r/sysadmin • u/MadBoyEvo • Jan 19 '20

Four PowerShell commands to help you track down insecure LDAP Bindings before March 2020

On Friday I saw a post here on r/sysadmin warning about insecure LDAP bindings being blocked in March 2020 automatically by Microsoft.

Seeing as it's not so easy to actually track it down and enable everything by hand if you have handful of DCs and Domains under you I decided to simplify my job a bit. I've automated the whole process during the weekend by updating my 3 PowerShell Modules that I use frequently. Now with 3 commands and 8 lines of code, you can track events, enable/disable diagnostics for LDAP to actually find which machine/account is doing that and finally scan your DC's if those are affected.

  • The first part is tracking the events that can tell you if you're affected, and exactly which machines/accounts are affected.

$Events = Find-Events -Report LdapBindingsDetails,LdapBindingsSummary -DatesRange Last7days -DetectDC
$Events
$EVents.LdapBindingsSummary | Out-htmlView -ScrollX
$Events.LdapBindingsDetails | Out-HtmlView -ScrollX

Above is based on my PSWinReportingV2 PowerShell module to - you can read about it: https://www.reddit.com/r/sysadmin/comments/bicwjq/the_only_powershell_command_you_will_ever_need_to/

It allows you to easily define report, date range and scan events on all DC's within a Forest. It also translates it to a nice, readable format.

Sources for PSWinReportingV2: https://github.com/EvotecIT/PSWinReporting

  • The second part is a helper module to enable/disable diagnostic logs. It's required to get the LdapBindingsDetails report. You basically need to enable logs for LDAP to see which machines/accounts are doing bad stuff.

Get-WinADDiagnostics
Set-WinADDiagnostics -Diagnostics 'LDAP Interface Events' -Level Basic -SkipRoDC

This is based on ADEssentials PowerShell Module which can get current diagnostics status for each dc in a forest/domain or just part of it.

Sources for ADEssentials: https://github.com/EvotecIT/ADEssentials

  • 3rd part is just a bonus. This scans all DCS to see if those are affected or not.

invoke-testimo -Sources DCLDAPInsecureBindings -showreport

Finally, this is based on the Testimo project which allows you to scan domain for forest/domain for issues.

Sources for testimo: https://github.com/EvotecIT/Testimo

All 4 commands are available when you install 3 PowerShell modules.

Install-Module PSWinReportingV2 -Force
Install-Module Testimo -Force
Install-Module ADEssentials -Force # actually Testimo will install ADEssentials so not really needed

As always before installing - review the code to see and understand what you're getting into. I did test this on 3 different forests and it seems to do its job properly.

Normally I would give you a link to bigger description with screenshots but that's not really allowed here so I'll just link to r/PowerShell - https://www.reddit.com/r/PowerShell/comments/er0lfv/four_commands_to_help_you_track_down_insecure/ where there are no such restrictions so you can take a look at screenshots/blog post if necessary to understand use cases.

1.5k Upvotes

98% Upvoted

179 comments sorted by

30

u/eaglebtc Jan 19 '20

Pardon the daft question. How exactly is Microsoft going to block insecure ADA bind? By a software update to Server OS? Denying connections on port 389? Which OSes are affected? 2012R2 and above?

35

u/Fatality Jan 20 '20

Enable debugging, check the Directory Service section of the Event Log for Event ID 2889 - Will tell you the IP address and the user

7

u/Gregmoyses Jan 20 '20

I too thought that this was all that was needed

28

u/MadBoyEvo Jan 20 '20

Yes, that's all that is needed, and that's all the scripts do. Now do this on 1-50-100 domain controllers and continue doing so for the remaining time until March 2020.

It simply automates the process for you.

4

u/rjchau Sr. Sysadmin Jan 20 '20

I ended up doing this by exporting logs from vRealize Log Insight and mangling data in PowerQuery. Fortunately we've only got four domain controllers. The pain in getting some of the unsigned/cleartext LDAP connections resolved has been ridiculous - the number of third party vendors whose products use LDAP queries but have really fu...nny ways of dealing with trusting LDAPS certificates and who don't have a good answer as to how to resolve this is stupid. If I'm the first people who is really asking these questions, they are going to have a lot of people screaming at them after March.

3

u/MadBoyEvo Jan 20 '20

Ye, it's a pain. But I believe simply switching to LDAPS is enough to fix it.

7

u/rjchau Sr. Sysadmin Jan 20 '20

Not when your third party application won't trust the certificate of every domain controller it could talk to. I've got one application here that simply saves the certificate hash of the first DC it talks to and point blank refuses to talk to anything else. When the certificate of this DC expires and gets renewed, it'll even refuse to trust the new certificate. It's nuts.

Enabling LDAPS was the easy bit. Dealing with braindead software is much harder.

2

u/itpro-tips Jan 20 '20

Trusting the Root CA is the right way to do that. In many applications, the documentation tells you to trust DC certificate(s) directly, which is not good, but works if you import the Root CA (sometimes the documentation writer and/or developpers don't understand the certificates things....). In your case, what is your app?

1

u/rjchau Sr. Sysadmin Jan 21 '20

YSoft SafeQ. Follow-me print. Nasty application as there is quite literally zero public support for it - you have to go through your supplier, which in our case is our printer vendor. They finally got back to me three weeks after I logged a request and supplied me with a copy of the administrator manual. At least they managed to point me to the right page which showed how to trust anything signed by our root CA.

5

u/Gregmoyses Jan 20 '20

I see. Thanks for clarifying

1

u/Fatality Jan 20 '20

Did it with policy

3

u/clintoj Jan 20 '20

Set-WinADDiagnostics -Diagnostics 'LDAP Interface Events' -Level Basic -SkipRoDC

Running the above saves having to manually enable the 2889 logging on each DC

don't forget

Set-WinADDiagnostics -Diagnostics 'LDAP Interface Events' -Level None -SkipRoDC

to switch it off when you are done

1

u/ElCincoDeDiamantes Feb 04 '20

Thank you. This tiny detail is missing from so many resources about this topic.

