre-requisites automatically
Use the default instance name or if you are already running a default instance then name it something like "FCSInstance"
1. On the Components to Install page, select the following check boxes:

SQL Server Database Services
Reporting Services
Integration Services
Workstation components

On the Service Account page, under Start services at the end of setup, select the SQL Server Agent check box
When installing SQL Server 2005, you should use Windows Authentication as the security mode
Click Install to Finish the setup

Install the SQL Server 2005 SP1 once you are done with the SQL Server installation
Install the MMC 3.0 (https://www.microsoft.com/downloads/details.aspx?familyid=4C84F80B-908D-4B5D-8AA8-27B962566D9F&displaylang=en )
Install the GPMC with SP1 (https://www.microsoft.com/downloads/details.aspx?FamilyId=0A6D4C24-8CBD-4B35-9272-DD3CBFC81887&displaylang=en )
Install the WSUS with SP1 (https://technet.microsoft.com/hi-in/wsus/bb466206(en-us).aspx )
Configure the WSUS server to synchronize with Microsoft Update. Check https://technet.microsoft.com/en-us/library/bb404230.aspx for help on configuring the WSUS server
Configure the Client machines using the group policy from your active directory DC
Synchronize the WSUS server with Microsoft Update center before you start installing the Forefront Client Security
Check if you can access the REPORTS and RESPORTSERVER virtual directory from the server. Type https:///Reports and https:///reportserver
Run the FCSServersetup.exe from the FCS installation disk.
Enter your/ company name and put organization
Accept License Agreement
Unselect all other roles accept "Distribution Role"
Click Next and mention the path to install. Usually it takes the same path as WSUS installed

Note: In a multi server topology you have to run this role on a server with WSUS installed on it

Go to the WSUS admin website https:///WSUSAdmin and go to updates. Verify that under products Forefront Client Security appears and also, check under updates that Definition Updates appears
Click "Synchronize Now" and wait for WSUS to synchronize all FCS related definition updates from Microsoft Update Website. Depending on the link you have for the internet, it will take time accordingly.
Go to your Domain Controller and Create the below 4 user account. These user accounts should have the following memberships
1. DAS (Domain User, Local Administrators group of the FCS Server)
2. DTS (Domain User, Local Administrators group of the FCS Server)
3. Reporting (Domain User)
4. Action (Domain User, Local Administrators group of the FCS Server)
Now, go to your FCS Server and run the setup again
Put your Name and Organization Name, then accept the License Agreement
On Collection Server Page, enter the current server name (Let it be default). Also, put the DAS account which we created above as YOURDOMAIN\DAS and mention the password from the DAS account
On Collection Database Page, enter the current server name with SQL instance name as LOCALHOSTNAME\SQLINSTANCENAME and also put the Database size you want to define. Now, put the reporting account which we created above as YOURDOMAIN\REPORTING and mention the password from the DAS account
On Reporting Database Page, enter the current server name and also put the Database size you want to define. Now, put the DTS account which we created above as YOURDOMAIN\DTS and mention the password from the DAS account
On Reporting Server Page, enter the Current Server Name and URL for reporting as mentioned in step 11 or leave it default (only for single server topology)
One the Action page, mention YOURDOMAIN\action (Action is the username we created above) and password
One the install Local page, mention the path where you would like to install client security files
Verify settings and click Next
Wait for all components to finish installation
Click Finish
Go to Start >Programs >Microsoft Forefront>Client Security>Microsoft Forefront Client Security Console
Before you begin the Configuration wizard assign the following permissions to the below users on mentioned databases in SQL Server 2005
1. Reporting (db_owner permission on SystemCenterReporting and one point Databases)
2. Action (db_owner permission on one point Database)
Once you are done with permissions come back to the wizard
Click Next
Now, remembering what all names we gave in the steps 6,7,8,9,10 mention them one by one in the wizard. Give the reporting username and password as well
Click Next to verify the Name and users you provided
Click next
Wait everything to finish
Now, approve the Client Update for Microsoft Forefront Client Security (1.0.1703.0) for Installation in WSUS Server
Let it install on all the client machines and once it's installed they will start appearing in the reporting with 24hours from the FCS agent install.

