Tag: Windows Server | Page 3

How to Setup HTTP Strict Transport Security (HSTS) on IIS

HTTP Strict-Transport-Security (HSTS) response header is used to tell browsers that the particular website should only be accessed solely over HTTPS. This is a powerful feature that is easy to implement to mitigate the risks for the communication to be intercepted by hackers and keep your website visitors safe.

Enabling HTTP Strict Transport Security on IIS

See the steps below to enable HSTS on IIS:

Launch IIS Manager.
On the left pane of the window, click on the website you want to add the HTTP header and double-click on HTTP Response Headers.
In HTTP Response Headers window, click on Add… on the right pane and type in Strict-Transport-Security for Name and max-age=63072000; includeSubDomains; preload for Value and click OK.The max-age value 63072000 is the number of seconds for the duration of two years. You need to enter a value of at least one year.

Now you can verify if the header is delivered correctly by running a curl command.

curl -I https://www.itnota.com

You should see that very header listed among other entries:

Strict-Transport-Security: max-age=63072000; includeSubdomains; preload

That’s all there is to utilize HSTS on IIS.

Buy me a coffee?

If you find this post helpful and would like to buy me a coffee to support the work here, you’ll have our big thanks!
Support IT Nota: Buy me a Coffee

How to Enable TLS 1.2 as the Default Security Protocol on Windows Servers

Transport Layer Security (TLS) are cryptographic protocols designed to provide communications security over a computer network, typically between a website and a browser.

TLS 1.0 and its deprecated predecessor, SSL are vulnerable to some well-known security issues such as POODLE and BEAST attacks. According to NIST, these vulnerabilities cannot be fixed or patched, therefore all companies, especially banks and other financial institutions who are notoriously slow in upgrading theirs systems, need to upgrade to a secure alternative as soon as possible, and disable any fallback to both SSL and the older TLS 1.0.

As of 30 June 2018, SSL and TLS 1.0 should be disabled and more secure encryption protocol such as TLS 1.2 (or at the minimum TLS 1.1) is required to meet the PCI Data Security Standard (PCI DSS) for safeguarding payment data.

The next question then how on do we enable TLS 1.2 on Windows Servers? Especially on older servers such as Windows Server 2008 as many companies are not on the latest and greatest operating systems?

This post will address what to look for and how to enable TLS 1.2 as the default protocol for Windows Server 2012 R2 or older.

IMPORTANT: As always and it’s worth repeating, you need to backup your current registry settings before attempting any of these changes on your servers.

Enable TLS 1.2 on Windows Servers 2008 SP2 or later

The blanket statement to enable your TLS 1.2 on your server from Windows Server 2008 SP2 or later. Microsoft provided an update to add support for TLS 1.1 and TLS 1.2 for Windows Server 2008, but it requires Windows Server 2008 SP2 installed.

So just to state the obvious, TLS 1.1 and TLS 1.2 are not supported for 32-bit Windows Server 2008 SP1.

Launch regedit.exe.

In registry, go to:

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

Create a new DWORD entry with a name TLS 1.2 and create another subkey Client and Server.
Under the subkey Server, create another DWORD Enabled with a value of 1.
Still under the subkey Server, create a DWORD DisabledByDefault with a value of 0.
You must create a subkey DisabledByDefault entry in the appropriate subkey (Client, Server) and set the DWORD value to 0 since this entry is set to 1 by default.
Reboot the server and test.

Enable TLS 1.2 on .NET Framework 3.5 (including 2.0)

.NET Framework 3.5 or earlier did not originally provide support of applications to use TLS System Default Versions as a cryptographic protocol. However, for Windows Server 2012 R2, check if KB3154520 is installed (or KB3154519 for Windows Server 2012; KB3154518 for Windows Server 2008 R2; KB3154517 for Windows Server 2008 SP2).

How to check the KB updates

Right-click on the Windows button and select Programs and Features.
On Programs and Features window, click onthe View installed updates on the left pane.
You will see a list of the updates that you can narrow down or do a very specific search by using the Search Installed Updates box. You can type in the KB number (i.e., “KB3154520”).
If the corresponding KB is already installed, we just need to enable it via registry change. Otherwise, you need to install the patch from either of the links for Windows Server 2012 R2 (or use the same corresponding links above for earlier versions of Windows Server).

