Task: 

Assumptions:  

• These instructions are for situations that require minimal VPN support.
• This solution only supports enrollment requests from the Windows certificate snap-in.
• It enforces administrative approval for end-device enrollment -this is not a completely automated process.
• Workplace Join is the preferred method for device enrollment.  It provides self-service automation.  It provides secure key management.  This walk-through is not for Workplace Join.

Steps:

1. Open certificate templates.  From the Windows CA:  Start → MMC → File → Add Snap-In:  Add Certificate Templates.
2. Step 2:  Duplicate User template:  Certificate Templates → Right-Click on User (Template) →  Duplicate Template.  
3. Step 3:  Edit Properties of New Template (Table 1):

Task:  

Requirements:

•  Apple OSX running Apple Configurator 2
• Server certificates:  Root_CA.cer and VPN_Server.cer(s).
  N.B., this process does not require the private keys for the Root CA or VPN server.
• Client Certificate
     (a) Subject CN in username format (e.g., smj@stevenjordan.net).
     (b) Enhanced Key Usage (EKU) uses client authentication (1.3.6.1.5.5.7.3.2).
     (c) Subject Alternative Name with DNS attribute that matches the subject CN
           (e.g., DNS Name=smj@stevenjordan.net)
     (d) IKEv2 requires RSA (2048) SHA256 certificate.  

Administrative Process:

Mobile Config

• IKEv2 VPN authentication requires PFX installation.  
• Merging the PFX and the mobile-config provides the best user experience.
• All PFX installations require special security precautions -regardless of mobile-config.
• Self-service MDM makes administration easier..

Apple Configurator 2:  

1. Start the Configurator and create a new profile:  File → New Profile.  Alternetly, edit an existing profile:  File → Open → Shoreland_Mobile_Config.
2. General Tab:  Name, identifier (default), Organization, etc.
3. Certificates Tab:  Import root.crt, VPN_server.crt.  Import device.pfx (i.e., client cert and private key (optional).
4. VPN Tab:
   
   Table 1.  Apple Configurator 2 IKEv2 VPN Example.

Distribute Mobile-Config

Import Mobile-Config

• Installation requires the end-user's device PIN.  
• The end user will receive an alert that the mobile-config file is not signed
• The end user must install user certificates and private keys (e.g. device.pfx) as required.  PKIs can be incorporated into the mobile-config script.
• User may receive a warning that the PFX is not signed or trusted.

Additional Information:  

Task:

Solution:  

Mobile-Config Background:   

Certificate Background:  

Solution Steps:  

1. Use Certutil.exe to encode PFX file with Base64.  This process creates a new encoded file (*.enc).C:\source\cert>certutil -encode iphone.pfx user.enc
2. Encode CER files (e.g., trusted root and VPN server) as needed.
   C:\source\cert>certutil -encode vpnserver.CER VPNServer.enc
3. Open the encoded file with any XML editor (e.g., Notepad+).  Copy and paste its contents to the appropriate section within the mobile-confg script.  

Alternate Solution Steps:

Merge Base64 

Risks

• It's best to distribute scripts via MDM solutions.  
• These certificates should not be exportable.  
• Do not install private keys on rooted devices.  
• IT staff should assist with all manual installations.  
• Implement a process to ensure safe handling of private keys.  
• Ensure scripts that contain private keys are deleted when work is complete.  

References:

Problem:  

Figure 1.  Win IKEv2 authenticates with ALL root CAs.  Yikes!

Figure 2.  Confirm IKEv2 authentication with Get-VPNAuthProtocl.

PS C:\Windows\system32> $cert1 = ( Get-ChildItem -Path cert:LocalMachine\root | Where-Object -FilterScript { $_.Subject-Like "*THWATE*" } )

PS C:\Windows\system32> Set-VpnAuthProtocol -RootCertificateNameToAccept $cert1 -PassThru

WARNING: Configuration parameters will be modified after the Remote Access service is restarted.

