You’ve no doubt by now heard about the massive scale OpenSSL vulnerability that was discovered to have left a large majority of the web servers on the internet open to compromise. The net of the attack is that once an SSL session has been established between the client and web server, there is a heartbeat mechanism that functions as a keep-alive to the client. By sending an empty 64KB data request back to the server, vulnerable servers are tricked into returning the contents of their memory buffers back to the client. These buffers can contain passwords, among other data. This is the “heartbleed” of the hearbeat mechanism. Best of all, apparently there is little trace left behind once this attack has completed successfully, although there are logged attempts of the attack.

It remains to be seen how widespread this is or what exactly was compromised, although there is proof of Yahoo passwords revealed in the wild. There is a server-side fix now for this which results in requiring new stronger certificate generation and many sites have begun implementing. What we do know is which sites use OpenSSL and when new certificates are issued. If a given website is still vulnerable to Heartbleed, there is no point in changing your password until they implement the fix server-side. If you’re busy changing passwords on sites that have not yet patched this bug and generated new certs, those new passwords will still be vulnerable until the fix is in place; I.e. waste of time.

If you don’t use LastPass yet (you should be) this is a very good time to start. One password tied to private keys you hold, not LastPass, enabling the use of 100% complex and random passwords for every site you log into. It’s a fantastic solution that I use on every device I own. If you’re one of those who still use a single common password on every site you log into, there is a very good chance that it has been compromised somewhere, possibly a long time ago. One of the many things to love about LastPass is that they provide a security challenge tool that tests the strength and frequency of your passwords. Now part of that tool also includes a Heartbleed site checker that watches the websites in your vault, when those sites patch against the bug and when you should change your password after the fix. Important to note: you will need to run this tool again every day for awhile until you are completely in the clear. This brings a great deal of sanity to this otherwise chaotic and widespread problem.

References:

Ars Technica

LastPass Blog

LastPass Security Challenge Tool

*Updated 5/16/14 – Sync just announced a new Vault feature that allows you to keep some files in the cloud that you don’t want to sync down to devices.

Previously, I took a look at another promising secure cloud storage provider called Tresorit, currently my default, which you can read about here. Toronto based Sync.com (currently in beta) looks to be going after the same market during a poignant time of concern over privacy and data security. Ever more more relevant as Dropbox just updated their TOS so more users will be looking for a more secure offering. Due to the NSA’s ability to snoop data “on the wire” as well as within US datacenters, sadly, this is also a time where considering cloud storage providers outside of US soil is a good thing.

 

“Zero Knowledge” Architecture

Sync.com uses what they call a zero knowledge storage environment, meaning that they have no knowledge of nor ability to access the files you upload.  Just like Tresorit, Sync.com provides a cloud encryption solution, meaning neither solution encrypts your files on local disk, only files sent up to and stored in the cloud as they leave your PC.  

There is a degree of trust one has to be willing to accept with these solutions as we really have no way to definitely prove that what is stored in the cloud is actually encrypted. Nor are we privy to the security standards or mechanisms in place in these datacenters to keep our data secure. That said, Sync.com expresses interest on their website to make their client software open source so greater transparency will come when that happens.

Sync.com does not provide a detailed white paper like Tresorit does but they do describe their methods.  Pretty straight-forward stuff. Your Sync.com account password protects your private key (AES-256), this key is used to encrypt a “file unlock key” for every file you upload to the cloud. File transfer and authentication happens via SSL. Authentication strings are SHA256 (never clear) and stored in their database as a salted BCRYPT-hashed string immune to rainbow table lookups. This is their claim, I can’t speak to the validity of this. 

Looks like the packaging of private key-encrypted file unlock keys with each encrypted file is what enables Sync.com to provide access to your files via a web portal (unlike Tresorit). This is closer to the LastPass method which also provides a web portal for that offering. I created a quickie diagram that illustrates their method below.

Just like Dropbox, Sync.com ultimately rides on the Amazon infrastructure but uses the Elastic Computing service (EC2), instead of S3, and keeps many local processes running at all times. Three most notably are the taskbar process, several dispatch instances and a watch master process. Interestingly, one of the dispatch processes keeps a persistent connection to a Network Solutions domain which also receives the majority of all bytes sent into the Sync.com cloud. All files added to any Sync.com folder locally get pushed up to this netfirms.com address first. It’s unclear to me what happens from there. Dropbox file uploads establish connections directly to AWS as well as Dropbox servers. Sync.com appears to be proxying all file uploads to an unknown location.

