Goal:   

Determine if file share replication is up-to-date between shares.

Problem:  

DFS replication propagation reports show usually high replication times (e.g., 11 days instead of 11 seconds).  Users complain about missing data.

Solution:  

Use DFS diagnostic commands to check for backlogs.  Large backlogs indicate replication problems (e.g., insufficient staging size, failed pre-seeding, etc.).

Example:

C:\dfsrdiag backlog /rgname:"contoso\data\content" /rfname:Namespace-Folder /sendingmember:server1-hostname /receivingmember:server2-hostname

No Backlog - member 

 References:

https://blogs.technet.microsoft.com/filecab/2009/05/28/dfsrdiag-exe-replicationstate-whats-dfsr-up-to/
https://blogs.technet.microsoft.com/askds/2010/09/07/replacing-dfsr-member-hardware-or-os-part-2-pre-seeding/

Problem:  

Solution:  

Background: 

Enable NAT-T 

1.   Edit Registry or create GPO:

2.   Create new DWORD value:   AssumeUDPEncapsulationContextOnSendRule

3.   Modify DWORD value:  2

Headlines:  DIGITAL INTERROGATION? TRAVELERS' PHONES, SOCIALS SCANNED AT AIRPORTS... 

Takeaway:  

Personal electronic devices are subject to searches by the TSA and CBP agents -travelers beware.  U.S. Agents may request full access to smart phones, tablets and laptops.  Special emphasis is placed on search history, text history, and social media (e.g., Facebook).  TSA/ CBP may temporarily confiscate the device, up to thirty days, or copy the contents of the entire disk for further investigation.

News about digital frisking is en vogue because of recent political events.  However, this specific policy has been in effect before 2011 -during both Bush and Obama administrations. (Schneier, 2008).  The less told story, however, is that data is at greatest risk when traveling to other countries.

Problem:

It may come as a surprise to learn that most Western governments do not respect individual privacy rights -digital or otherwise.  For example, authorities at Paris Charles de Gaulle Airport are known to scan laptops (BBC, 1998).  Devices are also subject to search when traveling through Canada, Australia, or the U.K  -no warrants needed. (Hughes, 2014).  

Encryption to the rescue?  Encryption may protect your data but it's not fail-proof.  For starters, there are different types of encryption.  Some types of encryption are considered strong and nearly impossible to break.  However, encryption uses cryptographic algorithms that become obsolete within months or years.  Implementing secure encryption can be a complicated process.   

What's more, encryption may protect your data, but it will not stop a frustrated border patrol agent from taking your device or arresting you. (Hughes, 2014).

Why the Fuss?

There are two sides to every coin.  Governments have legitimate national security issues to contend with.  Digital search and seizure policies are a simple means to identify terrorists, child pornographers, and other criminal activity.

On the other hand, the majority of international travelers are not criminals.  At least in the U.S., and with exceptions, the right to privacy is a constitutional civil right.  There are legitimate reasons to keep trade secrets, health records, or financial information secret.

Data at Risk

Not all inspections are invasive.  Some agents may simply ask you to turn the device on.  Others may causally browse its contents.   However, there are situations that compromise data integrity:

• If you provide a key code or password.
• If the device is removed from your line of sight.
• If the device is physically connected to another machine (e.g., scanned).
• If the device connects to an agent's network (Ethernet or WiFi).

• Your data is no longer confidential (e.g., pictures, credit cards, etc.)
• Your data may have been altered or deleted.
• The device may contain a viruses or malware.
• All of your passwords may be compromised.
• Your network accounts may be vulnerable (e.g., Exchange, VPN, RDP)

Conclusion:

In most situations, digital searches by the TSA/ CBP are probably harmless.  However, it's prudent to take extra precautions when traveling outside the United States.

Links:

http://www.vocativ.com/397897/travelers-affected-by-trump-ban-forced-to-unlock-phones-computers/
https://www.eff.org/wp/defending-privacy-us-border-guide-travelers-carrying-digital-devices
http://www.stevenjordan.net/2014/08/network-security-international-and.html
http://www.stevenjordan.net/2016/09/ipsec-security-levels.html
http://www.stevenjordan.net/2016/09/secure-ikev2-win-10.html
https://www.theguardian.com/profile/bruceschneier
http://news.bbc.co.uk/2/hi/science/nature/150465.stm

FYI, data snooping occurs at most other international airports (e.g., British Russian , & Chinese).https://t.co/lfOjvbCS6W

— Steven Jordan (@stevenuwm) January 31, 2017

https://www.theguardian.com/technology/2008/may/15/computing.security

Task:  

Solution:

Figure 1.  Android IKEv2 VPN Settings.

