有哪些TPAM的功能會使用WMI? 為何會用使用49154, 49155 port 連接受管目標主機?
最近有使用TPAM的客戶，在防火牆端發現TPAM appliance連接到受管目標主機，而連接埠號是 49154 and 49155，進而詢問這個現象的原因。以下對此狀況做一分析與說明。
一般TPAM PPM (Privileged Password Management) 的功能，像是修改作業系統帳號密碼，會使用這些連接埠:
Windows Active Dir: TCP/389, TCP/445
Windows, Windows Desktop TCP/445
而當使用下列功能的時候，TPAM會使用WMI/DCOM access target，沒有強制關閉的方式。
簡單測試:
1. 沒有寫Computer Name，做 Test System，則TPAM會使用TCP/135, 49154 連接PSD-SQL1
2. 有寫Computer Name，做 Test System，則TPAM使用TCP/445 連接PSD-SQL1
參考資訊:
1. How to configure RPC dynamic port allocation to work with firewalls
2. https://support.oneidentity.com/kb/123021/ports-used-by-windows-or-windows-active-dir-platforms
3. https://support.oneidentity.com/tpam/kb/230930/which-tpam-features-use-wmi-and-which-do-not-
49154 and 49155 是 Windows Server 內部定義的RPC dynamic port，當TPAM使用TCP/135和受管目標主機初始連接後，接下來會使用RPC dynamic port來做後續的連接。
WMI / DCOM from DPA/TPAM will need access to TCP/135 to initiate communication on the target. The subsequent conversation then continues on a random negotiated port.
On Windows 2003/XP this would be in the range 1025 - 5000 on Windows 7/Windows 2008 and above : 49152 - 65535.
On Windows 2003/XP this would be in the range 1025 - 5000 on Windows 7/Windows 2008 and above : 49152 - 65535.
一般TPAM PPM (Privileged Password Management) 的功能，像是修改作業系統帳號密碼，會使用這些連接埠:
Windows Active Dir: TCP/389, TCP/445
Windows, Windows Desktop TCP/445
而當使用下列功能的時候，TPAM會使用WMI/DCOM access target，沒有強制關閉的方式。
- Managing service account passwords ("Change password for Windows Service started by this account" ticked)
- Managing scheduled task passwords ("Change password for Scheduled Tasks started by this account" ticked)
- Restarting a service ("Automatically restart such Services" ticked)
- Using Account Discovery on the target
- Using Event Capture on PSM sessions (Privileged Session Manager)
- Restarting a service ("Automatically restart such Services" ticked)
- Using Account Discovery on the target
- Using Event Capture on PSM sessions (Privileged Session Manager)
1. 如果要避免TCP/135, 49154, 49155 的使用，請確認沒有使用上述五項功能。
- 請確認每套windows server的 System->Deteils->Information-> 填寫Computer Name(用大寫英文字母)
簡單測試:
1. 沒有寫Computer Name，做 Test System，則TPAM會使用TCP/135, 49154 連接PSD-SQL1
2. 有寫Computer Name，做 Test System，則TPAM使用TCP/445 連接PSD-SQL1
參考資訊:
1. How to configure RPC dynamic port allocation to work with firewalls
2. https://support.oneidentity.com/kb/123021/ports-used-by-windows-or-windows-active-dir-platforms
3. https://support.oneidentity.com/tpam/kb/230930/which-tpam-features-use-wmi-and-which-do-not-
留言
張貼留言