Keeping processes alive with persistent connections to the cloud definitely enables speedy syncs, up and down. Tresorit still uses the timed sync approach where at specified times its processes are spun up, connections to the cloud made, files synced, then connections and processes torn down. Not as speedy to sync, but there are no persistent connections.

 

Sync.com Client

User accounts are created via the download and install of the sync.com client. There is no way to log into the web portal until the client has been installed and account created first. Just like Tresorit, Sync.com provides a 5GB free account which is much larger than Dropbox’s 2GB. They don’t specifically mention a file size limit so to test I uploaded a 600MB file then a 3.7GB file, they both went. This could be a byproduct of the beta so uncertain if this will stick around but if so, this could be very promising.

 

The basic functionality of Sync.com is exactly like that of Dropbox: one folder whose contents gets synced up and down. Drop in files or folders and they get uploaded to the cloud and other Sync.com clients. The software client itself is very reminiscent of earlier versions of the Dropbox client.

They do provide a more mobile-friendly up/down limiter for those who presumably would run up against mobile data limits, although there is currently no mobile client. Curious that they would include this here in the desktop client.

The one key point of differentiation here is that in the client preferences they provide a progress tab showing any activity and estimated time remaining. Neither Dropbox nor Tresorit do this.

The right-click system tray menu is almost identical to Tresorit’s.

Web Portal

From a local PC capabilities perspective, that’s about it. All other functions, including sharing, happen from the web portal. Considering that Tresorit does not currently have a web portal, this is a pretty big deal.

The aesthetic and design of the web portal clearly took many queues from box.net although the Sync.com team managed to make it much cleaner and more intuitive.

 

Navigation and file operation are fairly predictable along with the expected ability to upload files to the web portal directly. You don’t have to use the desktop client to create new files. At this time folders cannot be uploaded to the portal, but more than one file can be selected and added to the upload queue. Cool!

 

Box.net and Dropbox offer a nice online photo viewer with Box’s offering heads and shoulders ahead of the other two. Sync.com’s implementation follows pretty close to what Dropbox has in play.

 

Sharing

Something else that occurs via the web portal is sharing which can be done in a few different ways. The simplest method happens via Secure Links which enables the secure public sharing of single files or folders. This sharing method is probably best suited to blind read-only sharing amongst larger groups. First select the file or folder to create a public link for by clicking the chain icon next to a given item.

You’ll then receive a pop-up with the link URL that you can opt whether or not to include the link password in the URL itself or leave it separated.

Other more precise ways to share content involve explicit sharing to people you specify.  Clicking the “Create a share” button will create a new folder and allow you to invite specific people via email addresses. The people invitation part is mandatory, no invited people = no share, but you can invite only yourself to test.

The third way to share is by clicking the plus sign next to any existing file or folder and enable sharing directly.

The same sharing dialog will appear which, again, requires the entering of someone else's email address to create the share.

Once shares are created, they can be managed either from the top level sharing link or via the “Manage Share” dialog next to any shared item.

Sharing management is simple and provides almost everything you need. Member status, permissions, ability to re-invite or invite new as well as stop sharing. Permissions need to be a bit more robust here to include ideally read-only and editing levels.

 

Mobile Client

As of this writing there is no Sync.com mobile client which will be a deal breaker to some but this is obviously coming. Sync.com states in their blog that they will simul-release clients for both Android and IOS but that was printed July of last year. The web portal does work on the mobile device, however, and even has a nice photo viewer functionality. 

