Secure Truxton - Revision history

Sam: /* Services */

2021-10-21T16:07:22Z

Services

Sam at 12:14, 17 April 2021

2021-04-17T12:14:54Z

Sam: Created page with "If you run Truxton in a high-security environment, you will have to change a few things. =Services= When customers run a security scan, Truxton may show some service [https:/..."

2020-06-02T13:55:13Z

Created page with "If you run Truxton in a high-security environment, you will have to change a few things. =Services= When customers run a security scan, Truxton may show some service [https:/..."

New page

If you run Truxton in a high-security environment, you will have to change a few things.

=Services=
When customers run a security scan, Truxton may show some service [https://www.tenable.com/plugins/nessus/44676 vulnerabilities.]
Microsoft [https://support.microsoft.com/en-us/help/914392/best-practices-and-guidance-for-writers-of-service-discretionary-acces recommends] that services not allow users not have the following permissions:
* ChangeConf (DC) - Change Configuration (aka Write Data)
* WDac (WD) - Change Permissions, probably means "Write Discretionary Access Control"
* WOwn (WO) - Take Ownership, probably means "Write Ownership"

You can check the services configuration using the <code>sc sdshow</code> command.

This will produce an almost incomprehensible output called [https://docs.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language SDDL]:
<syntaxhighlight lang="bat">
sc sdshow Les
D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
</syntaxhighlight>

This is a set of permissions enclosed in parentheses.
The fields in the permissions is delimited by a semicolon.
The last field is the group that the permissions applies to.
So <code>(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BU)</code> belongs to the <code>BU</code> group (Built-In users).
Edit the permissions to remove the <code>DC</code>, <code>WD</code>, and <code>WO</code> codes <code>(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BU)</code>

Now set the security on the services using the <code>sc sdset</code> command from a command prompt running with the Administrator privileges.
<syntaxhighlight lang="bat">
sc sdset Les D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
sc sdset Truxton D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
sc sdset TruxtonDatabase D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
</syntaxhighlight>

If it succeeds, it should produce a message of <code>[SC] SetServiceObjectSecurity SUCCESS</code>

=Wix=
[https://wixtoolset.org/ Wix] can set these permissions at install time via the <code>util:PermissionEx</code> element which is a subelement of the <code>ServiceInstall</code> element.
* ChangeConf (DC) - <code>ServiceChangeConfig</code>
* WDac (WD) - <code>ChangePermission</code>
* WOwn (WO) - <code>TakeOwnership</code>

← Older revision		Revision as of 12:14, 17 April 2021
Line 36:		Line 36:
	* WDac (WD) - <code>ChangePermission</code>		* WDac (WD) - <code>ChangePermission</code>
	* WOwn (WO) - <code>TakeOwnership</code>		* WOwn (WO) - <code>TakeOwnership</code>
		+
		+	=PostgreSQL=
		+	To rid the database of using the [https://en.wikipedia.org/wiki/MD5 MD5 hash algorithm] for user authentications:
		+	[https://blog.crunchydata.com/blog/how-to-upgrade-postgresql-passwords-to-scram use SCRAM]

@@ Line 4: / Line 4: @@
 When customers run a security scan, Truxton may show some service [https://www.tenable.com/plugins/nessus/44676 vulnerabilities.]
 Microsoft [https://support.microsoft.com/en-us/help/914392/best-practices-and-guidance-for-writers-of-service-discretionary-acces recommends] that services not allow users not have the following permissions:
-* ChangeConf (DC) - Change Configuration (aka Write Data)
+* ChangeConf (DC) - Change Configuration (aka Write Data), probably means "Data Change"
 * WDac (WD) - Change Permissions, probably means "Write Discretionary Access Control"
 * WOwn (WO) - Take Ownership, probably means "Write Ownership"