search

dsccommunity / SChannelDsc

MIT License
12 stars 6 forks source link

CipherSuites: Using 'Absent' for named CipherSuites on default installations does not work. #33

Open holentommy opened 1 year ago

holentommy commented 1 year ago

We were considering to use the 'CipherSuites' resource to remove unwanted ciphersuites due to regulatory requirements. Unfortunately, we ran into some issues.

Using 'Absent' for named CipherSuites on a default Windows installation does not work for Windows installations where CipherSuites have not been previously configured. I believe it is caused by the registry key HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002:Functions is non-existent when the OS is in default configuration.

Registry: registry DSC verbose output: ciphersuites

Since the registry property does not exist the TestScript will not return $False, as the unwanted cipersuites are not present.

I was thinking the Get-TlsCipherSuite, Disable-TlsCipherSuite, and Enable-TlsCipherSuite commands should work better than editing the registry. But these commandlets are not compatible with Windows Server 2012 R2 and older, albeit that should not be the worst issue after October 10th.

johlju commented 1 year ago

I would be okay by using those commands and publish the module as a new major version that removes support for Windows Server 2012 R2 and older. If using older OS those configurations can pin an older version of the module.