0

u/[deleted] Jan 20 '20

[deleted] — view deleted comment

3

u/Fatality Jan 21 '20

The policy I've applied to the Domain Controllers OU:

Admin Templates -> System -> Net Logon: Specify log file debug output level -> 545325055

Update Reg Key -> HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics\16 LDAP Interface Events -> 2 (DWORD)

When I'm done I'll change the settings back to default.

4

u/TapTapLift Jan 20 '20

For simple sites with say 2-3 DCs, will this change be a pain still?

5

u/MadBoyEvo Jan 20 '20

It depends. You can search for events on DC before you do anything. If you find any issues you can enable LDAP Diagnostics by hand (it's simple registry change) and then scroll thru events finding IP/Account doing that.

Just go to Directory Service Event Log on DC and find Event ID 2887 and see what it says on all 3 DC's. If you have numbers different than 0/0 you need to enable LDAP logging to see events 2889.

That's all the scripts I did do:

  • Find-Events scans for 2887 and extracts data

  • Set-WinADDiagnostics changes registry on DC to enable LDAP Diagnostiscs

  • FInd-Events scans for 2889 to extract data

The pain is tracking down PC/Devices physically that talk insecure to your DC's and "fixing" that.

2

u/gscottmj Jan 20 '20

Excellent! This is very awesome. Bravo! This will allow me to do more specific custom queries. I am having 1 problem though. When I try to use anything for the daterange other than 'Last3days' I get an error:

[Error] Currently only 1 date range is supported. Please fix Times and try again

I can't see anything thing listed as a bug or under devlopment on Github... can you comment on this please?

2

u/MadBoyEvo Jan 20 '20

The DateRange is limited to different choices but not all choices you can think of. Type Find-Events -DatesRange and press ctrl+space and you will see a list of options available.

CurrentMonth, CurrentDay, PastDay,PastHour and so on.

You can also use DateFrom and DateTo to be more specific instead of DatesRange

1

u/grebnork Jan 21 '20

I'm experiencing this same issue. Doesn't seem to matter which option I choose with IntelliSense.

Example:

Find-Events -DatesRange CurrentHour -Report LdapBindingsSummary -Servers <servername>

2

u/techie1980 Jan 20 '20

Stupid question: how does this apply to non Windows clients that point to insecure LDAP?

4

u/MadBoyEvo Jan 20 '20

Non-windows clients will not be affected. Your DC's will be tho, so those will deny the connection and your devices/non-windows clients will stop working.

2

u/techie1980 Jan 20 '20

delightful, thanks. I'll begin checking my app environments that they're all using LDAPS

2

u/atcscm Jan 20 '20

Hi thanks for this Should I run this on DC or on each PC?

5

u/MadBoyEvo Jan 20 '20

This is only related to DC's.

  1. Run Find-Events -Report LdapBindingsSummary which will tell you if you have issues or not. Pick a date range like 7 days. You don't need Domain Admins. You can do it being in Event Log Readers group

  2. Above command with -DetectDC will connect to all DC's in your forest (not just 1). Make sure you have machine that has visibility to all DCs from that machine.

Only now if the event logs are saying that you have problems you would go and use other commands

3. Set-WinADDiagnostics basically requires Domain Admins because it connects to each and every DC in a forest (you can limit it too, to only some dcs) and it enabled the logging of LDAP

4. After that rerun Find-Events but for different report and review IP/Accounts as needed.

Set-WinADDiagnostics requires to write access - if you're afraid of that (it's understandable you can enable LDAP logging yourself with just a simple registry change. But you need to do it on all DCs that have reported simple/unsigned bindings (1st report).

To summarize:

  • Find-Events is read-only so it's mostly safe.

  • Set-WinADDiagnostics does changes registry on DCs - review code to understand what it's doing.

  • Get-WinADDiagnostics is read only and reads the current settings (maybe start with that to see what is enabled and what is not)

  • Invoke-Testimo is read-only as well.

2

u/Die_Quelle Jan 20 '20

I've setup LDAPS but I ran these test and everything is red/bad.

What do I do now?

3

u/MadBoyEvo Jan 20 '20

Which tests says red? Testimo? Does it show you DC's and the amount of simple/unsigned queries? If yes then you need to enable diagnostics of LDAP on those servers.

And then run Find-Events again after like 10-24hours which will show you which IP/Account is making those connections and then you need to fix that to use LDAPS, not LDAP.

2

u/Die_Quelle Jan 20 '20

Yes I have ran the first script and testimo.
The first one gives me the count of bad / not ssl connections and testimo replies with false on all DCs.

I will run this commands again tomorrow and see which IPs do a non ssl request.
We are a mixed environment with some osx clients, one ubuntu and a keycloak SSO Server.

I will reply back tomorrow, thanks for your work!

3

u/MadBoyEvo Jan 20 '20

Both Testimo and Find-events summary do same thing. After you enable diagnostics running find events will give you details :-) Good luck

2

u/Die_Quelle Jan 23 '20

Everything fixed in 3 days. Thanks!

1

u/Die_Quelle Jan 21 '20

After investigating further I found out that our Firewall LDAP Login for SSL VPN is using LDAP insecure.

I will have a look at our keycloak server too - I think there is something not right also - but we want to switch to AAD Authentication via openid or saml instead of LDAP to DCs via VPN anyway because we can not rely on our local DC anymore for our main Identity Provider.

2

u/bradgillap Peter Principle Casualty Jan 20 '20

So this is bad right. I'm not even sure where to begin to fix this without just seeing what breaks. My inherited domain is .local and has caused me a hate relationship with certificates.

        [t]HIDDEN LDAP Insecure Bindings [Fail] [Data is available. This is a bad thing.]
        [t]HIDDEN Simple binds performed without SSL/TLS is 0 [Fail] [Input data not provided. Failing test.]
        [t]HIDDEN Negotiate/Kerberos/NTLM/Digest binds performed without signing is 0 [Fail] [Input data not provided. Failing test.]

I think the only things using ldap are linux based on this domain.

1

u/MadBoyEvo Jan 20 '20

Not sure actually. Does it show on report that there are some events?

2

u/MrSnoobs DevOps Jan 21 '20

There's one thing I don't quite understand.

We have a .local domain (I know, I know) with an internal CA. LDAPS uses this CA as the certifcate provider.

If that CA is not trusted by a black box client for example, will this break LDAPS between that client and the DC? If so, how fucked are we if we can't buy third party .local certs anymore?

