Difference between revisions of "Secure Truxton"
(Created page with "If you run Truxton in a high-security environment, you will have to change a few things. =Services= When customers run a security scan, Truxton may show some service [https:/...") |
|||
| (One intermediate revision by the same user not shown) | |||
| Line 4: | Line 4: | ||
When customers run a security scan, Truxton may show some service [https://www.tenable.com/plugins/nessus/44676 vulnerabilities.] | When customers run a security scan, Truxton may show some service [https://www.tenable.com/plugins/nessus/44676 vulnerabilities.] | ||
Microsoft [https://support.microsoft.com/en-us/help/914392/best-practices-and-guidance-for-writers-of-service-discretionary-acces recommends] that services not allow users not have the following permissions: | Microsoft [https://support.microsoft.com/en-us/help/914392/best-practices-and-guidance-for-writers-of-service-discretionary-acces recommends] that services not allow users not have the following permissions: | ||
| − | * ChangeConf (DC) - Change Configuration (aka Write Data) | + | * ChangeConf (DC) - Change Configuration (aka Write Data), probably means "Data Change" |
* WDac (WD) - Change Permissions, probably means "Write Discretionary Access Control" | * WDac (WD) - Change Permissions, probably means "Write Discretionary Access Control" | ||
* WOwn (WO) - Take Ownership, probably means "Write Ownership" | * WOwn (WO) - Take Ownership, probably means "Write Ownership" | ||
| Line 36: | Line 36: | ||
* WDac (WD) - <code>ChangePermission</code> | * WDac (WD) - <code>ChangePermission</code> | ||
* WOwn (WO) - <code>TakeOwnership</code> | * WOwn (WO) - <code>TakeOwnership</code> | ||
| + | |||
| + | =PostgreSQL= | ||
| + | To rid the database of using the [https://en.wikipedia.org/wiki/MD5 MD5 hash algorithm] for user authentications: | ||
| + | [https://blog.crunchydata.com/blog/how-to-upgrade-postgresql-passwords-to-scram use SCRAM] | ||
Latest revision as of 12:07, 21 October 2021
If you run Truxton in a high-security environment, you will have to change a few things.
Services
When customers run a security scan, Truxton may show some service vulnerabilities. Microsoft recommends that services not allow users not have the following permissions:
- ChangeConf (DC) - Change Configuration (aka Write Data), probably means "Data Change"
- WDac (WD) - Change Permissions, probably means "Write Discretionary Access Control"
- WOwn (WO) - Take Ownership, probably means "Write Ownership"
You can check the services configuration using the sc sdshow command.
This will produce an almost incomprehensible output called SDDL:
sc sdshow Les
D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
This is a set of permissions enclosed in parentheses.
The fields in the permissions is delimited by a semicolon.
The last field is the group that the permissions applies to.
So (A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BU) belongs to the BU group (Built-In users).
Edit the permissions to remove the DC, WD, and WO codes (A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BU)
Now set the security on the services using the sc sdset command from a command prompt running with the Administrator privileges.
sc sdset Les D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
sc sdset Truxton D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
sc sdset TruxtonDatabase D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
If it succeeds, it should produce a message of [SC] SetServiceObjectSecurity SUCCESS
Wix
Wix can set these permissions at install time via the util:PermissionEx element which is a subelement of the ServiceInstall element.
- ChangeConf (DC) -
ServiceChangeConfig - WDac (WD) -
ChangePermission - WOwn (WO) -
TakeOwnership
PostgreSQL
To rid the database of using the MD5 hash algorithm for user authentications: use SCRAM
