Tag: Windows Server

Categories
Articles Windows Windows Server

Evolution of SSL/TLS Protocols & Disabling TLS 1.0 and TLS 1.1 on Windows Servers while Enabling TLS 1.2

History of SSL/TLS

SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are cryptographic protocols used to secure communication over the internet. They are similar but distinct security protocols and are often collectively referred to as “SSL/TLS.”

1.SSL (Secure Sockets Layer):

  • SSL was initially developed by Netscape Communications Corporation in 1994.
  • Its first version, SSL 1.0, was never publicly released due to numerous security vulnerabilities.
  • SSL 2.0 emerged in 1995 and saw more widespread use, but its lifespan was short-lived due to security vulnerabilities.
  • SSL 3.0, introduced in 1996, was more secure. However, over time, various security vulnerabilities were discovered, leading to the abandonment of SSL 3.0.

2.TLS (Transport Layer Security):

  • TLS is considered an enhanced and secure version of SSL.
  • TLS 1.0, introduced in 1999, is an improved version of SSL 3.0 with security vulnerabilities addressed.
  • TLS 1.1 arrived in 2006, and TLS 1.2 followed in 2008, both enhancing the protocol’s security.
  • TLS 1.3 was released in 2018, introducing numerous security and performance improvements. TLS 1.3 is faster and more secure compared to its predecessors.

SSL and TLS secure internet communication by encrypting traffic, ensuring the confidentiality of data exchanges, and updating security protocols. However, as vulnerabilities and weaknesses emerge, these protocols are continually updated and improved.

TLS 1.2 or TLS 1.3?

As of 2021, TLS 1.0 and TLS 1.1 have been officially deprecated.
Source

TLS 1.2: 

  • It is an older version and is supported by many applications and systems.
  • It is a good option for establishing a secure connection but may have some security vulnerabilities.
  • Security experts recommend using TLS 1.3 whenever possible instead of TLS 1.2.

TLS 1.3:

  • It is a more recent version and offers a range of security improvements.
  • It includes faster connection establishment times and more secure encryption algorithms.
  • Designed to address security vulnerabilities, it is supported by many modern browsers and servers.

The version you should use depends on the systems, applications, and requirements in use. However, generally, you might prefer TLS 1.3 if possible, as it is more secure and offers better performance. Nevertheless, compatibility issues with older systems or specific requirements may necessitate the use of TLS 1.2.

Web servers and browsers typically automatically use up-to-date and supported TLS versions. If you manage a web server, it is advisable to use the latest and supported TLS version. As users, keeping your browsers and systems up-to-date is essential for enhancing security and ensuring optimal performance.

In this article, we will explore how to address the general SSL/TLS warnings provided by https://www.ssllabs.com/ssltest, a platform used to check and score the SSL/TLS security levels of the web hosting platforms. Additionally, we will conduct these checks on the test website https://ahmetorhan.xyz for demonstration purposes. The article will simplify the steps to disable the RC4 protocol and TLS 1.0 and TLS 1.1, especially focusing on how to implement these measures on Windows Servers. As indicated in the output, we will observe the necessity of disabling these protocols for enhanced security.

  • Our objective here is to disable the deprecated TLS 1.0 and TLS 1.1, as indicated in the following sections.

SSL Security Registry Configuration

  • Paste the provided code into a text document named “security_enable.txt.” Rename the file to “security_enable.reg” and remove the “.txt” extension.
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]
"Enabled"=dword:00000001
"DisabledByDefault"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]
"Enabled"=dword:00000001
"DisabledByDefault"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman]
"ServerMinKeyBitLength"=dword:00000800

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
"Enabled"=dword:00000000
  • When we run the “security_enable.reg” file, all the entries above will be automatically added to the registry, and you can verify that they have been added as shown below.
  • Open regedit by following the path Start -> Run.

  • After completing these steps, you need to restart your server for the changes to take effect.
  • After the restart process is complete, I am initiating the test procedure again for the domain https://ahmetorhan.xyz. Initially classified as B, we now observe that it is categorized as A.

  • You can observe that the TLS 1.0 and TLS 1.1 protocols have been disabled.