Successful execution always provides output that specifies the associated root certificate (Figure 3):

Figure 3.  Set-VPNAuthProtocol secures our VPN.

Please note, this script does not provide errors if the variable doesn't match a subject a certificate in the Trusted Root store. The Root Certificate field simply remains empty (e.g., Figure 2).
 
Step 3:  Restart the RRAS service.

Additional Thoughts:

Consider additional PowerShell safeguards for certificate authentication:

• Define the server certificate sent to clients:
  Set-VpnAuthProtocol –CertificateAdvertised
• Only accept certificates issued for client authentication:
  Set-VpnAuthProtocol –CertificateEKUsToAccept 1.3.6.1.5.5.7.3.2

Consider implementing both certificate and EAP authentication.  This may not be a good fit for all devices because of different types of clients.  However, if every client is Windows 10 we may be better off with SSTP.

Alternately, S2S VPNs can serve as a work-around for this public CA free-for-all.  We can assign specific client authentication certificates to individual S2S interfaces.  The system works but it creates administrative overhead.  I’ll write more about this in a future article.

Finally, it’s OK to implement both solutions:  Remove all public CAs from the Trusted Root Store; and only authenticate clients from our private CA (i.e., PowerShell).

That’s It!

References:

Task:  

Use master
GO

SELECT 
name AS [LogicalName]
,physical_name AS [Location]
,state_desc AS [Status]
FROM sys.master_files
WHERE database_id = DB_ID(N'tempdb');
GO

tempdev C:\Program Files\Microsoft DPM\SQL\MSSQL10.MSDPM2010\MSSQL\DATA\tempdb.mdf
templog C:\Program Files\Microsoft DPM\SQL\MSSQL10.MSDPM2010\MSSQL\DATA\templog.ldf

USE master;
GO

ALTER DATABASE tempdb 
MODIFY FILE (NAME = tempdev, FILENAME = 'X:\SQL\Data\tempdb.mdf');
GO

ALTER DATABASE tempdb 
MODIFY FILE (NAME = templog, FILENAME = 'X:\SQL\Data\templog.ldf');
GO

The file "tempdev" has been modified in the system catalog. The new path will be used the next time the database is started.
The file "templog" has been modified in the system catalog. The new path will be used the next time the database is started.

How To:

Problem:

Solution:

Background:

PS C:\Users\stevenuwm> Get-NetIPsecMainMode
 
 Name                                : 51
 LocalEndpoint                       : x.x.x.x
 RemoteEndpoint                      : x.x.x.x
 LocalFirstId.AuthenticationMethod   : Certificate
 CipherAlgorithm                     : AES256
 HashAlgorithm                       : SHA1
 KeyModule                           : IkeV2
 CipherAlgorithm                     : DES3
 HashAlgorithm                       : SHA1
 GroupId                             : DH2
 KeyModule                           : IkeV1

Security Guidelines:

Key Management Tips:

• DH Group-2 SHOULD NOT be used.
• Use DH Group-14.    
• Use RSA-3096 certificates.
• Use AES128 encryption.
• SHA1 (Main-Mode) can be used.  SHA256 is a better alternative.
• Use HMAC-SHA1.  It is not the same thing as SHA1

Registry Solution:  

Windows VPN Server:

PowerShell

Add-VpnConnection -Name "IKEv2-VPN" -ServerAddress "vpn.stevenjordan.net" -TunnelType IKEv2 -AuthenticationMethod MachineCertificate

Set-VpnConnectionIPsecConfiguration -ConnectionName "IKE-SMJ" -AuthenticationTransformConstants None -CipherTransformConstants AES256 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -DHGroup Group14 -PfsGroup None -PassThru -AllUserConnection

AuthenticationTransformConstants : None

CipherTransformConstants         : AES256

DHGroup                          : Group14

IntegrityCheckMethod             : SHA256

PfsGroup                         : None

EncryptionMethod                 : AES256

PfsGroup                         : None

Additional Thoughts:

Conclusion:

References:

VPN Problem:  

Solution:

Key Management

Security Strength 

IPsec Cipher Assessment

• 89 security-bits are vulnerable to known attacks.
• 103 security-bits are not vulnerable to known attacks -for now.  Status forecast to depreciate in the near-future (may be months or years).
• 128 security-bits are not vulnerable to known attacks.  Status forecast remains secure for near-future.
• 192 security-bits are not vulnerable to known attacks.  Status forecast remains secure for long-term future (years).

