Mumbai Security and Compliance User Group

Integration of Windows 2008 Server with SSIM using Domain Account

The SSIM integration activity consists of two parts as mentioned below :

1. Activity to be performed on Windows 2008 server

2. Activity to be performed on SSIM

1. Activity to be performed on Windows 2008 Server

OBTAIN THE FQDN (Fully Qualified Domain Name) name of monitored server & OS version:

Use this host name in SSIM’s sensor configuration to fetch the logs through OFF box integration. This hostname should contain complete domain name (incase of Member server ) or a workgroup name. Note down the FQDN name & OS version details which will be required at the time of sensor configuration.

CHECKING THE WINDOWS FIREWALL STATUS

You need to determine if the Windows Firewall is running
To determine if the firewall is running, type the following command from a command prompt:
netsh advfirewall firewall show rule name=all
 

• If the firewall is running you will see a very long list of the firewall rules, then skip this step & move ahead to the next step 3(configure winrm).
• If the firewall is not running you will see an error "An error occurred while attempting to contact the Windows Firewall service...", then start the firewall service & under Windows firewall settings OFF the firewall status.

Please refer the below screenshot for more details.

CONFIGURE WINRM

Run the below commands to configure winrm service on 2008 server

winrm quickconfigand answer Y to accept changesif it is already configured it will show below message.

The command performs the following operations:

• Starts the WinRM service and sets the service startup type to auto-start
• Configures a listener for the ports that send and receive MS-Management protocol messages using either the HTTP (5985) protocol or the HTTPS protocol
• Defines the Internet Connection Firewall (ICF) exceptions for the WinRM service and opens the ports

Now we will set specific parameters for winrm.

We will configure winrm to allow unencrypted traffic as we are using HTP for communication & not HTTPS:

From a command prompt:
winrm set winrm/config/service @{AllowUnencrypted="true"}

As we are using kerberos authentication we will disable the basic authentication for winrm:

From a command prompt:
winrm set winrm/config/service/Auth @{Basic="false"}

The winrmquickconfig command enables the Remote Shell access by default.

For security, Symantec recommends that you disable the Remote Shell access.

When you run winrm set winrm/config, the following message displays:

AllowRemoteShell Access=true.

To turn the default off, type the following command:

winrm set winrm/config/Winrs @{AllowRemoteShellAccess="false"}

CONFIGURE USER / GROUPS ACCOUNTS

• Open the Server Manager
• Expand Local Users & Groups.
• Expand Groups.
• Add user ssimtest01 id into members of “Event Log Readers” group.

• Add the Network Service account to the Event Log Readers group as winrm service isexecuted by network service( Run the following command from command propmt)
  net localgroup "Event Log Readers" /add "NT Authority\Network Service"

CONFIGURE WINDOWS SECURITY DESCRIPTOR

Network service must be allowed to Read windows security Logs via winrm service  because in windows 2008 Security event log is restricted to very few users to do this append the security descriptor of network service (A;;0x1;;;S-1-5-20)& )(A;;0x1;;;NS)in channel access by running below commands.
 

wevtutil sl security /ca:O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20)

wevtutil sl security /ca:O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20)(A;;0x1;;;NS)

Above command Grants Read only Access to Network service to read security Event log.

CONFIGURE WINDOWS FIREWALL RULE (If Firewall is enabled)

After ensuring that the firewall service is enabled and running, you can use the commands below.

netsh advfirewall firewall show rule name=all

Commands for opening up the Windows Firewall Port
Enter the following command from the command prompt:

For Windows Server 2008 with Winrm 1.1
netsh advfirewall firewall add portopening TCP 80 "Windows Remote Management"

                                                                        OR

For Windows Server 2008 R2 with Winrm 2.0

netsh advfirewall firewall add portopening TCP 5985 "Windows Remote Management"

You can also create winrm listner on custom port to avoid any mismatch of ports with existing running applications:

This command will create a winrm listner on custom port 8888:

Winrm set winrm/config/listener?Address=*+Transport=HTTP @{Port="8888"}

GET THE FINAL OUTPUT OF FOLLOWING COMMANDS & Reconfirm the settings done:

Type following command from command prompt:

winrm get winrm/config

Verify under the Service portion the following
It should return these settings under the Services section.
Auth
Basic = false
Kerberos = true
Negotiate = true
Certificate = false

To determine the port and IP that the listener is active on

From a command prompt:
winrm enumerate winrm/config/Listener

What to inspect
DefaultPort - the port the service is listening on
ListeningOn - Verify the port and address that the service is listening on

Run the wevtutil command to get information about access rights.

wevtutil gl security

Also note down the following information prior moving to the sensor config.

1. FQDN of target Server
2. Server OS version(Windows server 2008 or 2008 R2)
3. Information for the output of following commands:

winrm get winrm/config

winrm enumerate winrm/config/Listener

wevtutil gl security

2. Activity to be performed on SSIM :

SSIM Sensor Configuration for OFF BOX Collection

We are creating a new Sensor configuration Under “Microsoft Windows Vista® Event collector 4.4” This collector is compatible with Windows 2008 & Vista.

Step 1: In Monitored host name enter the FQDN name of server to be monitored (Local host, or 127.0.0.1 or the actual IP will not able to create the connection through winrm service)

Step 2: In Monitored Host Realm enter the realm on domain (testdom.com) this can be found by running Ksetup command from Server from which log needs to be fetched

Step 3: In Connection port use 80, 5985 for http or 5986 for https communication.
For https communication to work it is required to install Certificate authority on the domain and retrieve the certificate to be used in SSIM Agent configuration for log collection)

Step 4: In monitored host Account Name enter a domain ID or its equivalent ID to be used for log collection. (Use only User ID, do not use domain\username format).