Managing Local Administrator Passwords on Windows Workstations

Microsoft offers the Local Administrator Password Solution (LAPS) to allow administrators to set random and unique passwords on each workstation/server joined to active directory. This tool works by installing a small application on the client machine and then configuring a GPO to apply the specific settings for the password format and expiration intervals. Below are the steps required to configure LAPS.


Server Setup 

1. Download LAPS from https://support.microsoft.com/en-us/kb/3062591
2. Run the install on your management workstations and select the three items under the management tools and select next to complete the install.
3. Next run the following command to extend the schema to add the ms-Mcs-AdmPwd & ms-Mcs-AdmPwdExpiration attributes to the computer objects class

4. Next run the following command to set the permission to allow the computer account to update itself and allow domain admins to reset the password.

Granting Non-Admin Users permission to manage specific services

Granting Non-Admin Users permission to manage specific services
1. Login as an administrator 
2. Install subinacl.exe (http://www.microsoft.com/en-us/download/details.aspx?id=23510)
3. Open a command prompt
4. Navigate to c:\program files (x86)\Windows Resource Kits\Tools\
5. Below are examples of the syntax to use to grant permissions to a particular service
   - SUBINACL /SERVICE \\MachineName\ServiceName /GRANT=[DomainName\]UserName[=Access]
   - subinacl.exe /service \\localhost\gupdate /GRANT=domain.com\username=F
   - subinacl.exe /service \\localhost\VMTools /GRANT=domain.com\username=F
6. Log out the administrator and let the end user log back in.

Valid Access Values
 F : Full Control
 R : Generic Read
 W : Generic Write
 X : Generic eXecute
 L : Read controL
 Q : Query Service Configuration
 S : Query Service Status
 E : Enumerate Dependent Services
 C : Service Change Configuration
 T : Start Service
 O : Stop Service
 P : Pause/Continue Service
 I : Interrogate Service
 U : Service User-Defined Control Commands

Installing PGP Whole Disk Encryption on Linux Workstations

Note: This installation was tested on Ubuntu 10.04 64bit with PGP WDE Version, 10.2.0 Build 2233.

Installation

1. Open the terminal and issue the following command:

                - "chmod +x pgp_desktop_10.2.0.2233_linux_ub10.04_x86_64.bsx"

2. Open the terminal and issue the following command:

                - "sudo ./ pgp_desktop_10.2.0.2233_linux_ub10.04_x86_64.bsx "

3. Press enter to read the license

4. Type "y" to agree to the terms of the license.

5. Reboot the workstation

Configuring Whole Disk Encryption

1. Make sure the username of the logged in linux user is the exact same as the domain username.

2. Open a terminal
3  Issue the following command to configure PGP to point to your PGP Universal Server

            - sudo pgpconfigure "ovid=&mail=*&admin=1"

4. Reboot the workstation

5. Login as the user that needs to enroll and issue the following command.
           - pgpenroll --enroll (Note: Do not use sudo)

6. When prompted for a username type you Domain credentials

7. And you should see output similar to the screen below.

8. Now reboot the workstation and you should be presented with the grey bootguard.
9. Type your password and hit enter.

10. Once you load the desktop open the terminal
11. To verify whole disk encryption is enabled run the following commands.

                "pgpwde --status"

12. The output should confirm that the disk is either encrypted or in process of encrypting.

Securing Linux Workstations from Data Leakage

If you have linux workstations in your corporate environment you should be addressing the issues regarding data leakage. Below are the steps i have taken to block writing to usb storage devices.


Disabling USB storage devices

Linux uses a module called "usb_storage" to mount external usb storage devices. If you are interested in stopping a user from mounting external usb storage follow the steps below.