Task:  

Setup instructions for manual distribution of mobile-config scripts for iPhones and iPads.

Assumptions:

These instructions assume the mobile-config script has already been generated,  These instructions are for situations when mobile device management (MDM) is not available.  It assumes email distribution from a private server.  Use caution whenever distributing certificates and private keys!

Background:

Mobile-device scripts run on any iPhone or iPad –simply open the email attachment to start the process.  It installs certificates and configures the IKEv2 VPN.  This script can configure multiple devices.

Security Considerations

Also note, the script includes the private key for the client certificate.  This provides identity validation, authentication, and authorization.  Anyone that gets a hold of this key can impersonate the account.  It’s critical to use a passcode and enforce encryption.  Do not install these files on jailbroken devices.  Delete the script from your mailbox after all devices are configured.

Brief instructions:

Step 1:  Open mobile-config file to start the profile installation.

· N.B., This script is not signed –that’s OK.
· Click Next.




Step 2:  Enter device passcode.

Step 3:  Consent.

· Brief description for mobile-config.
· Installation requires consent.
· Click Next.




Step 4:  Confirm Install.

· General VPN disclosure.
· Click Install.  Click Done.

Step 5.  Connect to the VPN.

· Open Settings.
· Toggle the VPN button.
· The VPN symbol appears in upper left-hand corner to confirm active VPN sessions.

Task:

Create site-to-site (S2S) interfaces for dynamic IKEv2 VPN clients (e.g., iPhones).  Assign different cryptographic algorithms to each S2S interface.

What are dynamic S2S VPNs?

 S2S VPNs usually support static VPN endpoints.  For example, a dedicated (i.e., always-on) VPN that connects a branch office to its HQ office.  However, S2S VPNs can also connect mobile clients for dynamic connections.   This hybrid approach is for special circumstances.

Why use dynamic S2S VPNs?

Most folks should stick with the default RRAS dial-up VPN server.  It provides better management and reporting tools.  However, dynamic S2S VPNs support configuration features that are unavailable with the standard RRAS client VPNs.

For example, dial-up IKEv2 VPNs may authenticate any certificate issued from one of its trusted root certificates.  S2S VPNs can limit authentication to specific client certificates.  The best part, IMHO,  is the ability to apply unique cipher suites per S2S interface.  For example, we can create separate S2S interfaces for each client -including unique cipher suite standards.

How do we implement dynamic S2S VPNs?

PowerShell offers a straight-forward method to implement S2S VPNs.  However, consider using a GUI-Powershell hybrid approach that supports additional client management features.

Dynamic S2S via PowerShell:

The following example creates a new S2S interface with strong security targets:
• Certificate authentication
• IKEv2 Protocol
• Main Mode:   AES128-SHA256-DHGroup14
• Quick Mode:   AES256-SHA256

Add-VpnS2SInterface -name smj@stevenjordan.net -CustomPolicy -CipherTransformConstants AES128 -DHGroup Group14 -EncryptionMethod aes128 -IntegrityCheckMethod SHA256 -Destination 0.0.0.0 -Protocol IKEv2 -AuthenticationMethod MachineCertificates -ResponderAuthenticationMethod MachineCertificates -EncryptionType RequireEncryption

The interface name always matches the authentication certificate's subject name.  Some clients (e.g., iPhone) require a matching subject common name and matching subject alternative name (SAN) DNS name.  This attribute associates the authentication certificate with the S2S interface.  The destination flag is set to accept connection requests from any IP (i.e., it's dynamic).

Don't forget to lock down the VPN server.  Enforcing subject names does not secure the server.  Recall, Windows VPN server leaves its front door wide open -by default.  Windows VPN security requires manual changes:  http://www.stevenjordan.net/2016/10/door-wide-open-on-win-ikev2.html

Managing S2S connections via PowerShell:

Managing client connections is cumbersome compared to traditional RRAS client VPN tools.  For example, RRAS and Remote Access Management provide simple GUI tools to manage dial-up connections (Figure 1).  However, Remote Access Clients does not display S2S connections.  Additionally, RRAS Network Interfaces does display S2S interfaces by deafult.

Figure 1.  RRAS Client Connections.

The RRAS management GUI does not play well with dynamic S2S connections.  The Remote Access Clients tab does not display active connections.  However, the GUI will display active IKEv2 WAN Miniports:

Figure 2.  Active WAN Miniports.  Good enough.