 

What Sync.com does well

• Files synced to the cloud are encrypted in transit (SSL) and at rest in the Sync.com datacenter (AES-256).
• Very large file limits or none at all (>550MB and 3.7GB verified on my free account, but this could and likely will change)
• The ability to store, access and share encrypted files via a web portal is a big deal, no one else in the business can do this today!
• Split-brain: Ability to host some files in the cloud only that don’t have to be sync’d down to clients.
• Multi-client subfolder sync (Have to check since Box has struggled with this)
• 5GB free accounts with 500MB referrals, no indication of limits
• Robust and granular sharing options
• Robust and well-known compute backend (Amazon EC2)
• Persistent cloud connections and watcher processes = near instant file syncs
• 30-day file history to restore deleted or previous file versions

Where Sync.com falls short

• Amazon EC2 is a flexible compute service for web services, not a storage service like Amazon S3. Where is Sync.com actually storing our data? 
• No mobile Android or IOS client yet, but they say this is coming soon in their blog.
• No mobile client = no camera uploads
• Web portal provides upload ability for multi-select individual files only, not entire folders like Box does.
• Single bucket root folder like Dropbox. I like Tresorit’s approach of multiple root folders residing anywhere you like better. Sync the folders you like on the clients you like, save local space if you need to.   
• No LAN sync like Dropbox but seems they have the framework to make this a reality at some point.
• No MS Office mobile previews like Box.net but this too could be accomplished.

Watch this space!

The Sync.com team has clearly tried to preserve the best of what makes Dropbox great while incorporating some other useful features, the likes used by Box.net, while also providing data security in the cloud. The current climate of public technology will make this a requirement soon, no longer merely a luxury. This will leave the cloud storage pioneers (Dropbox) left to retool and scramble as they figure out how to make their now very mature offerings more secure, if they hope to survive. There’s too much good competition appearing in this space with nothing really compelling that will keep people using a less secure service. Building this type of offering with security as a focus first is absolutely the right approach and one that will pay dividends for companies like Tresorit and Sync.com.  After a few days using Sync.com there’s really not much to dislike. There are a few key features I’d like to see before I consider (another) switch. Tresorit better hurry up with their web portal or they will be outdone here. Hopefully Sync.com will offer some of us beta testers a 50GB+ opportunity soon. :-)

Feel free to use my referral link if you want to check out Sync.com with some free bonus space: here.

References:

Sync.com Privacy

Sync.com Blog

Check out my other cloud storage posts as well:

• Sync.com
• Box.net

*Updated 3/24/14

Part of living on the bleeding edge of technology is always looking for that better mouse trap. Needs and circumstances change along with the climate we live in, these things drive evolutionary product innovations and robust competition.  No service or offering is perfect so there are always concessions to be made but as long as you aren’t stepping backwards, technological change can be a good thing. I previously wrote about a potential shift from Dropbox to Box, but due to a fatal flaw in the Box offering I moved away from that ledge. (With the Box.net Sync v4 client, this is purportedly fixed, finally, although I haven’t tested. Even still, Box  = unsecure cloud storage since they encrypt contents with private keys they own. Tresorit started with a very strong launch but is now imposing limits that make the offer much less compelling. Read on for more info.

So what’s wrong with Dropbox? Honestly, not much, it is the feature/ functionality yard stick that all other cloud storage providers measure themselves against. The 2 big pain points I see are free storage space and security. It has become relatively easy to get 50GB on competing platforms, so Dropbox providing a meager 2GB with opportunities to increase it to ~20GB with referrals on the high side, is paltry. That said, Tresorit looks to be matching the 16GB possible extra referral space which will net them 3GB more total in the end. Secondly, beyond SSL + 2-factor authentication to access your Dropbox, you are on your own for securing your contents which ultimately reside in the Amazon S3 cloud. Although Dropbox claims to encrypt your files in the S3 cloud, this has proven to be exploitable and remains a problem for them today. Tresorit looks hopeful on solving both of these problems while providing the majority of the interesting features native to Dropbox.

What is Tresorit?

Tresorit is another contender in the cloud storage category with a heavy emphasis on security. Security is the first and foremost consideration of Tresorit, not an afterthought (see the whitepaper link at the bottom). A quick overview of the related nomenclature before we go deeper:

Tresorit (“Treasure It”) is the holistic cloud storage solution centered around protecting personal data in transit and at rest in the cloud.

Tresors are individual folders that have been client-side encrypted and synced up to the cloud.

