Using Kemp Load balancer for SSL offloading for perfect forward secrecy and TLS1.x (A rating on SSL labs)

You may have already seen in my previous post how to perform SSL offloading to a Kemp Load Balancer but another usefull feature is setting up the ciphers available to each Virtual Service to get a good "A" rating on the SSL labs vulnerability scan of your site

To set Ciphers on Windows for IIS requires a bit of powershell scripting and there is a guide available here

However to update the SSL ciphers that we are using on a Virtual Service (VS) in the load balancer is much easier.  Once you have assigned an SSL cert do the following to update the ciphers

• Click Virtual Services
• Click View/Modify Services
• Select the VS to update
• You will note that SSL acceleration is Enabled and there is a Cihpers list which by default just contains the default ciphers.
• On the left column are the available ciphers - ticking the various options in the "Selection filters" check boxes on the right filters this list



Options required to filter the list

• Tick "Perfect Forward Secrecy", "No RC4"" and "TLS 1.x Ciphers Only"
• Highlight all of the available ciphers in the now filtered list
• Click on the > button to move the selected ciphers over to the "Assigned Ciphers" list and be sure to click the "Set Ciphers" button to confirm the new ciphers

Test the SSL configuration at here: https://www.ssllabs.com/ssltest/ but make sure to tick the box to not sure the results of your test on the results board!  You should get an A rating on your SSL configuration.

How to enable SSL offloading on a Kemp Load Balancer

I love the 2 Kemp Load balancers that we have at work.  As well as the obvious job of directing traffic to multiple application front-ends it can also perform SSL offloading.

This means that we can have a single portal through which to manage our SSL certificates rather than having to update on individual IIS computers.

To start you need an SSL certificate and any intermediate certificate that is required.

Logon to the Kemp load balancer

Select Certificates > SSL Certificates

Click "Import Certificate"

Click "Browse" to select your certificates

Fill in the Pass Phrase and add a Certificate Identifier (this can be anything as its a friendly name that you can use to identify it in the web UI)

You can now add Virtual Services to the assigned list for the certificate - you need to make sure that your VirtualService listens on port 443 and you might want to disable SSL on the real servers and have the load balancer and the real server communicate over port 80 without SSL unless you are concerned about the security of your internal network communications.

Citrix XenServer XAPI Not running

Issue

A XenServer node is not available in the pool - all VM's running on the server have stopped/migrated to other nodes.

When logging into the server via the DRAC card the following message is displayed:

"The XenA API xapi is not running. This console will have reduced functionality."

Resolution - lifted from http://support.citrix.com/article/CTX128316

•  The most common cause is that the XenServer disk has ran out of space.  Usually because a log file has grown especially large.
• Open the console via Putty/any SSH terminal (The server will not be available in XenCenter)
• Typr df in the console - this will show you the current disk use - you will see a "Use%" listed as the 5th column, if this shows at or very near 100% then disk space is probably the issue

My usage is at 54%

• The most common cause of disk space being used is the logs in /var/log so do the following:
• cd /var/log
• Run the following command to see the size of all the files in the current directory; narrow down your search by specifying one file, if needed:
• du –ksh *.*
• If you see an excessively large file, run the following command to delete the file:
• rm <filename>.log.
• Restart the XenServer to recreate the log file and it restarts XAPI automatically.

Office 2010 - User gets an installation window each time they open an Office 2010 application for the first time

Symptom

User who has office 2003 and Office 2010 installed may get an installation window each time they open an Office 2010 application for the first time

Resolution

• Click Start > Run
• Copy and paste the following command:
• reg add HKCU\Software\Microsoft\Office\14.0\Word\Options /v NoReReg /t REG_DWORD /d 1
• Hit enter, you will not see anything happen unfortunately
• Launch one of the affected Office 2010 applications to check that the issue is resolved
• If the problem persists - open regedit and browse to HKCU\Software\Microsoft\Office\14.0\Word\Options
• Check the NoReReg value is set to 1

Setting up a user home using Windows 8 RSAT part 1 – Server 2008 R2 server without WinRM 3.0

There are 3 main steps to configuring user home directories

1. Create a new share eg home$ with domain users having Full Control of the share but the "users" group is removed entirely from NTFS permissions

            This leaves Creator Owner with full permissions, Administrators with full permissions and I also add domain admins with full permissions also.

2. In ADUC* modify the users home H: drive mapping to \\FileServer\home$\%username% - on clicking apply a new folder will be created by ADUC with the users name in the home$ share with the NTFS permissions defined above AND the user being added explicitly with full control - thus granting just this one user access to his home folder but not any other standard user

3. Move the users data from any previous share/local drive into their new folder

*ADUC = Active Directory Users and Computers

Add your file server to Windows Server Manager:

Right click on “All Servers” and click Add Server

Type the name of your server and click Find Now and press the > button to move it over to the Selected pane and then click on OK

The process on Windows Server 2008 R2

Server 2008 R2 does not have WinRM3.0 installed by default so server manager probably shows something like this next to the server

This means that we will need to use the older share wizard in Computer Management to complete the task

Right click on your server in server management and select Computer Management

Expand System Tools > Shared Folders > Shares

Right Click on Shares and select New Share

I am creating a new folder “home” on the D: drive to house users documents etc

On the next screen I have provided a share name

The $ at the end of the share name means that the share is hidden – if a user happens to browse the server looking for shares it will not appear

On the next screen click Customize permissions and then click Custom

By Default the Everyone group has access to this folder (share tab), lets change that to domain users have full control

We now need to edit the NTFS permissions to lock down the users home folder so that only the user it belongs to and the IT staff can access it so click on the Security Tab

Click Advanced at the bottom of the Security Tab

On the advanced screen we need to Disable inheritance and then Convert inherited permissions into explicit permissions on this object

Next highlight the Users group and click Remove – that will leave your advanced security settings looking something like this

Now if you go into ADUC and select a user

Go to the profile tab

Under home folder click Connect, select a drive letter from the drop down box and then set the home directory to \\FileServer\share$\%username% (replace the server and share name as appropriate but the %username% variable will auto populate with the users name when you click OK)

My TestHomeShare user immediately creates this shared folder after setting his home drive mapping in ADUC which I can see by browsing to the folder that I created

Now when the user logs in they have got a H:\ drive which is automatically mapped to the path that we setup earlier