Microsoft operating system remote management implementation solution (lumeng)

Microsoft operating system remote management implementation solution

Author: xiongtun <xiongtun@sohu.com>
Source: http://www.nsfocus.com
Date: 2003-02 2

Many Microsoft system administrators are faced with the problem of how to manage remote systems securely! In Unix systems, the answer is simple: using the SSH protocol is secure and effective. In SSH mode, we can not only manage remote systems under the command line, but also run remote X-window through tunnlling. Strong encryption algorithms are used during transmission to prevent unauthorized access to transmitted data.

Unfortunately, it is not very easy to apply remote secure access to Microsoft operating systems. First, only the NT Terminal Server is installed. The 2000 Server and XP Server are installed with the Remote Management Service (Terminal Service ). Second, some third-party companies generally spend a lot of money on implementing the remote management service provided to Microsoft. With the further implementation of the scheme, the cost is getting higher and higher. Some free remote management software, such as VNC, cannot provide encrypted transmission, and the security is compromised .!

This article proposes a solution that can be used to remotely manage Microsoft operating systems from Windows 95 to Windows XP. This scheme is characterized not only by the minimum cost, but also by high security.

Solution

What are the characteristics of an ideal remote management solution? First, this solution must be efficient. Although it is satisfactory to manage the command line mode of the simulated terminal in UNIX systems. however, using this method to manage Windows Remote services is far from enough, because Windows is an operating system based on the graphical environment, and remote management should also be implemented in a graphical way. In addition to efficiency, remote management must be based on security. This solution must not only provide user authentication, but also ensure the confidentiality and integrity of the transmitted data.

In the remote management solution discussed in this article, the following open source software is used to meet the above requirements!

1. VNC-(Virtual Network Computing) provides a graphical interface for managing remote systems. In our solution, the VNC software will be the "core" of this entire solution ". It provides a graphical interface to connect to a remote operating system.

2. The main purpose of Stunnel-is to establish an SSL tunnel that can be used to securely transmit data transmitted by other non-encrypted protocols. In the solution described in this article, this tool will be used to encrypt the VNC protocol. In Stunnel, not only can ensure the confidentiality and integrity of the transmitted data, but also can use the certificate to sign the VNC client and server.

3. OpenSSL-OpenSSL provides an encryption function library that can be used to encrypt data for applications. By using OpenSSL, we can generate, sign, or revoke certificates based on the Public Key Infrastructure (PKI. The scheme proposed below will be used to generate and sign certificates that need to confirm the VNC client and server

The above software is used to provide a secure remote management solution!

The actual implementation of this solution is as follows:

Install software

The first step to implementing this security management remote Microsoft system is to install the above software.

Install VNC

Here we can download VNC from the http://www.uk.research.att.com/vnc/ and install it on the desktop operating system we want to be remotely managed, which is the VNC server. what you need to do next is to register the VNC service. The registration method is to open "start", "RealVNC", "VNC Server", "register VNC Server service ", then the system will require a restart.

After the system is restarted, we must set the basic parameters of the VNC service. The most important thing is to set a valid password to prevent unauthorized access to the VNC service. Next, disable the "enable Jave viewer" option (this option requires two separate SSL tunnels and we will not use it), as shown in:

After setting the VNC server, we should download the VNC client software (vncviewer.exe) and place it on the VNC client.

Check whether the VNC client can establish a connection with the VNC server. If both parties can establish a connection, we have completed the preliminary settings.

Because the VNC server can only be accessed by the locally installed Stunnel software, we need to add a key value to the registry .:

Key: HKEY_LOCAL_MACHINE/software/orl/winvnc3name: loopbackonly
Type: REG_DWORD
Value: 1
The above key value is used to enable loopback connection, that is, send-back connection, and restrict the connection on the listening port 5900 to a local IP address (127.0.0.1 ), in this way, the VNC server will not be directly accessed by machines on the network, which greatly improves security. in addition, if you do not want to disable the VNC service, add one to the server registry:
Key: HKEY_LOCAL_MACHINE/software/orl/winvnc3/Default
Name: allowshutdown
Type: REG_DWORD
Value: 0
To make the above settings take effect, we should restart the VNC service.

