Disabling TLS 1.0

Recently I had to deal with an issue where the f5 load balancer had turned off any incoming and outgoing TLS 1.0 traffic which caused a system wide outage for a set of identical machines across the company.

We were in a time crunch since the change has already been implemented and had to be rolled back. We were given 2 weeks to determine the root cause, come up with a solution and apply the fix before mgmt will be forced to decide whether to move on with the TLS 1.0 traffic denial to meet the deadline or hold off.

At first logically, we thought maybe the TLS and SSL settings within the systems are to be blamed. But that wasn't the case, the settings for the most part was the default IE 11 settings.

While troubleshooting, we discovered the issue only happened when logged in with a particular service account. When logged in as an admin, the issue on the same machine doesn't appear to be happening. (I think you can already see where this is going).

https://technet.microsoft.com/en-us/library/dn786418(v=ws.11).aspx#BKMK_SchannelTR_TLS11

The link above discusses how to enable/disable TLS/SSL settings on a machine via system registry. NOTE: even if you made changes in a system via the IE Properties, those changes will not show up in the registry.

So, from the article above I thought Ok, we will simply disable TLS 1.0 in the system and that will resolve the issue. To disable TLS 1.0 do the following:

1. Open registry.
2. Local Machine\SYSTEM\CurrentControlSet\Control\SecurityProvider\SCHANNEL\Protocols
3. Create a subkey Client.
4. Create the DWORD entry Enabled and set the value to 0. BTW, to disable it is 0 and to enable set it to 1.

Crossed my finger hoping this will force the system to using anything other than TLS 1.0. Nope!
It didn't work. Issue still persist with the below error screen:

So, the search continues. Thanks Google!

BTW, we were able to determine via a packet capture (thanks Wireshark) that for each web request the system would start with TLS 1.0 request first. It's suppose to be the other way around. The request always start top down, from TLS 1.2 and down.

Then I stumbled across this article below from MS:

https://support.microsoft.com/en-us/help/3140245/update-to-enable-tls-1.1-and-tls-1.2-as-a-default-secure-protocols-in

Basically this article describes how you can force a system to use either TLS 1.2 or 1.1 via registry. Below are the steps to do just that:

1. Open registry
2. Local Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHTTP
3. Here add the subkey DefaultSecureProtocols and enter the desired value.

If you want the option to use both TLS 1.2 and 1.1, you can just add 0x00000A00.

Within the same article, there's also the option to Download the fix and apply it to the system. However, I didn't like this particular solution.

I didn't like the solution because it is forcing a system to use a specific protocols for each request which means, I will have to have that documented and that piece of info will have to be passed on for anyone other than me in future responsible with this particular platform. Also if any changes were decided upon in future with TLS settings like this time, we will be revisiting the issue again.

So the search continues. And that's when I noticed the Note section right below the Download button within the same article.

Hmmm, interesting.

I immediately had a feeling that the particular User(Service) account that's having the issue has an entry for that subkey. I took the below steps:

1. Open registry.
2. Load the user hive.
3. Browse out to: Software\Microsoft\Windows\CurrentVersion\Internet Settings
4. And lo, behold! There it is. There's an entry for SecureProtocols.
5. I deleted the entry and voila, we are up and running like nothing ever happened.

Bottom line: instead of disabling the TLS 1.0 in the system and create a subkey DefaultSecureProtocols which would force the system to use either TLS 1.2/1.1, I simply deleted the SecureProtocols entry within the user account where the issue was.

Being Thankful to our parents

Yesterday, talking to my dad he reminded how in high school I used to cover my head over minty hot water to take in all the steams.

For a moment, I was thinking really?! I did that? Can't remember why? Maybe clear my voice for singing?

Anyway, since moving to NC each Spring I have been continuously coming down. This time was no exception. I came down hard on Saturday night around 2.35am and it has been non stop suffering.

So, he suggested I try that to sooth my pain from cough. Around 6.am I woke up and was greeted with some good old cough and I am not even a smoker anymore. Ran downstairs, drink some water, no good. Take some med, still no good.

Going thru the pantry trying to find some Halls and no luck. That's when I remember our (me & dad) convo from yesterday. Put up some water on the stove with the intention to drink some hot tea with some fresh ginger in it. As the water starts to boil, I stand tall over it just inhaling the steam, kinda like a steam bath but more efficient and economical.

Wow, slowly I start to feel much better. The cough subsides. Now, that could be either because of the prescription med or the steam from the ginger hot tea. That's yet to be experimented on and determined.

Either Thanks dad.

BTW, I was able to manage a good 3 milers in yesterday. It's funny. My leg and body is still ready but my lung says otherwise, wheezing like a old man from the damn cough.

Hiking Latta Plantation the Second Time

April 24, 2016:

Since I wasn't able to head out to either Stone Mountain, Uwharrie or Kings Mountain, I decided to head over to Latta instead.