The technique employed here is very similar to what LastPass does where all data is encrypted client side using a strong secret password and only the encrypted data is sent up to the cloud using secure channels. Tresorit never has your password so only you or those you explicitly share with can unencrypt your data via the Tresorit client. The communication channels use SSL/TLS but the security of this solution does not depend upon it as your data package itself is encrypted. Shared Tresors are decrypted client-side to the people you have expressly allowed access. Important to note that your files are not encrypted locally at rest on disk, they are only encrypted when synced up to the cloud.

Everything happens via the Tresorit client which must be installed on your PC or mobile device. There is no web portal to log into. Account registration and referral processing also happen via the client. Once installed, start creating new Tresors by connecting to any folder anywhere in your local file system. This is one of the cool things about Tresorit: many buckets, not just one like Dropbox. Although I have admittedly grown accustomed to keeping all things cloud in a single folder. Each Tresor will then be encrypted and sent up to the cloud.

Tresorit also handles selective syncing very intuitively: all Tresors disconnected by default. You choose what to sync on which clients simply by choosing to connect to the Tresor you would like to pull down on a given device. I have a 70GB account which is nearly 4x what my Dropbox account is so it is nice that I can selectively connect/disconnect those buckets as I see fit. Dropbox provides selective sync for top-level folders 1 level below the root Dropbox folder. Functionally no different, but Tresorit’s method is cleaner.

 

Any Tresor can be securely shared with anyone you like with 3 simple permissions to attach to each invitee.  

Any Tresor can be individually disconnected or deleted from the cloud or sync stopped. This is an improvement over the Dropbox offering. Sync can also be disabled globally too, of course. Disconnecting a Tresor from the PC or deleting a Tresor from the cloud does not delete the files locally.

 

On the mobile side, Tresorit also supports seamless mobile camera uploads, just like Dropbox, which is an awesome feature. Not having a web portal to access your files, however, not only requires you to install Tresorit but to connect and download a full Tresor before you can manipulate any files within it. If you have a space limited device this can prove challenging for obvious reasons. If you have an Anrdoid or IOS device, the Tresorit client on those platforms will allow more granular manipulation without having to first download a full Tresor. You can delete individual files or send a file which will trigger a download, but for that file only. It seems like the same functionality should be eventually brought to the desktop client as well at some point.

New Features (*updated 3/24/14)

Encrypted links allow you to securely share any individual file in any Tresor. Free users are limited in both the number of links that can be created but also how many times each can be downloaded. Not tremendously different than Dropbox’s sharing mechanism but secure and severely more limited.

File activity can now be viewed from within the Tresorit desktop or mobile client. Encrypted links can be generated for the latest version of any active file, however deleted or prior versions cannot be viewed or retrieved.

Plans

There are paid plan options just like all of these types of services but keep in mind the limitations of the free version (which have sadly increased in Q1 of 2014). New limitations have been introduced around the number of devices you can use, monthly traffic, bandwidth speeds and the number of people you can share with (down to 5 from 10). The device limit alone is now a deal breaker for me, maybe not for you. 

 

Disconnected Tresor sync

To prove that Tresorit could handle a net new file within an incomplete Tresor sync from a disconnected Tresor I performed the following test:

• Disconnect a Tresor folder with incomplete content (only 50% downloaded from the cloud)
• Uninstalled Tresorit client on same PC, reinstalled
• Added new file to existing directory structure 3 folder levels deep (still not synced)
• Connect the Tresor, sync

This performed flawlessly. The PC that had the Tresor with the 50% sync picked up where it left off (despite the Tresorit client being uninstalled/ reinstalled) and successfully pushed up the new file to the other PCs connected to the same Tresor. This is logical and exactly how it should work. Box couldn’t do this (maybe still can’t) which was their fatal flaw and why I felt compelled to test this here.

The one issue that popped up during this test was the fact that when reinstalling the client, it automatically logged into the same account with no prompt for credentials. This is obviously a serious problem if you ever wanted to install Tresorit at a friend or family member’s house to access a file, then uninstall thinking your account is safe. I contacted Tresorit about this and they said the issue will be resolved in the next release. As a precaution, manually logging out of the client before uninstalling would be a prudent step to protect your account.