  • If you want to revert the changes made in the registry, running the following entries and restarting will be sufficient.
Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman]
"ServerMinKeyBitLength"=dword:00000800

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
"Enabled"=dword:00000000

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
"Enabled"=dword:00000000

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
"Enabled"=dword:00000000

If you have any questions or details you would like to add, feel free to write me.

Categories
Articles Windows Server

Installation of ELK Stack (Elasticsearch, Logstash, and Kibana) on Windows Server

ELK Stack (Elasticsearch, Logstash, Kibana Stack) is a data analysis and visualization platform where Elasticsearch, Logstash, and Kibana are brought together. These three open-source components are used collectively to gather, process, analyze, and visualize unstructured data. ELK Stack offers a powerful toolkit for organizations aiming to effectively work with large datasets.

Here are the fundamental components of ELK Stack:

Elastics
Elastics

1. Elasticsearch: Elasticsearch is a search and analytics engine that provides rapid search, querying, and indexing capabilities for unstructured data. By swiftly indexing and storing data, it facilitates easy access to information. Elasticsearch is used to handle various types of unstructured data such as text documents, log files, time series data, and other non-structured data.

Logstash
Logstash

2. Logstash: Logstash collects data from various sources, processes and transforms it, and then directs it to Elasticsearch or other destinations. Logstash plays a significant role in data collection, processing, and transformation stages. With Logstash, it is possible to organize, filter, enrich, and convert data into different formats.

Kibana
Kibana

3. Kibana: Kibana is used to visualize, analyze, and share data from Elasticsearch. Through Kibana, users can discover data, create diverse visual elements, and build dashboards to effectively present information.

When these three components come together, organizations can collect, process, analyze, and visualize their data. ELK Stack can be employed for handling various data types such as application logs, network logs, text documents, performance metrics, and more. Moreover, the flexible nature of ELK Stack enables the creation of customized solutions and addressing unique data analysis needs.

Installation and Configuration of ELK Stack (Elasticsearch, Logstash, Kibana) on Windows Server can be achieved through the following steps:

1: Java Installation:
Java is required to run Elasticsearch and Logstash. I recommend using OpenJDK instead of the official Oracle JDK. Follow the steps to download and install OpenJDK.

2: Elasticsearch Download and Installation:
2.1. Download the suitable version of Elasticsearch for Windows from the official Elasticsearch website: https://www.elastic.co/downloads/elasticsearch

elasticsearch
elasticsearch
  • Extract the downloaded compressed file to a folder.

2.2. Configuration File (elasticsearch.yml):

  • The configuration file for Elasticsearch is located in the “config” folder.
  • Open the “elasticsearch.yml” file with a text editor.
  • Make the necessary configurations.

2.3. Starting Elasticsearch as a Service:

  • To run Elasticsearch as a Windows service, locate the “elasticsearch-service.bat” file in the “bin” folder.

  • Open the command prompt as an administrator (right-click and select “Run as administrator”) and navigate to the relevant directory.

  • Use the command elasticsearch-service.bat install to register Elasticsearch as a service.

  • Then, start the Elasticsearch service using the command elasticsearch-service.bat start.

  • You can stop or manage the service using the command elasticsearch-service.bat manager.

2.4. After these steps, check whether the Elasticsearch service is installed and running:

  • Go to Start > Run > services.msc, and verify that the Elasticsearch service is installed and running.
Services / elasticsearch
Services / elasticsearch

3. Installation of Logstash:

3.1. Download Logstash: Obtain the appropriate Logstash file for Windows from the official Logstash download page: https://www.elastic.co/downloads/logstash

3.2. Extract the downloaded compressed file to a folder.

3.3. Configuring Logstash via logstash.yml:
Logstash is configured through the “logstash.yml” file, typically located in the “config” subdirectory within the Logstash installation directory. In the configuration file, you can set up input, filter, and output settings. Additionally, you define the pipeline processing logic here.

