1. Changes in Windows XP Service Pack 2 7/2004robsmith@cs.cmu.edu

2. Enhancements in XP SP2  Network Protection  Memory Protection (compatible cpu’s)  Safer E-mail handling  Enhanced Browsing Security  Improved Computer Maintenance

3. Services Disabled by Default  Messenger Service  Alerter Service

4. Updated / Modified Applications  Windows Media Player upgraded to v9  Windows Messenger security enhancements: - blocks unsafe file transfers - required user display name (different from e-mail address) - ports need to be opened through firewall  Outlook Express – plain text mode, more  Windows Installer v3.0

5. RPC / DCOM, other Changes  Anonymous RPC calls no longer allowed  DCOM computer level ACL  Configurable via Registry key  Better support for Bluetooth wireless devices

6. Major changes  Firewall turned on by default  IE Pop-Up blocker  IE runs in restricted mode  Installed patches not displayed by default (enabled via registry key)

7. Firewall Definition - electronic blocking mechanism that will not allow unauthorized intruders into a computer system The firewall in Windows XP will not block any traffic originated on the local system.

8. Quick Survey  Black Ice?  ZoneAlarm?  Symantec Firewall?  Tiny?  Other? SCS Computing Facilities will support the firewall bundled with WinXP SP2

9. Methods for configuring the Windows Firewall in XP-SP2  Group Policy .Inf file bundled with setup  Manual configuration  Netsh command line tool Example: netsh firewall show state

10. Group Policy Settings  GPO will be linked to the three Organizational Units where computers reside  Contain settings that allow the standard SCS Windows environment to function:  Backup Agents (local network scope)  Windows File Sharing (local network scope)  Remote Administration (Hyena),WMI (local network scope)  Common Internet Services (Http,FTP,Telnet,SSH)  Additional exceptions will be configurable by user

11. Group Policy Details Ports: 7 (Echo) 6050 (Arcserve Client Agent) 497 (Retrospect Client Agent) 1977 (TiBS Client Agent) 6000,177(udp) (X-Win32) 3389 Remote Desktop Windows File Sharing (NetBios Ports) Remote Management (WMI Ports) All ICMP Traffic

12. Configuring Exceptions

13. Configuring Exceptions # 2

14. Configuring Exceptions #3  Add a text description and specify port

15. Dynamic additions of exceptions Add an exception to the firewall when a newly installed application wants to listen on a port. Add an exception to the firewall when a newly installed application wants to listen on a port.

16. SCS Subnets – Local Scope 128.2.178.0/23 (255.255.254.0) 128.2.180.0/22 (255.255.252.0) 128.2.184.0/21 (255.255.248.0) 128.2.192.0/19 (255.255.224.0) 128.2.242.0/24 (255.255.255.0) 128.2.254.0/24 (255.255.255.0)

17. Pop-Up Blocker Pop-up Blocker can be enabled by three different methods: Pop-up Blocker can be enabled by three different methods: Prompt at first occurrence. Prompt at first occurrence. A prompt appears before the first pop-up window appears that asks the customer to enable Pop-up Blocker. The Tools menu: In Internet Explorer, on the Tools menu, click Pop-up Blocker, and then click Block Pop-up Windows. Internet Options: In Internet Explorer, on the Tools menu, click Internet Options, click the Privacy tab, and then click Block pop-up windows. You can then click Options to configure Pop-up Blocker settings.

18. IE Restrictions  Configurable via Group Policy (TBD) Binary Behavior Security Restriction MK Protocol Security Restriction Local Machine Zone Lockdown Consistent Mime Handling Mime Sniffing Safety Feature Object Caching Protection Popup Management Scripted Window Security Restrictions Protection From Zone Elevation SecurityBand Restrict ActiveX Install Restrict FileDownload

19. IE prompt when downloading files, adding ActiveX controls, etc. Information Bar - used to bypass default settings in order to download files (AES), display pop-up windows, run unsigned scripts, etc. Information Bar - used to bypass default settings in order to download files (AES), display pop-up windows, run unsigned scripts, etc.

20. Tools for troubleshooting  Port Reporter Tool – useful for determining additional ports that may need to be opened. http://support.microsoft.com/default.aspx?scid=kb;en-us;837243  Firewall Log: %systemroot%\winnt\win_FW.log

21. Additional Reading   Details on changes http://www.microsoft.com/downloads/details. aspx?FamilyID=7bd948d7-b791-40b6- 8364-685b84158c78&DisplayLang=en   Manually configuring the Firewall http://www.microsoft.com/technet/communit y/columns/cableguy/cg0204.mspx

22. Questions ???

23. Fall 2004 - Software Changes  New Kerberos ticket manager (Kfw)  Updates versions of WinZip, Mozilla,X- Win32, OpenAFS (integrated with Kfw)