Securing Truxton Services

If you must operate in a more "locked down" mode, FISMA for instance, you must change how Truxton's services run.

How Secure Truxton Services

To find out what the permissions are for a service, use the sc sdshow command:

sc sdshow Les
sc sdshow Truxton
sc sdshow TruxtonDatabase

On my machine, it produces this lovely string:

D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)

You can use the Powershell ConvertFrom-SddlString command to convert it to something humanly readable.

ConvertFrom-SddlString -Sddl "D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)" | Foreach-Object {$_.DiscretionaryAcl}

A better way to begin to understand it is by adding spaces and line breaks:

D:
(A;;CC DC LC SW RP WP DT LO CR SD RC WD WO;;;BU)
(A;;CC LC SW RP WP DT LO CR RC;;;SY)
(A;;CC DC LC SW RP WP DT LO CR SD RC WD WO;;;BA)
(A;;CC LC SW LO CR RC;;;IU)
(A;;CC LC SW LO CR RC;;;SU)

The most common permissions to alter are DC, WD and WO.

Code	Meaning
DC	Change Configuration (aka Write Data)
WD	Change Permissions (aka Write Descriptor)
WO	Take Ownership (aka Write Owner)

It looks like the BuiltIn Users is the culprit. Let's change the BU part to get rid of those:

(A;;CC LC SW RP WP DT LO CR SD RC;;;BU)

Start a command prompt as Administrator then:

sc sdset Les D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
sc sdset Truxton D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
sc sdset TruxtonDatabase D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)

External links

• Microsoft Guidelines
• How to Read SDDL
• ACE Strings are the string of letters and semicolons between the parentheses above

PostgreSQL Logon without MD5

By default, PostgreSQL uses the MD5 hashing algorithm for password authentication. The problem is MD5 is no longer approved for use in FIPS certified systems. Luckily, PostgreSQL will allow you to use a different method called SCRAM which uses SHA-256 as the algorithm for hashing passwords.

Now you are left with a bit of a chicken-or-the-egg situation. If you change the algorithm to SCRAM then you can't log on with the MD5 stored in the database. The trick to successfully switching to SCRAM from MD5 is to tell PostgreSQL to use SCRAM to obfuscate all new passwords while logged in with MD5. We must:

1. While logged in using MD5, tell PostgreSQL to scramble passwords with SCRAM
2. Change our password so it will be stored in SCRAM format
3. Tell PostgreSQL to use SCRAM for password authentication

Steps

IT IS HIGHLY RECOMMENDED THAT YOU TRY THESE STEPS ON A TEMPORARY INSTALL OF POSTGRESQL!

The steps are as follows:

1. Install PostgreSQL Server
2. Log onto the server

   psql.exe -U postgres
   

3. Configure PostgreSQL to use SCRAM instead of MD5

   alter system set password_encryption = 'scram-sha-256';
   

4. Reload PostgreSQL's configuration by executing

   select pg_reload_conf();
   

5. Now change your password by executing

   \password
   

6. Enter the same password you had or a new one
7. At this point, your password is stored in PostgreSQL as SCRAM and not MD5 which means you can no longer log onto PostgreSQL
8. Edit the pg_hba.conf and alter lines that end with md5 to end with scram-sha-256

host    all             all             0.0.0.0/0               scram-sha-256
host    all             all             ::0/0                   scram-sha-256

External links

• Steps