3.4. Running Logstash:
To run Logstash, open the command prompt, navigate to the Logstash installation directory, and use the following command to start Logstash:

bin\logstash -f logstash.conf

logstash
logstash

4. Installation of Kibana:

4.1. Download Kibana: Download the suitable Kibana file for Windows from the official Kibana download page: https://www.elastic.co/downloads/kibana

Kibana
Kibana

4.2. Extract the downloaded compressed file to a folder.

4.3. Configure Kibana: Edit the Kibana configuration file (kibana.yml) to make your configurations (e.g., Elasticsearch connection settings, etc.).

4.4. Running Kibana: Open the command prompt, navigate to the Kibana installation directory, and use the following command to start the service:

bin\kibana

Installation is complete, now we move on to configuration settings:

Elasticsearch’s security features can vary depending on the version of Elasticsearch you are using. Starting from version 6.8.0, basic security features (Security) are enabled by default in Elasticsearch. These features include user authentication, role-based access control, and encryption.

In Elasticsearch 7.0.0 and later versions, there is a built-in “elastic” user with a default password. This user can be used for administrative tasks. The credentials for the default “elastic” user are as follows: Username: elastic, Password: A randomly generated password in these versions, printed to the console when Elasticsearch is started.

However, for security reasons, it’s highly recommended to promptly change this default password. It’s advised to replace the randomly generated password with a secure one as soon as Elasticsearch is started.

For the most up-to-date information about Elasticsearch versions and security features, you can refer to the official Elasticsearch documentation or other reliable sources. Security features can evolve over time, so checking the official Elasticsearch documentation is advisable for staying informed.

https://localhost:9200/

Username: elastic

Password: Enter the password that was generated during the initial installation, found in the “log” folder within the Elasticsearch directory.

  • Open your web browser and navigate tohttp://localhost:5601 . This address is the default location where Kibana operates.

  • At this step, it requires you to generate a token.
  • To generate the token, you need to run the relevant command in the command prompt.
bin\elasticsearch-create-enrollment-token.bat

binelastlcsearch-create-enrollment-token.bat
bin\elasticsearch-create-enrollment-token.bat

  • You add the code you generated to the Kibana panel.
Kibana Panel
Kibana Panel
  • You establish the connection with the Elastic panel.

The configuration process for connecting Kibana with Elasticsearch is complete. Now, your ELK Stack connections are ready.

Since data security is crucial in our lives, remember to change the “default” password from the Kibana panel.

  • Select the “Edit Profile” option from the top right corner.
Edit Profile
Edit Profile
  • From the “Profile” section, select the “Change password” option.

  • Complete the process of changing the password by filling in the relevant fields.

By following these steps, you should have completed the installation and configuration of ELK Stack (Elasticsearch, Logstash, Kibana) on a Windows Server. Now, you can begin utilizing this powerful toolset for data analysis and visualization. ELK Stack will assist you in the processes of data collection, processing, analysis, and creating meaningful visuals.

Data security is of utmost importance, so remember to change the default passwords in Elasticsearch and Kibana to strong and unique passwords. This step will ensure the safety of your data.

If you encounter any challenges along the way, it’s a good idea to refer to the official documentation of Elasticsearch and Kibana or seek help from community support forums. Best of luck, and I wish you a successful journey filled with data insights!

If you have any questions or details you would like to add, feel free to write me.

Categories
Articles Windows Server

Installing IIS on Windows Server

You can install IIS (Internet Information Services) on Windows Server using Server Manager by following the steps below:

1. Server Preparation:
— Make sure you have Administrator privileges on your server if you are using a Windows Server operating system.

2. Opening Server Manager:
— Click on the Start button.

— Search for “Server Manager” and open it.

3. Select “Add Roles and Features” from the Left Menu:
— In the Server Manager main window, locate “Upper Banners” and select “Add Roles and Features.”

4. Launch the “Add Roles and Features Wizard”:
— The “Add Roles and Features Wizard” window will open. This wizard helps you add roles and features to your server.

5. Select Features:
— In the first step of the wizard, choose the “Installation Type.” Typically, select “Role-based or feature-based installation,” and proceed.

6. Choose the Target Server:
— Select your server or specify the target server, then click “Next.”

7. Select Roles:
— In the “Roles” section, find “Web Server (IIS)” and check the box. You can also select additional components if needed.

