7.10. Hands-On Labs
The labs in this chapter are as follows:
Lab 7.1: Hash Rules in Windows Server 2003
Lab 7.2: SSL Settings in Windows Server 2003
Lab 7.3: Encrypting a File System in Linux
Lab 7.4: Look for Errors in IPSec Performance Statistics
7.10.1. Lab 7.1: Hash Rules in Windows Server 2003
This lab requires a test machine (nonproduction) running Windows Server 2003.
NOTE
On a generic 2003 Server with Active Directory, you must access the local security policy slightly differently. Launch an MMC, then choose to add the GPO Editor, and select Local Computer. Everything else will then work the same.
To create a new hash rule, follow these steps:
Choose Start
Administrative Tools 
Local Security Policy.Expand Software Restriction Policies.
Right-click Additional Rules and choose New Hash Rule from the context menu.
Click the Browse button and choose the file hisecws.inf from the Templates folder (this is under WinntSecurityTemplates).
Notice the file hash that appears and the file information. Click OK.
Notice that the new hash rule is added to the right pane along with the default path rules that appear there.
7.10.2. Lab 7.2: SSL Settings in Windows Server 2003
This lab requires a test machine (nonproduction) running Windows Server 2003. To configure the SSL port setting, follow these steps:
Expand the left pane entries until your website becomes an option. Right-click the website and choose Properties from the context menu.
Select the Web Site tab. Check whether the port number for SSL is filled in. If it isn't, enter a number here.
Click OK and exit the Internet Information Services Manager.
Administrative Tools 
Internet Information Services (IIS) Manager.Notice that the SSL port field is blank by default, and any port number can be entered here—this differs from the way some previous versions of IIS worked. The default SSL port is 443; if you enter a number other than that in this field, then clients must know and request that port in advance in order to connect.
7.10.3. Lab 7.3: Encrypting a File System in Linux
This lab requires access to a server running SuSE Linux Enterprise Server 9. To encrypt a filesystem, follow these steps:
Log in as root and start YaST.
Choose System, then Partitioner.
Answer Yes to the prompt that appears. Select a filesystem and click Edit.
Select the Encrypt File System check box and click OK.
7.10.4. Lab 7.4: Look for Errors in IPSec Performance Statistics
This lab requires access to a server running Windows Server 2003. To configure IPSec monitoring, follow these steps:
Open the System Monitor by choosing Start
Administrative Tools 
Performance 
System Monitor.Click the + icon to add counters.
For an object, select IPSec v4 IKE.
Choose each counter that appears in the list, and click the Explain button to learn what it is able to show you.
Add the following counters: Total Authentication Failures and Total Negotiation Failures.
Click Close.
You're now monitoring the failures as they occur. On a properly functioning system, this graph should show no activity. Any activity that appears is indicative of problems since IPSec was last started and should be carefully examined.