Resources:

https://tarek-online.blogspot.com/2007_10_01_archive.html
www.Microsoft.com/clientsecurity
https://blogs.technet.com/clientsecurity/archive/2007/10/05/changes-to-fcs-client-wsus-installation-package.aspx

Publishing Internal Servers for Telnet in Back to Back ISA Firewall

TechNet Archive — Fri, 21 Dec 2007 18:34:00 GMT

Diagram

Internal Server ===> Back End Firewall <=========> Front End Firewall ========> Internet

If you want to publish Internal server for telnet, follow the below steps to do so:

1. Make sure that you have the Default Gateway on Back End Firewall as the Perimeter NIC address of the Front End Firewall
2. Create a Non-Publish rule on Back End Firewall with the IP address of the internal server and protocol as TELNET SERVER
3. Create a Non-Publish rule on Front End Firewall with the IP address of the External NIC Address of Back End Firewall with protocol as TELNET SERVER
4. Goto the Client Machine outside your network and telnet the External IP of the Front End Firewall

Note: Make sure that when you are creating the Non-Web Publishing rules to publish TELNET goto its properties and Uncheck the RPC Filter from the bottom mentioned list of filters. If not done then the connection will be handed over to the localhost rather than to be proxied.

Forefront for Exchange 2007

TechNet Archive — Tue, 18 Dec 2007 18:19:00 GMT

Forefront for Exchange 2007 is an Anti-virus and content filtering solution. It works only with Exchange 2007 due to 64-bit Architecture. It works like a champ.

Features:

1. Antivirus engines from 8 different companies and out of 8 engines, users can use 5 scan engines to scan their exchange emails

2. File filtering based on Extension as well as true file type

3. Spam filtering through Subject line filtering, Keyword filtering in message body and through attachment filtering

4. Qurantine, Notifications, Logs and simple configuration

This product is one of the best Microsoft products i love the most. This works perfect with Exchange 2007 as it uses Exchange default VSAPI to scan the emails

Forefront for Exchange is for Exchange 2007 but if you wanna use this product with Exchange 2003 then you may have to purchase Antigen 9.0 and get licenses for Forefront for exchange.

Nice product in comparison to other products because of Multi-scan functionality

Some Security Tips - Will help Secure you workstation

TechNet Archive — Tue, 18 Dec 2007 18:11:00 GMT

hey everyone....thanks for reading my blogs. My key focus is security so i mostly bolg on security. In this blog i will let you know how you can make your desktop more safe when you connect your home computers on internet.

1. Always make sure you have de-selected the File and Print Sharing option on the interface connected to internet. What this does is that it allows others to connect to you computers remotely. Since, you are on internet and you really dont need this service. So, dont select this option when connecting to internet

2. Be aware of Phishing attacks, this is a technique through which an attacker will send you a webpage in an email or may be in the form of a weblink. This web page could be an advertiseent which guides you to some other page or may be a bank webpage asking you to enter your credentials. Donot enter your credentials until and unless you specifically know what you are doing. on internet things may not be what they appear.

3. Always update you Windows through microsoft update servers. use https://update.microsoft.com for updating your computers.

4. Use antivirus in your computer like Microsoft OneCare and Microsoft Defender or may be any other. Also, regularly update the antivirus software so that you can have updates signatures for latest viruses.

Want UAC in XP? To exercise least privilege in XP, don’t put users in the local admins or power users groups. This is a good idea in Vista also since users in the administrators group can just click “Continue” when prompted to execute viral code. Any virus that attacks the user will run in the context of the user, which doesn’t allow changes to the system if they’re running with least privilege.

