Debug code security .net framework to use caspol.exe - c#

We have an application that is distribute to a varity of customers. Sometime it is installed on a network share. Usually we can give that application access with caspol.exe and grant the LocalIntranet Zone FullTrust. Sometimes the customers admins do not manage to grant that application access due to some network settings.
When we launch the exe it opens for a short time and appears in the Client Task Manager and disappears silently... now the question is there a tool which gives me some debugging or tracing details on that. Is there a tool to debug security issues like that... I assueme that this happens before any of my code is executed... and I do not see anything in the event trace neither on the client nor on the server...
Any ideas?

Can I recommend - perhaps look at ClickOnce - a click-once application can be hosted on a network share, but has much better security deployment factors. You just run the .application rather than the .exe (VS2005 and VS2008 have all the tools you need to publish a ClickOnce application trivially).
Also - in one of the recent service packs (perhaps with 3.5 SP1), I believe that mapped shares get more priveleges - so \\foo\bar\my.exe would still error, but f:\my.exe (to the same location) should work.

We're having similar issues with our applications which are usually placed on a network share. We're solving this issue by:
signing and timestamping all application components with Microsoft Authenticode certificate issued by Thawte.
deploying msi package containing security policy granting full trust to applications signed by our certificate.
If your company will not / cannot buy code signing cert, you can install a CA somewhere and issue cert for that purpose only ( I think it will work altough this cert will not resolve to trusted root. )
The other option, with a lot more hassle would be to strong-sign all assemblies, and grant full trust to all assemblies signed with that key.
Both approaches result in performing procedure once per workstation ( updated applications will still work ). I think it can even be propagated throughout the enterprise somehow, but never did that and don't know details.

