Win2012R2, IIS 8.5 and logging client crypto settings

-
All major browsers will disable TLS1.0/1.1 support next spring. And many of them in Q1/2020. SSL Server Test by SSL Labs will start to cap the rating to B if the server offers TLS1.0/1.1

So, it is the last months to start deprecating those settings and verify that all crypto relate configs are in good condition. Really easy to do with Apache and nginx. Not so easy to do with IIS. Well, it is quite easy, if you are really familiar with editing registry (or have enough Google-fu in your backpocket).

I contacted one project manager about this so he could ask from the customer if it's okay that we'll disable TLS 1.0/1.1. *sigh* I just should have disabled it and not to tell anyone, but I usually try to play by the book. ;)

"But based on the data, there will be many percent of users who can't access that site anymore!"

Yes, globally. This is national service, not used by many global users, I suppose. And I really think that situation in Finland is much better than globally, in this respect. If you have a computer with a browser made after 2014 or Android newer than 4.4, you are okay. No idea about Apple products, or how new you should have in this case, but I suppose it's not an issue.

But he still couldn't accept my view. He required data! Yes, good thinking. I also love data. But sometimes you just need to decide even when you don't have that.

Finally I agreed to look the IIS logs, because logs will reveal everything, right?

No. Not this time.

By default IIS won't log crypto related settings, and it's not just one button to enable them. *sigh* Why can't I just play with Linux systems??

Luckily we have Google. I don't understand how anyone could get anything done before we had really working search engines? ;) So, quick search found me these links:
The problem after reading these was that the crypto-* sources can't be found from the Source-box automatically, as can be seen below. I searched quite long, verified IIS versions, checked which version has this functionality (it should be available at least starting from Win2008R2/IIS8), and so on.

Until I decided just to write them to the box. And it works. Now I have beautiful IIS logs, which I can comb through later and plot how many are using TLS 1.0/1.1.

I just need to parse dozens (or thousands) of megabytes of text files, where lines are ending '400 6610 8004 ae06', which really means: TLS1.2 AES_256 SHA1 ECDH_EPHEM. Simple, right?



Comments

Post a Comment

Popular posts from this blog

The only constant is change

-
"I'm leaving next week. I'll change to company Y." This comment from my coworker caused quite many feelings and put my thoughts in motion. "Company Y.... Umm... I have heard it few times, and I know persons who have joined them, but I have no clue what they actually are doing. Let's see what their website shows. Oh. They seem to have an open position, which would be a direct match for me." At this point I had been in my position a little less than three years. Those years had been absolutely incredible, from the experience (and also CV...) point of view. When you are working in a global enterprise as the product security engineer/cyber security architect for a product line whose products are used globally in critical infra related use cases, it's quite unique place to gather experience and hopefully also knowledge & know-how.  There were multiple really interesting projects going on, which would give even more experience around how to secure 40 y...
Read more

Passion is a fruit

-
 "What if we educate them and they leave?"  "Well, what if we won't and they won't leave?" "Hi, there will be a big security conference in Helsinki next February. I'm going there. Can I use work hours for that or should I use my vacation days?" This is how I presented the trip to Disobey to my boss last autumn.  Disobey is quite a unique event, and presentations are not The Thing(tm) for this event, even though they are also awesome. Meeting people and discussions with them are among the reasons to go there.  This year the following presentations were nominated to my top list. Not all of them will be released on Youtube, but I can recommend any of those which will be released. Antti Kurittu: Story of Vastaamo (Keynote) Juho Jauhiainen: Losing My Mental Health in Cyber Security Jussi Eronen: Vulnerability Handling for the Masses Helinä Turunen: Cyber Comms 101 - What to Say When Cyber Hits the Fan (workshop) Lea Viljanen: Hacking the Audit Int...
Read more

Hack the Box, CTF, challenges, and ethical hacking (+ some thoughts about courses)

-
During last few years I've bought some Udemy courses when some person has suggested them. Mostly they are related to security and hacking, because that's the high level topic in ICT which interests me most. Yes, I've bought them. And hadn't started any. Until this summer. In the past if you wanted to learn some new skill in the ICT world, you usually attended some 3-5 day long course which normally costs some thousands of euros. Quite costly, too much information in short time span, and it required many days off from work + traveling. Then came the online courses. They cost less, you can follow the videos as you wish with your own schedule and you'll get community reviews for courses before buying them. I'm not fully sure but I suppose that the instructors get some amount of money for every attendee and no one wants to use their money (or time) to poorly made course. Thus every instructor has an incentive to make their course as good as just possible. At the mo...
Read more