PowerShell provides a better method to view active S2S connections:
PS C:\Users\SMJ> Get-VpnS2SInterface
RoutingDomain Name Destination AdminStatus ConnectionState
------ ------- ----------- ----------- ---------------
XXXXXX-XXXX-SMJ {0.0.0.0} True Connected


Dynamic S2S GUI-Powershell Hybrid

Alternately, create dynamic S2S interfaces with the RRAS GUI.  This approach offers some S2S client management benefits.  Keep in mind, these S2S interfaces use default cryptographic algorithms.  We'll need to modify S2S security targets with PowerShell:

Step 1.  RRAS → VNS server → Right-click Network Inerfaces → New Demand-Dial Interface:

• Interface Name:  Certificate's subject common name.
• Connection Type:  VPN → Next
• VPN Type:  IKEv2 → Next
• Hostname:  None (leave blank) → Next
• Protocols & Security:  Route IP packets on this interface → Next
• Static Routes:  None (or add based on your organization's needs).
• Dial-Out Credentials:  None → Next → Finish.

Step 2:  Edit S2S interface properties → Options tab.
• Connection type:  Persistent connection →  OK.

Step 3:  Edit security targets for S2S interface in PowerShell.

PS C:\Users\SMJ> Set-VpnS2SInterface -name xxxx-xxxx-SMJ -CustomPolicy -CipherTransformConstants AES256 -DHGroup Group14 -EncryptionMethod aes256 -IntegrityCheckMethod SHA256 -EncryptionType RequireEncryption

WARNING: VPN site-to-site adapter xxxx-xxxx-SMJ will be modified and the parameters 
other than IPv4Subnet/IPv6Subnet will be applicable next time the connection is dialed.

Check Hybrid S2S Connection from GUI:

 RRAS → VNS server → Network Interfaces:  Connection Status

Figure 3.  S2S connection status via RRAS GUI.

The RRAS Network Interface GUI now includes a list of S2S interfaces and connection status.  It also provides a simple method to disconnect or disable client connections.

Troubleshoot:

Use PowerShell to check server IPsec crypto-sets:
• Get-NetIPsecMainModeCryptoSet
• Get-NetIPsecQuickModeCryptoSet


Confirm server-client security targets work as intended:
• Get-VPNS2SInterface
• Get-NetIPsecMainModeSA
• Get-NetIPsecQuickModeSA

That's It!

Task:

How to manually request and enroll certificates for BYOD devices with Windows CA server.

Background:

Automated mobile device management (MDM)  (e.g., Microsoft Workplace-Join,) provides a secure method for device key management.  However, rolling out the right MDM solution can be a serious undertaking.  It may be overkill for some organizations.

This article covers device key-management for special use situations.  It provides instructions on how to manually generate device (e.g., iPhone) certificates for mutual authentication (e.g., IKEv2 VPNs).

Assumptions:

• This article assumes the use of Windows CA servers.
• It assumes that the CA has an active enrollment template for mobile devices: http://www.stevenjordan.net/2016/11/ca-template-for-vpns.html

Solution:

Step 1:  Request the device certificate from from any workstation:

• Start → MMC → File → Add Snap-In:  Add Certificates - Current User
• Certificates → Current User →  Personal → Certificates → All Tasks → Request New Certificate

• Select Policy: No changes.  Click Next.
• → Request Certificates:  User Device Auth → Click Details →  Click Properties.
• → Certificate Properties:      

        →  [Subject Tab]
                  Subject Name:
                       Common Name (CN) = user_device@stevenjordan.net;  add.
                       Email = user_email@stevenjordan.net;  add. Given Name:  First and last name; add.
                  Alternative Name:
                        DNS = user_device@stevenjordan.net; add. N.B., DNS must match Full CN.
                        Email = user_email@stevenjordan.net; add.
         → [General Tab]
                   Friendly name:  user_device@stevenjordan.net
         → Click OK.

Task: 

Prepare Windows CA certificate template for end-user enrollment.

Assumptions:  

• These instructions are for situations that require minimal VPN support.
• This solution only supports enrollment requests from the Windows certificate snap-in.
• It enforces administrative approval for end-device enrollment -this is not a completely automated process.
• Workplace Join is the preferred method for device enrollment.  It provides self-service automation.  It provides secure key management.  This walk-through is not for Workplace Join.

Steps:

1. Open certificate templates.  From the Windows CA:  Start → MMC → File → Add Snap-In:  Add Certificate Templates.
2. Step 2:  Duplicate User template:  Certificate Templates → Right-Click on User (Template) →  Duplicate Template.  
3. Step 3:  Edit Properties of New Template (Table 1):

Table 1:  New Certificate Template Properties.