security

Upgrade Unified Access Gateway

fabio1975, , , , Leave a comment

VMware Horizon infrastructures often have the Unified Access Gateway (UAG) component to enable a secure connection from outside your corporate network to VDI.

This positioning makes the UAG subject to frequent updates, today we will see how to update it.

Download the ISO file of the version we want to update from the VMware Customer Site:

File Information Unified Access Gateway 2203 for vSphere, Amazon AWS and Google Cloud (Non-FIPS) DOWNLOAD NOW File size: 2.63 File type: Ova Read More Unified Access Gateway (UAG) 2203 for vSphere (FIPS) DOWNLOAD NOW File size: 2.14 Ga File type: ova Read More Unified Access Gateway WAG) 2203 for Microsoft Azure DOWNLOAD Now File size: 2.54 GB File type: zip Read More Unified Access Gateway WAG) 2203 PowerShell Scripts DOWNLOAD NOW File size: 79.4 KB File type: zip Read More MDS checksums. SHAI checksums and SdA256 checksums

Check compatibility with your Horizon infrastructure:

Product Interoperability Matrix (vmware.com)

Add to My Favorite List Hide Interoperability Compatible IV Incompatible Com*tible Put End of a Put End of Not S upgnrted VMwere Horizon 2111 2106 2103 2012 T 132 - VMwere Horizon 7 713 1 - VMwere Horizon 7 T 13 0 - VMwere Horizon 7 Hide Legacy Releases O Past End ot General Support Past End at Technical Guidance VMware Unified Access Gateway 2203 and 21112 and 2111.1 and 2106.2 and 2103.1 and 2103 2012 and 2009 3.10

Download the INI file containing the current UAG configuration

  • Access the Unified Access Gateway interface
    • HTTPS://<fqdnUAG>:9443

Using the credentials of the admin user

or VMware Unified Access Gateway dmin Username Admin Password Login

Once logged in, download the .ini file

A picture containing chart Description automatically generated

OCSP Settings Support Settings Support Settings Edge Service Session Statistics Log Archive Log Level Settings Export Unified Access Gateway Settings

Retrieving the information needed to complete the configuration file:

  • Certificate for public access and password
  • Certificate for the admin center and its password
  • SAML component XML if integration with AZURE MFA
  • Information on where to deploy (vCenter, Cluster, virtual network, datastore ) the Virtual Appliance of the new UAG

The data indicated will serve me to fill in the fields of the downloaded ini file

Notepad File Edit Format [General] netlnternet= View Help ipø=192.168.247.54 diskMode= ip1=192,168,246.54 defaultGateway=192.168.247.1 target= ds= routes 2.168.246.1,192.168.4.0/24 192.168.246.1,172.25.2.0/23 192.168.246.1,172.25.6 netmaskØ=255.255.255. or netManagement etwor net3ackendNetwork • pØA110cationMode=STATICV4 name= deploymentOption=twonic forceNetmaskØ=255.255.255. or forceNetmask1=255.255.255. or

I summarize the info required in this table

Sector Field Description
General netInternet PortGroup on which to certify the network card that communicates to the internet world *
General diskmode Thin or Thick
General Source Absolute path where the ISO resides
General Target Path of the vSphere infrastructure where we will deploy the virtual appliance
General Ds Datastore where the VM will be created
General netManagementNetwork Portgroup on which to certify the network adapter for UAG management *
General netBackendNetwork Portgroup on which to certify the network adapter for UAG management *
General Name Virtual Machine Name
General uagName Hostname of the UAG (normally to be left that of the UAG to be replaced)
SSLCert pfxCerts Property Path where the SSL Certificate generated by a public CA in password protected PFX format used to access VDI by Horizon Clients resides
SSLCertAdmin pfxCerts Property Path where the SSL Certificate generated by a CA (normally Microsoft and Private) used to secure and validate access to the UAG Management Interface resides
IDPExternalMetadata1 metadataXmlFile Property XML file of the Identity Provider (In this case Azure AD) to enable Azure MFA for access

*VMware recommends at least two network adapters in two different segments for production environments

  • One for internet traffic (I call it the EXT-DMZ)
  • One for traffic to the internal LAN (I call it the INT-DMZ)

It is possible to create environments with 1 or 3 network adapters, in the first case VMware recommends only one card only for test environments, and in the second to also differentiate the management traffic that otherwise, in the two-card configuration would pass through the card that communicates with the internal LAN.

Notepad File Edit Format View Help l[Generate1] net Internet—DPG - EXT•4Zjjj) ipe=192.168.247.55 diskMode—thick source—E : - unified - access - gateway- 22.03. 1955Ø 91_OVFI Ø. Ova ip1=192,168,246.55 default-Gateway=192.168.247.1 target—vi : / /vcaØ7 ds=vsanDatastore routes1=172.16.e.Ø/16 192.168.246.1,192.168.4.0/24 192.168.246.1,172.25.2.0/23 192.168.246.1,172 netmaskØ=255.255.255. and netManagementUetwork net8ackendNetwork=DPG - INT - C*IZ ipeA110cationMode=STATICV4 name-VilJAGØ3-22Ø3 deploymentOption=twonic forceNetmaskØ=255.255.255. and forceNetmask1-255.255.255. and ip1A110cationMode=STATICV4 net-maski=255,255,255. and authenticationT imeout—3ØØØØe fipsEnab1ed—fa1se sys L ogType=UDP uagName=viuage3 clockSkewT01erance=6Øe

At this point we can proceed with the deployment of the virtual appliance:

  • The first step is Shutdown the old UAG Virtual Appliance (I suppose do you have at least two UAGs with a Load Balancer in front and at least a DNS round-robin for balancing the traffic to the Connection server)

.\uagdeploy.ps1 -iniFile UAG_Settings_VIUAG04.ini

Administrator: Windows PowerShell uag ep oy2203> uag ep oy. PSI

Allow CEIP

Insert password for PFX Certificate File

Insert a new (or reuse the old) password for the Root account (for access to UAG OS) and Admin account (for access to UAG WEB admin console)

Waiting to complete the UAG Deploy (You can check the process from the vCenter task)

Now the new UAG virtual appliance is up and running!! Test it and apply the same step for all UAG virtual appliances of your VMware Horizon Infrastructure.

