Write IPSec (WIN) using command lines)

Write IPSec (WIN) using command lines)
Http://www.chinaunix.net Author: t920 published at: 22:12:13

Some customers have requested that IPsec rules be automatically set on win.
Crazy !!!!!

Even after a long time, I finally got it done. In fact, it was nothing. I used ipsecpol. EXE, a command line tool provided by Ms.

Hohohoho is a little bit of a cool at Microsoft !!!!!

×××××××××××××××××××××××××××××××××××××

Use ipsecpol. EXE to write a policy script

Ipsecpol. EXE is included in Windows 2000 resource kit. It is a command line utility used to create, assign, and delete IPSec policies. Ipsecpol. EXE is flexible. It allows you to create dynamic and static policies in Active Directory and local and remote Registries. For complete information, see the documentation in resource kit. Here, a static policy is created in the registry of the local computer.

Ipsecpol. EXE has many parameters and its syntax is hard to understand at the beginning. However, if you follow the example provided here, you can use three commands to copy all the configurations shown in the previous GUI example. You may want to enable MMC after each command and refresh its display to verify that the command is executed as expected. Let's get started.

The first command (as shown below) creates a new policy, adds rules to the policy, and adds two filter lists and one filter operation to the rule.

Ipsecpol-W reg-P "packet filter"-R "inbound web protocol"
-F * + 131.107.1.1: 80: TCP-f * + 131.107.1.1: 443: TCP-N pass

This command is displayed in two rows for printing. Press enter in one row. It includes the following parameters:

*-W reg-write a static policy to the Registry. This is exactly the same as using MMC.
*-P "packet filter"-create a policy named "packet filter.
*-R "inbound web protocol"-create a rule named "inbound web protocol.
*-F * + 131.107.1.1: 80: TCP-Add a filter. * specify any source address and any port. 131.107.1.1: 80 specify the target address (server address) and specific port ,: specifies the TCP protocol. + indicates that the filter has been mirrored.
*-F * + 131.107.1.1: 443: TCP-except the target address is 443, it is the same as the preceding parameter.
*-N pass-communication without negotiation security.

Note that the values of-W,-F, and-N are case sensitive and only uppercase is used!

You can include any number of filters. Remember the previous discussions on the role-based Filter list. If your server runs multiple services, you should use a separate ipsecpol. EXE command for each type of filter. For example, the following command can allow inbound connections on ports 110, 995, 143, 993, and 25, and allow outbound connections from ports 25 to any place.

Ipsecpol-W reg-P "packet filter"-R "inbound/outbound mail"
-F * + 131.107.1.1: 110: TCP-f * + 131.107.1.1: 995: TCP
-F * + 131.107.1.1: 143: TCP-f * + 131.107.1.1: 993: TCP
-F * + 131.107.1.1: 25: TCP-F 131.107.1.1 + *: 25: TCP
-N pass

(Last filter-F 131.107.1.1 + *: 25: TCP looks a little different. It allows an outbound connection from any port on the server's own address to port 25 on any server. This filter allows the server to start an outbound SMTP connection to the Internet .}

The following command creates a general rule that matches and blocks all communications:

Ipsecpol-W reg-P "packet filter"-R "All inbound communication"
-F * + 131.107.1.1-N Block

It includes the following parameters:

*-W reg-write a static policy to the Registry. This is exactly the same as using MMC.
*-P "packet filter"-add to an existing policy named "packet filter.
*-R "All inbound communications"-create a rule named "All inbound communications.
*-F * + 131.107.1.1-Add a filter, in which * specifies any source address and any port, and 131.107.1.1 specifies the destination address and any port. Protocol vacancy means any protocol is used, + specify that the filter has been mirrored
*-N block-blocks communication.

The last command assigns a policy:

Ipsecpol-W reg-P "packet filter"-x

It includes the following parameters:

*-W reg-write a static policy to the Registry. This is exactly the same as using MMC.
*-P "packet filter"-add to an existing policy named "packet filter.
*-X-assignment policy.

This is all the commands. Using the three commands, you have completed the same task as using the GUI. When you add ipsecpol. EXE support to the server compilation script, remember that you may not want to assign a policy before creating the server. Therefore, the script should only contain the-n pass and-N block commands. After all servers are installed, you can use the following commands to remotely assign policies:

Ipsecpol // machine name-W reg-P "Policy Name"-x

You must have the permission to manage the specified machine in this command. To temporarily cancel policy assignment, replace-X with-y.

You can use the following command to delete the entire policy (including all related filter lists and Filter Operations ):

Ipsecpol-W reg-P "Policy Name"-o

This is useful if your server creation process allows you to dynamically change the server role (without restarting. Delete existing policies, and create and assign new policies. If you want to remotely write a script to create a policy on all servers, you can add the // host name to all forms of commands.

Differences between GUI and ipsecpol. EXE. Yes, there are some differences between the two, but they are only related to how some content is displayed in the GUI.

* The default response rule cannot be disabled, but in the packet filter example, this does not matter because the incoming connection is not always allowed or is always blocked.
* The rule name is used as the name of the filter list.
* The-N pass and-N block commands do not use the existing allow and block operations (if they have been created in the GUI). Instead, they create new allow or block operations for each rule, and name the new operation "rule list name negpol ".
* The default list of security methods exists in the attributes of each filter operation. However, this list is ignored because there is no actual security negotiation.
* When you use the-O command to delete a policy, the related Filter list and filter operations are also deleted. When deleting a policy in the GUI, the related Filter list and filter operations are not deleted.

So, is this true?

In short, this is indeed valid. Shortly after Windows 2000 was released, a popular industry magazine tested the security of many web servers. Microsoft was invited to participate in the test. We have created a Windows 5.0 server that enables Internet Information Services 2000. All we do to protect the server is to add a password to the administrator account and create an IPsec Policy as in the example. The server is directly connected to the Internet and is spared from attacks attempted in a few weeks.

**************************************** **********

Let's take a look at the usefulness of this stuff !!! Hohohoho
Do you want that guy to get on the Internet ????
Ipsecpol-W reg-p fw-r outdeny-F 0 = *-N Block
One line !!!
(Limited to Win2000, XP and 2003 have other similar tools)