Server Hardening - Revision history

Agrace at 18:01, 3 May 2022

2022-05-03T18:01:29Z

← Older revision		Revision as of 18:01, 3 May 2022
Line 1:		Line 1:
			[[Category:Cyber Security]]
	==Overview==		==Overview==
	Server Hardening is the process of preemptively patching any security vulnerabilities that may arise. This is done by a multiplicity of policy adjustments either manually or run through a script. Scripts act as a blanket when it comes to changing policy, its great for changing lots of different areas on different devices quickly. On the other hand, manual server hardening can be tedious, but gives you the scalpel to change device specific policies that you may want to be enacted. Server Hardening itself is a broad category itself as well, ranging from password policy to remote connection policy, to firewall policy. There isn't any "one size fits all" solutions either, you will have to make some changes depending on the current 24pin policy.		Server Hardening is the process of preemptively patching any security vulnerabilities that may arise. This is done by a multiplicity of policy adjustments either manually or run through a script. Scripts act as a blanket when it comes to changing policy, its great for changing lots of different areas on different devices quickly. On the other hand, manual server hardening can be tedious, but gives you the scalpel to change device specific policies that you may want to be enacted. Server Hardening itself is a broad category itself as well, ranging from password policy to remote connection policy, to firewall policy. There isn't any "one size fits all" solutions either, you will have to make some changes depending on the current 24pin policy.

AOwen at 01:17, 21 May 2021

2021-05-21T01:17:32Z

← Older revision		Revision as of 01:17, 21 May 2021
Line 43:		Line 43:

	==Linux==		==Linux==
	It'~~s linked somewhere else on the wiki, I'm asking where Deegan put it~~.		Hasn't been publicly documented due to security concerns.

	==References==		==References==

AOwen at 20:03, 20 May 2021

2021-05-20T20:03:21Z

← Older revision		Revision as of 20:03, 20 May 2021
Line 37:		Line 37:
	##<code>install-module ComputerManagementDsc</code>		##<code>install-module ComputerManagementDsc</code>
	##<code>install-module SecurityPolicyDsc</code>		##<code>install-module SecurityPolicyDsc</code>
	###If unable to install required modules, use the [Net.ServicePointManager] ~~command listed above~~.		###If unable to install required modules, use the command: <code>[Net.ServicePointManager]::Security Protocol = [Net.SecurityProtocolType]::Tls12</code>
	#Copy and Paste the script into the Elevated PowerShell instance and press enter, after a brief delay, you should see the path that the .MOF was saved to.		#Copy and Paste the script into the Elevated PowerShell instance and press enter, after a brief delay, you should see the path that the .MOF was saved to.
	#Use the command <code>Start-DscConfiguration -Path C:\Windows\system32\CIS_WindowsServer2019_v110 -Force -Wait -Verbose</code> and use the path that was given to you in place of the path used in the example, and press enter.		#Use the command <code>Start-DscConfiguration -Path C:\Windows\system32\CIS_WindowsServer2019_v110 -Force -Wait -Verbose</code> and use the path that was given to you in place of the path used in the example, and press enter.

AOwen at 19:58, 20 May 2021

2021-05-20T19:58:30Z

← Older revision		Revision as of 19:58, 20 May 2021
Line 23:		Line 23:
	Now with that all out of the way, you should have just created a .MOF file, now this MOF file isn't the endpoint. What we just did was compress that whole block of text into something readable by Windows PowerShell, why couldn't we just do it from the.txt file? I don't know ,but this way works so we're rolling with it. Next step will be to run that .MOF file that was just created.		Now with that all out of the way, you should have just created a .MOF file, now this MOF file isn't the endpoint. What we just did was compress that whole block of text into something readable by Windows PowerShell, why couldn't we just do it from the.txt file? I don't know ,but this way works so we're rolling with it. Next step will be to run that .MOF file that was just created.