Related

Desktop applicaton not opening after installation in client system

I am currently working with visual studio 2017 with 4.6.1 .net framework. I created setup file for my desktop application the setup installs and runs perfectly in my system. The issue is that the setup installs successfully in other computers but the application not getting opened.
edit
Downloaded .net framework in client system but still same issue occurs.
edit 2
I ran a dependency scan using Dependency walker. It said there were a bunch of files the system could not find - error opening file. The system cannot find the files specified.
API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL
API-MS-WIN-CORE-WINRT-ERROR-L1-1-0.DLL
API-MS-WIN-CORE-WINRT-L1-1-0.DLL
API-MS-WIN-CORE-WINRT-ROBUFFER-L1-1-0.DLL
API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL
API-MS-WIN-SHCORE-SCALING-L1-1-1.DLL
DCOMP.DLL
IESHIMS.DLL
Also, there was an error with modules with an x86 type found - including the setup.exe - but I am unaware how this happened. I have selected 64 wherever I saw the option listed. Please find the screenshot. If this is indeed the issue, how do I solve this?
Application Launch Problems: Here is a short version: WPF application crashes when I launch. Chattier version. Nice one from Martin Prikryl: Application does not work when installed with Inno Setup
Logs: Always check all event logs, application logs and MSI logs - if available. Just to mention it. Maybe try to attach debugger for testing as described here - provided the application gets off the ground at all. Then step through code.
The Usual Culprits: You probably just lack a runtime (example), have a bitness problem (32/64-bit) or insufficient permissions / privileges, or configuration errors (ini, xml, registry, etc...).
To summarize - torpedos, full spread below - nothing too dumb not to mention :-):
Missing Runtimes: First, always check for missing runtimes. For example: .Net, .Net Core, Java, Silverlight,
Direct X (used even for applications now), VC++ Runtime, MS-XML (legacy), etc.... Remember that they come in different versions and some can not co-exist on the box whilst others
can run side-by-side.
Error Code: Looking up error codes and exception messages.
"The Magic Number Database" - online lookup.
Checking Error Codes - several tools and approaches.
Debugging Tools: Some information on debugging tools.
Tools to debug dependency issues - ProcMon.exe, VS, Dependency Walker, etc...
COM dependency errors
Essential service debugging tools:
Event Viewer, Task Manager, Services.msc
Process Explorer, NET command, SC.exe
Windows Services Frequently Asked Questions (FAQ)
ProcMon.exe: The tool of the trade. The one-size-fits-all
tool. The bee's knees, the topper-most, the quantum leap, the cat's
pajamas (yes, it is a Top Gear Hamster allusion). It can be a challenge to use it effectively, but it is the
best general-purpose debugging tool that is free.
Quick, Rudimentary Sample
Hanselman's longer video sample
Other Ideas:
Configuration Settings?
Dev-box sins: Hard coded references? Test Servers / UAT links?
Manifests, INI files and XMLfiles?
Registry settings? HKLM / HKCU
Connection strings. See Authentication & Authorization section below as well.
Platform & Bitness? (ARM, Intel 32 / 64, etc...).
Very common to read from wrong registry hive (the classic time waster):
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\MyApp\MySettings (32-bit)
HKEY_LOCAL_MACHINE\SOFTWARE\MyApp\MySettings (64-bit)
Prerequisites & Dependencies?
On the topic of dependency scanning and debugging.
Dependency Walker: Types of dependencies.
Does Fuslogvw.exe tell you anything? (.NET assembly binding failures for a .NET application). How the Runtime Locates Assemblies
Quick check: Visual Studio modules view
Missing / Broken Registration (indirect dependencies)
Missing COM, COM Interop (regasm.exe), registrationless COM (manifest based)
Calling a .NET Component from a COM Component
Calling COM Components from .NET Clients
Broken Side-By-Side Win32 Assembly Manifest (obscure, can be caused by sloppy corporate application repackaging, may strike seemingly random PCs)
GAC installation?
Two GACs exist.
GAC / WinSxS Commit Issues: GAC / WinSXS files don't get installed into the GAC until the commit phase which is after StartServices.
Permissions & Privilege? - local - ACL permissions and NT privileges?
ProcMon.exe
Resolving Permission Denied:
System.UnauthorizedAccessException while running .exe under program files
WiX after installation my exe file doesn't work by double click, only run as administrator work
Authentication / Authorization - network related
Local user, domain user, Active Directory: group membership, group policy, etc...
Launching User: User profile issues? Maybe try with another user logged on where it fails?
Authentication Mode: Windows Authentication. SQL Server Authentication, etc...
General Network & Proxy issues? (proxies, WINS, DNS and all the complexities involved in networking. UNC paths reachable?)
Licensing? (conceivably related to hardware dongles and drivers)
Security software interference? (software / hardware firewall, anti-virus, encryption tools and suites, etc...)
OS version or edition? (Windows 7 problems)
Localization? Non-English systems?
Drivers?
Hardware?
Encoding?
System corruption? (wrong time, disk errors, file and path names are too long, disk full, "wrong something")
Target Machine Nature? Virtuals? SOE? Are the target machines real machines? Test machines?
Locking / Blocking / In-Use files and registry keys?
Malware? Can cause practically anything in terms of problems.
Links:
WiX Toolset PermissionEx Problem - App Does Not Run After Installation
EXE file is not working
make sure that the 4.6.1 .net framework is installed on the client system.Because the application requires .net frame work installed on the computer
To successfully deploy an application, you must also deploy all components that are referenced by the application.View the Deployment Process
Users might need administrative permissions or similar user permissions on the computer to install bootstrapped components. For ClickOnce applications, this means that the user might need administrative permissions to install the application regardless of the security level specified by the application. After the application is installed, the user can run the application without administrative permissions.
I am assuming you and your client are running install and application run as Administrator.
Possible root cause:
System prerequisite is not meet, you should check all dependencies is ready on the target client system, or add the prerequisite to your installation guide
Privilege issues, you might copy files or change registry locally with administrator rights, but the client is not. If so, you need change files to "C:\Users{username}\AppData\Roaming" or install with administrator privilege on the client system.
In such a situation, app possibly crashed in client system:
Check your application log if any errors
Check windows Log if any errors
Dump system info using WinDbg.exe and debug it
I also faced that kind of problem before.
Just try to install another location not inside the program file of C:\ Drive. You may choose different drive or you may install in C drive also but not inside the program files.