Install Stunnel

Next, install the Stunnel software: Program C:/program files/Stunnel. You also need to download two required DLL files, libeay32.dll and libssl32.dll.

If you want to automatically start the Stunnel process at startup, add the following key values to the registry:
Key: HKEY_LOCAL_MACHINE/software/Microsoft/Windows/CurrentVersion/run
Name: Stunnel
Type: REG_SZ
Value: "C:/program files/Stunnel/stunnel-4.04.exe"
Install OpenSSL
As we all know, in most Linux versions, the typical installation includes the OpenSSL library, which is mainly because the OpenSSL library is a required component to install OpenSSH. in fact, there is another version of OpenSSL, which is suitable for Microsoft operating systems and has the same features as Linux. in the solution mentioned in this article, we need OpenSSL on Windows.
We will install and configure the OpenSSL Service as follows:
1. trusted host (WIN program can download ghost and libssl32.dll. 2 files from the Stunnel official site. The downloaded files must be placed in the C:/program files/OpenSSL. folder.
2. You also need to download two files, one configuration file, OpenSSL. conf, which can be downloaded from http://www.securityfocus.com/data/tools/openssl.conf.
CA. Bat script file, used to generate a certificate: http://www.securityfocus.com/data/tools/ca.bat
These two files must also be placed in the C:/program files/OpenSSL. folder, as shown in:

Next, you should generate a certificate to identify the VNC server and client.
Generate Keys and certificates
CA authentication
This process should first generate a private/public key pair and a third-party trusted certificate. in the subsequent process, the private key will be used to issue certificates for the VNC server and client. The CA certificate will be assigned to all VNC servers and clients. because the CA private key is one of the most important foundations in the implementation of PKI, the key should be assigned a pass phrase ). The access code can also be called a password, which is used to protect the private key, and users can choose freely. You cannot use a private key without a password. Therefore, passwords and private keys are equally important. Select a safe password ..
We use the ca. bat batch file to generate the key pair and certificate:
C:/progra ~ 1/OpenSSL/CA genca

After completing the preceding steps, the CA certificate will be stored in C:/CA/cacert. in the PEM file, private/public key pairs are stored in C:/CA/private/cakey. in the PEM file.
VNC Server
Next, generate the server's key pair and certificate.
C:/progra ~ 1/OpenSSL/CA Server

Therefore, the following file is generated in C:/CA/temp/vnc_server:
Server. Key-private/public key pair
Server. CRT-server certificate
Server. pem-server. Key + server. CRT (used when using Stunnel)
It should be emphasized that the private key of the server does not have a pass code to encrypt. The method of using a pass code to encrypt the private key is not applicable here, the main reason is that Stunnel does not support the pass code. Second, the private key encrypted with the pass code cannot be used for Stunnel software.

VNC client

The last step is to generate the client's key pair and certificate.
C:/progra ~ 1/OpenSSL/CA Client

Similar to the server, the following files are generated in the C:/CA/temp/vnc_client Folder:

Client. Key-private/public key pair R
Client. CRT-client certificate
Client. pem-client. Key + client. CRT (used when using Stunnel)
Stunnel settings

VNC Server

Before establishing a secure transmission mode for the service segment and client, we must set the Stunnel software and install the necessary keys and certificates.

Create a new Stunnel. conf file in the C:/program files/Stunnel folder. The file content is:

Cafile = cacert. pem
Capath = Certificates
CERT = server. pem
Client = No
Verify = 3

[VNC]
Accept = 443
Connect = 127.0.0.1: 5900
With the preceding settings, all connections connecting to the tcp443 port are redirected to the local tcp5900 port. Of course, there is a premise that the client must provide a valid certificate and the certificate must be local

Next, set the CA certificate (C:/CA/cacert. PEM) and the key of the VNC Server, certificate (C:/CA/temp/vnc_server/server. put PEM in C:/program files/Stunnel
Finally, we must install the VNC client certificate. To make the tunnel program find the certificate during the authentication process, we must change the Certificate Name as follows. (The following command must be run on the server that generates the certificate. The value is the output result after the OpenSSL X509 command is run. When you use the copy command, value must be replaced by the actual output result .)
Cd c:/CA/temp/vnc_client
C:/progra ~ 1/OpenSSL X509-hash-noout-in client. CRT
Value
Copy client. CRT value.0