It was also later in the day. Due to time constrain, I hike about 6.45 miles in 1 hour and 57 minutes.

This time due to the challenge of the Cove trail, I started off on my right side after parking the car. Started off on Hill Trail to Cove Trail connector and on.

Things I learned:
1. I certainly prefer a banana during the hike. It seems to rejuvinate the mind and body.

Hiking at Latta Plantation

April 10, 2016:

In preparation for the Grand Canyon and Zion National Park hike, this is the first extensive hike I did. I used Runkeeper to track my progress.

I hiked about 14.08 miles in 4 hours and 31 minutes.

This hike taught me a lot on items I should carry, I would need. My style of hiking and such.

I started about 7am in the morning, keeping in mind when the gates are opened.

After parking the car, started off on my left side of the trail. This is the trail, I mostly run o. Hill trail to shady trail. What got me, was I kept deviating from the map to explore other sceneries.

When you are running, you are brushing through the landscape, and it is hard to take in the beauty of a place. But hiking certainly opens up all of the senses.

The last leg of the hike certainly kicked my butt quite a bit. I didn’t expect Cove trail to be such rocky. Pretty much the whole trail is rocky and there’s also a sign warns on that.

Things I learned on this hike:

1.       I like to have a headphone on during the hike but not listen to anything

2.       I like wrapping a hotel around my neck

3.       I have a bad habit of not taking break, practically at all.

Coming back

I have been away for quiet some time now. I am going to interject myself again.

I am going to break up the blog in 3 different category.

Main Page: Will blog about most stuff as well as any miscellaneous topic can stay here.

Running & Biking (R&B): ah...running, my biggest passion. Also when I say biking, it is motorcycle and not bicycle.

Startup & Tech (S&T): things I am learning as I working to start my own business. Also technical stuff I am learning at work.

I am also going to tie this blog with my professional Google profile.

So, stay tune. More to come. Till then here's a pic of one of our newest member:

Rescued Husky

Few days ago, I am driving home during lunch hour to log in from home. As I get close to our house, I see a Husky walking down the main road, without an owner.

Immediately I realize, he must've escaped and now lost. So, I turn on the emergency light, pull up to the side of the road and call him to me. He comes up. Which tells me he's OK with other people. He's panting quiet heavily. I pet him for a while to calm him down. Check the dog tag, and call the owner. No one answers the phone, so I leave a voicemail.

Not wanting to leave him by the side of the road, I pick him up in our car, and get home. Once home, I am not sure if he is good/OK with other dog. So, I ask my wife to hold Hunter. I put the leash on him and bring him inside. Put our dog in crate, since the Husky won't go in the crate and our  dog is too excited to sniff/check out the new dog.

I give the Husky some water, and treats. He comes down quiet a bit. In between this, we found another number and get a hold of the owner who actually happens to leave few doors down from us. I talk to the owner and ask her if his dog is OK with other pet. Once she confirms, I let both of them loose. They start checking each other out, both of them pees on the carpet and the Husky (Dallas) immediately establishes itself as the Alpha.

Hunter playing with Dallas

Flatulent Guy on the Plane

A lot of has been going on since my last post. Lately, as much I want to post about different things I have been doing, just can't find the time to do it.

To start off, me and my cousin we made an attempt to hike up and back to Mt. Mitchell from Black Mountain Campground. We weren't sure if we would be able to do the whole thing, specially the first hour was the most challenging. But we did it. Lesson: start early so you are back by daylight and not hiking through dark, falling 3 times like me. We got tied up on other things for too long. Also rationing food is a must during break and salt cracker is a life saver. When you start the ascend, you might feel a light headache. I felt like I am about to get a headache, best thing to do at that time is to simply breath and be quiet. Below is the video of our journey.

https://www.youtube.com/watch?v=hVGYHhEFOPU

We both are thoroughly excited and have talked about Rim to Rim next year and back country at the Yellowstone the year after.

At the moment, getting back home from a week long summit at work. Several thing were discussed, and one of the big topic was 'Office of the Future.' Not so much what it would look like, but how the end users will do their work. No pointer/solution came out of it. It was more along the line, hey I am working on this just so you know.

My proposal, look at it from a gamers perspective. A gamer wants to play game, he/she has preference on what kind of game to play. Imagine the end user as a gamer. Now, the gamer can play certain games on either PC, Wii, Xbox or PS. Depending on which system meets the need, the gamer will choose a system to play on. So, how can that be applied on corp world. Offer three/four delivery system to the end user to get their job done. User can pick which system they want to work on, but the delivery, experience should be consistent, seamless for the user.

I will into more detail in terms of the system that I believe will be viable. But we see the same approach on other places. Take flying for example. Several airlines offer service. The job is the same on each company, deliver customer and goods to destination. Users pick airlines depending on many factors.

Speaking of flying, on the way to layover had to sit next two a flatulent guy sandwiched between me and another guy, who was drunk, passed out, passing gas and who knows what else. We both were just hoping he doesn't throw up.