VSTO Outlook Deployment - ClickOnce

I have written a very simple add-in that adds a button to the ribbon of outlook (C#).
I have spent days trying to get this very simple add-in to install on another machine using the clickonce method.
I have published clickonce to ftp using Visual Studio. All fine so far.
Upon running the resulting vsto (or setup.exe) on a different machine I am getting the error:
'System.Security.SecurityException: Customized functionality in this application will not work because the certificate used to sign the deployment manifest for Add-In or its location is not trusted. Contact your administrator for further assistance.'
I understand the idea behind a certificate being required to remove rogue add-ins being added to Outlook. I have signed the clickonce deployment using a test certificate on my machine.
Simply is it possible, without paying for a third-party certificate, to give a user the clickonce url and them install it without me having to do anything to their machine? (and/or domain etc.) This is ideally to be used by lots of enterprise users. Altering their environment isn't practical.
Many thanks.
Check your certificate chain. Most likely you need to place a copy of the certificate into:
Certificates - Current User\Trusted Root Certification Authorities
...so your "issuer" is trusted in order for your certificate to be trusted.

Deploy security warning

I have created several applications, these are deployed on the server and will be opend by the user from the network.
Each time a user opens a application they get confronted with a security warning:
Open File - security warning
We can't verify who created this file. Are you sure you want to run this file?
Is it possible to supress this message by code?
I found an article that says I need to Sign the application but unfortunately this is not help. Another article I found says I need to manual change the security level, but that is not what I want.
I just want Windows to trust my applications.
You have to sign your application with an so called "Microsoft Authenticode Certificate". Furthermore you need to register the Certificate as Trusted Publisher on all affected machines (easy if you are in an business environment with an Active Directory).
You could use the Windows Certificate Snapin (press CTRL + R and type Certmgr.msc) to display all installed certificates on your machine. There you will find a folder named trusted puplisher. However this is only possible in business environments where you have some kind of control over the network (active directory etc.). If you're distributing your application over the internet you will have a hard time ;)
Remember, certificates are about trust and there is a reason for this warning because an *.exe file could indeed harm your computer.
EDIT:
helpful post about Microsoft Authenticode Certificates

Silverlight browser-in app doesn't work in different machine

I have a Silverlight application executed within a browser that uses the scanner by WIA, I configured my server and my client (I allowed Silverlight to elevated trust in browser,
I signed the xap after I installed the certificate into Trusted Editors and Trust root (into the machine store) , change the registry value,etc all wich it's specified in http://support.leadtools.com/CS/forums/40466/ShowPost.aspx) and when I've published in my local IIS and I load the test page from the same machine: the application works but when i've tried to access to the page from another machine (with internet explorer with a low secured settings and Runned as administrator) I got the exception with the message this operation is not supported in the current context.
what's wrong?
can you help me?
Thanks in advance!
Here is the official Microsoft guide for allowing elevated trust in browser:
http://msdn.microsoft.com/en-us/library/gg192793(v=vs.95).aspx
See: 1.Configure the target computers to allow trusted applications inside the browser by setting the following registry key:
And I don't think you can use a self signed certificate.
Maybe you have to install the certificate on each individual machine you intend to use the app on?
The certificate may work fine run from local host as it uses the test certificate, but is different when accessed from the server.
This would make sense as the elevated trust setting is made for enterprise use.
Check this blog post out, it's a really good guide on how to set up a trusted app.
Silverlight 5 Trusted applications

.NET C# running application from UNC results in error

I have an application which does not read ANY files from the local disk or does not try to write anything.
It runs perfectly on the local filesystem, but it needs to run on a few 100 workstations, so I put it on a share on a Win2003 server.
But when I try to start it on a XP workstation from the UNC:
system.io.fileloadexception
What can be the issue here?
The issue is that the XP machine is likely running an earlier version of .Net 2.0. Up until 3.5 SP1 it was a violation of CLR security policies to run a .Net application from an UNC share. To do so you must tweak the CAS (Code Access Security) policy on the local machine. Starting with 3.5SP1 this requirement was removed.
More Details:
http://geekswithblogs.net/robz/archive/2008/08/19/.net-framework-3.5-sp1-no-more-need-for-caspol-on.aspx
Only applications on the local file system have full trust to run. Try following the steps on this site:
http://dotnetdud.blogspot.com/2009/01/how-to-give-file-share-fulltrust.html
.Net code access security might be one of reasons. You can adjust it in thru control panel and change the settings for "Local intranet" zone. The best solution is to create a custom policy, however.
it is because of limited permissions. as far as i remember, if you go to explorer and find that exe, right click on it, you will see tab for extending permissions for app.

Categories

Resources