SharePoint Security – State of the Union

SharePoint Security – State of the Union

A call to action regarding SharePoint and Security

Citizens of SharePoint!
I would like to say a little something about SharePoint and Security.
The usual focus when talking about IT and Security is technical aspects of security, it is a global phenomenon and it has always been like that. My most private thinking on the reasons for this is, that technical solutions simply are a lot more fun than the boring processes and policies. Take a Windows laptop for example, when discussing security it always comes down to Bit locker instead of discussing how you work to be secure.
SharePoint is no different, but in the SharePoint industry I feel that we have taken it even further, we do not even feel that Security is that much fun, or even that important maybe, the SharePoint community feels that custom solutions and architectural designs, maybe even corporate branding are a lot more fun than any aspect of Security.

Titanic, the unsinkable ship that sunk

In my personal opinion this is a shame and my hope is that this will gradually change in the future toward a more Security aware SharePoint community.
Developing new solutions, new custom applications and designing the world’s most elaborate SharePoint architecture will for a while yet I realize, be more interesting to the individual engineer than promoting the importance of keeping your local admin groups clean and why you should not logon using the farm account, for the most experienced Certified Master same as for the SharePoint IT-Pro beginner.
This is a fact and the risk is that we will start to see downsides from this as SharePoint for real has by now, found its rightful place in most every company’s infrastructure, all over the world.
Now you are probably starting to wonder how I can be so bold to state these things unfounded and without proof? You are probably thinking that you yourself is not like that, you do care about Security and all this is just about everyone else, if even that. Maybe some of us are better and some are worse, but we can all do better.
I have a feeling and I have some proof:
– I have for a while now worked dedicated with SharePoint Security, reviewing existing SharePoint environments and designing and implementing fresh new environments. During this period I have yet to come by a Security aware design of a SharePoint environment (my own designs excluded obviously).
– I have customers that have come to me and stated that part of the reason that they have contacted me, is that there simply is no other partner that focuses on SharePoint and Security and that can offer the services that I do. I am according to my customer, without competition, at least in my part of the world.
– I have seen from the SharePoint conference participant surveys, that of all of the topics that the participants want to hear more about next year, Security is always at the very bottom of the list.
– The number one rated and watched session at TechEd this year, was about hacker tools…

I may be wrong but I doubt it, security is not really on our agenda.
In my experience, all of us in this larger and larger SharePoint community, should pay a little extra attention on Security in all that we do. Not only in the Security technical aspects that we implement because we have to, take for example Kerberos authentication (Link to guide). Kerberos is a great Security feature that will enhance the Security in most SharePoint environments, but not many implementations have been made for the Security aspects of it, but for the simple reason that a double-hop scenario required it and thus it was implemented (visit my blog for an easy step by step guide to Kerberos in SharePoint).
Also, many, many SharePoint environments out there are setup by developers, I beg your pardon developers, but your focus is often to get a working test and development platform up and running, not to make it secure and stable. Also, after a solution has been developed and tested for functionality, your job is often done. The result is often something that is less than perfect in terms of Security.

It would be really nice if we could all help to change this, if we could all do just a few things that will in fact make the SharePoint environment more secure or at least, make it harder to penetrate and easier to keep track of.

I have made a list of things that we could all easily think of and do, and that would help SharePoint Security awareness.

Keep the number of local server administrators down to a minimum (0).

In most SharePoint environments we can assume that a local server administrator can get access to all of the content in SharePoint. Use domain groups, add an individual’s user account only as needed and remove when he/she is done.
You’ll find a command at the end that will show you a course list of the members of the local administrators group.

Do not disable the Loopback check on your Web servers.

This is a great Security feature, it will make life a little harder on a possible intruder, so why disable it. Add the URLs you need instead. If you buy a house and it has an alarm installed, you do not disable it, you grant access to the members of your family. Also worth mentioning, you should always avoid browsing from the server, but some features like search may depend on accessing the local server so a configuration may be the best answer.
You’ll find a PowerShell script at the end how you can easily configure it to allow the URL’s you need instead of disabling it completely.

Disable the SQL authentication and especially the SA account.

