10/4/2016. Advanced Windows Services. IPv6. IPv6 header. IPv6. IPv6 Address. Optimizing 0 s

Transcription

1 Advanced Windows Services IPv6 IPv6 FSRM, FCI, DAC and RMS PKI IPv6 IP is the foundation of nearly all communication The number of addresses is limited Technologies like NAT help in addition to enhancements to services such as Windows 2012 IIS IPv6 solves the IP address shortage problem in addition to increasing functionality Enables single address to be used without NAT with global network reach 128 bit address IPv6 header Fixed 40 byte header allows faster processing Optional extensions can be added as required IPv6 Address Optimizing 0 s Addresses written in format XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX Written in hexadecimal instead of decimal Each 4 bits is one hexcharacter so 16 bit block is example: fc01 Subnet mask written as number of bits for the mask XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX/60 ::1 is the loopback address ( ) :: is unspecified ( ) First 64 bits are network ID (but can be subnetted) and the last 64 are always the interface of host ID (always 64) Leading 0 s in a block can be removed but must have at least one numeral in each block 1080:0:0:0:8:800:200C:417A Blocks of 0 s can be removed once in address 1080::8:800:200C:417A 1

2 Types of IPv6 address Global Address (unicast) IPv4 does not distinguish a scope for an IP address IPv6 defines a scope for IP addresses o Global address like a public IPv4 address o Unique-Local address like an internal IPv4 address o Link-Local address like the APIPA address for communication on same subnet Machines may have any number of these IPv6 routers will not forward a packet that has the wrong scope type When querying DNS multiple IP addresses are returned and clients will use the address with the most appropriate scope type Globally routable Defined in RFC 3587 Global Routing Prefix assigned to organization Subnet ID used within company to split into subnets 48 bits 45 bits 16 bits 64 bits Global Routing Prefix Subnet ID Interface ID 001 Link Local Like the /16 (Automatic Private IP Addressing, APIPA) Used by nodes to communicate that are on the same subnet communication and enables Neighbor Discovery processes Automatically configured 10 bits 54 bits 64 bits Unique Local Think of as a space to be used internally such as private intranets without direct, routed connection to IPv6 Internet This space can be used internally without Internet space conflict Always starts with FD00::/8 48 bits 40 bits 16 bits 64 bits Interface ID Global ID Subnet ID Interface ID RFC4193 = RFC1918 Subneting For IPv4 there are ranges to be used internally, e.g. 10/8, /12, /16 There is an equivalent for IPv6 o fc00::/7 however fd00::/8 is used as space is split helps create a unique range to use for your organization You need to define the routing within organization Global and unique local have 16 bits for you to use as subnets If you think about what you do with IPv4 maybe you use the 3 rd octet for the subnet, e.g. o <subnet>.<host address> Those 16 bits are used by you for the subnets within the IPv6 space after the first 48 bits that are fixed via global/site How you split those 16 bits are really up to you however where possible is good to split over the nibbles 2

3 Example nibble Nubble A nibble is one hexadecimal digit (4 bits) With 16 bits we have 4 nibbles If you wanted to divide the subnets by location:building:subnet this would work if for example I have 15 or less of two and 255 or less of the other, for example 1 nubble for location, 1 for building and 2 for the subnet US location, building 8 and subnet 63 could be 183F for the subnet (63 in decimal is 3F in hex) If this is not possible would have to use binary boundaries along the 16 bits which is slightly harder to read as a human but not impossible Each stick is a bit so 4 bits is a nubble But don t have to divide among the nubble if does not work Location (0-F) Building (0-F) Subnet (0-FF) Manually configuring Disabling IPv6 You probably won t! You can unselect IPv6 on an interface to completely disable Alternatively HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servi ces\tcpip6\parameters\disabledcomponents (DWORD) and set based on bits required E.g. prefer IPv4 is bit 5 therefore 32 which is 20 in hex Tool support with IPv6 Protocol Translation Most of the standard tools continue to work with IPv6 o Ping o Tracert o Ipconfig o Pathping o Route o Netstat 6to4 IPv6 over IPv4 network but does not work behind NAT Teredo Adds support for working behind a NAT ISATAP Adds support for IPv6 over IPv4 on your Intranet but not the Internet 3

