Skip to content

Commit c78d7a9

Browse files
ykuijsykuijs
authored
Merge pull request #6 from ykuijs/master
SChannelSettings: Added possibility to configure Kerberos Encryption Types
2 parents 0e10d45 + 7d7759a commit c78d7a9

14 files changed

Lines changed: 518 additions & 88 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
### Added
99

10-
- None
10+
- SChannelSettings
11+
- Added the possiblity to configure the Kerberos Encryption Types
1112

1213
### Changed
1314

14-
- None
15+
- SChannelDsc
16+
- Implemented the new DSC Community CD/CI system
1517

1618
### Deprecated
1719

‎source/DSCResources/MSFT_Cipher/readme.md‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,3 @@
11
# Description
22

33
This resource is responsible for enabling or disabling ciphers.
4-
5-
The default value for the Ensure parameter is Present. When not specifying this
6-
parameter, the cipher is enabled.

‎source/DSCResources/MSFT_CipherSuites/readme.md‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,3 @@
11
# Description
22

33
This resource is responsible for enabling or disabling cipher suites.
4-
5-
The default value for the Ensure parameter is Present. When not specifying this
6-
parameter, the cipher is enabled.

‎source/DSCResources/MSFT_Hash/readme.md‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,3 @@
11
# Description
22

33
This resource is responsible for enabling or disabling hashes.
4-
5-
The default value for the Ensure parameter is Present. When not specifying this
6-
parameter, the cipher is enabled.

‎source/DSCResources/MSFT_KeyExchangeAlgorithm/readme.md‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,3 @@
11
# Description
22

33
This resource is responsible for enabling or disabling key exchange algorithms.
4-
5-
The default value for the Ensure parameter is Present. When not specifying this
6-
parameter, the cipher is enabled.

‎source/DSCResources/MSFT_Protocol/readme.md‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,3 @@
11
# Description
22

33
This resource is responsible for enabling or disabling protocols.
4-
5-
The default value for the Ensure parameter is Present. When not specifying this
6-
parameter, the cipher is enabled.

‎source/DSCResources/MSFT_SChannelSettings/MSFT_SChannelSettings.psm1‎

Lines changed: 133 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,11 @@ function Get-TargetResource
3131
[System.UInt32]
3232
$DiffieHellmanMinServerKeySize,
3333

34+
[Parameter()]
35+
[ValidateSet('DES-CBC-CRC', 'DES-CBC-MD5', 'RC4-HMAC-MD5', 'AES128-HMAC-SHA1', 'AES256-HMAC-SHA1')]
36+
[System.String[]]
37+
$KerberosSupportedEncryptionType,
38+
3439
[Parameter()]
3540
[System.Boolean]
3641
$EnableFIPSAlgorithmPolicy
@@ -159,6 +164,47 @@ function Get-TargetResource
159164
$dhMinServerKeySizeValue = Get-SChannelRegKeyValue -Key $dhMinKeySizeKey `
160165
-Name 'ServerMinKeyBitLength'
161166

167+
# Kerberos Supported Encryption Type
168+
Write-Verbose -Message ($script:localizedData.GetKerbEncrTypes)
169+
170+
$kerberosEncrTypesKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters'
171+
$kerberosEncrTypesValue = Get-SChannelRegKeyValue -Key $kerberosEncrTypesKey `
172+
-Name 'SupportedEncryptionTypes'
173+
174+
$kerberosEncrTypes = @()
175+
if ($null -ne $kerberosEncrTypesValue)
176+
{
177+
## Check DES-CBC-CRC
178+
if (($kerberosEncrTypesValue -band 1) -eq 1)
179+
{
180+
$kerberosEncrTypes += "DES-CBC-CRC"
181+
}
182+
183+
## Check DES-CBC-MD5
184+
if (($kerberosEncrTypesValue -band 2) -eq 2)
185+
{
186+
$kerberosEncrTypes += "DES-CBC-MD5"
187+
}
188+
189+
## Check RC4-HMAC
190+
if (($kerberosEncrTypesValue -band 4) -eq 4)
191+
{
192+
$kerberosEncrTypes += "RC4-HMAC-MD5"
193+
}
194+
195+
## Check AES128-CTS-HMAC-SHA1-96
196+
if (($kerberosEncrTypesValue -band 8) -eq 8)
197+
{
198+
$kerberosEncrTypes += "AES128-HMAC-SHA1"
199+
}
200+
201+
## Check AES256-CTS-HMAC-SHA1-96
202+
if (($kerberosEncrTypesValue -band 16) -eq 16)
203+
{
204+
$kerberosEncrTypes += "AES256-HMAC-SHA1"
205+
}
206+
}
207+
162208
# FIPS Algorithm Policy
163209
Write-Verbose -Message ($script:localizedData.GetFIPS)
164210

