Establish Secure Client-Server Channel for Remote Scripting

[Jerry G. Young II]

All,

I apologize if this is an extremely easy question but I was wondering what
people do to secure communications between a client and a server for remote
scripting when security is a concern.

By default (based on sniffing packets), it appears that account names are
passed in clear text while passwords are passed using NTLM. This is against
Windows 2000 and Windows 2003 servers from 2000/XP clients.

These results were gathered while using command line-based utilities only.
In particular, since the servers I need to run command line-based utilities
against are not part of any domain, I have to use the 'runas' command with
the '/netonly' switch to pass remote server credentials to the utility I
wish to use against the remote server. In my particular tests, I was using
the 'uptime' utility from the Windows 2000 Resource Kit.

Now, I know that servers can be set up to restrict communication to secure
channels. This isn't what I want to do because I'd have to visit thousands
of servers to make these changes. My understanding, though, is that Windows
2000 and Windows 2003 will default to the first requested form of
communication from a client. In this case, apparently NTLM. My question
is, is it possible to force the client (through a one-off command at the
command line or other script) to request a more secure channel with a remote
server?

For example, with WMI scripts, by setting the SWbemSecurity object to use an
authentication level of WbemAuthenticationLevelPktPrivacy, you're supposed
to be able to athenticate all previous impersonation levels and encrypt the
argument value of each remote procedure call. I'd like to do essentially
the same from the command line since the username and password should be an
argument value for the RPC made by the utility used.

If someone could help me out here, I'd greatly appreciate it.

Cordially yours,
Jerry G. Young II

 

[Steven L Umbach]

I don't know of anything that you can do at the command line. You might try setting
the lan manager authentication level of the computer you use to "send ntlmv2
responses" only as described in the article below. This can be done in the Local
Security Policy under security settings/local policies/security options. I believe
the user name will still be sent in clear text [not 100% sure, you could test] , but
a much stronger password hash will be used and the only way to prevent seeing the
user name would be to use ipsec ESP encryption which can easily be done in a forest
via Group Policy but would require a preshared key or certificate for machine
authentication in a non forest setting and the other machines would have to have at
least the client/respond policy enabled locally. Secure channels are used primarily
between domain controllers and domain members. --- Steve

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/gp/576.asp
http://www.microsoft.com/technet/Security/prodtech/win2000/win2khg/05sconfg.mspx --- description
of W2K security options and recommendations.