☰

使用 Windows 防火墙允许/阻止特定的 RPC 接口 UUID

tag-icon • tag-icon windows security firewall windows-firewall
使用 Windows 防火墙允许/阻止特定的 RPC 接口 UUID

是否可以使用 Windows 防火墙阻止/允许某些 RPC UUID？

例如，Active Directory 域控制器复制通过 TCP 使用 RPC 进行，通过drsuapi 和 dsaop RPC 服务器分别使用 UUIDe3514235-4b06-11d1-ab04-00c04fc2dcd2和7c44d7d4-31d5-424c-bd5e-2b3e1f323d22。我想创建一个规则，仅允许来自域控制器和 IT 管理员子网的流量。允许全部RPC 流量太广泛，因为这会大大增加攻击面，因为 Windows 暴露了许多其他 RPC 服务器（例如 DCOM 或任务调度程序）。有什么方法可以限制此级别的流量吗？

答案1

是的，您可以使用命令执行此netsh rpc filter操作，但文档和示例很少。最好的文档是 netsh help：

netsh rpc 过滤器添加条件/？

Usage: add condition [field=]<string> [matchtype=]<string> [data=]<string>

Parameters:

       Tag           Value
       field       - One of the following values:
                     For layer = um
                         if_uuid if_version if_flag dcom_app_id image_name
                         protocol auth_type auth_level sec_encrypt_alg
                         sec_key_size remote_user_token local_addr_v4
                         local_addr_v6 remote_addr_v4 remote_addr_v6
                         local_port pipe
                     For layer = epmap
                         if_uuid if_version protocol auth_type auth_level
                         sec_encrypt_alg sec_key_size remote_user_token
                         local_addr_v4 local_addr_v6 remote_addr_v4
                         remote_addr_v6 local_port pipe
                     For layer = ep_add
                         process_with_if_uuid protocol ep_value ep_flags
                     For layer = proxy_conn
                         server_name server_port proxy_auth_type
                         client_token client_cert_key_name client_cert_oid
                     For layer = proxy_if
                         if_uuid if_version server_name server_port
                         proxy_auth_type client_token client_cert_key_length
                         client_cert_oid
       matchtype   - One of the following values:
                     equal
                     greater
                     less
                     greater_or_equal
                     less_or_equal
                     range
                     all_set
                     any_set
                     none_set
       data        - Value associated with the field paramter.

Remarks: Adds a condition to the RPC firewall rule.

Examples:

       add condition field=if_uuid matchtype=equal
                     data=11111111-1111-1111-1111-111111111111
       add condition field=protocol matchtype=equal data=ncacn_ip_tcp

netsh rpc 过滤器添加过滤器/？

Usage: add filter

Remarks: Adds an RPC firewall filter.
         A rule and one or more conditions must be added
         before adding a filter.


Example:

       add filter

netsh rpc 过滤器添加规则/？

Usage: add rule [layer=]<string> [actiontype=]<string> [[filterkey=]<string>]
             [[persistence=]volatile] [[audit=]enable]

Parameters:

       Tag           Value
       layer       - One of the following values:
                     um
                     epmap
                     ep_add
                     proxy_conn
                     proxy_if
       actiontype  - One of the following values:
                     block
                     permit
                     continue
       persistence - Filter will be persistent.
                     This is the default.
       filterkey   - Uuid to uniquely identify the RPC firewall filter.
       audit       - Enable auditing for this filter
                     Only permit action type is allowed for audit rules.
                     Audit rules are not allowed at ep_add layer.

Remarks: Adds an RPC firewall filter rule.

Examples:

       add rule layer=um actiontype=block
       add rule layer=epmap actiontype=permit
                filterkey=11111111-1111-1111-1111-111111111111

我在网上找到的例子只有几个，其中一个是此知识库文章格式搞乱了，但我碰巧有一个格式化的快照：

netsh 示例

这两篇文章也有一些有趣的信息：

https://support.microsoft.com/en-us/help/838191/list-of-remote-procedure-call-rpc-fixes-in-windows-xp-service-pack-2-a

https://docs.microsoft.com/en-us/windows/desktop/rpc/load-balancing-best-practices

相关内容