These account are completely unmanaged and unmonitored, it is a popular backdoor for any hacker.
They are rarely used and when used often by legacy applications, if they are, find out why and reconfigure or put the legacy app on a separate instance or server.

Never use Shared accounts (Never ever!).

I still see people defending the ‘setup account’ (shared installation and configuration user) and they state that it is given special permissions that are required later on. Operations people with a lot of people coming and going often use a ‘server monitor’ account that can be borrowed and used to get easy and fast access to the server. It is often a local account and often has a password that is well known by all…
In my opinion, there is never or very rarely a reason to keep a shared account. If you absolutely feel that you must, use a domain account and more importantly, disable it when it is not used. Also, change the password regularly.

Keep the Windows Firewall On (Ports-Link/Conf-Link).

Need I even explain this? It is however a sad fact that it is often disabled even in a production environment. It should be used and on in all environments, the development environment would else make an easy target for the evil hacker.
Configure it even during development, there are many ways to do it, PowerShell may be the simplest, check my blog blksthl.com on how to.
If you don’t do it right away, you or your customer will most likely forget to enable and configure it when you are done.

Keep the IE ESC On – Internet Explorer Enhanced Security Configuration.

A server is not really meant for us to browse SharePoint sites or the internet, use a client machine or a separate test server if you have to. If you MUST browse from this particular SharePoint server, disable it for admins only and enable it when done.
You’ll find a PowerShell script at the end how you can easily configure it.

Use HTTPS on Central Administration site.

Often, too often, https is used for web applications bt usually not for the central administration site, it is a bit of configuring and thinking to get it working, but it is a recommended way to protect your Environment. Remember, passwords will at times be transfered in cleartext on the central admin site.
Follow the Word of Spencer Harbar to get it done:
Using SSL for Central Administration with SharePoint 2013
http://www.harbar.net/archive/2013/02/13/Using-SSL-for-Central-Administration-with-SharePoint-2013.aspx

***

Summary,
My hope is, that we will all try do something extra when it comes to Security in the future, do your best to leave a better more secure environment behind, take a while instructing the customer on the importance of keeping the environment secure even after you have left. Make them aware as well.
If you or your customers need a wakeup call, please watch my dear colleague’s session from TechEd North America this year voted no 1, Marcus Murray and Hasain Alshakarti at Truesec:
Live Demonstration: Hacker Tools You Should Know and Worry About
http://channel9.msdn.com/Events/TechEd/NorthAmerica/2013/ATC-B309#fbid=SxGCyIja7i5
After you or your customer has seen what can be done with simple tools avalable to all…perhaps the general attitude towards security processes may improve a bit?

Final word: It is not all about cool buzzwords/technologies like oauth or claims or federations, it is even more about processes and boring policies…

Configure Loopbackcheck (Link) In a PowerShell prompt running as administrator: Get-Item -path ”HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0” | new-Itemproperty -Name “BackConnectionHostNames” -Value (“coolsite.corp.balkestahl.se”, “alias.corp.balkestahl.se”) -PropertyType “MultiString” (Replace mine with your own URL’s and add more using double quotes and a comma and space as separator) Make the changes stick with: Restart-Service IISADMIN

Configure IE ESC (Link) In a PowerShell prompt running as administrator: function Disable-IEESC { $AdminKey = “HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}” Set-ItemProperty -Path $AdminKey -Name “IsInstalled” -Value 0 Stop-Process -Name Explorer } Disable-IEESC (You have to hit enter twice after pasting the script)

Crude list of all members of Local Administrators In a PowerShell prompt running as administrator: Gwmi win32_groupuser | where-object {$_.groupcomponent –like ‘*”Administrators”‘} | ft partcomponent There are better looking examples out there but this is a one-liner that does the trick…

References:

DisableLoopbackCheck & SharePoint: What every admin and developer should know. (Spencer Harbar folks)
http://www.harbar.net/archive/2009/07/02/disableloopbackcheck-amp-sharepoint-what-every-admin-and-developer-should-know.aspx

A quick guide to configuring the Loopback check
https://blog.blksthl.com/2013/05/07/a-quick-guide-to-configuring-the-loopback-check/