 

What Tresorit does well

• Auto-encrypt and sync any folder anywhere on your Mac/PC to the cloud. (not just a single bucket like Dropbox)
• Multi-client sub-folder sync
• Granular selective folder sync enabled by default
• 5GB space for free users (>2x more than Dropbox), bonus referrals of 16GB, opportunities to get 50GB+ (Gone for now)
• Robust mobile client for Android/IOS that includes camera uploads, selective local caching, and passcode lockout
• Actual support! – That’s right, you can open a support request with Tresorit and actually expect an email back in a reasonable time. The staff seems genuinely interested in helping.

Where Tresorit falls short

• Limitations – Number of devices that can access an account, download, bandwidth and sharing.
• No web portal: Tresorit provides no web portal through which you can access your files. If this is possible with LastPass, also client-side encrypted, it should be possible here.
• Full folder download required: Full Tresor download is required to manipulate files on the PC client. Mobile client provides more granularity being able to access, delete or send individual files without downloading full Tresor folder. This applies to sharing as well which is a hassle to have to download 100% of all files in a given Tresor.
• No deleted files protection: There is no mechanism to retrieve deleted files today but the activity mechanism, currently in beta, may be an indication this is coming.
• No device management: There is no way to manage the multiple devices you have permitted to access your Tresorit account. If you lost your phone, for example, the only recourse you have right now is changing your password.
• No MS Office file previews: There is no mobile MS Office file preview which is something only Box does right now. I really like this feature and hope it makes it in at some point.
• 500GB file limits + 20 top-level folder max on free accounts
• There is no way (that I see) to change the master password once it’s been set (As of v0.8.100.133, there is!)
• No LAN sync – very nice Dropbox feature if you use multiple PCs as it copies bit via the LAN faster than pulling everything down from the cloud.
• Timed syncs – Tresorit syncs appear to operate on a timed schedule so are not change aware nor are they instantaneous. Opening the client manually will trigger the sync operation.
• No password recovery – This could go in either bucket really depending on where you stand. Bottom line, if you forget your password, kiss your Tresorit account and all data within goodbye.
• Camera uploads are broken on Android as of 1/5/14. This worked for a short time on a previous build but the Tresorit team appears to be struggling with this one. I’ve re-enabled my Dropbox account for this purpose alone until this gets sorted out. As of 2/21/14, this is working for me!

Off to a good start at first, now wait and see

After several days months of exclusive Tresorit use across multiple devices, I really have no didn’t have too many complaints. The majority of the core features I need are there. PC client syncs are not as snappy as they should be. Dropbox clients keep a persistent connection open to dropbox.com and all other LAN sync clients, so file changes sync almost immediately. Tresorit uses timed syncs which establish and tear down the sync session every time. To force a local sync early, you have to actually open the client which triggers an update operation. I don’t like this. On the other hand, I do feel like my data is secure and I have a huge storage footprint that I can grow further with referrals. This I like. New limitations introduced in 2014 have me rethinking how far I can go with Tresorit now. Of course, if a fatal flaw rears its head, I’ll tuck my tail and crawl back to Dropbox but so far I have no reason to see that happening. Working across several devices daily, I live in my cloud storage so this is important to me and having it secure without taking additional steps is a huge bonus. I’m now debating my options which include Box, Dropbox, Tresorit and Sync.

Feel free to use my referral link if you want to check out Tresorit with some free bonus space: Link

Resources:

Tresorit White Paper: Link

One of the problems that has continued to plague Windows is the ability for users, administrative or not, to execute programs from unsafe temporary file system locations sometimes bypassing security controls. UAC has helped to reduce the attack surface along with the Windows integrity mechanism that monitors and restricts files based on a level of trustworthiness.  Combine that with a good anti-virus product and sometimes the bad stuff can still get through, even when accidentally executed from a dangerous location such as temporary internet files. Internet Explorer contributes to this problem as the only major browser on the market that actually allows execution directly from a download (which can happen accidentally). Chrome and Firefox require a download to be saved to disk first then manually executed after the download is completed. This alone is good enough reason to not use IE for daily casual browsing.

Microsoft’s AppLocker is a free built-in group policy utility that comes with the Enterprise and Ultimate versions of Windows that puts a stranglehold on the execution environment of the OS. Unlike the troublesome software restriction policies of long ago, AppLocker provides an intuitive and highly customizable framework to protect your PC and servers, if desired. AppLocker works for home or corporate PCs and can be configured using group policy. I have configured AppLocker on every Win7 PC I’ve built for friends or family for years and they do not have malware problems. Period.