4 IPv6 DNS New type of host record, AAAA with corresponding PTR Set DNS server with o Netsh interface ipv6 add dnsserver "<connection>" <address> o DHCP Link Local addresses are not registered in DNS (since they are local to subnet) DHCP with IPv6 Clients attempt to auto-configure checking via Neighbor Advertisement the address is not already in use (if it is all future auto configuration stops) Router solicitation message is sent to discover other prefix addresses based on stateless or stateful configuration o Managed Address Configuration Flag (M) Use configuration protocol for stateful addresses o Other Stateful Configuration Flag (O) Use configuration protocol for M Flag O Flag Result other settings 0 0 No DHCPv6 all configuration via router advertisements 1 0 DHCPv6 for address but not other settings (not common) 0 1 DHCPv6 for configuration settings but router advertisement for address prefixes (DHCPv6 stateless) No part of this presentation may be used without permission 1 the 1 DHCPv6 used for address and configuration express from author Interface ID (host ID) Why is it 64 bits? Will you ever have that many hosts in a subnet!!! 64-bits to allow a number of different mappings to be used for Interface ID o MAC address of network card is 48-bits, this can be mapped or the future 64-bit (RFC 4291) EUI-64 identified on network cards etc. RFC 2373 states this is used for Global addresses o Can be random generated for Internet anonymity (changes periodically to avoid tracking). Not done for Global by default and this is additional to normal one o Assigned by stateful such as DHCP o Manual configuration Advanced File Services File Server Resource Manager RMS Dynamic Access Control File Classification Infrastructure File Server Resource Manager Why FSRM is needed How to install FSRM Managing FSRM Using Storage Reports Using Quotas and File Screening Protecting data Scenario RMS EFS BitLocker TM Remote document policy enforcement Protect content in transit Protect content during collaboration Local multi-user file & folder protection on a shared machine Remote file & folder protection Untrusted network administrator Laptop protection Branch office server Local single-user file & folder protection 4

5 RMS Azure RMS Templates created Provides encryption of data Controls what can be done with data Initially only worked for RMS aware applications such as Office This changed with the new RMS client application Still premium experience for RMS-aware applications but any data can be RMS protected to control access and timebombed access Utilizes a ppdf view for viewing if no local app when sharing via The AD RMS component does not have future investment and is deprecated Azure RMS is the future RMS Connector enables an on-premises host to act as a proxy for Azure RMS which allows on-premises solution that are not Azure RMS aware to utilize it o SharePoint o Exchange o FCI Dynamic Access Control DAC Requirements Current access controls can be difficult to use requiring duplicate effort defining groups and many Access Control Entries (ACE) Dynamic Access Control (DAC) is a claims-based authorization for both user and device claims User-claims, device-claims and tradition SIDS create a compound identity FCI leveraged for classification Policies define access and audit File System only for initial release I F o b j e c t. S e c u ri t y L e v e l = To p S e c r e t T H E N a u d i t. S u c c e s s W H E N u s e r. A g e n t Ty p e = 0 0 Windows Server file server At least one Windows Server domain controller accessible by the Windows client in the user's domain At least one Windows Server domain controller in each domain when using claims across a forest trust Windows 8+ client (required when using device claims) Windows 8+ domain-joined computers o Required if performing authorization decisions that involve device claims and Compound authentication Windows 7 domain-joined computers o Work for user claims ( no device claims) provided. In this case, the Windows Server 2012 file server is configured to use S4U2Self to obtain claim information DAC Steps Enable user attributes to use for DAC Enable resource properties and add to global list Create Central Access Rule Create Central Access Policy Deploy policy via Group Policy and enable DC s to support claims Enable DAC on a file server via FSRM and share properties File Classification Infrastructure Provides the ability to automatically classify data Data Classification Toolkit - is a must Once data is classified rules can be created to perform actions based on the data classification 5

