105 lines
6.6 KiB
Markdown
105 lines
6.6 KiB
Markdown
# Valleywide (VWP)
|
|
|
|
## Infrastructure
|
|
|
|
### Servers
|
|
|
|
**HP ProLiant Server (SN: MXQ80400X4)**
|
|
- VM Host / Hypervisor
|
|
- iLO IP: [TO BE DOCUMENTED]
|
|
- All VMs running on this host
|
|
- [WARNING] 2026-04-22: NVRAM corruption from power outage - BIOS/iLO reset to factory, reconfigured
|
|
- [ACTION REQUIRED] iLO needs reconfiguration after factory reset
|
|
|
|
**VWP_ADSRVR (192.168.0.25)**
|
|
- Windows Server 2019 Standard (build 17763)
|
|
- Domain Controller for `vwp.local`
|
|
- SSH enabled (OpenSSH Server), key auth working for `vwp\guru`
|
|
- Likely runs as VM on HP ProLiant host
|
|
|
|
**VWP-QBS (172.16.9.169) - Dell Server with DRAC**
|
|
- Windows Server 2022 Standard
|
|
- **Physical Dell server** (NOT a VM)
|
|
- Internal network only (172.16.9.0/24 reachable via VWP site VPN)
|
|
- Runs QuickBooks + **IIS with RD Gateway / RD Web Access** (`/RDWeb`, `/RDWeb/Pages`, `/RDWeb/Feed`, `/Rpc`, `/RpcWithCert`)
|
|
- WinRM available on 5985 (used for remote admin via Invoke-Command)
|
|
- DRAC available for remote management
|
|
- [NOTE] 2026-04-22: Boot retry issue after power outage, resolved via DRAC manual boot to Windows Boot Manager
|
|
|
|
### Networks
|
|
- Internal: `172.16.9.0/24`
|
|
- One subnet also numbered `192.168.0.0/24` (conflicts with IMC's LAN if VPNs overlap — be careful switching contexts)
|
|
|
|
### Access
|
|
- **SSH to VWP_ADSRVR:** `ssh vwp\guru@192.168.0.25` (ed25519 key, added 2026-04-13)
|
|
- **Double-hop to VWP-QBS:** SSH won't forward Kerberos; use `Invoke-Command -ComputerName VWP-QBS -Credential $cred` with `vwp\sysadmin` PSCredential
|
|
|
|
## Security posture
|
|
|
|
### 2026-04-13 incident
|
|
RDWeb (`https://VWP-QBS/RDWeb/Pages/login.aspx`) was exposed to the public internet via UDM port forward. Distributed brute-force attack was in progress (multiple external IPs, ~6 POSTs/min, hitting usernames like `scanner`, `Guest`, etc.). This was discovered while investigating repeated `scanner` account lockouts (event 4740) which originally looked like a stale service credential.
|
|
|
|
**Actions taken:**
|
|
- UDM port forward removed (user action)
|
|
- IIS reset on VWP-QBS to drain in-flight attacker sessions
|
|
- Domain lockout policy restored (threshold 5, 16-min duration/window) after being temporarily disabled during diagnosis
|
|
- 30-day audit: **no successful external logons** — no compromise
|
|
|
|
### Current state
|
|
- RDWeb no longer reachable from public internet
|
|
- Internal access still works on port 443 from within 172.16.9.0/24
|
|
- Account lockout policy active
|
|
|
|
### Recommendations (outstanding)
|
|
- If RDWeb must be public again: deploy **IPBan** (https://github.com/DigitalRuby/IPBan) + firewall restriction to known client IPs
|
|
- Audit UDM for UPnP (prevents the server from re-punching its own hole)
|
|
- Consider 2FA / Conditional Access on any externally-reachable Windows service
|
|
- Rotate `scanner` AD account password (last set 2024-10-17) as hygiene
|
|
|
|
## 2026-04-16: RemoteApp over VPN (post-gateway) + RDS licensing fix
|
|
|
|
After the 2026-04-13 public RDWeb port-forward removal, users launching the QuickBooks RemoteApp via VPN hit `0x3000008` (RD Gateway unreachable) because the RDP manifest still routed through the gateway at the (now-firewalled) public IP.