Registry Change

Launch regedit.exe.

Go to:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727

Create a new entry SystemDefaultTlsVersions with a DWORD value set to 1.
Create a new entry SchUseStrongCrypto with a DWORD value set to 1.

Go to:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319

Create a new entry SystemDefaultTlsVersions with a DWORD value set to 1.
Create a new entry SchUseStrongCrypto with a DWORD value set to 1.

For 64-bit OS, the same changes also needed for the following locations:

  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727

Create a new entry SystemDefaultTlsVersions with a DWORD value set to 1.
Create a new entry SchUseStrongCrypto with a DWORD value set to 1.

Go to:

  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319

Create a new entry SystemDefaultTlsVersions with a DWORD value set to 1.
Create a new entry SchUseStrongCrypto with a DWORD value set to 1.
Test.

Enable TLS 1.2 as default for WinHTTP

This may be applicable for any Classic ASP or VB6 applications that use WinHTTP. Prior to Windows 10 and Windows Server 2016, TLS 1.1 or 1.2 is not enabled by default for client-server communications through WinHTTP.

To set TLS 1.2 by default, do the following:

Create a registry entry DefaultSecureProtocols on the following location:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp

Set the DWORD value to 800 for TLS 1.2.

For 64-bit OS, repeat step 1 and 2 on the following location:

  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp

Reboot the server and test.

Windows 10 and Windows Server 2016/2019 support TLS 1.2 for client-server communications by using WinHTTP.

Download

Solving the TLS 1.0 Problem (MS Word document)

How to Fix SMTP 550 5.7.1 Unable to Relay Error on Windows Server 2012 R2

Here is one way of fixing an SMTP error on Windows Server 2012 when you see an error message similar to the one below:

Error Message

System.Exception: SMTP error sending: Client Service Setup Error on SERVERNAME ---> System.Web.HttpException: The server rejected one or more recipient addresses. The server response was: 550 5.7.1 Unable to relay for [email protected]    ---> System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Runtime.InteropServices.COMException: The server rejected one or more recipient addresses. The server response was: 550 5.7.1 Unable to  relay for [email protected]       --- End of inner exception stack trace ---     at System.RuntimeType.InvokeDispMethod(String name, BindingFlags invokeAttr, Object target, Object[] args, Boolean[] byrefModifiers, Int32 culture, String[] namedParameters)      at System.RuntimeType.InvokeMember(String name, BindingFlags bindingFlags, Binder binder, Object target, Object[] providedArgs, ParameterModifier[] modifiers, CultureInfo culture, String[] namedParams)     at System.Web.Mail.SmtpMail.LateBoundAccessHelper.CallMethod(Object  obj, String methodName, Object[] args)     --- End of inner exception stack trace ---     at System.Web.Mail.SmtpMail.LateBoundAccessHelper.CallMethod(Object obj, String methodName, Object[] args)     at System.Web.Mail.SmtpMail.CdoSysHelper.Send(MailMessage  message)     at System.Web.Mail.SmtpMail.Send(MailMessage message)     at ClientServiceSetup.CommonFunctions.SendMail(MailMessage objMail)     --- End of inner exception stack trace ---

Steps to Add Localhost to the SMTP Relay

Launch IIS 6.0 Manager.
Right-click on the STMP Server (on this example it’s named default, but it could be named something else) and select Properties.
Click on the Access tab and at the very bottom under Relay restrictions, click on Relay button.
Select Only the list below, click on Add… button and under Single computer and IP Address, type in 127.0.0.1 and click OK.
Check Allow all computers which successfully authenticate to relay, regardless of the list above. and click OK, and OK one more time to get out the Properties window.
Re-test and that should be it.

How to Troubleshoot Response Buffer Limit Exceeded Error in Classic ASP

How do you troubleshoot a classic ASP website when it crashes with the following error message?

Response object error 'ASP 0251 : 80004005'
 
Response Buffer Limit Exceeded
 
/itnota/test.asp, line 0
 
Execution of the ASP page caused the Response Buffer to exceed its configured limit.

Turn Off Page Buffering

By default, page buffering in ASP is set to On so one way to do it is just to turn off the page buffering.