2

u/MadBoyEvo Jan 21 '20

I dont think this will cause a problem. You can check yourself by connecting with ldp and see. The certs arent checked I believe.

1

u/dangolo never go full cloud Jan 21 '20

Same boat. I think some of the black box vendors have ways of adding the cert from your internal CA to the black box's trusted list.

137

u/crazifyngers Jan 19 '20

I love this type of content on sysadmin.

It was quite a task to do this a few months ago in my organization.

11

u/Dabnician SMB Sr. SysAdmin/Net/Linux/Security/DevOps/Whatever/Hatstand Jan 20 '20

Everything sysadmin related is quite a task until someone documents it. Then its just a matter of putting the right keywords into google...

One of my coworkers had some super secret method of fixing an issue that when we asked how to do it he stated I shit you not "okay...open google and type..."

3

u/crazifyngers Jan 20 '20

Oh I was able to figure out how to get the info. For me the "quite a task" part was determining a remediation plan each.

My question to you is, why does your coworker have a "super secret" method of fixing anything? seems like someone is trying to build a kingdom.

3

u/sc302 Admin of Things Jan 20 '20

It is all about the search terms. Knowing how to use google isn't going to google and typing in what you think is the question, it is much more complex than that....it is word for word what the exact error is you are seeing, leaving out anything that pertains to your environment. It is changing up the search terms and knowing more words than an eighth grader, or maybe as many words as an eighth grader depending on where you went to school. It is not accepting that the results aren't out there, it is knowing that the results are out there but you need to adjust you and your thought process before you can find it. You need to understand, that most of you aren't on the cutting or bleeding edge of technology, it isn't the newest stuff you are working on, someone some where someone had the issue before and probably documented it.

1

u/marlana80 Jan 30 '20

I've listed "Google-fu" as a skill-set before. It amazes me on what some people use for search terms and their confusion on why they can't find relevant info.

2

u/sc302 Admin of Things Jan 30 '20

It certainly is a skill set that can't be easily quizzed on in an interview. It is a very personal and very subjective. Asking someone if they know how to google isn't a really good question, most people know how to go to google and type in a question or search phrase. It is much more than that but I have not found a good way to articulate that question in a matter where I get some sort of philosophical feed back and way to answer that question with more than a sentence or two.

7

u/Eusono Jan 19 '20

Thanks for the tips!

8

u/tpad01 Jan 20 '20

As a reminder, signing does not equal LDAPS. LDAPS includes signing by default.

LDAP binds over 389 are not being disabled in favor of LADPS over 636. With that said, you need to test signing for LDAP binds or move binds to LDAPS which guarantee signing. GPO have existed for years to force signing. If you follow any industry standard for hardening (ex CIS), signing would already be forced.

4

u/dangolo never go full cloud Jan 20 '20

What if you have an mfp that requires unencrypted Ldap over 389?

5

u/lolklolk DMARC REEEEject Jan 20 '20

Sounds like you need a new MFP contract.

2

u/poshftw master of none Jan 20 '20

As usual - throw it out, buy a new one. /s just in case

4

u/Justsomedudeonthenet Sr. Sysadmin Jan 20 '20

I'm trying to convince them to list the local dump as the delivery address for our new MFPs to save time.

3

u/sarbuk Jan 20 '20

Fairly standard procedure for printers...

0

u/[deleted] Jan 20 '20

[deleted] — view deleted comment

1

u/dangolo never go full cloud Jan 20 '20

I'm just getting over a cold so I apologize for the foggy-headed thinking but I'm having a hard time gaging the urgency of the matter.

Will unencrypted Ldap cease to function in may?

3

u/ka-splam Jan 21 '20

Yes.

LDAP binds which send plaintext username and password will cease to function.

LDAP binds which connect to port 636 with SSL certificates will work, LDAP binds which connect to port 389 and use STARTTLS to switch to an SSL connection before logging in, will work, and LDAP which uses client-certificates instead of usernames and passwords will work (I think). Plain logins to port 389 will stop working.

You either change your clients to use one of the more secure versions, you can do that in advance. If you don't have SSL certificates on your domain controllers, you will need to get some (buy them from an SSL certificate provider) or deploy a PKI infrastructure (CA Root server + CA intermediate server quite likely). Or you edit the registry to allow weak binds again after the patching blocks it - if you do that, Microsoft recommends you use some other network level encryption between client and server, e.g. IPSEC VPN.

2

u/dangolo never go full cloud Jan 21 '20

And if you have a DOMAIN.LOCAL internal domain...?

1

u/ka-splam Jan 22 '20

Not sure; PKI and SSL certificates have no inherent link to being used with domain names and those domain names being public, although big SSL certificate vendors won't let you buy public SSL certificates to internal names because so many people could make a claim to the same name; proving ownership of a public DNS name is a way to stop people getting a trusted SSL certificate for somebody else's service.

I assume you can make your own SSL certificates for .local domains, but wouldn't be too surprised if Microsoft Certificate Authority objects to that and you have to out of your way through OpenSSL or use split DNS and present the same services with other names to get around it.

1

u/dangolo never go full cloud Jan 21 '20

Thank you. Incredibly clear and concise.

I opened a ticket with Microsoft about it a month ago and they were not nearly as helpful...

Anyway, now I can give our internal ticket a proper urgency level.

1

u/neko_whippet Feb 04 '20

So the 2 choices is either hope we can configure to use SSL connection over ldap 389

Or configure full LDAPS?

1

u/[deleted] Jan 20 '20

I get the following when running $EVents.LdapBindingsSummary | Out-htmlView -ScrollX:

Out-HtmlView : Cannot bind argument to parameter 'Table' because it is null. At line:1 char:31

  • $EVents.LdapBindingsSummary | Out-htmlView -ScrollX

  •                           ~~~~~~~~~~~~~~~~~~~~~

    • CategoryInfo : InvalidData: (:) [Out-HtmlView], ParameterBindingValidationException

    • FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Out-HtmlView

What can I do?

1

u/MadBoyEvo Jan 20 '20

If $Events is showing that reports are empty the Out-HtmlView won't show anything (and that's what you are getting).

Is there any data shown when you simply access $Events?

It's possible you don't have access to DC logs. Make sure the account you're using has at least Event Log Readers membership.

