Quick Assist: CredSSP encryption oracle remediation Error

In the past 12 hours I’ve seen the first mentions of people no longer being able to connect over RDP via a RD Gateway to their clients or servers. I also got a call to ask for help with such an issue. The moment I saw the error message it rang home that this was a known and documented issue with CredSSP encryption oracle remediation, which is both preventable and fixable.

The person trying to connect over RD Gateway get the following message:
[Window Title]
Remote Desktop Connection
[Content]
An authentication error has occurred.
The function requested is not supported
Remote computer: target.domain.com
This could be due to CredSSP encryption oracle remediation.
For more information, see
https://go.microsoft.com/fwlink/?linkid=866660
[OK]

image

Follow that link and it will tell you all you need to know to fix it and how to avoid it.
A remote code execution vulnerability (CVE-2018-0886) exists in unpatched versions of CredSSP. This issue was addressed by correcting how CredSSP validates requests during the authentication process.

The initial March 13, 2018, release updates the CredSSP authentication protocol and the Remote Desktop clients for all affected platforms.
Mitigation consists of installing the update on all eligible client and server operating systems and then using included Group Policy settings or registry-based equivalents to manage the setting options on the client and server computers. We recommend that administrators apply the policy and set it to  “Force updated clients” or “Mitigated” on client and server computers as soon as possible.  These changes will require a reboot of the affected systems. Pay close attention to Group Policy or registry settings pairs that result in “Blocked” interactions between clients and servers in the compatibility table later in this article.

April 17, 2018:
The Remote Desktop Client (RDP) update update in KB 4093120 will enhance the error message that is presented when an updated client fails to connect to a server that has not been updated.

May 8, 2018:
An update to change the default setting from Vulnerable to Mitigated (KB4103723 for W2K16 servers) and KB4103727 for Windows 10 clients. Don’t forget the vulnerability also exists for W2K12(R2) and lower as well as equivalent clients.

The key here is that with the May updates change the default for the new policy setting changes the default setting from to mitigated.

Microsoft is releasing new Windows security updates to address this CVE on May 8, 2018. The updates released in March did not enforce the new version of the Credential Security Support Provider protocol. These security updates do make the new version mandatory. For more information see “CredSSP updates for CVE-2018-0886” located at https://support.microsoft.com/en-us/help/4093492.

This can result in mismatches between systems at different patch levels. Which is why it’s now more of a wide spread issue. Looking at the table in the article and the documented errors it’s clear enough there was a mismatch. It was also clear how to fix it. Patch all systems and make sure the settings are consistent. Use GPO or edit the registry settings to do so. Automation is key here. Uninstalling the patch works but is not a good idea. This vulnerability is serious.

image

Now Microsoft did warn about this change. You can even read about it on the PFE blog https://blogs.technet.microsoft.com/askpfeplat/tag/encryption-oracle-remediation/. Nevertheless, many people seem to have been bitten by this one. I know it’s hard to keep up with everything that is moving at the speed of light in IT but this is one I was on top of. This is due to the fact that the fix is for a remote vulnerability in RDS. That’s a big deal and not one I was willing let slide. You need to roll out the updates and you need to configure your policy and make sure you’re secured. The alternative (rolling back the updates, allowing vulnerable connections) is not acceptable, be vulnerable to a known and fixable exploit. TAKE YOUR MEDICIN!  Read the links above for detailed guidance on how to do this. Set your policy on both sides to mitigated. You don’t need to force updated clients to fix the issue this way and you can patch your servers 1st followed by your clients. Do note the tips given on doing this in the PFE blog:

Note: Ensure that you update the Group Policy Central Store (Or if not using a Central Store, use a device with the patch applied when editing Group Policy) with the latest CredSSP.admx and CredSSP.adml. These files will contain the latest copy of the edit configuration settings for these settings, as seen below.

