Secure Truxton

If you run Truxton in a high-security environment, you will have to change a few things.

Services

When customers run a security scan, Truxton may show some service vulnerabilities. Microsoft recommends that services not allow users not have the following permissions:

• ChangeConf (DC) - Change Configuration (aka Write Data), probably means "Data Change"
• WDac (WD) - Change Permissions, probably means "Write Discretionary Access Control"
• WOwn (WO) - Take Ownership, probably means "Write Ownership"

You can check the services configuration using the sc sdshow command.

This will produce an almost incomprehensible output called SDDL:

sc sdshow Les
D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)

This is a set of permissions enclosed in parentheses. The fields in the permissions is delimited by a semicolon. The last field is the group that the permissions applies to. So (A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BU) belongs to the BU group (Built-In users). Edit the permissions to remove the DC, WD, and WO codes (A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BU)

Now set the security on the services using the sc sdset command from a command prompt running with the Administrator privileges.

sc sdset Les D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
sc sdset Truxton D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
sc sdset TruxtonDatabase D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)

If it succeeds, it should produce a message of [SC] SetServiceObjectSecurity SUCCESS

Wix

Wix can set these permissions at install time via the util:PermissionEx element which is a subelement of the ServiceInstall element.

• ChangeConf (DC) - ServiceChangeConfig
• WDac (WD) - ChangePermission
• WOwn (WO) - TakeOwnership

PostgreSQL

To rid the database of using the MD5 hash algorithm for user authentications: use SCRAM