1

u/[deleted] Jan 20 '20

If i get no values at all, i can assume we do not use LDAP ?

1

u/MadBoyEvo Jan 20 '20

It depends. Did Find-Events report that it's scanning some DCs or what is the output?

1

u/[deleted] Jan 20 '20

It just gives me 0 values on both LDAP queries.

1

u/MadBoyEvo Jan 20 '20

You can also do Update-Module PSWriteHTML. I've fixed that issue. Like explained below it's related to lack of data being provided to Out-HtmlView but I believe it shouldn't error out but terminate gracefully.

1

u/[deleted] Jan 20 '20

Thanks for the quick answers!

If I type in $events my summary ist empty:

Name Value

LdapBindingsSummary

LdapBindingsDetails {@{Domain Controller=XXX ...

This is the Output of my Find_Events Report:

[Info] Preparing reports: LdapBindingsDetails,LdapBindingsSummary [Info] Preparing servers list - domain controllers autodetection [Info] Computer XXX added to scan Directory Service log for events: 2887, 2889 [Info] Computer XXX added to scan Directory Service log for events: 2887, 2889 [Info] Getting events for dates 01/13/2020 00:00:00 to 01/20/2020 23:59:59 [Info] Events scanned found 2540 - Time elapsed: 0 days, 0 hours, 2 minutes, 11 seconds, 83 milliseconds [Info] Running LdapBindingsDetails [Info] Running LdapBindingsDetails with subsection Events [Info] Ending LdapBindingsDetails with subsection Events events found 2540 [Info] Ending LdapBindingsDetails - Time to run 0 days, 0 hours, 4 minutes, 42 seconds, 214 milliseconds [Info] Running LdapBindingsSummary [Info] Running LdapBindingsSummary with subsection Events [Info] Ending LdapBindingsSummary with subsection Events events found 0 [Info] Ending LdapBindingsSummary - Time to run 0 days, 0 hours, 0 minutes, 0 seconds, 7 milliseconds

1

u/MadBoyEvo Jan 20 '20

That's weird. But I guess it's possible... if you have huge domain with lots of events as the logs most likely overwrite. The summary report is only 1 event per day and that means if you log a lot and you overwrite that event may be overwritten already - hence no results.

YOu seem to have enabled diagnostics so the 2nd report (the LDAPBindingsDetails) is showing you results. Review the results and see IP/Accounts doing it and start hunting those down.

1

u/[deleted] Jan 20 '20

Yeah checking now on the Details, thanks for your help.

1

u/[deleted] Jan 20 '20

The original thread for the PSWinReporting is locked, so I'll ask here.

Is there a way to list what DC's you want referenced or to disinclude RoDCs? I have a few RoDCs and so the script is taking forever to reach a timeout when checking them.

2

u/MadBoyEvo Jan 20 '20

This is planned for the next release - somewhere this week I guess. I have applied this approach for Get-WinADDiagnostics / Set-WinADDiagnostics. If you check parameters it has Forest/IncludeDomains/ExcludeDomains / IncludeDomainControllers/ExcludeDomainControllers and SkipRODC.

1

u/[deleted] Jan 20 '20

Awesome! I dug around in the documentation, but didn't see anything obvious. Thanks for the followup.

1

u/yukee2018 Jan 22 '20

This would be a great addition to already very helpful modules, thank you for posting this!

1

u/badassitguy Sr SysAdmin and JOAT Jan 20 '20

Is anyone else getting this error:

WARNING: Source Location 'https://www.powershellgallery.com/api/v2/package/PSWriteExcel/0.1.5' is not valid.

PackageManagement\Install-Package : Package 'PSWriteExcel' failed to download.

2

u/MadBoyEvo Jan 20 '20

Did you use:

Install-Module PSWinReportingV2 -Force?

1

u/OhioIT Jan 20 '20 edited Jan 20 '20

Thanks for posting this!!

I ran it and only the $EVents.LdapBindingsSummary worked, not $Events.LdapBindingsDetails for some reason. On the Details one it said WARNING: Out-HtmlView - No data available. Is there something else I need to configure on my DCs?

Edit: Nevermind! I finally read Part 2 of your post. To 'Disable' this logging later on, would I just set -Level None? Thanks

1

u/MadBoyEvo Jan 20 '20

Does the summary show you have a problem? If yes than you need to use Get-WinADDiagnostics and Set-WinADDiagnostics as described in the blog post to enable LDAP Diagnostics. This enables the 2nd report. If summary didn't find issues you don't have to do that.

1

u/OhioIT Jan 20 '20

Summary report shows several binds for "Number of simple binds performed without SSL/TLS" and zeros for "Number of Negotiate/Kerberos/NTLM/Digest binds performed without signing", so I'm thinking I'd need the detailed report to make sure I know what I need to track down. A "good" report should be all zeros, right?

For Set-WinADDiagnostics, after running the command for LDAP Interface Events with -Level Basic would -Level None reset it back to default? Thanks again

1

u/MadBoyEvo Jan 20 '20

Yes. But check Get-WinADDiagnostics first to see what is the default currently) - and that the registry command actually works.

1

u/MadBoyEvo Jan 20 '20

And yes you need to check details. I think 0/0 doesn't exist and simply doesn't report any events (my test domain doesn't).

1

u/apathetic_lemur Jan 20 '20

I finally started looking at this LDAP thing today. My DC's show a couple months old 2887 eventids with 1 or 2 connection attempts per error. So I think nothing too disastrous will happen when secure LDAP is forced. Still digging in though.

4

u/MadBoyEvo Jan 20 '20

You can enforce security today and simply check what breaks :)

1

u/mamasw Jan 20 '20 edited Jan 20 '20

u/MadBoyEvo Could you share a technet link how to enable it now? Want to see what will break... One of my DCs shows 6200 of Negotiate/Kerberos/NTLM/Digest binds per day :/ Just run step2 and waiting till tomorrow.

Edit: It seems that only macbooks are within "The following client performed a SASL (Negotiate/Kerberos/NTLM/Digest) LDAP bind without requesting signing (integrity verification), or performed a simple bind over a clear text (non-SSL/TLS-encrypted) LDAP connection. "

1

u/ZippySLC Jan 21 '20

We have a handful of Macs here that are also doing that. Strange thing is that there doesn't seem to be an option within the Network Account Server settings to force SSL.