Configure automatic password change in SharePoint 2013 using PowerShell
https://blog.blksthl.com/2013/05/14/configure-automatic-password-change-in-sharepoint-2013-using-powershell/

TCP/IP Ports of SharePoint 2013
https://blog.blksthl.com/2013/02/21/tcpip-ports-of-sharepoint-2013/

A guide to https and Secure Sockets Layer in SharePoint 2013
https://blog.blksthl.com/2012/12/20/a-guide-to-https-and-secure-sockets-layer-in-sharepoint-2013/

How to disable IE Enhanced Security in Windows Server 2012
https://blog.blksthl.com/2012/11/28/how-to-disable-ie-enhanced-security-in-windows-server-2012/

The first Kerberos guide for SharePoint 2013 technicians
https://blog.blksthl.com/2012/09/26/the-first-kerberos-guide-for-sharepoint-2013-technicians/

Using SSL for Central Administration with SharePoint 2013
http://www.harbar.net/archive/2013/02/13/Using-SSL-for-Central-Administration-with-SharePoint-2013.aspx

Thanks to:

Hasain Alshakarti – TrueSec
Marcus Murray – TrueSec
TrueSec Sweden / TrueSec US
Spencer Harbar – harbar.net
Andrija Marcic – Microsoft

___________________________________________________________________________________________________

Consider?

Regards

Twitter | Technet Profile | LinkedIn

Configure ULS log and Usage and Health log location

SharePoint jokers!

If you left the settings in SharePoint 2013 as default when installing and configuring, then you will probably have a log path that looks like this for both the ULS log and the Usage and Health log.
C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\LOGS

If you want to change this to a new path, maybe on a different disk like D: (recommended) or on a simpler path easier to remember, use the following commands:

You will need to run the commands in a PowerShell running as administrator and you will also need to load the SharePoint snapin first, add-pssnapin.
add-pssnapin microsoft.sharepoint

For the Diagnostics log(ULS)
set-SPDiagnosticConfig -LogLocation “D:\Program Files\Common files\Microsoft shared\Web server extensions\15\LOGS”
or
set-SPDiagnosticConfig -LogLocation “D:\SharePoint Logs\ULS”

For the Usage and Health log
set-SPUsageService -UsageLogLocation “C:\Program Files\Common files\Microsoft shared\Web server extensions\15\LOGS”
or
set-SPUsageService -UsageLogLocation “D:\SharePoint Logs\Health”

set-SPDiagnosticConfig -LogLocation “C:\Program Files\Common files\Microsoft shared\Web server extensions\15\LOGS”

In my environment, the Diagnostics trace log path looks like this:

And for the Usage and Health log, it looks like this:

References:

(If the two paths Point to a different location then you may see this in your event log)
6398 – The Execute method of job definition…SPUsageImportJobDefinition
https://blog.blksthl.com/2013/05/27/6398-the-execute-method-of-job-definition-spusageimportjobdefinition/

ULS Log Viewer download
http://archive.msdn.microsoft.com/ULSViewer

Thanks to:

Ankie at my customers, who pointed out the Usage and Health log issue 6398 in the first place.

___________________________________________________________________________________________________

Enjoy!

Regards

Twitter | Technet Profile | LinkedIn

6398 – The Execute method of job definition…SPUsageImportJobDefinition

SharePointees!

Have this critical error in your Eventlog?

The Execute method of job definition Microsoft.SharePoint.Administration.SPUsageImportJobDefinition (ID ef497ec2-0cbf-4458-91ea-db75422fd9da) threw an exception. More information is included below.

Access to the path ‘C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\LOGS’ is denied.

This is a really annoying error in the eventlog, there are many references to this out there but most or even all take the easy way out and that is not for me 🙂

Two suggestions I have seen(that I do not recommend):

1. Add the ‘serviceaccount’ (usually the farm account) to the local administrators Group effectively giving the account full access to the entire filesystem.