@@ -186,11 +232,12 @@ function Get-TargetResource
186232
}
187233

188234
$returnValue = @{
189-
IsSingleInstance = 'Yes'
190-
TLS12State = $currentTls12State
191-
DiffieHellmanMinClientKeySize = $dhMinClientKeySizeValue
192-
DiffieHellmanMinServerKeySize = $dhMinServerKeySizeValue
193-
EnableFIPSAlgorithmPolicy = $fipsValue
235+
IsSingleInstance = 'Yes'
236+
TLS12State = $currentTls12State
237+
DiffieHellmanMinClientKeySize = $dhMinClientKeySizeValue
238+
DiffieHellmanMinServerKeySize = $dhMinServerKeySizeValue
239+
KerberosSupportedEncryptionType = $kerberosEncrTypes
240+
EnableFIPSAlgorithmPolicy = $fipsValue
194241
}
195242

196243
return $returnValue
@@ -221,6 +268,11 @@ function Set-TargetResource
221268
[System.UInt32]
222269
$DiffieHellmanMinServerKeySize,
223270

271+
[Parameter()]
272+
[ValidateSet('DES-CBC-CRC', 'DES-CBC-MD5', 'RC4-HMAC-MD5', 'AES128-HMAC-SHA1', 'AES256-HMAC-SHA1')]
273+
[System.String[]]
274+
$KerberosSupportedEncryptionType,
275+
224276
[Parameter()]
225277
[System.Boolean]
226278
$EnableFIPSAlgorithmPolicy
@@ -355,6 +407,7 @@ function Set-TargetResource
355407
Write-Verbose -Message ($script:localizedData.NetFramework46Detected)
356408
}
357409

410+
# Diffie Hellman Minimum Key Size
358411
$keaKey = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms'
359412
if ($DiffieHellmanMinClientKeySize -ne 0 -and
360413
$DiffieHellmanMinClientKeySize -ne $CurrentValues.DiffieHellmanMinClientKeySize)
@@ -376,10 +429,75 @@ function Set-TargetResource
376429
-Value $DiffieHellmanMinServerKeySize
377430
}
378431

432+
# Kerberos Supported Encyption Types
433+
if ($PSBoundParameters.ContainsKey('KerberosSupportedEncryptionType'))
434+
{
435+
$kerberosEncrTypesKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos'
436+
437+
if ($KerberosSupportedEncryptionType.Count -ne 0)
438+
{
439+
$ketValue = 0
440+
if ('DES-CBC-CRC' -in $KerberosSupportedEncryptionType)
441+
{
442+
$ketValue += 1
443+
}
444+
445+
if ('DES-CBC-MD5' -in $KerberosSupportedEncryptionType)
446+
{
447+
$ketValue += 2
448+
}
449+
450+
if ('RC4-HMAC-MD5' -in $KerberosSupportedEncryptionType)
451+
{
452+
$ketValue += 4
453+
}
454+
455+
if ('AES128-HMAC-SHA1' -in $KerberosSupportedEncryptionType)
456+
{
457+
$ketValue += 8
458+
}
459+
460+
if ('AES256-HMAC-SHA1' -in $KerberosSupportedEncryptionType)
461+
{
462+
$ketValue += 16
463+
}
464+
465+
$kerberosEncrTypesValue = Get-SChannelRegKeyValue -Key "$kerberosEncrTypesKey\Parameters" `
466+
-Name 'SupportedEncryptionTypes'
467+
468+
if ($null -eq $kerberosEncrTypesValue -or ($kerberosEncrTypesValue -band $ketValue) -ne $ketValue)
469+
{
470+
Write-Verbose -Message ($script:localizedData.ConfigureKerbEncrTypes -f ($KerberosSupportedEncryptionType -join ", "))
471+
if ($null -eq $kerberosEncrTypesValue)
472+
{
473+
$newValue = $ketValue
474+
}
475+
else
476+
{
477+
$newValue = $kerberosEncrTypesValue -bor $ketValue
478+
}
479+
Set-SChannelRegKeyValue -Key $kerberosEncrTypesKey `
480+
-SubKey 'Parameters' `
481+
-Name 'SupportedEncryptionTypes' `
482+
-Value $newValue
483+
}
484+
}
485+
else
486+
{
487+
if ($CurrentValues.KerberosSupportedEncryptionType.Count -ne 0)
488+
{
489+
Write-Verbose -Message ($script:localizedData.RemoveKerbEncrTypes)
490+
Remove-ItemProperty -Path "$kerberosEncrTypesKey\Parameters" `
491+
-Name 'SupportedEncryptionTypes'
492+
}
493+
}
494+
}
495+
496+
# FIPS Algorithm Policy
379497
if ($null -ne $EnableFIPSAlgorithmPolicy -and
380498
$EnableFIPSAlgorithmPolicy -ne $CurrentValues.EnableFIPSAlgorithmPolicy)
381499
{
382-
Write-Verbose -Message ($script:localizedData.ConfigureFIPS)
500+
Write-Verbose -Message ($script:localizedData.ConfigureFIPS -f $EnableFIPSAlgorithmPolicy)
383501
$lsaKey = 'HKLM:SYSTEM\CurrentControlSet\Control\LSA'
384502
if ($EnableFIPSAlgorithmPolicy)
385503
{
@@ -424,6 +542,11 @@ function Test-TargetResource
424542
[System.UInt32]
425543
$DiffieHellmanMinServerKeySize,
426544