At the top of your ASP page, add the following line after the VBScript declaration (Line 2 – highlighted):

<% @Language="VBScript" %>
<% Response.Buffer = False %>

In general though, you do want to pose a limit so your data stream does not clog up your resources especially if you’re sharing the web server with other applications. That’s why the next solution would be a better one especially for production environment.

Modify Response Buffering Limit in IIS

Another way to solve this issue is explained below, demonstrated using IIS 10 but should work the same way with IIS 7 or later as well. This would be the best solution but you need access to your IIS.

Launch your IIS Manager and select your site on the Connections box on the left. Then double-click on the ASP on the right pane, which is under IIS section.
Once the ASP window is opened, look for Limit Properties and expand on it and go to Response Buffering Limit.
If the value was never modified, you would see 4194304 which translates to roughly 4 MB.
This is the value, we want to modify so go ahead and change it to a larger number. In this example, we put in 64000000 (~64 MB, not quite but you get the point), basically adjust according to your need.
Once you entered the value, just click on the Apply link button to save all settings.

The effect should be immediate without requiring a restart of IIS or Application Pool. That’s all there is to it.

How to Cache Specific Static Files and Directories on IIS

As part of IIS performance tuning to improve a web page load speed, in general you want to enable browser caching by double-clicking on HTTP Response Headers in IIS Manager, click on Set Common Headers and check the Expire Web content:, then set the After: with an x number of days.

Often times though, you may want to be more granular in IIS static content caching for different type of files or all static files under certain folders. In the same way that you can disable browser caching for specific files on IIS, you can also configure the web.config to setup browser caching for specific files or directories with different lengths of time.

<configuration>
...
  <location path="favicon.ico">
    <system.webServer>
      <staticContent>
        <clientCache cacheControlCustom="public" cacheControlMode="UseMaxAge" cacheControlMaxAge="365.00:00:00" />
      </staticContent>
    </system.webServer>
  </location>
  <location path="js">
    <system.webServer>
      <staticContent>
        <clientCache cacheControlCustom="public" cacheControlMode="UseMaxAge" cacheControlMaxAge="60.00:00:00" />
      </staticContent>
    </system.webServer>
  </location>
  <location path="images">
    <system.webServer>
      <staticContent>
        <clientCache cacheControlCustom="public" cacheControlMode="UseMaxAge" cacheControlMaxAge="30.00:00:00" />
      </staticContent>
    </system.webServer>
  </location>
</configuration>

In this example we can see the caching for a specific file favicon.ico is set to 1 year (365 days) and two folders js and images are set to 60 and 30 days respectively (In a format of days.hours:minutes:seconds). This means, all static files under js folder will be cached for 60 days, similarly for images folder, although for less duration since the contents change more frequently.

By caching as many static files as possible on the browser, you can tremendously improve IIS performance, which translates to better users experience in loading your site faster on their subsequent visits.

How to Setup HTTP Strict Transport Security (HSTS) on IIS

Enabling HTTP Strict Transport Security on IIS

Buy me a coffee?

Further Reading

How to Enable TLS 1.2 as the Default Security Protocol on Windows Servers

Enable TLS 1.2 on Windows Servers 2008 SP2 or later

Enable TLS 1.2 on .NET Framework 3.5 (including 2.0)

How to check the KB updates

Registry Change

Enable TLS 1.2 as default for WinHTTP

Further Reading

Download

How to Fix SMTP 550 5.7.1 Unable to Relay Error on Windows Server 2012 R2

Error Message

Steps to Add Localhost to the SMTP Relay

Further Reading

How to Troubleshoot Response Buffer Limit Exceeded Error in Classic ASP

Turn Off Page Buffering

Modify Response Buffering Limit in IIS

Further Reading

How to Cache Specific Static Files and Directories on IIS

Further Reading

Recent Posts

Enabling HTTP Strict Transport Security on IIS

Buy me a coffee?

Further Reading

Enable TLS 1.2 on Windows Servers 2008 SP2 or later

Enable TLS 1.2 on .NET Framework 3.5 (including 2.0)

How to check the KB updates

Registry Change

Enable TLS 1.2 as default for WinHTTP

Further Reading

Download

Error Message

Steps to Add Localhost to the SMTP Relay

Further Reading

Turn Off Page Buffering

Modify Response Buffering Limit in IIS

Further Reading

Further Reading

Recent Posts

Tags