1. Create a file called "usb_storage.conf" in the /etc/modprobe.d/ directory.
2. Open the file and enter "blacklist usb_storage.conf" in the file and then close and save the file.
3. Reboot the workstation
4. Plug in a USB storage device and you should see that the device does not get auto mounted

Additional Tips

lsmod - shows what modules are currently loaded

modinfo - shows information about module

modprobe -r usb_storage - Can be used to unload the usb_storage module

Using John the Ripper to crack Ubuntu passwords

John the Ripper is a password cracker that can be used to uncover weak passwords on systems on your network. Starting with Ubuntu 9.10 John the Ripper fails to crack passwords because it does not support sha-512 encryption. Below are the steps i used to add sha-512 support to John the Ripper so that you can test the password strength of your newer Ubuntu systems.

1. Download the source for John the Ripper from http://www.openwall.com/john/

2. Extract the tar file with the following command:
tar -xzvf john-1.7.9.tar.gz

3. Open the john-1.7.9/src/Makefile and append "-lcrypt" to line "LDFLAGS = -s"

OLD VALUE: LDFLAGS = -s $(OMPFLAGS)
NEW VALUE: LDFLAGS = -s -lcrypt $(OMPFLAGS)

4. Create a new file called "crypt_fmt.c" and paste the following code into it. Save the file in john-1.7.9/src/

Embed A TrueCrypt Volume In A Playable Video File

"Steganography is the process of hiding an encrypted message in some otherwise innocent-looking format. We’ve gone over some ways to do this in the past with image files, but now you can take it to a whole new level by hiding an entire TrueCrypt volume in an mp4 video file."
Read More: Embed A TrueCrypt Volume In A Playable Video File 

Why you should be using Google’s 2-step verification AKA 2-Factor Authentication?

Have you ever been concerned about logging into your Google account on a public computer? Have you considered the risk of connecting to free wireless networks? If you have then Google’s 2-Step verificatioin comes to the rescue, if not then you should really reconsider the risk of using public networks and computers.

What is this 2-Factor Authentication you speak of? Two-factor authentication means that instead of using only one type of authentication factor, such as only things  a user knows (login IDs, passwords, secret images, shared secrets, solicited personal information, etc), a second factor, something the user has or something the user is, must be supplied in order to authenticate.

In february 2011 Google released a 2 step verification process for all web based applications. This 2 step verification process offers an extra level of security comparable to more mainstream products like RSA SecurID and CryptoCard. The idea is that when you login to your computer you have your username and password Plus you have access to a randomly generated access code for the second step. If someone finds out your username and password they still wouldn’t be able to login to your account because they do not have your phone to be able to generate the one time use access code. So what happens if you loose your phone?....well don't fret you can use backup codes that were created when you enrolled in the 2-Step verification or you can allow google to send a text or call a predefined phone number to give you an access code.

Do you have to go through these steps each time you login to your Google account?....NO! When you login you have the option to click a check box to remember that computer for 30 days. Yes this is an extra step but it will significantly improve the security of your Google account and all the data you have stored in Google Docs, PicasaWeb Albums, Gmail, etc.

For more information about this new feature visit 2 Step Verification

Time it takes to crack a password

Length: 6 characters

• Lowercase: 10 minutes
• Uppercase: 10 hours
• Numbers & Symbols: 18 days

Length: 7 characters

• Lowercase: 4 hours
• Uppercase: 23 days
• Numbers & Symbols: 4 years

Length: 8 characters

• Lowercase: 4 days
• Uppercase: 3 years
• Numbers & Symbols: 463 years

Length: 9 characters

• Lowercase: 4 months
• Uppercase: 178 years
• Numbers & Symbols: 44,530 years

Source: Business Week

Thoughts on the CISSP

My thoughts on preparing for and acquiring the (ISC)2  CISSP (Certified Information System Security Professional) certification. Before deciding on pursuing the CISSP i considered a few other certifications including CEH, CISA, & CISM, however the CISSP seemed like the best option when i started to consider the value of the certification. In many circles the CISSP is considered the gold standard of information security certifications. Many government agencies along with companies recognize and require the CISSP credential for employment in certain positions relating to all aspects of information security. After reading more about this certification i decided i wanted to join the thousands of people that have already achieved it.