Skip to content

Commit 697b3c0

Browse files
Malcolm-StewartMalcolm-Stewart
committed
SQLCheck updates
Annotated TSL Cipher Suites. Fixed 32-bit SQL Aliases. Identify Java apps and Microsoft.Data.SqlClient.dll apps. Fixed default LanmanCompatibilityMode. Fixed null TLS Policy list. Remove space error in formatting suggested SPNs. Show ForceStrict setting.
1 parent 02a258e commit 697b3c0

File tree

6 files changed

+159
-22
lines changed

6 files changed

+159
-22
lines changed

‎SQLCheck/.vs/SQLCheck/v15/Server/sqlite3/storage.ide‎

0 Bytes
Binary file not shown.

‎SQLCheck/SQLCheck/Collectors.cs‎

Lines changed: 38 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -699,11 +699,18 @@ public static void CollectSecurity(DataSet ds)
699699
// Lanman compatibility Level - affects NTLM connections but not Kerberos connections
700700
//
701701

702-
string lanmanCompatibilityLevel = Utility.GetRegistryValueAsString(@"HKLM\SYSTEM\CurrentControlSet\Control\Lsa", "LMCompatibilityLevel", RegistryValueKind.DWord, 0);
703-
string lanmanDesc = Utility.LanmanNames(lanmanCompatibilityLevel);
704-
Security["LanmanCompatibilityLevel"] = lanmanDesc == "" ? lanmanCompatibilityLevel : $"{lanmanCompatibilityLevel} ({lanmanDesc})";
705-
Security.CheckRange("LanmanCompatibilityLevel", lanmanCompatibilityLevel, 0, 7);
706-
if (lanmanCompatibilityLevel.CompareTo("3") < 0) Security.LogWarning("LanmanCompatibilityLevel: The setting may be too low.");
702+
string lanmanCompatibilityLevel = Utility.GetRegistryValueAsString(@"HKLM\SYSTEM\CurrentControlSet\Control\Lsa", "LMCompatibilityLevel", RegistryValueKind.DWord, "");
703+
if (lanmanCompatibilityLevel == "")
704+
{
705+
Security["LanmanCompatibilityLevel"] = $"Not specified - default: 5 ({Utility.LanmanNames("5")})";
706+
}
707+
else
708+
{
709+
string lanmanDesc = Utility.LanmanNames(lanmanCompatibilityLevel);
710+
Security["LanmanCompatibilityLevel"] = lanmanDesc == "" ? lanmanCompatibilityLevel : $"{lanmanCompatibilityLevel} ({lanmanDesc})";
711+
Security.CheckRange("LanmanCompatibilityLevel", lanmanCompatibilityLevel, 0, 7);
712+
if (lanmanCompatibilityLevel.CompareTo("3") < 0) Security.LogWarning("LanmanCompatibilityLevel: The setting may be too low.");
713+
}
707714

708715

709716
//
@@ -926,13 +933,31 @@ public static void CollectProtocolOrder(DataSet ds)
926933
if (prot != null)
927934
{
928935
string[] po = (string[])prot;
936+
// RegStrings is before the annotation
929937
ProtocolOrder["RegistryList"] = string.Join(",", po);
930938
}
931939

932940
// From HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002 ! Functions REG_SZ, comma-delimited
933941

934-
ProtocolOrder["PolicyList"] = Registry.GetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002", "Functions", null);
942+
prot = Registry.GetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002", "Functions", null);
935943

944+
if (prot != null)
945+
{
946+
string[] po = (string[])prot;
947+
// RegStrings is before the annotation
948+
ProtocolOrder["PolicyList"] = string.Join(",", po);
949+
950+
// Warn if the Protocol List has entries that arent in the ReistryList
951+
if (po.Length > 0)
952+
{
953+
string[] RegStrings = ProtocolOrder.GetString("RegistryList").Trim().Split(',');
954+
string[] PolStrings = ProtocolOrder.GetString("PolicyList").Trim().Split(',');
955+
var comp = new StringIgnoreCaseComparer();
956+
var ExtraStrings = PolStrings.Except(RegStrings, comp);
957+
ExtraStrings.ToList().ForEach(s => ProtocolOrder.LogWarning($"Cipher Suite '{s}' appears in the Protocol List but not in the Registry List."));
958+
}
959+
}
960+
936961
// Warn if the Protocol List has entries that arent in the ReistryList
937962
if (ProtocolOrder.GetString("PolicyList").Trim().Length > 0)
938963
{
@@ -1750,7 +1775,8 @@ public static void CollectProcessDrivers(DataSet ds)
17501775
"msodbcsql11.dll", "msodbcsql13.dll", "msodbcsql17.dll", "msoledbsql.dll", "sqlnclirda11.dll",
17511776
// some non SQL driver DLLs
17521777
"aceodbc.dll", "aceoledb.dll", "msolap.dll", "activeds.dll", "odbcjt32.dll",
1753-
"msjetoledb40.dll", "ibmdadb2.dll", "ibmdadb264.dll", "system.data.entity.dll", "system.data.oracleclient.dll"
1778+
"msjetoledb40.dll", "ibmdadb2.dll", "ibmdadb264.dll", "system.data.entity.dll", "system.data.oracleclient.dll",
1779+
"microsoft.data.sqlclient.dll", "java.exe", "jvm.dll", "javaw.exe"
17541780
};
17551781

