Securing Truxton Services - Revision history

Sam at 19:37, 3 April 2025

2025-04-03T19:37:41Z

2025-04-03T19:29:02Z

2023-07-26T10:49:19Z

PostgreSQL Logon without Password

2023-07-26T10:23:00Z

PostgreSQL Logon without Password

2023-07-26T10:06:04Z

PostgreSQL Logon without Password

2023-07-26T10:04:37Z

PostgreSQL Logon without Password

2023-07-26T09:56:09Z

PostgreSQL Logon without Password

2023-07-26T09:38:44Z

2023-07-26T09:37:28Z

Steps

2021-09-27T11:47:04Z

Easy Button Loads

@@ Line 70: / Line 70: @@
 # Stop the Les service
 # Stop the Postgres service
-# Edit the <code>pg_ident.conf</code> to add <source lang="txt">windows_map BillyG postgres</source>
+# Edit the <code>pg_ident.conf</code> to add <source lang="text">windows_map BillyG postgres</source>
-# Edit the <code>pg_hba.conf</code> to add (above all other entries) <source lang="txt">host all postgres 0.0.0.0/0 sspi map=windows_map include_realm=0
+# Edit the <code>pg_hba.conf</code> to add (above all other entries) <source lang="text">host all postgres 0.0.0.0/0 sspi map=windows_map include_realm=0
 host all postgres ::0/0     sspi map=windows_map include_realm=0</source>
 # Edit the <code>[[Configuration_System#Truxton_Settings_File|TruxtonSettings.xml]]</code> file to modify the connection strings <source lang="xml">

@@ Line 3: / Line 3: @@
 =How Secure Truxton Services=
 To find out what the permissions are for a service, use the <code>sc sdshow</code> command:
-<source lang="BAT">
+<source lang="bat">
 sc sdshow Les
 sc sdshow Truxton
@@ Line 50: / Line 50: @@
 Start a command prompt as Administrator then:
-<source lang="BAT">
+<source lang="bat">
 sc sdset Les D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
 sc sdset Truxton D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
@@ Line 135: / Line 135: @@
 In order to allow mere mortals to control Postgres, you must alter the permissions of that service.
-<source lang=cmd>
+<source lang="bat">
 sc sdset postgresql-x64-12 D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AU)
 </source>
 The above gives Authorized Users (<code>AU</code>) the same permissions as administrators.

@@ Line 84: / Line 84: @@
 Be very careful of case of the account names.
 Postgres is case sensitive.
 =PostgreSQL Logon without MD5=

@@ Line 81: / Line 81: @@
 # Restart the Truxton service
-Be very careful of case of the account names. Postgres is case sensitive.
+You can test the connection by using the [https://raw.githubusercontent.com/SammyB428/Truxton-Samples/main/Scripts/version.py version.py] Python script.
 =PostgreSQL Logon without MD5=

@@ Line 73: / Line 73: @@
 # Edit the <code>pg_hba.conf</code> to add (above all other entries) <source lang="txt">host all postgres 0.0.0.0/0 sspi map=windows_map include_realm=0
 host all postgres ::0/0     sspi map=windows_map include_realm=0</source>
-# Edit the <code>TruxtonSettings.xml</code> file to modify the connection strings <source lang="xml">
+# Edit the <code>[[Configuration_System#Truxton_Settings_File|TruxtonSettings.xml]]</code> file to modify the connection strings <source lang="xml">
 <dbconnectionstring>Host=localhost;Port=5432;Database=Truxton;Username=postgres;Integrated Security=True;</dbconnectionstring>
 <mbconnectionstring>Host=localhost;Port=5432;Database=TruxtonMessageBus;Username=postgres;Integrated Security=True;</mbconnectionstring>

@@ Line 63: / Line 63: @@
 =PostgreSQL Logon without Password=
-You can configure Truxton and Postgres to use Windows accounts for authentication.
+You can configure Truxton and Postgres to use Windows accounts for authentication ([https://learn.microsoft.com/en-us/windows/win32/rpc/security-support-provider-interface-sspi- SSPI]).
 This allows you to get rid of passwords.
 The following example assumes the name of the account to log onto Postgres is <code>postgres</code> and the name of the account to log onto Windows is <code>BillyG</code>.

@@ Line 61: / Line 61: @@
 * [https://docs.microsoft.com/en-us/windows/win32/secauthz/ace-strings ACE Strings] are the string of letters and semicolons between the parentheses above
 * [https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/f4296d69-1c0f-491f-9587-a960b292d070 SDDL Specification]
 =PostgreSQL Logon without MD5=

← Older revision		Revision as of 09:37, 26 July 2023
Line 76:		Line 76:

	==Steps==		==Steps==
		+	This is for very old installations of Truxton that used MD5 as the logon method.
		+
	'''IT IS HIGHLY RECOMMENDED THAT YOU TRY THESE STEPS ON A TEMPORARY INSTALL OF POSTGRESQL!'''		'''IT IS HIGHLY RECOMMENDED THAT YOU TRY THESE STEPS ON A TEMPORARY INSTALL OF POSTGRESQL!'''

@@ Line 103: / Line 103: @@
 <code>net stop</code> will fail with users' favorite error - Access Denied.
 So we have a service running in a reduced-permissions context that can only be started or stopped by Administrators.
-To really confuse the snot out of users, the Services control panel application has no problem starting or stopping the service.
+To really confuse the snot out of everyone, the [https://en.wikipedia.org/wiki/Microsoft_Management_Console Services] control panel application has no problem starting or stopping the service.
 Security just sucks.
@@ Line 111: / Line 112: @@
 sc sdset postgresql-x64-12 D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AU)
 </source>