	*<code>Start-DscConfiguration -Path .\~~Name of MOF~~ -Force -Wait -Verbose</code>		*<code>Start-DscConfiguration -Path C:\Windows\system32\CIS_WindowsServer2019_v110 -Force -Wait -Verbose</code>

	[[File:Script Running.png\|thumb\|429x429px\|An Image of what everything should look like if you've ran the script correctly]]		[[File:Script Running.png\|thumb\|429x429px\|An Image of what everything should look like if you've ran the script correctly]]
Line 33:		Line 33:

	#Open an Elevated PowerShell instance.		#Open an Elevated PowerShell instance.
	#~~Install required modules using~~ the ~~three~~ commands ~~above. (If already installed before, skip this step)~~		#If this is a first time instillation, use the following commands to install vital modules
	##If unable to install required modules, use the [Net.ServicePointManager] command listed above.		##<code>install-module AuditPolicyDSC</code>
	#Copy and Paste script into PowerShell ~~to create~~ a .MOF.		##<code>install-module ComputerManagementDsc</code>
	#~~Run the .MOF file using~~ the Start-DscConfiguration ~~command listed above using~~ the path to the ~~.MOF that~~ the ~~previous command specified~~.		##<code>install-module SecurityPolicyDsc</code>
	#~~Wait~~ for the ~~.MOF~~ to ~~run~~, and ~~you're done~~.		###If unable to install required modules, use the [Net.ServicePointManager] command listed above.
			#Copy and Paste the script into the Elevated PowerShell instance and press enter, after a brief delay, you should see the path that the .MOF was saved to.
			#Use the command <code>Start-DscConfiguration -Path C:\Windows\system32\CIS_WindowsServer2019_v110 -Force -Wait -Verbose</code> and use the path that was given to you in place of the path used in the example, and press enter.
			#The .MOF should now be running, wait for the timer to finish, and it should be opperational.

	==Linux==		==Linux==

AOwen at 19:30, 20 May 2021

2021-05-20T19:30:26Z

← Older revision		Revision as of 19:30, 20 May 2021
Line 30:		Line 30:
	Now you should see all this mishmash of words coming at you, don't worry this is the script doing its job. They aren't warnings or failures, this is what <code>-Verbose</code> does. Otherwise just let it do its thing, the flashing timer at the top should tell you when its approximately going to be done. After that the script is all done and ran, feel free to close PowerShell. Just make sure to double check local and group policy to make sure that the script is in fact functional. Once you've doublechecked, you're all done, just repeat these steps if you're looking to run this script on more machines.		Now you should see all this mishmash of words coming at you, don't worry this is the script doing its job. They aren't warnings or failures, this is what <code>-Verbose</code> does. Otherwise just let it do its thing, the flashing timer at the top should tell you when its approximately going to be done. After that the script is all done and ran, feel free to close PowerShell. Just make sure to double check local and group policy to make sure that the script is in fact functional. Once you've doublechecked, you're all done, just repeat these steps if you're looking to run this script on more machines.

	==== Step-by-Step Scripted Server Hardening ====		====Step-by-Step Scripted Server Hardening====

	# Open an Elevated PowerShell instance.		#Open an Elevated PowerShell instance.
	# Install required modules using the three commands above. (If already installed before, skip this step)		#Install required modules using the three commands above. (If already installed before, skip this step)
	## If unable to install required modules, use the [Net.ServicePointManager] command.		##If unable to install required modules, use the [Net.ServicePointManager] command listed above.
	# Copy and Paste script into PowerShell to create .MOF.		#Copy and Paste script into PowerShell to create a .MOF.
	# Run the .MOF file using the Start-DscConfiguration command.		#Run the .MOF file using the Start-DscConfiguration command listed above using the path to the .MOF that the previous command specified.
	# Wait for the .MOF to run, and you're done.		#Wait for the .MOF to run, and you're done.

	==Linux==		==Linux==

AOwen: Changed script reference & added step by step.

2021-05-20T19:19:45Z

Changed script reference & added step by step.

