Тёмный

Disable Weak Ciphers (RC4 & TripleDES) Windows Server 2012 

Phr33fall
Подписаться 405
Просмотров 57 тыс.
50% 1

This video is following on from the previous one (Disabling SSLv3 and TLS v1.0), which can be found here - • Disable SSLv3 & TLS1.0...
The video covers removing support for RC4 and TripleDES ciphers, as well as removing support for the weaker exchange algorithm 'Diffie-Hellman'.

Опубликовано:

 

11 мар 2018

Поделиться:

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист
Посмотреть позже
Комментарии : 33   
@Jason_P
@Jason_P Год назад
Excellent content, thank you! This works for Server 2019 as well.
@jganer
@jganer 5 лет назад
Thank you! I need to figure out how to do this a work and your videos have been very helpful!
@phr33fall83
@phr33fall83 5 лет назад
Awesome! Glad it helped :)
@alfredoramos1450
@alfredoramos1450 Год назад
Thank you sir, your solutions works! I tried it on Windows server 2012R2
@phillip5838
@phillip5838 Год назад
Happy to help!
@jashimuddinbhuiyan7555
@jashimuddinbhuiyan7555 2 года назад
how this will be disable "AECDH-AES128-SHA" 128 and 256 . please specify
@ninoteves8573
@ninoteves8573 Год назад
How did you know that that's the right key is there a list? Or name or something?
@AnkitGupta-ew4bk
@AnkitGupta-ew4bk 3 года назад
Thank you really helpful.
@phr33fall83
@phr33fall83 2 года назад
Glad it was helpful!
@daftrok
@daftrok 5 лет назад
Is there a reason why you still keep TLS 1.1 enabled with the worry of POODLE and BEAST vulnerabilities? Is this more for compatibility reasons or can we now safely assume that anything that can support 1.1 will support 1.2 and we can disable 1.1 as well?
@phr33fall83
@phr33fall83 5 лет назад
No reason. You can apply the same principles to disable TLS 1.1 if you wish.
@seanyang1209
@seanyang1209 2 года назад
Thank you very much!
@phr33fall83
@phr33fall83 2 года назад
You're welcome!
@luweybeatz
@luweybeatz 2 года назад
Hello, is there a command that I can run on the box itself, or remotely (without Kali) that can tell me what ciphers are enabled? Thank you
@notta3d
@notta3d 2 года назад
I would love to hear this as well.
@sangovan7975
@sangovan7975 Год назад
How can i rollback?
@OshiOnYT
@OshiOnYT 3 года назад
Thank you so much
@phr33fall83
@phr33fall83 2 года назад
You're most welcome
@kerryhannah1264
@kerryhannah1264 5 лет назад
Thanks for the video, very informative. I am still getting this error when trying to connect to TLS1.2: Failed to connect with TLS1.2 : Error during handshake: the client and server cannot communicate, because they do not possess a common algorithm. (0x80090331) Any thoughts would be appreciated. Thanks!
@phr33fall83
@phr33fall83 5 лет назад
Hi Kerry. It could be that the client you are trying to connect does not support TLS v1.1 or TLSv1.2 and needs updating. It would be worth checking with the vendor.
@kerryhannah1264
@kerryhannah1264 5 лет назад
@@phr33fall83 thanks for your response sir!
@joeyofblades
@joeyofblades 3 года назад
What's that "sslscan" script? Looks useful.
@phr33fall83
@phr33fall83 2 года назад
Hi Joey. It comes default on Kali, or you can download it from GitHub - github.com/rbsec/sslscan
@diegoalvarez9918
@diegoalvarez9918 4 года назад
Awesome video. Is there an easier way to do this ? What I mean is, a command script to disable Triple DES instead of manually creating the key and then creating a dword value (enable=0)
@MegaWhiteBeaner
@MegaWhiteBeaner 4 года назад
You can create and set the dwords with a script and pass that through to a csv with all the computer names or prompt the user for a computer name. This is pretty basic stuff.
@phr33fall83
@phr33fall83 2 года назад
There is software called IISCrypto that will take a lot of the manual work out. www.nartac.com/Products/IISCrypto
@Ian_Butterworth
@Ian_Butterworth 3 года назад
Rather than disable Diffie-Hellman, wouldn't it be better to set it to use 2048bit instead?
@phr33fall83
@phr33fall83 2 года назад
Hey Ian. Yeah absolutely. The video was made over 3 years ago specifically for those ciphers :)
@sheeshee5083
@sheeshee5083 Год назад
How do u do that?
@Ian_Butterworth
@Ian_Butterworth Год назад
@@sheeshee5083 I believe if you made a .reg file with the following contents it will force 2048 bit DH. Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman] "ServerMinKeyBitLength"=dword:00000800
@sheeshee5083
@sheeshee5083 Год назад
@@Ian_Butterworth whoaa thank you!!!
@sheeshee5083
@sheeshee5083 Год назад
I believe we can also do it by setting jdk.tls.ephemeralDHKeySize to 2048. I'm new to these things, I could be wrong.
Далее
Disable SSLv3 & TLS1.0 Windows Server 2012 R2
4:40
Просмотров 71 тыс.
What is a TLS Cipher Suite?
20:47
Просмотров 114 тыс.
شربت كل الماء؟ 🤣
00:31
Просмотров 14 млн
Копия iPhone с WildBerries
01:00
Просмотров 486 тыс.
D3 BMW XM LABEL Король.
31:52
Просмотров 587 тыс.
Windows Server 2012 UI Evolution!
4:25
Просмотров 47 тыс.
Strong vs. Weak TLS Ciphers
12:24
Просмотров 21 тыс.
Linux vs Windows: Malware
6:57
Просмотров 161 тыс.
Disable Weak Algorithms in OpenSSH (Alma Redhat Rocky)
23:04
شربت كل الماء؟ 🤣
00:31
Просмотров 14 млн