Registry
Path: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters
Value: AllowEncryptionOracle
Date type: DWORD
Reboot required: Yes

Here’s are the registry settings you need to make sure connectivity is restored

Everything patched: 0 => when all is patched including 3rd party CredSSP clients you can use “Force updated clients”
server patched but not all clients: 1 =>use “mitigated”, you’ll be as secure as possible without blocking people. Alternatively you can use 2 (“vulnerable”) but avoid that if possible  as it is more risky, so I would avoid that.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters]
“AllowEncryptionOracle”=dword:00000001

So, check your clients and servers, both on-premises and in the cloud to make sure you’re protected and have as little RDS connectivity issues as possible. Don’t forget about 3rd party clients that need updates to if you have those! Don’t panic and carry on.

Azure Virtual Datacenter

Image

Azure Virtual Datacenter

Sometimes Microsoft times a blog post exactly right. For a while now working on bridging worlds (on-premises / cloud) in a responsible and realistic manner. Making sure the transition is smooth and avoids pitfalls. You use what you need where you need it, when you need it and in a way that fits your needs, right? Anyway, in real life that means that I’m working on a Azure Virtual Datacenter deployment (brainstorming/architecture/design phase).

Last week during white boarding twitter notified me of the release of a new portal for the Azure Virtual Datacenter. That’s great timing! And no, there’s no need for thin foil head paranoia here. We MVP are not linked directly into the mother ship.

Azure Virtual Datacenter

MSFT previously delivered an Azure Virtual Datacenter eBook with the concepts and the Lift and Shift Guide. But right now we are mainly looking at workload migrations and not lift and shift. You evaluate and make the best decision within the context at hand.

Help with project communications

The nice thing is they also published a slide deck about the Azure Virtual Datacenter concept. This helps me build presentations on this subject. Well, after removing the marketing slides and adding some extra content. Both technical content and information specific to the environments I’m working in.

Azure Virtual Datacenter

Right now I’m working on the network part (VNETs, subnets, peering, BGP), but I need to pause now and go take care of some Dell PowerEdge R740 and maybe R940 server configurations to order together with some RDMA NICs. Yeah, my existing skills are still in high demand and I know how to bridge worlds pragmatically, efficiently and effectively. There is server- less in our future as well as hardware, at least for now. Now I need to get some IoT in this mix, that’s the fun full stack game right now.

Cosmetic Issue on DELL PowerEdge servers with iDRAC firmware 2.52.52.52

Just a head up to people who might notice the following on their DELL PowerEdge servers after updating to iDRAC firmware 2.52.52.52. I have seen it on DELL generation 12 and 13 servers (R720/730) myself.  I noticed 4 Mas Storage Function devices under “Other devices” after the installation. Before a reboot there are 4.

image

While not needed for the iDRAC firmware upgrade I did try a reboot. It is still there after a reboot, but we’re down to 2 now.

image

The device instant path and other properties show for both of these

USB \ VID_0624 & PID_0251 \ 20120731-1
USB \ VID_0624 & PID_0252 \ 20120731-2

and the USB and ID points to iDRAC remote virtual devices. Dell support confirmed this is a benign cosmetic bug with not performance or stability issues. It should be resolved in the next firm ware upgrade for the iDRAC.

Altaro Webinar with Ben Armstrong: Ask me anything on containers

Altaro is organizing a “Ask me Anything” webinar with Ben Armstrong. Our fellow MVP and always in learning mode  Andy Syrewicze @asyrewicze) from Altaro is our host

So if you’d like or need to find out what containers are al about and if they are something for you or not you’ll want to attend this webinar.

Ben Armstrong (@vBenArmstrong) has been the driving force behind Hyper-V, a great hypervisor, that also happens to power Azure and yes containers (nested virtualization anyone?). Andy Syrewicze from Altaro will be moderating this Ask Me Anything (AMA) webinar with Ben to answer all your burning questions about containers in the Microsoft ecosystem.

Topics that will be addressed are:

  • Industry adoption of containers
  • Container and micro-services examples
  • Best practices for deployment
  • The future of containers

image

Talking to Ben,listening to Ben is always an educational process. He makes you think about the subject and the ecosystem it exists in. So do yourself a favor. Grab a slot this webinar. If you have any question you can send them via the hastag #AskBenArmstrong on any social media platform and get it answered.

Register for the webinar via this link Ben Armstrong – AMA on Containers