2. Give the service account ‘serviceaccount’ (usually the farm account) read/write permissions to the LOGS folder.

Both are wrong, if the system would need access to this Place, why does it not have that allready?
In a real Life scenario I had this in the customers logs, when t-shooting I eventually figured out why they had it. In this customers Environment we had moved the ULS log location.
Central Administration/Monitoring/Configure Diagnostic Logging/Path
We had changed it (during PowerShell setup) to D: as one would…

So far so good, this will not in itself cause you any issues or events.
However, it as the other configurable location that did it. Usage and Health data…

This setting looked like this:

This was the reason…why this setting eaither was changed together with the log or if it would still have access…but no.
We ended up changing this path to D: as well, after all, this is what we really wanted anyway, no eccessive data on C:

Hope this helps anyone else.

Good luck!

Thanks to:

Mattias Gutke at CAG. My main man…

___________________________________________________________________________________________________

Enjoy!

Regards

Twitter | Technet Profile | LinkedIn

SharePoint 2013 page loads takes a very long time

–

Short version: Stopping the Distributed cache service gave me great performance! From 6.10 s to 79 ms

Something is just a liiitle bit off…?

Long story: This is a bit of reality right here…
I was about to give up on one of my labb SharePoint 2013 Environments because it was so extremely slow all the time.
Warmup scripts, reloads, more memory, more CPU, stopping services, stopping search…nothing helped.

I had a constant loadtime of all aspx pages of 6+ seconds, 6.10-6.20 something. Even when the page was just loaded and I pressed F5 to reload, it still took 6.10 seconds.
This was an environment that gave you sensitive nerves…

So, after looking for any solution or more like looking for the little issue that caused this all day, I gave up more or less.
– CPU was at a maximum 40% on SQL, SharePoint cranked it up to 18%…
– Memory consumtion was at 25% of the 12GB SharePoint had…
– SQL was Lightning fast to all other SharePoint farms…
– Network utilization showed about 100Kbps at the most…

I scavenged the internet as usual and found nothing but the standard: add more memeory, add more CPU, stop services, stop search…
None of that helped and I had tried it all…

Then…when all hope was lost, I got on a call with my excellent SharePoint buddy Mattias Gutke, we talked about the issue, his server on a laptop with SSD disks showed 50-100ms loadtime of all pages, reload did nopt even produce a flicker…
Then as often happens, we came to discuss the Distributed cache service, what it did and why it was there and so on…I had already had a look at it but could not find any reason why a default cache would give me this lousy performance. Then, I had a look at the timestamp in the F12 Developer dashbord – Network tab – Start capturing. I saw the home.aspx load and it took the usual 6.10 seconds.
The timestamp could be found in the detailed view and on the response header.
I memorized the timestamp (that was in GMT timezone) and opened up my ULS log. In the log at the exact time of the response header, I saw errors from the distributed cache.

I decided that t-shooting the distributed cache would have to wait, it was getting late…but, before disconnecting the Lync call with Mattias, we decided to try and see just what would happen if I stopped the distributed cache service and loaded the page.
Said and done:

Now, loaded the same site:

Whit the Distributed cache service running:

Notice any difference? Now my SharePoint farm is Lightning fast!!! From 6.10 seconds down to 79 ms!

Why is this so then you ask? No idea, something misconfigured or perhaps this is standard when using a single SharePoint server…anyway, today I don’t care.
Stop the service and the performance is great!

Hope this may help you as it did me!

Thanks to:

Mattias Gutke at CAG. Again, my SharePoint sparring partner no 1…

___________________________________________________________________________________________________

Enjoy!

Regards

Twitter | Technet Profile | LinkedIn

Configure automatic password change in SharePoint 2013 using PowerShell

SharePoint fellas!

I have a new tip for you.
My very best SharePoint buddy asked me today how to configure the Automatic password change using PowerShell, he could not find an answer anywhere…it was a good question…seems like the answer was missing and that was when I started to do some research.
I found nothing! Could be that I missed something, but Technet, Blogs, Forums, none had the answer…

The impressive Engine of a Boeing 787 – Dreamliner

After a lot of testing and failing, I managed to produce this working script:

*Must be executed in a PowerShell prompt running as administrator.
*If used in a .ps1 script file, you have to set the execution policy first.
*Replace the domain\accountname with an existing managed account.
*Change the values to valid values that you want to use.