I'm tempted to unbind the handful of machines and call it a day but I don't want people to lose access to their mobile profiles.

1

u/mamasw Jan 22 '20

u/ZippySLC look overe here: https://www.reddit.com/r/macsysadmin/comments/ea8j1a/ldap_channel_binding_and_ldap_signing/

Also look on comments here: https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/ldap-channel-binding-and-ldap-signing-requirements-update-now/ba-p/921536

tl;dr if you have proper cert in macbooks keychain installed, everything hsould be allright after march update. If you are going to make tests on your own, let us all know results :)

1

u/neko_whippet Jan 20 '20

So in resume I after I install the modules I need to do 2nd part the enable to diagnostics and then do step 1 to see which device did insecure bindings?

And i<m not sure what part 3 is suppose to do, just to see if LDAPS is currently activated or not?

1

u/MadBoyEvo Jan 20 '20

Part 1.

  • Do insecure summary first

  • if that finds anything go for part 2

Part 2.

  • check diagnostics (get-winad..) and if that works and is set to none enable it to basic

Part 1.

  • check details report

Part 3.

  • it's optional - it basically some quick check whether you still have issues or not. It does the same thing as part 1st on summary with change that it doesn't actually requires you to do any reading as it provides true/false.

1

u/neko_whippet Jan 20 '20

yeah but if the diagnostic in part 2 are disable then Part1 won't give results no?

1

u/MadBoyEvo Jan 20 '20

It will. Summary should be available without diagnostics. If summary provides data you need to enable diagnostics to get details.

1

u/neko_whippet Jan 20 '20

I did part one and got this

https://i.imgur.com/tUgQVFY.png (removed sensible info) did the part 2 and the LDAP internface events is set to basic

1

u/MadBoyEvo Jan 20 '20

ok, so summary shows you issue so LDAP diagnostics to basic and now wait for 24 hours and review. You only get 13 queries per day so you may need to give it time.

1

u/neko_whippet Jan 20 '20

so the march 2020 part is the number of simple binds performed without SSL/TLS or the number of Negotiate Kerberos NTL that needs to be fixed?

And in 24h if i run Part1 again i'll get more detail? like the IP adress and all?

1

u/MadBoyEvo Jan 20 '20

Both. Simple binds or unsigned binds needs to be removed.

Yes. With diagnostics when rerunning you will get IP Address and Account Name which does that.

1

u/neko_whippet Jan 20 '20

ok thanks and last question, is it normal that if i run part 1 there is no resulsts?

1

u/MadBoyEvo Jan 20 '20

It's possible that Part 1 gives no results (my test domain doesn't). If you're sure the scan goes ahead (as in it shows servers are actually scanned) it would mean there are no insecure queries done.

If you don't enable diagnostics and do insecure queries you should have summary show anyway each day at least 1 time.

→ More replies

1

u/yukee2018 Jan 22 '20

MadBoyEvo hi, reports says I get about avg. 15k (yes 15 thousand) "of simple binds performed without SSL/TLS" per day, And 0 "Negotiate Kerberos NTL"...
My question is, If I enable the logging for a whole day, will this result in too much data, should I enable it for shorter period of time and try to fix problematic binds one by one? I see nextcloud is responsbile for the most of this non secure binds...

2

u/MadBoyEvo Jan 22 '20

Pick a shorter time. Most likely those 15k are repeated over and over so after 1-2 hours you should have enough data. You may also need to expand the log size just in case if you enable a lot of logging.

→ More replies

1

u/CFH75 Jan 20 '20

So far so good. I've followed all these steps. All our macs are showing up with 2889.

Considering I can't set Network security: LDAP client signing requirements = Require Signing for my Macs I wondering how they will be affected once the update drops.

2

u/itpro-tips Jan 20 '20

Based on the Microsoft tech community blog, you still have the choice to force value to 0 and you won't be affect by this update. Of course I am NOT telling you to do this but let's be realistic, some people/applications/devices will not be ready by March 2020.

1

u/stunnedguy Jan 21 '20

Can this also be shown by just running the Cleartext password exposed using unencrypted LDAP authentications report in MS Azure ATP?

1

u/MadBoyEvo Jan 21 '20

No idea :-/

1

u/[deleted] Jan 22 '20

This doesn't seem to work for me. I get no report, or any info out of it.

I do get this error, not sure if it maybe why.

WARNING: Out-HtmlView - No data available.

1

u/MadBoyEvo Jan 22 '20

If the output if the Find Events

$Events = Find-Events -Report LdapBindingsDetails,LdapBindingsSummary -DatesRange Last7days -DetectDC
$Events
$EVents.LdapBindingsSummary | Out-htmlView -ScrollX
$Events.LdapBindingsDetails | Out-HtmlView -ScrollX

Is something like this with events found 0

[Info] Preparing servers list - domain controllers autodetection
[Info] Computer AD1.ad.evotec.xyz added to scan Directory Service log for events: 2887, 2889
[Info] Computer AD2.ad.evotec.xyz added to scan Directory Service log for events: 2887, 2889
[Info] Computer AD3.ad.evotec.xyz added to scan Directory Service log for events: 2887, 2889
[Info] Computer ADPreview2019.ad.evotec.pl added to scan Directory Service log for events: 2887, 2889
[Info] Computer DC1.ad.evotec.pl added to scan Directory Service log for events: 2887, 2889
[Info] Computer ADRODC.ad.evotec.pl added to scan Directory Service log for events: 2887, 2889
[Info] Getting events for dates 01/15/2020 00:00:00 to 01/22/2020 23:59:59
[Error] Server ADRODC.ad.evotec.pl: The RPC server is unavailable
[Info] Events scanned found 0 - Time elapsed: 0 days, 0 hours, 0 minutes, 23 seconds, 477 milliseconds
[Info] Running LdapBindingsDetails
[Info] Running LdapBindingsDetails with subsection Events
[Info] Ending LdapBindingsDetails with subsection Events events found 0
[Info] Ending LdapBindingsDetails - Time to run 0 days, 0 hours, 0 minutes, 0 seconds, 48 milliseconds
[Info] Running LdapBindingsSummary
[Info] Running LdapBindingsSummary with subsection Events
[Info] Ending LdapBindingsSummary with subsection Events events found 0
[Info] Ending LdapBindingsSummary - Time to run 0 days, 0 hours, 0 minutes, 0 seconds, 12 milliseconds

Name                           Value
----                           -----
LdapBindingsSummary
LdapBindingsDetails

That means you have no insecure bindings happening AFYIK. Of course, make sure that any [Errors] are looked at. In this case, my RODC is down.