17561782
// get command results - output the data in CSV format, 3 columns; the last has sub-columns in it
@@ -1859,7 +1885,7 @@ public static void CollectSQLAlias(DataSet ds)
18591885
RegistryKey aliasKey = null;
18601886
string[] aliases = null, parts = null;
18611887
bool is64bit = Computer["CPU64Bit"].ToBoolean();
1862-
string[] regPath = new string[] { @"SOFTWARE\Microsoft\MSSQLServer\Client\ConnectTo", @"SOFTWARE\WOW6432Node\MSSQLServer\Client\ConnectTo" };
1888+
string[] regPath = new string[] { @"SOFTWARE\Microsoft\MSSQLServer\Client\ConnectTo", @"SOFTWARE\WOW6432Node\Microsoft\MSSQLServer\Client\ConnectTo" };
18631889
int loopCount = is64bit ? 2 : 1; // only look to Wow64 registry path if on a 64-bit system
18641890
string redirectsTo = "";
18651891

@@ -2271,7 +2297,7 @@ public static void CollectSPNAccount(DataSet ds)
22712297
int NOT_DELEGATED = 1048576; // 0x00100000
22722298
int USE_DES_KEY_ONLY = 2097152; // 0x00200000
22732299
int PASSWORD_EXPIRED = 8388608; // 0x00800000
2274-
int TRUSTED_TO_AUTH_FOR_DELEGATION = 16777216; // 0x01000000
2300+
int TRUSTED_TO_AUTH_FOR_DELEGATION = 16777216; // 0x01000000 allow protocol transition - we aren't distinguishing this right now
22752301

22762302
DataRow Computer = ds.Tables["Computer"].Rows[0];
22772303
DataRow SPNAccount = null;
@@ -2401,7 +2427,7 @@ public static void CollectSPNAccount(DataSet ds)
24012427
CollectSPN(ds, SPNAccount, entry.Path);
24022428

24032429
// Get constrained delegation SPNs for this account
2404-
bool constrained = entry.Properties["msDS-AllowedToDelegateTo"].Count > 0;
2430+
bool constrained = (entry.Properties["msDS-AllowedToDelegateTo"].Count > 0);
24052431
SPNAccount["ConstrainedDelegationEnabled"] = constrained;
24062432
if (constrained) // get SPNs for constrained delegation
24072433
{
@@ -3191,14 +3217,14 @@ public static void ProcessSQLPathAndSPNs(DataSet ds, DataRow SQLInstance, DataRo
31913217
SuggestedSPN = dtSuggestedSPN.NewRow();
31923218
dtSuggestedSPN.Rows.Add(SuggestedSPN);
31933219
SuggestedSPN["ParentID"] = SQLServer["ID"];
3194-
suggestedSPN = $@"{spnPrefixF}:{portNumber}"; // FQDN
3220+
suggestedSPN = $@"{spnPrefixF}:{portNumber.Trim()}"; // FQDN
31953221
SuggestedSPN["SPNNAme"] = suggestedSPN;
31963222
CheckSPN(ds, SQLServer, SuggestedSPN, suggestedSPN, SPNServiceAccount);
31973223

31983224
SuggestedSPN = dtSuggestedSPN.NewRow();
31993225
dtSuggestedSPN.Rows.Add(SuggestedSPN);
32003226
SuggestedSPN["ParentID"] = SQLServer["ID"];
3201-
suggestedSPN = $@"{spnPrefixN}:{portNumber}"; // NETBIOS name
3227+
suggestedSPN = $@"{spnPrefixN}:{portNumber}.Trim()"; // NETBIOS name
32023228
SuggestedSPN["SPNNAme"] = suggestedSPN;
32033229
CheckSPN(ds, SQLServer, SuggestedSPN, suggestedSPN, SPNServiceAccount);
32043230
}

‎SQLCheck/SQLCheck/Properties/AssemblyInfo.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,5 +32,5 @@
3232
// You can specify all the values or you can default the Build and Revision Numbers
3333
// by using the '*' as shown below:
3434
// [assembly: AssemblyVersion("1.0.*")]
35-
[assembly: AssemblyVersion("1.0.1286.0")]
36-
[assembly: AssemblyFileVersion("1.0.1286.0")]
35+
[assembly: AssemblyVersion("1.0.1305.0")]
36+
[assembly: AssemblyFileVersion("1.0.1305.0")]