In other to secure your desktop, rename the administrator account to something uncommon and which you can remember when required. Also, keep disable GUEST account on your system. Some codes can really take advantage of this user and can play with your desktop.

A little understanding of what you are trying to execute on your system can save you from a formatted hard drive. Mostly people execute some program without knowing what it is and later end up cursing Microsoft. If you can't decide on what you have to download and what not to then How can Microsoft decide on your behalf....

Always download the software from its official website and donot download it from any other link until and unless directed from the official websites. What hsppens is that i know the vulnarabilities in a software and i download it from internet...i can add my own files into the package and could upload it to the internet for download. people downloading that pakage would not come to know that they have just downloaded the package containing some unwanted files. When executing those files also gets exceuted and make your computer vulnerable in their own way. So, always try to download the software from its official website.

freeware softwares available on internet may be a honeypot so be aware what you are downloading and what is this software going to do. If you see something suspicious aout the working...lets say if you downloaded some software to format your floppy drive....and if you see that utility trying to connect to internet..that means you just downloaded a HoneyPot. Someone designed that utilty to get access to your computer remotely. Softwares can do multiple stuffs at same time so, you need to be very specific about what you are doing.

Safety is better than sorry !!!!!

ISA Server Domain Member or Workgroup member??

TechNet Archive — Tue, 18 Dec 2007 18:10:00 GMT

This question is most common when you have Microsoft ISA server to be deployed in your organization. Whether to keep ISA a domain member or in workgroup?

Well....there is no specific answer to this question as ISA can be a domain member as well as work fine in workgroup scenarios. I really would like to laugh at people who tells me that putting ISA server in workgroup environment is more secure. It's not important to know where to put, but it's important to know why to put.

In my opinion, the ISA server should be a part of domain because it provides more flexibility in implementing many features which worksgroup scenario does not provide.

If you have ISA server 2006 in workgroup you want to use smart card functionality, you may not be able to use it because the smart card implementation does not work with RADIUS and LDAP (AD)

Some people think that if domain connected computer is compromised then its more chances that complete network is exposed. I would say if your workgroup ISA server is compromised then even it is in workgroup it's still connected to the internal network and anyone can modify the access rules accordingly to gain access. Though, its not a easy task to gain access to ISA server since it hardens the OS as well when installed on Windows 2003.

Also, we recommend that you run SCW on the ISA server and choose the specific template for ISA server. It ensures that no un neccesary services are running

one of friend said that if some hacks my ISA machine then using the Certificate he/she can read the encrypted content within my network. And i was WOW !!!, i replied saying that on workgroup scenario its a requirement to have certificates installed on ISA server, now if you have certificate on it already then anyone can use it for anything including enrypted file reading ;)

If you dont have the ISA server in domain then you cannot use user certification authentication. It may be required when you dont want users to enter their username and password instead you want them to enter passcode and certificate. In workgroup you cannot use client authetication certificates

For more details read article at https://www.redline-software.com/eng/support/articles/isaserver/security/debunking-myth-that-isa-firewall-should-not-domain-member.php by Thomas Shinder

Back to Back Firewall - ISA Server

TechNet Archive — Tue, 18 Dec 2007 18:09:00 GMT

Back to Back firewall model which most of the companies will prefer because of easy design and greater sense of security. Since, this a good design very limited information is available on designing the architecture. So, i thought of writing this blog

Design:

Internet ====>>> ISA Front-End ===>>> DMZ =====>>> ISA Back-End ====> Internal Network

Since there two ISA servers involved you have to be very careful in how to configure both with rules and which rules will go where.

That being said, in this scenario Front-End ISA server will be used for authenticating the users and presenting with login information for DMZ Servers. Since. DMZ Servers need to contact internal or back-end servers we need to open some specific ports on the Back-End firewalls. Below article is a great resource which discusses about the same https://www.isaserver.org/tutorials/Configuring-Domain-Members-Back-to-Back-ISA-Firewall-DMZ-Part2.html

For giving internet access to internal users you need to open access for HTTP, HTTPS and FTP on Back end Firewalll as well as on front end servers. Since, clients would require DNS servers to resolve the names for internet websites, you need to open access for internet DNS servers to query your ISP DNS servers. So, open port 53 on both Firewalls for smotth DNS resolution.