545+
[Parameter()]
546+
[ValidateSet('DES-CBC-CRC', 'DES-CBC-MD5', 'RC4-HMAC-MD5', 'AES128-HMAC-SHA1', 'AES256-HMAC-SHA1')]
547+
[System.String[]]
548+
$KerberosSupportedEncryptionType,
549+
427550
[Parameter()]
428551
[System.Boolean]
429552
$EnableFIPSAlgorithmPolicy
@@ -451,15 +574,17 @@ function Test-TargetResource
451574
-ValuesToCheck @('DiffieHellmanMinClientKeySize', `
452575
'DiffieHellmanMinServerKeySize', `
453576
'EnableFIPSAlgorithmPolicy', `
454-
"TLS12State")
577+
'TLS12State',
578+
'KerberosSupportedEncryptionType')
455579
}
456580
else
457581
{
458582
$compliant = Test-SCDscParameterState -CurrentValues $CurrentValues `
459583
-DesiredValues $PSBoundParameters `
460584
-ValuesToCheck @('DiffieHellmanMinClientKeySize', `
461585
'DiffieHellmanMinServerKeySize', `
462-
'EnableFIPSAlgorithmPolicy')
586+
'EnableFIPSAlgorithmPolicy',
587+
'KerberosSupportedEncryptionType')
463588
}
464589

465590
if ($compliant -eq $true)

‎source/DSCResources/MSFT_SChannelSettings/MSFT_SChannelSettings.schema.mof‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ class MSFT_SChannelSettings : OMI_BaseResource
66
[Write, Description("Specifies the state of TLS 1.2 for the .Net Framework 3.5 and 4.0 (not required for v4.6 and above)"), ValueMap{"Enabled","Disabled","Default"}, Values{"Enabled","Disabled","Default"}] String TLS12State;
77
[Write, Description("Minimum client key size for the Diffie-Hellman key exchange algorithm"), ValueMap{"1024","2048","3072","4096"}, Values{"1024","2048","3072","4096"}] Uint32 DiffieHellmanMinClientKeySize;
88
[Write, Description("Minimum server key size for the Diffie-Hellman key exchange algorithm"), ValueMap{"1024","2048","3072","4096"}, Values{"1024","2048","3072","4096"}] Uint32 DiffieHellmanMinServerKeySize;
9+
[Write, Description("Supported Kerberos Encryption Types"), ValueMap{"DES-CBC-CRC","DES-CBC-MD5","RC4-HMAC-MD5","AES128-HMAC-SHA1","AES256-HMAC-SHA1"}, Values{"DES-CBC-CRC","DES-CBC-MD5","RC4-HMAC-MD5","AES128-HMAC-SHA1","AES256-HMAC-SHA1"}] String KerberosSupportedEncryptionType[];
910
[Write, Description("Specifies if the FIPS Algorithm Policy is enabled")] Boolean EnableFIPSAlgorithmPolicy;
10-
1111
};
12-

‎source/DSCResources/MSFT_SChannelSettings/en-US/MSFT_SChannelSettings.strings.psd1‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,14 @@ ConvertFrom-StringData @'
22
NetFramework45Detected = Used .Net Framework 4.5 or lower
33
GetTLS12 = Getting TLS v1.2 state
44
GetDGKeySize = Getting Diffie Hellman Key Size
5+
GetKerbEncrTypes = Getting Kerberos Supported Encryption Types
56
GetFIPS = Getting FIPS Algorithm Policy
67
ConfigureTLS12State = Configuring TLS v1.2 state
78
NetFramework46Detected = .NET Framework 4.6 or higher detected. Configuration of TLS v1.2 not necessary
8-
ConfigureFIPS = Configuring FIPS Algorithm Policy
9+
ConfigureFIPS = Configuring FIPS Algorithm Policy to {0}
910
ConfigureDHMinKeySize = Configuring Diffie Hellman Min {0} Key Size
11+
ConfigureKerbEncrTypes = Configuring Kerberos Supported Encryption Types: {0}
12+
RemoveKerbEncrTypes = Removing Kerberos Supported Encryption Types
1013
ItemNotCompliant = {0} not compliant.
1114
ItemCompliant = {0} compliant.
1215
'@

‎source/DSCResources/MSFT_SChannelSettings/readme.md‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,3 @@
11
# Description
22

3-
This resource is responsible for enabling or disabling ciphers.
4-
5-
The default value for the Ensure parameter is Present. When not specifying this
6-
parameter, the cipher is enabled.
3+
This resource is responsible for configuring various Secure Channel settings.

0 commit comments

Comments
 (0)