‎SQLCheck/SQLCheck/TLSInfo.cs‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,10 @@ public static TLSInfo GetTLSInfo(DataRow Computer)
4343
//
4444
// https://docs.microsoft.com/en-us/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp-
4545
//
46+
// Confirmed with the SCHANNEL team that TLS 1.3 is not supported by any version of Windows 10 or 2019.
47+
// Some TLS 1.3 cipher suites may appear in the list on Windows 10 and 2019, but that was for TLS 1.3 proofing before releasing Windows 11 and 2022.
48+
// There is no actual support for TLS 1.3 before Windows 11 or 2022.
49+
//
4650
// Windows Version Version # Build # SSL 2 Client SSL 2 Server SSL3 TLS 1.0 TLS 1.1 TLS 1.2 TLS 1.3
4751
// ---------------------------------------------- ---------- ------- ------------ ------------ ---------- ---------- ---------- ---------- ----------
4852
// Windows Vista / Windows Server 2008 NT 6.0 older Disabled Enabled Enabled Enabled Not Supp Not Supp Not SUpp
@@ -57,10 +61,10 @@ public static TLSInfo GetTLSInfo(DataRow Computer)
5761
//
5862
// Windows 10, version 1607 / Windows Server 2016 10.0 14393 Not Supp Not Supp Disabled Enabled Enabled Enabled Not Supp Change
5963
// Windows 10, version 1809 / Windows Server 2019 10.0 17763 Not Supp Not Supp Disabled Enabled Enabled Enabled Not Supp
60-
// Windows 10, version 20H2 / Windows Server 2019 10.0 19042 Not Supp Not Supp Disabled Enabled Enabled Enabled Enabled Change
61-
// Windows 10, version 21H1 / Windows Server 2019 10.0 19043 Not Supp Not Supp Disabled Enabled Enabled Enabled Enabled
64+
// Windows 10, version 20H2 / Windows Server 2019 10.0 19042 Not Supp Not Supp Disabled Enabled Enabled Enabled Not Supp
65+
// Windows 10, version 21H1 / Windows Server 2019 10.0 19043 Not Supp Not Supp Disabled Enabled Enabled Enabled Not Supp
6266
//
63-
// Windows 11, version 21H2 10.0 22000 Not Supp Not Supp Disabled Enabled Enabled Enabled Enabled
67+
// Windows 11, version 21H2 10.0 22000 Not Supp Not Supp Disabled Enabled Enabled Enabled Enabled Change
6468
// Windows Server 2022, wersion 21H2 10.0 20348 Not Supp Not Supp Disabled Enabled Enabled Enabled Enabled
6569

6670

@@ -69,12 +73,12 @@ public static TLSInfo GetTLSInfo(DataRow Computer)
6973
string WindowsBuild = Computer.GetString("WindowsBuild");
7074
string WindowsName = Computer.GetString("WindowsName");
7175

72-
// Windows 11, Windows 2022, Windows 10 versions 19042 and greater - Windows 2019 is in there somewhere, as well
73-
if (Utility.CompareVersion(WindowsVersion, "10.0.19041") == ">") // Windows 11, Windows 2022, Windows 10/2019 versions 19042 and greater
76+
// Windows 11, Windows 2022 and above
77+
if (Utility.CompareVersion(WindowsVersion, "10.0.20000") == ">") // Windows 11, Windows 2022, Windows 10/2019 versions 19042 and greater
7478
{
7579
return new TLSInfo("Not Supported", "Not Supported", "Disabled", "Enabled", "Enabled", "Enabled", "Enabled");
7680
}
77-
// Windows 2016 / Windows 10 Build 1607
81+
// Windows 2016, 2019 / Windows 10 Build 1607 and above
7882
else if (Utility.CompareVersion(WindowsVersion, "10.0.14392") == ">") // starts with 10.0.14393
7983
{
8084
return new TLSInfo("Not Supported", "Not Supported", "Disabled", "Enabled", "Enabled", "Enabled", "Not Supported");

‎SQLCheck/SQLCheck/TextReport.cs‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -508,10 +508,11 @@ static void ReportSecurity(DataSet ds, TextWriter s) // outputs computer and do
508508
}
509509
rf = new ReportFormatter();
510510
rf.SetColumnNames("Registry List:L", "Policy List:L");
511+
511512
for (int i = 0; i < Math.Max(registryList.Length, policyList.Length); i++) // loop for the longest array
512513
{
513-
rf.SetcolumnData(i < registryList.Length ? registryList[i] : "",
514-
i < policyList.Length ? policyList[i] : "");
514+
rf.SetcolumnData(i < registryList.Length ? Utility.AnnotateCipherSuite(registryList[i]) : "",
515+
i < policyList.Length ? Utility.AnnotateCipherSuite(policyList[i]) : "");
515516
}
516517
s.WriteLine(rf.GetHeaderText());
517518
s.WriteLine(rf.GetSeparatorText());

0 commit comments

Comments
 (0)