# Set Automatic password change schedule

$SPManagedAccount = Get-SPManagedAccount -Identity “domain\accountname”

#Create a SPMonthlySchedule object and set default properties (as in the gui)
$SPSchedule = new-object Microsoft.SharePoint.SPMonthlySchedule
$SPSchedule.BeginDay = 7
$SPSchedule.EndDay = 7
$SPSchedule.BeginHour = 2
$SPSchedule.EndHour = 3
$SPSchedule.BeginMinute = 0
$SPSchedule.EndMinute = 0
$SPSchedule.beginsecond = 0
$SPSchedule.endsecond = 0

# Set the change schedule on the account
$SPManagedAccount.ChangeSchedule = $SPSchedule
$SPManagedAccount.DaysBeforeExpiryToChange = 2

# Properties not enabled in a default scenario in the GUI
$SPManagedAccount.EnableEmailBeforePasswordChange = $False
$SPManagedAccount.DaysBeforeChangeToEmail = 2

# Enable and make the change
$SPManagedAccount.AutomaticChange = $True
$SPManagedAccount.Update()

Done!

In my environment, it looks like this:

After successfulle updating the Managed Account with the automatic update Schedule, I just typed in

$SPManagedAccount

and hit enter, that gives you the most common properties
If you want to see the entire Schedule with details, type in:

$SPManagedAccount | ft ChangeSchedule

Then you get this:

Thats it, a Schedule has been set!

If you want to use the GUI in central administration to find out what values to set, enable the Automatic Password change on any managed account, than set the values you want in the graphical user interface. Save them by clicking OK.
Next you run the following in your PowerShell prompt:
$SPTemplateManagedAccount = Get-SPManagedAccount “corp\sp10search”
$SPTemplateSchedule = $SPTemplateManagedAccount.ChangeSchedule
$SPTemplateSchedule
This will produce a list looking like this:
BeginDay    : 7
EndDay      : 7
Description : Monthly
BeginHour   : 2
EndHour     : 3
BeginMinute : 0
EndMinute   : 0
BeginSecond : 0
EndSecond   : 0
Use the values in the list in your script and you will have identical values set.

Note: If you want to have a Daily Schedule instead of Monthly like in my example, you will have to modify the script to create a Microsoft.SharePoint.SPDailySchedule object instead.
If you do that, you will also have to remove the lines setting the BeginDay and EndDay values, they are not used in a Daily Schedule object.

Good luck!

References:

Configure automatic password change in SharePoint 2013 (GUI version only)
http://technet.microsoft.com/en-us/library/ff724280.aspx

Plan automatic password change in SharePoint 2013
http://technet.microsoft.com/en-us/library/ff724278.aspx

Thanks to:

Mattias Gutke at CAG. He asked the question…

___________________________________________________________________________________________________

Enjoy!

Regards

Twitter | Technet Profile | LinkedIn

A quick guide to configuring the Loopback check

Update: A free tool is available that does all this for you in a GUI: Loopback Check configuration Tool released – free download

Hi dear friends!

401.1 Access denied…
If you try to access your newly created web application with a real nice FQDN or NetBIOS name and you end up getting a 401.1 Access denied…

Even after adding the site to the local intranet zone in IE…
Even after beeing prompted 3 times and filling in the correct credentials…
After setting up your Search to crawl you sites in a small farm whith crawl and web services on the same server…

You check and doublecheck your credentials, you add yourself as the farm admin, you try logging on with the farm account, but nothing…still 401.1…

I know this has been written about many times Before, but some things seem to still be missing…
Now everyone seems comfortable with the sparse description on how to ‘add hosts to the list’ which is pretty much what you do when configuring the loopback check the ‘secure way’. You can also disable the loopbackcheck completely, but why if there is no real reason. Read Spencer Harbars excellent post on the topic if you need explaining why this is so. It is a few years but it is still the truth!