Best practices for novice or intermediate user PCs:

• Users should not run as administrators, remove the user account from local admins
• Enable the local admin account and set a password
• Run a quality antivirus product
• Ensure UAC is enabled and set to the default level
• Configure AppLocker to protect the OS

Accessed from within the local computer security policy (gpedit.msc) or via group policy in a AD domain, AppLocker can be found in the Application Control Policies section below Security Settings.

A number of different rule types can be configured and new for Win8/ Server 2012, AppLocker now supports Packaged apps, which I’ll talk about in the section that follows.

Executable Rules

Executable rules are by far the simplest and most effective means of providing solid protection. First thing to do is to create the default rules: right-click in the white space in the right pane, click “create default rules.” These rules will ensure that executables can only be run from within the trusted program files and windows folders. Administrators will be allowed to execute any file regardless of file system location. Anything that is executed from the desktop or temp folders, for example, will be denied.

For the PC of a non-administrative user, to execute a file outside of the specified safe locations will require both intent and elevation via UAC to run; no accidents will be possible.

Applications that are not installed for “all users” of a PC are typically installed to a space in %userprofile%\AppData. These applications will need to be individually permitted or they will subsequently fail to run. The easiest method providing the best protection is to configure path rules for each application as required.

If this is too troublesome, a publisher rule will suffice which will cast a wider net allowing any application of a given publisher or product to execute. Move the slider to enforce more or less granularity as desired.

Windows installer and script rules can also be used to to provide further restrictions. Use care if you choose to enable these as frustration could ensue when trying to install certain applications afterwards.

Packaged App Rules

For Windows 8 and Server 2012, having the interface formerly known as Metro and apps to go with it, AppLocker provides a new mechanism to comprehend these “packaged apps.” The options are more limited but provide suitable protection and control.

Create a packaged app rule by first choosing a reference file from the Metro apps installed:

Adjust the slider to specify a publisher, package or version rule:

Enforcement

Any configured rules will be enforced by default unless you specify Audit Only in the enforcement properties.

For any configured rules to actually take affect, the Application Identity service must be running. Set the service to Automatic and start it.

Follow these recommendations and you should never have to clean another malware infested PC again. I honestly can’t remember the last time I’ve had to.

References:

Windows System Integrity Mechanism

AppLocker Technical Architecture

One of the first few updates for the Office 2013 suite seems to have altered the file blocking mechanism in Visio 2013. If you don’t have any 2013 style files yet and try to open a previous version, you will get the error below:

In default form, Office 2013 blocks the opening all document versions prior to that of 2013. One fix is to enter the Trust Center, as the error message indicates, and alter the file block settings unchecking the “open” boxes next to the versions you require. Interestingly if you compare the file block settings between Word and Visio they do not match. Visio does not inherit any of these behaviors.

The “open behavior” options at the bottom default to “do not open” and cannot be changed. This should resolve the problem but another way is to click “Trusted Locations” from the left side of the Trust Center and add the file paths where your Visios live. You’ll notice that this is empty by default as trusted locations are exempt from the security mechanisms.

Make sure to include the subfolders of whatever location you select.

Click Ok all the way out and you should be good to go now.

Two ways to solve the same problem. This mechanism didn’t work correctly when Visio 2013 launched a year ago but now appears that all is well.

Symantec has updated their secret decoder ring that deciphers version builds to version names. They have also begun including both in the endpoint client which is incredibly helpful when looking for matching upgrades. In the SEP 12.1 RTM build as well as prior versions the client reported the following type of version information:

In the latest releases of SEP 12.1, the version name is included with the version number (finally).

From the link below, this Symantec page tracks the name, version, and release date of every version of SEP since 2007. Find what build you’re on, where you need to go, download the upgrade bits.

SEP EE 12.1.x
Name	Version	Release date (English)
RTM	12.1.671.4971	Jul 2011
RU1	12.1.1000.157	Nov 2011
RU1 MP1	12.1.1101.401	May 2012

 

SEP Versions and names: Link

SEP upgrade binaries: Link

One of my favorite and most versatile tools in the arsenal is Microsoft Forefront Threat Management Gateway (TMG). Although “ISA” still slips out occasionally, TMG is as ISA was, a firewall, a proxy, a router, and on my short list of solutions to use if traditional methods of routing between networks is not possible, for whatever reason.

