mirror of
https://github.com/apache/cloudstack.git
synced 2025-10-26 01:32:18 +02:00
139 lines
6.2 KiB
Batchfile
Executable File
139 lines
6.2 KiB
Batchfile
Executable File
rem Licensed to the Apache Software Foundation (ASF) under one
|
|
rem or more contributor license agreements. See the NOTICE file
|
|
rem distributed with this work for additional information
|
|
rem regarding copyright ownership. The ASF licenses this file
|
|
rem to you under the Apache License, Version 2.0 (the
|
|
rem "License"); you may not use this file except in compliance
|
|
rem with the License. You may obtain a copy of the License at
|
|
rem
|
|
rem http://www.apache.org/licenses/LICENSE-2.0
|
|
rem
|
|
rem Unless required by applicable law or agreed to in writing,
|
|
rem software distributed under the License is distributed on an
|
|
rem "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
rem KIND, either express or implied. See the License for the
|
|
rem specific language governing permissions and limitations
|
|
rem under the License.
|
|
|
|
rem
|
|
rem Configure and start RDP service.
|
|
rem Configure RPD service to use custom key instead of autogenerated for Wireshark and Network Monitor Decrypt Expert.
|
|
rem rdp.pfx is necessary because it fingerprints are hardcoded in this script.
|
|
rem
|
|
|
|
rem Turn off firewall
|
|
|
|
netsh advfirewall firewall set rule group="Remote Desktop" new enable=yes
|
|
|
|
rem Enable TS connections
|
|
rem
|
|
rem Windows Registry Editor Version 5.00
|
|
rem
|
|
rem [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server]
|
|
rem "AllowTSConnections"=dword:00000001
|
|
rem "fDenyTSConnections"=dword:00000000
|
|
|
|
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0 /f
|
|
|
|
rem Disable RDP NLA
|
|
|
|
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
|
|
|
|
rem Enable TS service
|
|
|
|
sc config TermService start=auto
|
|
|
|
rem Certificate Generation
|
|
|
|
rem Make self-signed certificate
|
|
|
|
rem makecert -r -pe -n "CN=%COMPUTERNAME%" -eku 1.3.6.1.5.5.7.3.1 -ss my -sr LocalMachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12
|
|
|
|
rem Import certificate
|
|
|
|
certutil -p test -importPFX "Remote Desktop" rdp.pfx
|
|
|
|
rem Configure RDP server to use certificate:
|
|
|
|
rem Windows Registry Editor Version 5.00
|
|
rem
|
|
rem [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp]
|
|
rem "SSLCertificateSHA1Hash"=hex:c1,70,84,70,bc,56,42,0a,bb,f4,35,35,ba,a6,09,b0,4e,98,4a,47
|
|
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "SSLCertificateSHA1Hash" /t REG_HEX /d "" /f
|
|
|
|
rem Grant permissions on certificate for everyone
|
|
|
|
rem certutil -repairstore My "bcb40fb84ac891bd41068fe686864559" D:PAI(A;;GA;;;BA)(A;;GA;;;SY)(A;;GR;;;NS)
|
|
certutil -repairstore "Remote Desktop" "bcb40fb84ac891bd41068fe686864559" D:PAI(A;;GA;;;BA)(A;;GA;;;SY)(A;;GR;;;NS)
|
|
|
|
rem confirm with
|
|
|
|
rem certutil -store -v My
|
|
certutil -store -v "Remote Desktop"
|
|
|
|
rem Disable TLS 1.1 (for Network Monitor Decrypt Expert)
|
|
rem
|
|
rem Windows Registry Editor Version 5.00
|
|
rem
|
|
rem [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client]
|
|
rem "Enabled"=dword:00000000
|
|
rem "DisabledByDefault"=dword:00000001
|
|
rem
|
|
rem [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server]
|
|
rem "Enabled"=dword:00000000
|
|
rem "DisabledByDefault"=dword:00000001
|
|
|
|
reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v "Enabled" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client" /v "DisabledByDefault" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v "Enabled" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v "DisabledByDefault" /t REG_DWORD /d 1 /f
|
|
|
|
|
|
rem Disable TLS 1.2 (for Network Monitor Decrypt Expert)
|
|
rem
|
|
rem Windows Registry Editor Version 5.00
|
|
rem
|
|
rem [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]
|
|
rem "Enabled"=dword:00000000
|
|
rem "DisabledByDefault"=dword:00000001
|
|
rem
|
|
rem [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]
|
|
rem "Enabled"=dword:00000000
|
|
rem "DisabledByDefault"=dword:00000001
|
|
|
|
reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v "Enabled" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v "DisabledByDefault" /t REG_DWORD /d 1 /f
|
|
reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v "Enabled" /t REG_DWORD /d 0 /f
|
|
reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" /v "DisabledByDefault" /t REG_DWORD /d 1 /f
|
|
|
|
rem Start TS service
|
|
|
|
net start Termservice
|
|
|
|
rem Enable logs
|
|
|
|
wevtutil sl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin /enabled:true /quiet:true
|
|
wevtutil sl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic /enabled:true /quiet:true
|
|
wevtutil sl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug /enabled:true /quiet:true
|
|
wevtutil sl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational /enabled:true /quiet:true
|
|
wevtutil sl Microsoft-Windows-TerminalServices-SessionBroker-Client/Admin /enabled:true /quiet:true
|
|
wevtutil sl Microsoft-Windows-TerminalServices-SessionBroker-Client/Analytic /enabled:true /quiet:true
|
|
wevtutil sl Microsoft-Windows-TerminalServices-SessionBroker-Client/Debug /enabled:true /quiet:true
|
|
wevtutil sl Microsoft-Windows-TerminalServices-SessionBroker-Client/Operational /enabled:true /quiet:true
|
|
wevtutil sl Microsoft-Windows-NTLM/Operational /enabled:true /quiet:true
|
|
|
|
|
|
|
|
rem For Network Monitor Decrypt Expert.
|
|
|
|
rem Install .Net 3.5
|
|
|
|
rem dism /online /enable-feature /featurename:NetFx3ServerFeatures
|
|
rem dism /online /enable-feature /featurename:NetFx3
|
|
|
|
rem PS.
|
|
rem Don't forget to set Windows profile as active in Network Monitor, so SSL traffic branch will appear under
|
|
rem svnchost.exe, so you will be able to decrypt it (don't forget to save and reopen captured traffic to file first).
|
|
rem
|