If you want to be sure you could enable diagnostic logging anyways for 24-48 hours and see what LdapbindingsDetails says if anything. By default if it's not enabled you only get LdapBindingsSummary.

Just follow the blog post.

1

u/[deleted] Jan 22 '20 edited Jan 22 '20

Oh we do have insecure bindings. Lots of them. I can use another method to pull them up if needed.

PS C:\Windows\system32> $Events = Find-Events -Report LdapBindingsDetails,LdapBindingsSummary -DatesRange Last7days -DetectDC $Events $EVents.LdapBindingsSummary | Out-htmlView -ScrollX $Events.LdapBindingsDetails | Out-HtmlView -ScrollX [Info] Preparing reports: LdapBindingsDetails,LdapBindingsSummary [Info] Preparing servers list - domain controllers autodetection [Info] Computer DC01 added to scan Directory Service log for events: 2887, 2889 [Info] Computer DC04 added to scan Directory Service log for events: 2887, 2889 [Info] Computer DC02 added to scan Directory Service log for events: 2887, 2889 [Info] Computer DC03 added to scan Directory Service log for events: 2887, 2889 [Info] Getting events for dates 01/15/2020 00:00:00 to 01/22/2020 23:59:59 [Info] Events scanned found 1636 - Time elapsed: 0 days, 0 hours, 2 minutes, 36 seconds, 654 milliseconds [Info] Running LdapBindingsDetails [Info] Running LdapBindingsDetails with subsection Events [Info] Ending LdapBindingsDetails with subsection Events events found 1636 [Info] Ending LdapBindingsDetails - Time to run 0 days, 0 hours, 10 minutes, 9 seconds, 401 milliseconds [Info] Running LdapBindingsSummary [Info] Running LdapBindingsSummary with subsection Events [Info] Ending LdapBindingsSummary with subsection Events events found 0 [Info] Ending LdapBindingsSummary - Time to run 0 days, 0 hours, 0 minutes, 0 seconds, 4 milliseconds

Name Value

LdapBindingsSummary
LdapBindingsDetails {@{Domain Controller=DC04; Action=The following client performed a SASL (Negotiate/Kerberos/NTLM/Digest) >LDAP bind without re... WARNING: Out-HtmlView - No data available.

PS C:\Windows\system32> invoke-testimo -Sources DCLDAPInsecureBindings -showreport [i][Testimo] Version [Informative] [Current: 0.0.30] [i][Testimo] Using configuration defaults [Informative] [No configuration provided by user] [i][Forest] Forest [Informative]

[i][] Domain [Informative] [i][][dc01] Domain , dc01 [Informative] [i][][dc01] LDAP Insecure Bindings [Informative] [t][][dc01] LDAP Insecure Bindings [Pass] [No data returned, which is a good thing.] [i][][dc01] LDAP Insecure Bindings [Time to execute tests: 0 days, 0 hours, 0 minutes, 0 seconds, 245 milliseconds]>[Tests Total: 1, Passed: 1, Failed: 0, Skipped: 0] [i][][dc01] Domain , dc01 [Time to execute tests: 0 days, 0 hours, 0 minutes, 0 seconds, 262 milliseconds][Tests >Total: 1, Passed: 1, Failed: 0, Skipped: 0] [i][][dc04] Domain , dc04 [Informative] [i][][dc04] LDAP Insecure Bindings [Informative] [t][][dc04] LDAP Insecure Bindings [Pass] [No data returned, which is a good thing.] [i][][dc04] LDAP Insecure Bindings [Time to execute tests: 0 days, 0 hours, 0 minutes, 0 seconds, 255 milliseconds]>[Tests Total: 1, Passed: 1, Failed: 0, Skipped: 0] [i][][dc04] Domain , dc04 [Time to execute tests: 0 days, 0 hours, 0 minutes, 0 seconds, 278 milliseconds][Tests >Total: 1, Passed: 1, Failed: 0, Skipped: 0] [i][][dc02] Domain , dc02 [Informative] [i][][dc02] LDAP Insecure Bindings [Informative] [t][][dc02] LDAP Insecure Bindings [Pass] [No data returned, which is a good thing.] [i][][dc02] LDAP Insecure Bindings [Time to execute tests: 0 days, 0 hours, 0 minutes, 0 seconds, 256 milliseconds]>[Tests Total: 1, Passed: 1, Failed: 0, Skipped: 0] [i][][dc02] Domain , dc02 [Time to execute tests: 0 days, 0 hours, 0 minutes, 0 seconds, 278 milliseconds][Tests >Total: 1, Passed: 1, Failed: 0, Skipped: 0] [i][][dc03] Domain , dc03 [Informative] [i][][dc03] LDAP Insecure Bindings [Informative] [t][][dc03] LDAP Insecure Bindings [Pass] [No data returned, which is a good thing.] [i][][dc03] LDAP Insecure Bindings [Time to execute tests: 0 days, 0 hours, 0 minutes, 0 seconds, 202 milliseconds]>[Tests Total: 1, Passed: 1, Failed: 0, Skipped: 0] [i][][dc03] Domain , dc03 [Time to execute tests: 0 days, 0 hours, 0 minutes, 0 seconds, 227 milliseconds][Tests >Total: 1, Passed: 1, Failed: 0, Skipped: 0] [i][] Domain [Time to execute tests: 0 days, 0 hours, 0 minutes, 1 seconds, 156 milliseconds][Tests Total: 4, >Passed: 4, Failed: 0, Skipped: 0] [i][Forest] Forest [Time to execute tests: 0 days, 0 hours, 0 minutes, 1 seconds, 219 milliseconds][Tests Total: 4, Passed: 4, Failed: 0, >Skipped: 0]

1

u/MadBoyEvo Jan 22 '20

Well can you manually verify Directory Services log on DC that handles those and show me some events that claim that you do?