Here is a scenario: I have a private L2 network, not reachable from or connected to the corporate network. The private network, unfortunately, uses an IP scheme also in use somewhere on the corporate network. So I cannot simply attach this network to the corporate LAN directly and changing the private network architecture is just not an option right now. Enter the ultimate software network bridge: TMG. But the plot thickens… I have resources on the private side that I want to make available to the corporate network, namely a VDI pool and a Kace web server.

Planning and Design

First and foremost, I need to protect the corporate network. Nothing that goes on in the private network should be able to negatively impact the corporate LAN. This is just a common-sense precaution. With that in mind, the private network will be considered “outside” and firewalled to protect the “inside” LAN. I only have 2 networks in this scenario so a simple perimeter network configuration with 2 interfaces will suffice. My TMG server will be virtual, of course, hosted on an ESXi server with physical connections to both networks. The guest OS will be Server 2008 R2 running TMG 2010, SP1. Because the private network will be considered “the internet”, for all intensive purposes, I will have to reverse publish/ proxy those resources I wish to make available to the internal network. Here is the topology I will be implementing:

This design is typically opposite of what you would normally do with TMG, where you might publish OWA or some other internal resource to the internet. I’ve also used TMG to route specific protocols between otherwise disconnected networks. The end result of this architecture is that users on the LAN side will be able to access the published resources on the “outside”. For this exercise I will be reusing the TMG server’s inside IP address to publish my web server. So users inside will be able to browse to http://10.1.1.50 and be able to view the website hosted on 192.168.1.10.

Setup

All the basic ISA/ TMG setup best practices still apply. Define the networks your internal and external NICs connect to, use a gateway and DNS on only one (the other will be static routed), disable all protocol stack services on the outside interface (NetBIOS, etc), set the NIC binding order properly, etc. These practices are all very well documented so I won’t cover them here. There is also nothing special to configure in the TMG network rules. You don’t need to create a External to Internal route or NAT rule. The magic is all in the publishing rule.

First, create a new Web Site Publishing Rule from within the Firewall Policy tab. Give it a name and set the rule action to Allow. Publish a single web site and decide if you want SSL to protect the server connection between TMG and the web server. For this exercise I will not be using SSL.

Because DNS on the LAN side does not resolve anything in the private network, we need to specify an IP address for the internal web site. Enter the site name, check the box to use an IP address and enter it. We can’t use this site name because it isn’t resolvable but the wizard requires it, we will change it once the setup is complete.

We don’t need to enter a specific path for this website and accept requests for any domain name. Next we need to create a web listener, click New and enter a name.  Choose do not require SSL and select the Internal network to listen for incoming web requests.

Select No Authentication and finish to complete the listener setup. Once complete the listener should look like this:

TMG has the ability to pass authentication requests made by published web servers to clients. In this case we don’t need this so ensure that delegation and direct client authentication are disabled. This rule will apply to all users. Once the base rule is created there are still a few tweaks to be made before it will work as intended.

Open the new rule you just created. On the “To” tab, change the published site entry to the IP address and delete the IP in the second field. Ensure that requests are set to appear to come from TMG.

On the “Public Name” tab, change the rule to apply to “requests for the following sites” and enter TMG’s inside IP address.

Now the secret sauce: Link Translation. Without this, the home page may load but every link a user would click on the website would be directed back to the source web server’s IP address. These requests will fail because there is no routing from the corporate LAN to the private network. Link translation will replace the true source IP address mapping with the TMG server’s IP address. On the Link translation tab, click apply link translation to this rule, then click configure.

The mappings button will show you all translations applied to that rule in a web browser report. At this point, after clicking apply, you should be able to test the rule by clicking the Test Rule button. This will initiate a path ping to ensure the destination is reachable as configured. Before it will take effect, you will need to apply the rule in TMG. Now you can test by accessing the website on the corporate LAN side.

Publishing the VDI host will be similar using standard http/https to access the resources. Link translation will again be the key there to ensure that everything that is published through TMG will appear to be hosted by TMG to the end user.