6 File Classification Infrastructure Questions? Windows 2008 R2 introduced the concept of classification for data in NTFS as an alternate data stream Windows Server 2012 provides classification properties managed in Active Directory for centralized management Classification can be set manually or using File Classification Infrastructure based on rules Actions can then be taken based on the classification of data Also can manage access based on classification of data using Dynamic Access Control Public Key Infrastructure Public Key Infrastructure (PKI) Public Key Infrastructure (PKI) implementation Provides security within a company and externally including: o Confidentiality (encryption) o Integrity (digital signatures based on message digest) o Authenticity (message digest signed by sender) o Non-repudiation (proof of data origin,) PKI Components Types of encryption Certificate Authority (CA) Issues and manages certificates Digital Certificates Consist of private and public key and have attributes such as friendly name Certificate Template Provides description of the content and use of a certificate type Certificate Revocation List (CRL) Identifies certificates that are revoked Online Responder Can confirm via OCSP protocol if certificate is valid Symmetric vs asymmetric This is a message Symmetric Key Asf$ FD4 *$&AFD(~@:S $%D (* (TF Symmetric Key This is a message 6

7 Types of encryption Certificate Trust Chain Symmetric vs asymmetric This is a private message for John John Public Key Asf$ FD4 *$&AFD(~@:S $%D (* (TF John Private Key This is a private message for John Root Certificate Authority Private vs Public CA The first CA in your organization (root CA) issues itself a certificate which is the root of the entire certificate trust for your organization and used to sign all other certificates (including signing certificates of subordinate CAs) so this signing certificates must be kept safe The root certificate could be issued by an external party making an organizations entire PKI trusted by however trusted the third party Hierarchies of CAs can be created and any certificate issued by any CA in hierarchy is trusted by any entity that trusts the root CA cert Can also trust different points in hierarchy such as a subordinate, issuing CA Possible for different organizations to have cross-certification hierarchy where each root CA issues cross-certification certificate for the others effectively joining the hierarchies Private CA is deployed within your organization but only trusted by internal not external but allows better management and low cost for issued certs. Use for internal purposes Public CA is trusted by the Internet and is low management but expensive for each certificate required and provisioning time longer. Useful for organizations public facing services like secure site Types of CA Creating a CA Complex hierarchies of CAs can be used in large organizations Standalone and Enterprise CA Root CA, Policy CA and Issuing CA types In 2012 no difference in functionality between standard and datacenter A role within Windows Server Optional CaPolicy.inf that gives access to options not available in GUI 7

8 How domain members trust the CA Certificate Templates CA creates forest Public Key Services service which forest members will automatically locate and has the certificate o Templates also stored in AD Export the root certificate and import into non-domain machines for them to trust certificates issued by domain CA Can also use Group Policy to configure trusting of a root o Computer Policies Windows Settings Security Settings Public Key Policies - Trusted Root Certification Authorities Certificate Imported New templates can be created with specific attributes Users have to be given rights to use a certificate o Read o Enroll Additionally need Autoenroll if autoenrollment will be used Restrict write permissions to those that really need it Within Certificate Authority Certificate Templates use the New Certificate Template to Issue to make the certificate available Can set if auto-approved or if manual required (approved manually using the Certificate Authority snap-in) Certificate Template Versions Autoenrollment Version 1 Created by default on a new CA and support many different types of certificate use and are supported by Windows 2000 and above Version 2 Introduced with Windows Server 2003 and are supported on XP/2003 and above and add additional features such as auto-enrollment capabilities and allows customization of most settings in the template. Version 3 Introduced with Windows Server 2008 and allow the use of Suite B cryptographic settings which has advanced options for encryption, digital signatures, key exchange and hashing. Supported only on Windows Server 2008 and Windows Vista Sometimes its useful to have certificates that are autoenrolled for users or machines Requires a v2 template or above and autoenroll security set Make sure the certificate is available for issue via the CA Use Group Policy to configure the autoenrollment as enabled for users and/or computers o Computer Policies Windows Settings Security Settings Public Key Policies Certificate Services Client Auto- Enrollment Set to Enabled Looking at certificates Requesting a new certificate Certificates assigned to o Users o Services o Computers Use the Certificates MMC snap-in Web interface - IIS Certificates MMC snap-in Allows optional fields to be requested o SAN commonly required 8

9 Export and Import Protect the users private keys! Can double click a certificate to import o Will ask where to store Exporting certificates from Certificates MMC o Can only export private key if certificate template allows And server private keys For user certificates those private keys will live on their machines If they roam or lose their machine they will lose the key and therefore potentially access to resources such as encrypted One option is to store private keys on smart card Or use Credential Roaming that allows certificates to be stored in AD (including Private Key) Questions? 9