|
|
|
|
### Changes made
|
|
|
|
1. **RDS Deployment** (on VWP-QBS, via Server Manager -> RDS -> Edit Deployment Properties -> RD Gateway) set to **"Do not use an RD Gateway server"**. New RDP manifests now write `gatewayusagemethod:i:0` and `full address:s:VWP-QBS.VWP.US` — direct connect, no gateway.
|
|
|
|
2. **UDM static DNS record** fixed typo `qwp-qbs.vwp.us` -> `vwp-qbs.vwp.us` (UniFi UI: Settings -> Routing -> DNS -> Static DNS Records), still pointing to `172.16.9.169`. Required because `vwp.us` is a real registered domain (resolves publicly to the website) but `vwp-qbs.vwp.us` is only valid internally. VPN clients receive DNS=192.168.4.1 (the UDM) via OpenVPN push, so this override is what lets them find the session host.
|
|
|
|
3. **RDS licensing configuration** (on VWP-QBS, via `Win32_TerminalServiceSetting` WMI):
|
|
- Mode: Per User (LicensingType=4)
|
|
- Specified license server: `vwp-qbs.vwp.us` (the same box — RDS-Licensing role was installed and activated but the RDSH was never pointed at it, so users hit "no license servers available")
|
|
|
|
### Rationale
|
|
|
|
- **No RD Gateway needed**: VWP users are either on-LAN or VPN-connected. OpenVPN pushes routes for 172.16.9.0/24, 192.168.0.0/24, 192.168.3.0/24. VPN -> LAN firewall policy is ACCEPT-all (`UBIOS_VPN_LAN_USER`). Gateway was only serving the public-access use case which is now intentionally closed.
|
|
- **DNS override avoids split-horizon complexity**: rather than pushing internal AD DNS (172.16.9.2) to VPN clients, we use the UDM's dnsmasq for both public and internal names, with overrides for the handful of internal FQDNs clients actually need.
|
|
|
|
### Current VPN / DNS topology
|
|
|
|
- OpenVPN server on UDM: pushes `192.168.4.0/24` to clients, routes for the three LAN subnets, DNS=192.168.4.1 (UDM)
|
|
- Site-to-site WireGuard peers visible on UDM (`wgsts1001`, `wgsts1003`, `wgsts1005`) — likely UniFi SiteMagic to ACG / other sites
|
|
- Static DNS records on UDM (as of 2026-04-16): `vwp-qbs.vwp.us` -> `172.16.9.169`
|
|
|
|
## RDS CAL purchase (outstanding)
|
|
|
|
VWP-QBS's RDS License Server is activated and running, but **has no real CALs installed** — only the Windows 2000-era `Built-in TS Per Device CAL` placeholder pack. Once grace period expires (or after the 2026-04-16 pointer fix re-triggers licensing logic), users will either get a fresh grace window or start seeing "license server has no licenses" errors.
|
|
|
|
**Action item:** purchase a pack of **Windows Server 2022 RDS Per User CALs** sized to the active user count (check VWP-QBS for distinct interactive logon count last 30d to size accurately). Install via `licmgr.msc` on VWP-QBS. Current licensing mode is Per User, matching this purchase path.
|
|
|
|
## Voice / IP Phones
|
|
|
|
- Yealink SIP-T54W fleet (16 devices) — see `docs/yealink-phones.md`
|
|
- YMCS portal: <https://us.ymcs.yealink.com/manager/sip-product/sipManage>
|
|
|
|
## Open items
|
|
|
|
- **[PRIORITY] HP ProLiant iLO reconfiguration** (2026-04-22 emergency: factory reset, needs credentials/network setup)
|
|
- **[PRIORITY] Verify all HP server BIOS settings** post-corruption recovery
|
|
- **[PRIORITY] UPS assessment** for HP server (power outage caused NVRAM corruption)
|
|
- Confirm UPnP state on UDM (2026-04-13 recommendation — still not verified)
|
|
- Document intended RDWeb access pattern (who connects from where) — superseded partially by 2026-04-16 VPN-only decision, but formalize
|
|
- Add Valleywide entry to SOPS vault (SOPS vault now has `clients/vwp/*` entries: adsrvr, dc1, udm, xenserver, quickbooks-server-idrac — superseded)
|
|
- RDS CALs purchase (see above)
|
|
- Rotate `scanner` AD account password (carried from 2026-04-13)
|