Then the value.0 file should be put into C:/program files/Stunnel/certificates
:

VNC client

The configuration on the client is similar to the preceding steps.
First, create a Stunnel. conf file in C:/program files/Stunnel /.
Content:
Cafile = cacert. pem
Capath = Certificates
CERT = client. pem
Client = Yes
Verify = 3

[VNC]
Accept = 127.0.0.1: 5900
Connect = vnc_server_ip_address: 443

Next, set the CA certificate (C:/CA/cacert. PEM) and the key of the VNC Server, certificate (C:/CA/temp/vnc_server/server. put PEM in C:/program files/Stunnel
Similarly, we need to change the Certificate Name as follows.

Cd c:/CA/temp/vnc_server
C:/progra ~ 1/OpenSSL X509-hash-noout-in server. CRT
Value
Copy server. CRT value.0

Then the value.0 file should be put into C:/program files/Stunnel/certificates

Finally, the C:/program files/Stunnel folder should be shown in:

Test connection

So far, all the settings have been completed. To test, we must enable both the network tunnel and the VNC server in the client and service segment.

On the server

On the client

If the connection fails to be established for some reason, we should increase the login level of Stunnel and find out the cause of the error. In this case, we need to add a line in the Stunnel. conf file:

DEBUG = 7
Restart the stunel service and test the connection again.

Reverse connection

In the preceding settings, a successful connection can be made only when the VNC server has an independent public IP address or is in the same LAN as the VNC client. What should I do if the VNC Server is behind the NAT (Network Address Translation) or the information trying to connect to the server is discarded by the firewall?

Because the VNC server has the "/listen" option, the above restrictions may be broken. In the traditional C-S mode transmission, the client initiates a connection, but now, not only can the client initiate a connection, but the server itself can be reversely connected. The only requirement is that the server and the client can be connected. of course, this requires that the client cannot intercept the information packet either after the NAT reverse proxy or by the firewall.

As mentioned above, VNC has the reverse connection function. To use this function, make a few changes to the Stunnel. conf file on the VNC Server: cafile = cacert. pem
Capath = Certificates
CERT = server. pem
Client = Yes
Verify = 3

[VNC]
Accept = 127.0.0.1: 5500
Connect = vnc_client_ip_address: 443
Similarly, Stunnel. conf Of The VNC client should be modified as follows:
Cafile = cacert. pem
Capath = Certificates
CERT = client. pem
Client = No
Verify = 3

[VNC]
Accept = 443
Connect = 127.0.0.1: 5500
At this time, the Stunnel software on the server is changed to the ssl client, while the Stunnel on the client is changed to the SSL server.
Of course, the listener for connecting the service end and the customer end will also change. First, the customer opens vncviewer.exe and enters the listening mode (open the Start menu in sequence, RealVNC, VNC Viewer, and run listening VNC Viewer). At the server end, we use the Add client options ,:

The above is very effective for servers under the NAT proxy, but it also has a drawback, that is, you must perform manual operations in the server segment, is there a way to establish the above connection without human operation?
Listen nine o'clock A.M. to nine o'clock P.M. every 10 minutes. When we want to connect the client, we only need to set vncviewer.exe to the listening mode, and wait for a maximum of 10 minutes for the active connection from the server.

Original article: http://www.securityfocus.com/infocus/1677

Author:. Artur Maj-ENSI (European Network Security Institute.) network security consultant, co-authored by <Solaris administrator Security Manual>.

Glossary:

SSH :( Secure Shell) is used to provide secure remote logon and other security network services.

SSL :( Secure Socket Layer) Secure Sockets Layer Protocol

Tunnel: a network tunnel that uses one network protocol to transmit another network protocol.

VNC: (Virtual Network Computing) a remote management software that is free and open-source. Consists of two parts: Server and viewer ).

Stunnel: a program that can use the OpenSSL library to encrypt any TCP session.

OpenSSL: an excellent SSL/TLS open source software package, which includes three parts: the SSL library, the encryption algorithm library, and the application program.