← Older revision		Revision as of 19:19, 20 May 2021
Line 11:		Line 11:

	===Scripted Server Hardening===		===Scripted Server Hardening===
	Scripts can be ran from an elevated PowerShell instance directly, or can be used to create an .MOF file. Ours can be copied and ~~pased~~ into PowerShell and it will create an .MOF.<sup>[1]</sup> It may claim that you don't have the required PowerShell module, in that case it should give you the command to install it. If not the required commands are		Scripts can be ran from an elevated PowerShell instance directly, or can be used to create an .MOF file. Ours can be copied and pasted into PowerShell and it will create an .MOF.<sup>[1]</sup> It may claim that you don't have the required PowerShell module, in that case it should give you the command to install it. If not the required commands are

	*<code>install-module AuditPolicyDSC</code>		*<code>install-module AuditPolicyDSC</code>
Line 30:		Line 30:
	Now you should see all this mishmash of words coming at you, don't worry this is the script doing its job. They aren't warnings or failures, this is what <code>-Verbose</code> does. Otherwise just let it do its thing, the flashing timer at the top should tell you when its approximately going to be done. After that the script is all done and ran, feel free to close PowerShell. Just make sure to double check local and group policy to make sure that the script is in fact functional. Once you've doublechecked, you're all done, just repeat these steps if you're looking to run this script on more machines.		Now you should see all this mishmash of words coming at you, don't worry this is the script doing its job. They aren't warnings or failures, this is what <code>-Verbose</code> does. Otherwise just let it do its thing, the flashing timer at the top should tell you when its approximately going to be done. After that the script is all done and ran, feel free to close PowerShell. Just make sure to double check local and group policy to make sure that the script is in fact functional. Once you've doublechecked, you're all done, just repeat these steps if you're looking to run this script on more machines.

	== Linux ==		==== Step-by-Step Scripted Server Hardening ====
	~~Workin~~' on it
			# Open an Elevated PowerShell instance.
			# Install required modules using the three commands above. (If already installed before, skip this step)
			## If unable to install required modules, use the [Net.ServicePointManager] command.
			# Copy and Paste script into PowerShell to create .MOF.
			# Run the .MOF file using the Start-DscConfiguration command.
			# Wait for the .MOF to run, and you're done.

			==Linux==
			It's linked somewhere else on the wiki, I'm asking where Deegan put it.

	==References==		==References==
	Our Modified Windows script for Windows Server 2019[https://~~www~~.~~dropbox~~.com/s/~~eoc3f6vpupvhe6c~~/~~Windows%20Hardening%20Script.txt~~?dl=0]		Our Modified Windows script for Windows Server 2019[https://docs.google.com/document/d/1GyCaeNv9F3taE8jpmVNqJ8JlcXy79q_S8GATVvzKFUE/edit?usp=sharing <nowiki>[1]</nowiki>]

	Original Script & Scripts for Server 2016[https://github.com/NVISOsecurity/posh-dsc-windows-hardening <nowiki>[2]</nowiki>]		Original Script & Scripts for Server 2016[https://github.com/NVISOsecurity/posh-dsc-windows-hardening <nowiki>[2]</nowiki>]

AOwen: Windows is now fully finished, waiting to document the Lemp stack.

2021-04-16T19:24:46Z

Windows is now fully finished, waiting to document the Lemp stack.

← Older revision		Revision as of 19:24, 16 April 2021
Line 1:		Line 1:
	~~(Page WIP)~~

	==Overview==		==Overview==
Line 27:		Line 26:

	[[File:Script Running.png\|thumb\|429x429px\|An Image of what everything should look like if you've ran the script correctly]]		[[File:Script Running.png\|thumb\|429x429px\|An Image of what everything should look like if you've ran the script correctly]]
	DscConfiguration will read the script and configure the policy listed in the .MOF file, <code>-path</code> will allow you to put in the path to the MOF, when the MOF is done compiling it should give you the path so make sure to write that down or remember it good. <code>-Force</code> will, well, force its way over any running commands. <code>-Wait</code> will wait for <code>-Force</code> to stop the running command before running the <code>DscConfiguration</code> command, and lastly <code>-Verbose</code> will generate a more detailed output.		DscConfiguration will read the script and configure the policy listed in the .MOF file, <code>-path</code> will allow you to put in the path to the MOF, when the MOF is done compiling it should give you the path so make sure to write that down or remember it good. <code>-Force</code> will, well, force its way over any running commands. <code>-Wait</code> will wait for <code>-Force</code> to stop the running command before running the <code>DscConfiguration</code> command, and lastly <code>-Verbose</code> will generate a more detailed output.