The KB article 896861 for this is an old one and the title does not really tell you that this is the one you are looking for, ‘type the host name or the host names for the sites that are on the local computer, and then click OK.’ is not crystal…

Jump to:

Configure Loopback check using the GUI

Configure Loopback check using Powershell

Credits and References

What you need to do is this step by step:

In ‘Metro’ mode, type regedit

Regedit will most likely be the only result, hit enter

In regedit, find the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

First…

then…

Now, create a Multi-String Value under the MSV1_0 key.

Type in the name of the new Multi-String value: ‘BackConnectionHostNames’, Hit Enter.

Right click on the value BackConnectionHostNames and coose Modify.

Add the URL you want to be able to access from a local browser on the server.

Don’t know why, but I seem to Always get this. Click Ok.

Viola!

Adding multiple URL’s to the list of ‘trusted’ URL’s, simply make a new line between them.

That will look like this.

To be extra sure that nothing else will sabotage functionality, check so that the URL’s are added to DNS.
(Or local hosts file)

Check so that the URL’s are added as bindings in IIS.

Verify that the URL’s are correct and are added to AAM.

Make sure that the URL is added to the Local Intranet Zone in Internet Explorer (if you need to browse the site from the server, NOT RECOMMENDED!).

Try to access the URL in a browser.

And the other URL.

Done!

Doing the same using PowerShell

Using PowerShell to configure the Loopback check, requires two steps:

1. Add the multistring value to the registry
Get-Item -path “HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0” | new-Itemproperty -Name “BackConnectionHostNames” -Value (“coolsite.corp.balkestahl.se”, “alias.corp.balkestahl.se”) -PropertyType “MultiString”

2. Restart the IISADMIN service
Restart-Service IISADMIN

1. Add the multistring value to the registry

Given that you have Everything setup correctly, your AAM’s, your DNS entrys, (URL added to local intranetsites zone in IE), and so forth…you can use this single PowerShell command to exclude the URL’s for your sites from the loopbackcheck, this way, you don’t have to disable the loopbackcheck at all (Way better security).

The following command will add my two URL’s to the exclusion list, edit the values to add your own URL’s.

Run this in a PowerShell prompt running in elevaled mode/as Administrator

Get-Item -path “HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0” | new-Itemproperty -Name “BackConnectionHostNames” -Value (“coolsite.corp.balkestahl.se”, “alias.corp.balkestahl.se”) -PropertyType “MultiString”

Running this will if Everything is done right, show this

This is how it will look if it succeeds!

If you get ‘The property already exists.’, then you already have the ‘BackConnectionHostNames’ value added to the registry, check using registry editor to see if you can delete it or if it has other values that need to be there.

After a successful execution, check the registry to verify

Regedit12x

2. Restart the IISADMIN service

Now you have to restart the IISADMIN service in order for it to ‘reread’ the registry values and implement our Changes.
This is easy, in a PowerShell prompt running in elevaled mode/as Administrator

Restart-Service IISADMIN

Note the typo/bug in the text, it says stopping twice but what it does it stopping and starting

Done!

The command line in step 1 will add two (2) entries to the list, coolsite.corp.balkestahl.se and alias.corp.balkestahl.se. If you need to add more URL’s, add them to the Values, like: -Value (“coolsite.corp.balkestahl.se”, “alias.corp.balkestahl.se”, “mycoolnetbiosname”, “extraname.corp.balkestahl.se”).

Make sure that the doublequotes are formated in the proper way if you copy from this post!

That would make the command

and

Restart-Service IISADMIN -force

–

References:

You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or a later version
http://support.microsoft.com/kb/896861

Can’t crawl web apps you KNOW you should be able to crawl (Todd Klindt’s oldie but goodie)
http://www.toddklindt.com/blog/Lists/Posts/Post.aspx?ID=107

Thanks to:

As Always, Mattias Gutke! Now at CAG. Always a great help and second opinion!

___________________________________________________________________________________________________

Enjoy!

Regards

Twitter | Technet Profile | LinkedIn

SharePoint Server 2013 Language Packs

Hi dear friends!

Update: Additional SharePoint Server 2013 LP’s (the full list) made GA, Generally Available since April 30 – SharePoint Server 2013 LP’s

Language support in SharePoint 2013 onprem…
(Lacking better info, I assume that the same list applies to SharePoint online)

Remember this anyone?