Upgrade Unified Access Gateway

VMware, CVE-2021-44228 and log4j (version 2)

fabio1975, , , , , , , , , Leave a comment

Since the end of last week, a new critical vulnerability has spread, present in many programs (Many VMware applications use this Java Logging including vCenter, Horizon, etc.)

“an exploit in the popular Java logging library log4j (version 2) was discovered that results in Remote Code Execution (RCE) by logging a certain string.” as indicated in this link:

https://www.lunasec.io/docs/blog/log4j-zero-day/

After a few hours, the CVE also released its bulletin (CVE-2021-44228).

https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228

On the day of 10/12/2021, VMware released its security advisor (VMSA-2021-0028) with the workarounds to limit the vulnerability pending the release of patched versions to fix it:

https://www.vmware.com/security/advisories/VMSA-2021-0028.html

So good application everyone!

By the way, for the uninitiated:

What is CVE? CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws. When someone refers to a CVE, they mean a security flaw that’s been assigned a CVE ID number.
Security advisories issued by vendors and researchers almost always mention at least one CVE ID. CVEs help IT professionals coordinate their efforts to prioritize and address these vulnerabilities to make computer systems more secure.

VMware, CVE-2021-44228 and log4j (version 2)

Hardening VMware vSphere 7

fabio, , , , , , Leave a comment

Non sono certo io a dover spiegare che parlare di security è ormai entrato nel day by day dei consulenti dei manager IT. Anche VMware da alcuni anni sta rilasciando  guide di come rafforzare l’hardening degli ambienti vSphere. Ormai è da diffidare di chi considera l’installazione  di ESXi e vCenter come dei semplici avanti avanti avanti ….

Riporto qui sotto il link alla guida di VMware per l’hardening degli ambienti vSphere 7 comprensivo anche dei dettagli dei parametri da configurare e  dei comandi per modificarli.
Hardening VMware vSphere 7

Antispam in cloud cosa aspettarsi

fabio, , , , , , , , Leave a comment
Negli ultimi anni si sente sempre di più parlare di cloud e di servizi in cloud. In questo post non voglio entrare nel dettaglio di cos’è  il cloud e se esistono veramente dei servizi che si posso definire in cloud, voglio solamente focalizzarmi su un di quei servizi, che con l’avvento del cloud e quindi del suo utilizzo in cloud  aumenta la sua efficacia e aumentano le sue potenzialità.
Stiamo parlando dell’antispam.
L’utilizzo  di un antispam nella nuvola ci permette di parlare non solo di blocco delle mail indesiderate ma anche di
  • Riduzione del traffico in ingresso
  • Mail continuity
  • Backup mail o archive mail
Riduzione del traffico in ingresso
Spostando il servizio di antispam dalla propria infrastruttura al cloud il traffico delle mail viene filtrato prima che raggiunga il nostro server di posta,  e quindi la banda occupata in ingresso  diminuisce annullando quasi del tutto quel traffico indesiderato generato dalla mail di spam. Quindi solo le mail puilite arrivano in ingresso al nostro server interno
Mail continuity (A volte già incluso in altri casi da pagare in aggiunta al servizio di antispam)
Quante volte ci è capitato di avere il server di posta offline (Aggiornamento, crash del sistema operativo etc.. ) e dover rispondere  al nostro amministratore delegato che la mail che sta aspettando  non  può arrivare e  non sappiamo quando arriverà. Con la mail continuity nel  caso  di offline del nostro mail server interno, la posta rimane sul nostro antispam in cloud, e quindi  può essere consultata dall’amministratore di sistema e con alcuni mail security cloud provider  ogni nostro singolo utente può accedere a una web mail e vedere la propria posta (Si può passare da un minimo di 3/4 giorni di “capacità” del servizio in cloud anche a due e piu’ settimane)
Mail Backup o Archive (Servizio che in alcuni casi può essere compreso  oppure  puo’ essere in  aggiunto coma add-on a pagamento)
Il passo di  avere in un datacenter  di altro livello, quindi in un posto “al sicuro”, un contenitore che ci controlla lo spam e ci pemrmette una sorta di HA della mail  ci porta  anche a valutare la possibilità di poter archiviare/salvare la mail  temporaneamente o all’infinito nel cloud. Altro plus, in alcune versioni, la possibilità di delegare al nostro utente finale la visione  e il recupero  delle  mail.
 
Non ho citato, ma ovviamente è da considerare come vantaggio  la diminuzione dell’attivita’ dell’amministratore IT nella gestione del servizio.
 CLOUD = no server da mantenere (che sia fisico o virtuale), no servizio antispam da mantenre (aggiornamento o upgrade di versione)
Mantenendo ovviamente le caratteristiche di base in un classico antispam:
Controllo delle mail in ingresso e in uscita
Controllo antivirus (in molti casi anche con piu’ di un motore)
Gestione personalizzate di blacklist e del livello di filtro dello spam
Gestione della quarantena a livello dell’amministratore ma anche dell’utente finale.
Quindi il cloud è sicuramente per il servizio di antispam un valore aggiunto.
Antispam in cloud cosa aspettarsi