8. Review Accessibility Information:
— Follow the wizard’s progression and configure necessary options when prompted.

9. Initiate the Installation:
— Start the IIS installation by clicking the “Install” button.

10. Completion of Installation:
— Once the installation is complete, you will receive a confirmation message indicating successful installation.You will then be prompted for a reboot.

You can successfully install IIS by following these steps. Afterward, you can configure your websites and applications using the IIS Management Console.

If you have any questions or details you would like to add, feel free to write me.

Categories
Articles Windows Server

Obtaining an SSL Certificate on Windows IIS Server Using “Certify the Web”

Certify The Web
Certify The Web

One of the crucial steps towards securing data traffic on the internet is to use SSL/TLS certificates on your websites. These certificates ensure encrypted data transmission and enable users to interact with your site securely. For Windows-based IIS servers, you can utilize the free tool “Certify the Web” to acquire and manage SSL certificates. Here’s a step-by-step guide on how to obtain an SSL certificate using the Certify the Web tool:

Step 1: Downloading and Installing Certify the Web

  1. Visit the official Certify the Web website and download the program. Proceed with the installation on your computer.
Certify the Web — 01
Certify the Web — 01
Certify the Web — 02
Certify the Web — 02
Certify the Web — 03
Certify the Web — 03
Certify the Web — 04
Certify the Web — 04

Step 2: Opening the Tool and Basic Configuration

1.Launch the Certify the Web application.

Certify the Web — 05
Certify the Web — 05

2. On the main screen, you’ll typically find an option like “New Certificate” or something similar. Click on this option to initiate the process of creating a new certificate.

Certify the Web — 06
Certify the Web — 06
Certify the Web — 07
Certify the Web — 07

Step 3: Domain Selection and Verification Methods

1.During the certificate creation process, you should add the domain names you wish to protect (e.g., www.example.com).

Certify the Web — 08
Certify the Web — 08

2.Certify the Web offers various methods to verify the ownership of your domain. Choose one of these methods. Usually, you can opt for HTTP or DNS-based verification methods.

HTTP-Based Verification:

  1. When HTTP-based verification is selected, Certify the Web will automatically create a special file in a designated folder on your server. This file is used to verify that your domain is accessible.

DNS-Based Verification:

  1. If DNS-based verification is chosen, you might need to create a specific DNS record. This record assists the certificate provider in verifying the ownership of your domain.

Step 4: Certificate Issuance and Installation

1.Once the verification process is completed, Certify the Web will automatically obtain the SSL/TLS certificates.

2.To manage the generated certificates and install them on your IIS server when needed, you can use the “Certificates” or a similar tab or menu.

IIS Server
IIS Server
IIS Server / Server Certificates
IIS Server / Server Certificates

Step 5: Using the Certificate on the IIS Server

1.While Certify the Web handles the certificate issuance, you need to activate these certificates on your IIS server.

2.In the IIS management interface, navigate to the connection security settings of the relevant website.

IIS Server — Binding
IIS Server — Binding

3.Select the newly acquired SSL/TLS certificate as the server certificate.

Site Binding
Site Binding
Edit Site Binding
Edit Site Binding

Data security is a paramount concern while managing your online presence. The Certify the Web tool simplifies the process of SSL certificate acquisition and management by making it easy and automated.

If you have any questions or details you would like to add, feel free to write me.

Categories
Articles Monitoring Windows Server

Resetting Grafana Password on Windows Server

1. Download the Grafana Password Reset Tool:

The first step is to download the official Grafana password reset tool. This tool is typically included with the Grafana installation. You can download it from the following link:

Grafana Password Reset Tool

2. Run It in the Command Prompt:

  • Navigate to the directory where Grafana is installed:

  • Run the Command Prompt as an administrator.

  • o to the relevant directory.

3.Execute the Command:

  • You can reset the Grafana password by using the following command:
Grafana-cli admin reset-admin-password YENI_SIFRE
  • Replace `NEW_PASSWORD` with your new password.

4. Log In with the New Password:

Once the password reset process is complete, you can log in to Grafana with your new password.

If you have any questions or details you would like to add, feel free to write me.