{"action":"created","issue":{"url":"https://api.github.com/repos/EvanAnderson/ts_block/issues/14","repository_url":"https://api.github.com/repos/EvanAnderson/ts_block","labels_url":"https://api.github.com/repos/EvanAnderson/ts_block/issues/14/labels{/name}","comments_url":"https://api.github.com/repos/EvanAnderson/ts_block/issues/14/comments","events_url":"https://api.github.com/repos/EvanAnderson/ts_block/issues/14/events","html_url":"https://github.com/EvanAnderson/ts_block/issues/14","id":16158387,"number":14,"title":"Find workaround for logging changes when the \"Security Layer\" is SSL/TLS","user":{"login":"EvanAnderson","id":1017167,"avatar_url":"https://avatars.githubusercontent.com/u/1017167?v=3","gravatar_id":"","url":"https://api.github.com/users/EvanAnderson","html_url":"https://github.com/EvanAnderson","followers_url":"https://api.github.com/users/EvanAnderson/followers","following_url":"https://api.github.com/users/EvanAnderson/following{/other_user}","gists_url":"https://api.github.com/users/EvanAnderson/gists{/gist_id}","starred_url":"https://api.github.com/users/EvanAnderson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/EvanAnderson/subscriptions","organizations_url":"https://api.github.com/users/EvanAnderson/orgs","repos_url":"https://api.github.com/users/EvanAnderson/repos","events_url":"https://api.github.com/users/EvanAnderson/events{/privacy}","received_events_url":"https://api.github.com/users/EvanAnderson/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2013-06-28T19:49:52Z","updated_at":"2016-12-09T14:56:05Z","closed_at":null,"body":"When an RDP client that supports SSL/TLS (rather than only \"RDP\" security, as was the case with older clients) fails authentication to the RDP server an IP address for the client won't be logged when the NtLmSsp security provider is used.\n\nArguably, SSL/TLS is a Good Thing(tm) (see http://technet.microsoft.com/en-us/magazine/ff458357.aspx) for details and I am wary of other invalid RDP logon block products suggestions to force the security layer to \"RDP\" (see http://rdpguard.com/windows-server-how-to-catch-failed-logons.aspx) because, while it does cause IP addresses to be logged, it prevents useful features (like mutual authentication) from being used.\n\nThe \"Cyberarms IDDS\" product came up with a workaround that allows the SSL/TLS security layer to remain enabled while still being able to log IP addresses. I'm going to look at their product to see if I'm able to determine what they're doing, however anything that involves compiled code is probably going to be above my interest level for ts_block.\n"},"comment":{"url":"https://api.github.com/repos/EvanAnderson/ts_block/issues/comments/266032735","html_url":"https://github.com/EvanAnderson/ts_block/issues/14#issuecomment-266032735","issue_url":"https://api.github.com/repos/EvanAnderson/ts_block/issues/14","id":266032735,"user":{"login":"EvanAnderson","id":1017167,"avatar_url":"https://avatars.githubusercontent.com/u/1017167?v=3","gravatar_id":"","url":"https://api.github.com/users/EvanAnderson","html_url":"https://github.com/EvanAnderson","followers_url":"https://api.github.com/users/EvanAnderson/followers","following_url":"https://api.github.com/users/EvanAnderson/following{/other_user}","gists_url":"https://api.github.com/users/EvanAnderson/gists{/gist_id}","starred_url":"https://api.github.com/users/EvanAnderson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/EvanAnderson/subscriptions","organizations_url":"https://api.github.com/users/EvanAnderson/orgs","repos_url":"https://api.github.com/users/EvanAnderson/repos","events_url":"https://api.github.com/users/EvanAnderson/events{/privacy}","received_events_url":"https://api.github.com/users/EvanAnderson/received_events","type":"User","site_admin":false},"created_at":"2016-12-09T14:56:05Z","updated_at":"2016-12-09T14:56:05Z","body":"Interesting. I have failure auditing for \"Audit account logon events\" and \"Audit logon events\" enabled. \r\n\r\nJust to confirm, you're seeing this logged on Windows Server 2012 R2 w/ default RDP security layer settings -- correct?"}}
{"actor":{"display_login":"EvanAnderson"}}