Unsolved
This post is more than 5 years old
60 Posts
0
5289
February 10th, 2016 13:00
SHA256 and Isilon connection issues
Has anyone experienced any connection issues with their Isilon (using SMB protocol) after upgrading to SHA256 on their DC's? We experienced some hosts not being able to connect.
Just wondering anyone else had any issues with SHA256.
0 events found
No Events found!
9ema
5 Posts
0
April 17th, 2023 06:00
Hi everyone,
This post is the only resource I have found that has shed some light on the problem affecting my company and for that I am truly grateful. However, my OneFS Version is 8.1.2.0 and after trying the klist check (which only shows AES encryption) and changing the attribute in AD there has been to change to the system logs indicating "the netlogon service created a secure channel with a client with rc4". has anyone encountered my situation and were you able to resolve it? Thanks in advance for any feedback...
DELL-Josh Cr
Moderator
•
9.6K Posts
•
116 Points
0
April 17th, 2023 06:00
Hi,
Thanks for your question. Have you restarted the lsass service after enabling AES? https://dell.to/3mI6hF6
Let us know if you have any additional questions.
DELL-Josh Cr
Moderator
•
9.6K Posts
•
116 Points
0
April 20th, 2023 07:00
This is what is in the article
The Microsoft Security Vulnerability announcement for CVE-2022-38023 (Netlogon RPC Elevation of Privilege Vulnerability) available here:
https://dell.to/43PAjXX
Describes the security vulnerability as "An authenticated attacker could leverage cryptographic protocol vulnerabilities in the Windows Netlogon protocol when RPC Signing is used instead of RPC Sealing. Where RPC Signing is used instead of RPC Sealing the attacker could gain control of the service and then might be able to modify Netlogon protocol traffic to elevate their privileges."
Microsoft KBA 5021130 available here:
https://dell.to/43S2qGf
Details how Microsoft will be addressing this security vulnerability in Microsoft Windows Server products.
Windows updates released on November 8, 2022 introduced the following system registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RequireSeal
That has 3 values:
0 – Disabled
1 – Compatibility mode. Windows domain controllers will require that Netlogon clients use RPC Seal if they are running Windows, or if they are acting as either domain controllers or Trust accounts.
2 - Enforcement mode. All clients are required to use RPC Seal, unless they are added to the "Domain Controller: Allow vulnerable Netlogon secure channel connections” group policy object (GPO).
This value will initially be set to Compatibility mode (1) by default. Starting with the April 11, 2023 or later updates, this value will be changed to Enforcement mode (2) by default.
Windows updates released on November 8, 2022 also introduced the following Windows event:
Event Log: System
Event Type: Warning
Event Source: NETLOGON
Event ID: 5840
Event Text: The Netlogon service created a secure channel with a client with RC4
Cause
How could an attacker exploit this vulnerability?
An authenticated attacker could leverage cryptographic protocol vulnerabilities in the Windows Netlogon protocol when RPC Signing is used instead of RPC Sealing. Where RPC Signing is used instead of RPC Sealing the attacker could gain control of the service and then might be able to modify Netlogon protocol traffic to elevate their privileges.
Resolution
These updates to Windows by Microsoft to address CVE-2022-38023 will have NO functional impact to PowerScale clients running any current release of OneFS as RPC Sign and Seal has been supported since OneFS 7.x.
New Event ID 5840 WILL be created with PowerScale clients running OneFS releaess 9.4.x and earlier which use RC4 by default for NTLM/Netlogon Secure Channel.
New Event ID 5840 WILL NOT be created with PowerScale clients running OneFS releases 9.5.0 and later as AES cryptography will be supported and preferred for NTLM/Netlogon Secure Channel.
A pre-existing system registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Netlogon\Parameters\RejectMd5Clients
Is disabled by default. If set to TRUE (1), this WILL result in NTLM/Netlogon Secure Channel auth failures with PowerScale clients running OneFS releases 9.4.x and earlier.
To take advantage of AES cryptography for NTLM/Netlogon Secure Channel in OneFS, upgrade to release 9.5.0 or higher.
The support of AES cryptography for NTLM/Netlogon Secure Channel will NOT be backported to OneFS releases 9.4.x and earlier.
9ema
5 Posts
0
April 20th, 2023 07:00
Hi Josh,
Thanks a lot for your prompt response however, the article is permission based and therefore, unable to view it. Does it outline the steps to restart lsass? Is another article available?
9ema
5 Posts
0
April 20th, 2023 07:00
Thanks Josh, I will look into upgrading to 9.5.0 or higher.
anonymous_stranger
7 Posts
0
April 25th, 2023 12:00
nm
9ema
5 Posts
0
May 3rd, 2023 11:00
Hi Dell,
Thanks again for the recommendation, however I have one more question. Does it make a difference if my Isilon OneFS v8.1.2.0 is a virtual appliance?
DELL-Josh Cr
Moderator
•
9.6K Posts
•
116 Points
0
May 3rd, 2023 12:00
The latest version of the simulator looks like it is 9.1 https://dell.to/44umEWW
Phil.Lam
4 Apprentice
•
637 Posts
0
May 23rd, 2023 16:00
@9ema , OneFS 9.4 simulator here:
https://dl.dell.com/downloads/V7H1C_PowerScale-OneFS-9.4.0.0-Simulator.zip