Greater care has to be put configuring Back-end firewalls as they are saving more sensitive servers/information. Any thing which is allowd on the Firewalls for temporary use must be turned off once the work is over.

Only Authenticated traffic should be allowed to pass through the Back-end Firewalls.

Domain Isolation - IPSEC

TechNet Archive — Tue, 18 Dec 2007 18:08:00 GMT

Domain isolation is to mitigate the threat posed by unauthorized access to a trusted computer by an untrusted computer. Domain isolation provides better security when it comes to unauthorized access. IPSEC (Internet Protocol Security) protocol is the best one to be used in this scenario, making your Domain and Domain member servers communicate to the computers you trust. Using IPSec we can filter the traffic to our domain controller and thus making it more secure. IPSEC uses the encryption algorithms like DES or 3DES and integrity algorithms like MD5 or SHA-1.

Traffic from servers like RADIUS server to domain server should be IPSEC in order to protect the communication between them. Since, RADIUS server is used to authenticate the DIAL-IN users against the Active Directory making it more prone to Sniffing attacks. IPSEC allows to encrypt the communication between RADIUS server and Domain making it hard for someone to easily understand the packets being traffered.

Few Things to consider:

1. Ensure that inbound network access to a trusted domain member on the internal network requires the use of another trusted domain member.
2. Allow trusted domain members to restrict inbound network access to a specific group of domain member computers.
3. Focus network attack risks on a smaller number of hosts, which provides a boundary to the trusted domain, where maximum risk mitigation strategies (such as logging, monitoring, and intrusion detection) can be applied more effectively.
4. Focus and prioritize proactive monitoring and compliance efforts prior to an attack.
5. Focus and accelerate remediation and recovery efforts before, during, and after an attack.
6. Improve security by adding strong per-packet mutual authentication, integrity, anti-replay and encryption.

IPSEC is one of best options when it comes to securing communication between two computers / servers.

RADIUS Proxy in Perimeter Network (ISA server 2006)

TechNet Archive — Mon, 02 Jul 2007 15:20:00 GMT

RADIUS Proxy in Perimeter Network (ISA server)

Scenario

======

You have RADIUS Proxy server in perimeter network and you have RADIUS server on intranet. Internet clients connect to ISA server extranet and ISA passes the credentials to RADIUS proxy. Now RADIUS proxy should contact RADIUS sever in order to have connection established.

Solution

======

FE = Front End Firewall

BE = Back End Firewall

Configure the RADIUS Proxy with the RADIUS Client as the IP address of the FE Firewall facing perimeter network. Also, configure the Default Gateway of the RADIUS proxy as the IP address of BE Firewall facing the perimeter network. Note: You can have the DG as the IP address of FE firewall in that case you have to give the following ciommand on your RADIUS proxy server

route add MASK

Now, you need to configure the RADIUS access policy and RADIUS Server group on RADIUS proxy server. Once its done, move to the RADIUS Server and put the RADIUS Proxy IP address as its RADIUS client. Also, make the access policy allowing VPN port and Windows User groups.

Configuring Firewalls:

1. Enable the Client VPN on FE firewall. Give the RADIUS Server address as the IP address of the RADIUS Proxy.

2. (Optional) You should have inbound and outbound traffic allow from internet to perimeter network (RADIUS PROXY SERVER) on port 1812 & 1813

3. On the BE firewall create a network rule from RADIUS Proxy in Perimeter to RADIUS Server(s) in Internal Network

4. Allow traffic from perimeter to Intranet (RADIUS SERVER) and Intranet to Perimeter

These steps assume that you have already checked your RADIUS Proxy and RADIUS Server for communication in internal network.