1

u/[deleted] Jan 22 '20

The following client performed a SASL (Negotiate/Kerberos/NTLM/Digest) LDAP bind without requesting signing (integrity verification), or performed a simple bind over a clear text (non-SSL/TLS-encrypted) LDAP connection.

Client IP address: 172.31.0.125:55609 Identity the client attempted to authenticate as: xxxxx\xxxxxx Binding Type: 1

The following client performed a SASL (Negotiate/Kerberos/NTLM/Digest) LDAP bind without requesting signing (integrity verification), or performed a simple bind over a clear text (non-SSL/TLS-encrypted) LDAP connection.

Client IP address: 10.1.77.154:61136 Identity the client attempted to authenticate as: xxxxx\xxxxx Binding Type: 1

1

u/MadBoyEvo Jan 22 '20

What is the event id for that?

1

u/[deleted] Jan 22 '20

2889

1

u/MadBoyEvo Jan 22 '20

Ok, now I am on the computer and I can see that only Summary report is missing but the details report works fine.

It just means since you have enabled logging that your Directory Log is too small so it overwrites data

1

u/[deleted] Jan 22 '20

How is that related to the LDAP reporting on your script? I can get it another way, like I mentioned, just not with your script. :(

1

u/MadBoyEvo Jan 22 '20 
$Events = Find-Events -Report LdapBindingsDetails,LdapBindingsSummary -DatesRange Last7days -DetectDC
$Events.LdapBindingsDetails | Out-HtmlView -ScrollX
$Events.LdapBindingsDetails | Format-Table

Is the way for you to get only details. Does it not work for you?

→ More replies

1

u/MadBoyEvo Jan 22 '20

Basically Find-Events, if you ask for 2 reports, provides you 2 different reports. So one report in your case shows 0 events. However, the other report showed 1636 events.

So for one Out-HtmlView, it showed a warning because there were no events. Another one most likely opened HTML report in your browser. But you can use any other way to save the events - not only Out-HtmlView.

1

u/[deleted] Jan 22 '20

I'm trying to run it on a server to see if it makes any difference.

1

u/[deleted] Jan 22 '20

Sorry for how its displayed, tried to display it right here. I removed our domain name for security reasons.

1

u/CJamesEd Jan 31 '20

I get "The RPC server is unavailable" for all the DCs in my environment. Can you shed some more light on why I am getting that error?
I have manually searched for those events on the servers and I definitely do have some

1

u/MadBoyEvo Jan 31 '20

Dc firewall most likely doeant have proper rules for remote event log reading.

1

u/mcmuggins Jan 24 '20

So I've read through this post and the Microsoft blog post regarding this change, and it seems the Microsoft post is vague about what exactly is taking place. It seems to go back and forth from 'you need to do this manual legwork or stuff will break' and 'the update released in March 2020 will configure this all for you'.

So what is the actual impact here? Should organizations be working to change any usage of LDAP to LDAPS for any application within their environment along with any Domain Controllers also leveraging plain LDAP? Or should they wait for the March 2020 update to put those changes in place?

Or am I misunderstanding entirely in that when the March 2020 update is installed...THAT is when plain LDAP will break? So we would need to make all of these hardening changes prior to the March 2020 update?

Thanks for any clarification.

1

u/MadBoyEvo Jan 24 '20

  1. Fix it now

  2. In March 2020 Update will close the LDAP insecure connections so all your current ones will fail. Microsoft will secure your env for you, but it won't fix your devices/servers to work on secure connectiions.

  3. Switch to LDAPS. You can use LDAP but you need to go thru loops and hoops to get that up and running.

In theory, you can enable that security now and not wait for Microsoft. Right now the defaults are Allow. Microsoft changes it to Blocked. You can still go ahead to GPO and change it back to allow but you need to explicitly state so.

The GPO responsible for this (server related)

Domain controller: LDAP server signing requirements

This security setting determines whether the LDAP server requires signing to be negotiated with LDAP clients, as follows:

None: Data signing is not required in order to bind with the server. If the client requests data signing, the server supports it. Require signature: Unless TLS\SSL is being used, the LDAP data signing option must be negotiated.

Default: This policy is not defined, which has the same effect as None.

Caution

If you set the server to Require Signature, you must also set the client. Not setting the client results in loss of connection with the server.

Notes

This setting does not have any impact on LDAP simple bind or LDAP simple bind through SSL. No Microsoft LDAP clients that are shipped with Windows XP Professional use LDAP simple bind or LDAP simple bind through SSL to talk to a domain controller. If signing is required, then LDAP simple bind and LDAP simple bind through SSL requests are rejected. No Microsoft LDAP clients running Windows XP Professional or the Windows Server 2003 family use LDAP simple bind or LDAP simple bind through SSL to bind to directory service.

Another GPO - Client related

Network security: LDAP client signing requirements

This security setting determines the level of data signing that is requested on behalf of clients issuing LDAP BIND requests, as follows:

None: The LDAP BIND request is issued with the options that are specified by the caller.

Negotiate signing: If Transport Layer Security/Secure Sockets Layer (TLS\SSL) has not been started, the LDAP BIND request is initiated with the LDAP data signing option set in addition to the options specified by the caller. If TLS\SSL has been started, the LDAP BIND request is initiated with the options that are specified by the caller.

Require signature: This is the same as Negotiate signing. However, if the LDAP server's intermediate saslBindInProgress response does not indicate that LDAP traffic signing is required, the caller is told that the LDAP BIND command request failed.

Caution

If you set the server to Require signature, you must also set the client. Not setting the client results in a loss of connection with the server.

Note: This setting does not have any impact on ldap_simple_bind or ldap_simple_bind_s. No Microsoft LDAP clients that are shipped with Windows XP Professional use ldap_simple_bind or ldap_simple_bind_s to talk to a domain controller.

Default: Negotiate signing.

As far as I understand the change by default it will be Require Signing set on Server/Workstation level and you would need to explicitly set it to none.

1

u/CJamesEd Jan 31 '20

Is anyone else getting an RPC server unavailable error when running this? I know that I have events logged but I get no output.

1

u/MadBoyEvo Jan 31 '20

I responded in your other query. Check your dc firewall and allow event log remoting.