			Now you should see all this mishmash of words coming at you, don't worry this is the script doing its job. They aren't warnings or failures, this is what <code>-Verbose</code> does. Otherwise just let it do its thing, the flashing timer at the top should tell you when its approximately going to be done. After that the script is all done and ran, feel free to close PowerShell. Just make sure to double check local and group policy to make sure that the script is in fact functional. Once you've doublechecked, you're all done, just repeat these steps if you're looking to run this script on more machines.

			== Linux ==
			Workin' on it

	==References==		==References==
	Our Modified Windows script for Server 2019[https://www.dropbox.com/s/eoc3f6vpupvhe6c/Windows%20Hardening%20Script.txt?dl=0]		Our Modified Windows script for Windows Server 2019[https://www.dropbox.com/s/eoc3f6vpupvhe6c/Windows%20Hardening%20Script.txt?dl=0]

	Original Script & Scripts for Server 2016[https://github.com/NVISOsecurity/posh-dsc-windows-hardening <nowiki>[2]</nowiki>]		Original Script & Scripts for Server 2016[https://github.com/NVISOsecurity/posh-dsc-windows-hardening <nowiki>[2]</nowiki>]

AOwen at 18:40, 16 April 2021

2021-04-16T18:40:50Z

← Older revision		Revision as of 18:40, 16 April 2021
Line 30:		Line 30:

	==References==		==References==
	Our Modified Windows script for Server 2019[https://www.dropbox.com/s/~~5ys8zsz07js5huc~~/Windows%20Hardening%20Script.txt?dl=0]		Our Modified Windows script for Server 2019[https://www.dropbox.com/s/eoc3f6vpupvhe6c/Windows%20Hardening%20Script.txt?dl=0]

	Original Script & Scripts for Server 2016[https://github.com/NVISOsecurity/posh-dsc-windows-hardening <nowiki>[2]</nowiki>]		Original Script & Scripts for Server 2016[https://github.com/NVISOsecurity/posh-dsc-windows-hardening <nowiki>[2]</nowiki>]

AOwen at 18:37, 16 April 2021

2021-04-16T18:37:27Z

← Older revision		Revision as of 18:37, 16 April 2021
Line 26:		Line 26:
	*<code>Start-DscConfiguration -Path .\Name of MOF -Force -Wait -Verbose</code>		*<code>Start-DscConfiguration -Path .\Name of MOF -Force -Wait -Verbose</code>

	DscConfiguration will read the script and configure the policy listed in the .MOF file, <code>-path</code> will allow you to put in the path to the MOF, when the MOF is done compiling it should give you the path so make sure to write that down or remember it good. <code>-Force</code> will, well, force its way over any running commands. <code>-Wait</code> will wait for <code>-Force</code> to stop the running command before running the <code>DscConfiguration</code> command, and lastly <code>-Verbose</code> will generate a more detailed output.		[[File:Script Running.png\|thumb\|429x429px\|An Image of what everything should look like if you've ran the script correctly]]
			DscConfiguration will read the script and configure the policy listed in the .MOF file, <code>-path</code> will allow you to put in the path to the MOF, when the MOF is done compiling it should give you the path so make sure to write that down or remember it good. <code>-Force</code> will, well, force its way over any running commands. <code>-Wait</code> will wait for <code>-Force</code> to stop the running command before running the <code>DscConfiguration</code> command, and lastly <code>-Verbose</code> will generate a more detailed output.

	==References==		==References==

AOwen at 19:15, 14 April 2021

2021-04-14T19:15:52Z

← Older revision		Revision as of 19:15, 14 April 2021
Line 29:		Line 29:

	==References==		==References==
	Our Windows script for Server 2019[https://www.dropbox.com/s/5ys8zsz07js5huc/Windows%20Hardening%20Script.txt?dl=0]		Our Modified Windows script for Server 2019[https://www.dropbox.com/s/5ys8zsz07js5huc/Windows%20Hardening%20Script.txt?dl=0]

	Original Script & Scripts for Server 2016[https://github.com/NVISOsecurity/posh-dsc-windows-hardening <nowiki>[2]</nowiki>]		Original Script & Scripts for Server 2016[https://github.com/NVISOsecurity/posh-dsc-windows-hardening <nowiki>[2]</nowiki>]