Summary:  

UPS Cable Connectors:

Figure 1.  UPS connector and contacts.

• Amp rating:  175A
• Voltage rating:  600V

Typical SB cable:

• 1/0 American wire gauge (AWG)
• 2 AWG

Figure 2.  UPS AWG 1/0 Cable.

SB connector colors:

Fig. 3.  UPS connector extraction tool.

APC UPS Fuses:

   Most Smart UPS units use bolt-mount fuses.  Screw the battery cable lugs and the fuse into the fuse-block.  Most Smart UPS units use blue bolt-mount 100A 32V fuses.  There are two types of bolt-mount fuses:

• FLD (i.e., smaller) 100A bolt-mount fuse for 9/16" bolt terminals.
  Generally found inside UPS with two batteries.
  
• FLB (i.e., larger) 100A bolt mount fuse for 13/16" bolt terminals.
  Generally connects four batteries (e.g., battery pack). 

Figure 4.  FLB or FLD fuses for UPS units.

   It's hard to mess up replacing a UPS fuse.  The smaller FLD fuse will not fit into the larger fuse block (i.e. FLB).  Likewise, the larger FLB fuse will not fit into smaller fuse blocks (i.e., FLD).

Also, please disconnect connectors and cables from the power source(s) when working with the UPS (e.g., batteries, fuses, etc).

That's It!

Problem:

Solution:

1. Identify amp hours (AH).
2. Determine DC amperage for existing load.
3. Create a base ratio from available AH.  Create a second ratio from the DC Amperage estimate. Cross multiply both ratios.
4. Apply power-factor multiple for final conservative runtime estimate. 

Identify Capacity (i.e., Total Amp Hours):   

Determine Load (i.e., DC Amperage):

Runtime Calculation:

Power Factor

Problem:  

Directions:  

Problem:  

Solution:  

How to Fix Premature UPS Shutdowns.

Takeaway:  

Problem:  

Drifting:

Soft Runtime Calibration: 

Calibration Tips:  

• Do not run calibration on new UPS units. 

• Re-calibrate after replacing old batteries with generic batteries. 

• Schedule an annual calibration.  

• Discharge and recharge old batteries -before calibration.   

• Calibrate with a 40% load. 

• Completely discharge and completely recharge UPS.

• Change/ reset the number of external batteries from the management card.

Hard-set the Battery Constant:

1.  Shut down UPS.
2.  Remove NMC.
3.  Use an APC serial cable to console to the UPS:
        2400 baud,
        8-N-1,
        Xon/Xoff,
        uncheck FIFO.
4.  Enter Smart mode:  Shift+Y (i.e., CAP "Y").
      Prompt changes to SM#.
5.  Enter Program mode: Y, 1, 1
     N.B., each comma represents a pause. 
6.  Enter "0" to display the battery constant.  The battery constant value (e.g., B2) is located under column 0 and is in HEX format:
   
   UPS Model  4   5   6   0   Hex   Firmware
750XL          EE  F8  B2
7.  Change the battery constant value to FF.
        Use "+" or "-" keys to change the value.  
8. Type "R" to save and exit.

Manual/ Hard Calibration

1. Move production servers to an alternate power source.
2. This test requires at least 30% load.  Attach old servers, workstations, etc to simulate production load.
3. Ensure batteries hold a full charge.  
4. Pull the plug so that the UPS operates on battery power.  
5. Allow the UPS to operate until it shuts down.
6. Plug the UPS back in and allow it to recharge.