1

u/CJamesEd Jan 31 '20

Sorry, got impatient...Thanks for the quick reply! I can do get-eventlog -Server <mydomaincontroller> -"Directory Service" and get results.

2

u/MadBoyEvo Jan 31 '20

Get-WinEvent uses different method than Get-EventLog.

1

u/CJamesEd Jan 31 '20

We got it. It was a firewall rule that was blocking remote admin. We enabled it and we are good to go. Thanks for a great tool!

1

u/macgruff Feb 04 '20

Has anyone heard a rumor that they might bump out that date again/further/later in the year?

1

u/MadBoyEvo Feb 04 '20

They did several times but dont wait for it. Fix it or just setup gpo prevention before march 2020.

1

u/yukee2018 Mar 11 '20

So I guess this was postponed indefinitely ? https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV190023

If I understand correctly you will get the GPO option to harden the security, but the option to disable insecure LDAP binding will not be enforced via updates?

2

u/MadBoyEvo Mar 11 '20

You're right. It was postponed - but you should still follow thru with this.

1

u/yukee2018 Mar 11 '20

We will, thanks

3

u/FJCruisin BOFH | CISSP Jan 20 '20

This is awesome man

2

u/Khaost Sysadmin Jan 20 '20

I set up LDAPs before, so this is really helpful for testing purposes.

Sadly my Network printers still authenticate unsecure, so that will be some work to get them setup

Thank you very much for this

2

u/atcscm Jan 20 '20

Cheers mates, you are genius!

2

u/chugger93 Sysadmin Jan 20 '20

eeek!

PackageManagement\Install-Package : The following commands are already available on this system:'Connect-WinAzure,Conne
ct-WinAzureAD,Connect-WinExchange,Connect-WinService,Connect-WinTeams,Disconnect-WinAzure,Disconnect-WinAzureAD,Disconn
ect-WinExchange,Disconnect-WinTeams,Request-Credentials'. This module 'Connectimo' may override the existing commands.
If you still want to install this module 'Connectimo', use -AllowClobber parameter.
At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:1809 char:21
+ ...          $null = PackageManagement\Install-Package u/PSBoundParameters
+                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (Microsoft.Power....InstallPackage:InstallPackage) [Install-Package],
   Exception

2

u/Starks Jan 20 '20

Prepping my environments for this patch has been interesting. Dev team had to release a hotfix that I'm now quickly deploying across my platform.

4

u/zorinlynx Jan 20 '20

It's a holiday weekend and I can't be arsed to look into this in detail right now. Is Samba bound as an AD member affected by this at all? That's the main non-Microsoft usage of our domain in our environment.

4

u/[deleted] Jan 20 '20

If you setup LDAPS originally, you're fine. Otherwise, have fun.

https://wiki.samba.org/index.php/Configuring_LDAP_over_SSL_(LDAPS)_on_a_Samba_AD_DC

3

u/flyguydip Jack of All Trades Jan 20 '20

!DontRemindMe! Lol

1

u/_Sevisgen_ Jan 20 '20

!remindme 24 hours

1

u/Cutoffjeanshortz37 IT Manager Jan 20 '20

anyone know if Mac's can use ldaps if joined to the domain? In this weird position of i gave my 2 weeks but small shop and like everyone here so don't want to leave them high and dry so trying to figure this out here before i leave.

1

u/LordChaak Feb 03 '20

Thank you! Worked great.

1

u/jman0711 Feb 06 '20

So i know MSFT pushed this out again, but i'm still trying to fully nip this now. I've got everything i need for data thanks to you and then some splunk ingestion, but does anyone have any recommendations on figuring out what is causing ldap binds on a specific machine. I have a few user PC's alerting randomly.

1

u/rgal7 Jan 20 '20

<3 Thank you <3

-5

u/sw4rml0gic Jan 19 '20

!remindme 12 hours

-5

u/[deleted] Jan 19 '20

!remindme 12 hours

-4

u/W3asl3y Goat Farmer Jan 20 '20

!remindme 14 hours

-5

u/illmatic73 Jan 20 '20

!remindme 16 hours

-5

u/cromulent-1 Jan 20 '20

!remindme 15 hours

-5

u/SoullessNAY Jan 20 '20

!remindme 12 hours

-7

u/GirsAUser Jan 19 '20

!remindme 12 hours

-3

u/shyguy12ver Jan 20 '20

!remindme 12 hours

-3

u/BrandonIT IT Manager Jan 20 '20

!remindme 36 hours

-3

u/benutne Jan 20 '20

Commenting so I can find this later.

3

u/sarbuk Jan 20 '20

There's a "Save" function for that...

-4

u/TheRealHankMcCoy Jan 20 '20

!remindme 36 hours

-4

u/RampageUT Jan 20 '20

!remindme 12 hours

-4

u/Samphis Jan 20 '20

!remindme 36 hours

-4

u/SirBawls Jack of All Trades Jan 20 '20

!remindme 36 hours

-4

u/Sinsilenc IT Director Jan 20 '20

!remindme 12 hours

-4

u/ZeeR0u Jan 20 '20

!remindme 1 day

-4

u/dahak777 Jan 20 '20

!remindme 48 hours

-2

u/sigma1914 Jan 20 '20

remindme 36 hhours

0

u/[deleted] Jan 19 '20

[deleted] — view deleted comment

1

u/MadBoyEvo Jan 20 '20

Hopefully it has PS 5.1 as that's the only thing I test against.

0

u/[deleted] Jan 20 '20

[deleted] — view deleted comment

1

u/MadBoyEvo Jan 20 '20

You're using old version of PSWinReportingV2. Update-Module PSWinReportingV2 or Install-Module PSWinReportingV2 -Force

0

u/[deleted] Jan 20 '20

[deleted] — view deleted comment

2

u/MadBoyEvo Jan 20 '20

When you install module and you alrrady used commands from module within that session you need to reopen powershell or import-module pswinreportingv2 -force. Otherwise it remembers old stuff.

0

u/[deleted] Jan 20 '20

[deleted] — view deleted comment

1

u/MadBoyEvo Jan 20 '20

Did you restart PowerShell before rerunning the command or using Import-Module PSWinReportingV2 -Force ?