If you are like me you have not seen anything official on the topic of Language Packs and release dates and availability yet (written April 16, 2013).
I don’t know if anyone has put this info out there yet, but I have not found it and then I figure it won’t hurt to do it here I guess…

In my case, I was looking for Swedish, but others need to find their special local language, now I have some info for all of you:

Jump to:

SharePoint Server 2013 LP’s (44 LP’s)

SharePoint Foundation 2013 LP’s (44 LP’s)

Office Web Apps 2013 LP’s (44 LP’s)

Credits and References

–

SharePoint in the languages listed under Server Language packs are also available in a localized server version, these are also available at MSDN

–

SharePoint Server 2013
Since (March 28) April 30th, all Language Packs are now available as a free download (link) Select your language in the dropdown or use the directlink in the list below.
(serverlanguagepack.img) I recommend renaming the files when downloaded since all LP’s have the same name, add for example the two letter code for your country after the filename: serverlanguagepack_se.exe (Swedish SPS LP)

TechNet suggests you take one of the following actions:
For Windows Server 2012, open the .img file directly and run Setup.exe (double-click it).
For Windows Server 2008 R2 SP1, use a program that can mount or extract .img files. Then run Setup.exe (double-click it).

Generally Available Server Language packs listed:

Language	Release date
English	March 28, 2013
German	April 30, 2013
French	April 30, 2013
Hebrew	April 30, 2013
Italian	April 30, 2013
Japanese	April 30, 2013
Spanish	April 30, 2013
Catalan	April 30, 2013
Portuguese-Brazil	April 30, 2013
Chinese – Simplified	April 30, 2013
Chinese – Traditional	April 30, 2013
Dutch	April 30, 2013
Korean	April 30, 2013
Russian	April 30, 2013
Czech	April 30, 2013
Greek	April 30, 2013
Hungarian	April 30, 2013
Romanian	April 30, 2013
Thai	April 30, 2013
Turkish	April 30, 2013
Ukrainian	April 30, 2013
Serbian (Latin) N/A!	April 30, 2013
Serbian (Cyrillic)	April 30, 2013
Slovak	April 30, 2013
Slovenian	April 30, 2013
Bulgarian	April 30, 2013
Croatian	April 30, 2013
Estonian	April 30, 2013
Kazakh	April 30, 2013
Latvian	April 30, 2013
Lithuanian	April 30, 2013
Danish	April 30, 2013
Finnish	April 30, 2013
Norwegian (Bokmål)	April 30, 2013
Swedish	April 30, 2013
Arabic	April 30, 2013
Hindi	April 30, 2013
Polish	April 30, 2013
Portuguese-Portugal	April 30, 2013
Malay (Malaysia)	April 30, 2013
Indonesian	April 30, 2013
Vietnamese	April 30, 2013
Galician	April 30, 2013
Basque	April 30, 2013

You can also find these on MSDN (and TechNet) (link):
(nn_office_server_2013_language_pack_x64_dvd_nnnnnnn.iso)

–

SharePoint Foundation 2013
Language Packs for SharePoint Foundation 2013 is a free download (link)
(sharepointlanguagepack.exe) I recommend renaming the files when downloaded since all LP’s have the same name, add for example the two letter code for your country after the filename: sharepointlanguagepack_se.exe (Swedish SPF LP)
Size: Aproximately 29 MB

Language	Release date
English	October 30, 2012
German	October 30, 2012
French	October 30, 2012
Hebrew	October 30, 2012
Italian	October 30, 2012
Japanese	October 30, 2012
Spanish	October 30, 2012
Catalan	October 30, 2012
Portuguese-Brazil	October 30, 2012
Chinese – Simplified	October 30, 2012
Chinese – Traditional	October 30, 2012
Dutch	October 30, 2012
Korean	October 30, 2012
Russian	October 30, 2012
Czech	October 30, 2012
Greek	October 30, 2012
Hungarian	October 30, 2012
Romanian	October 30, 2012
Thai	October 30, 2012
Turkish	October 30, 2012
Ukrainian	October 30, 2012
Serbian (Latin) N/A!	October 30, 2012
Serbian (Cyrillic)	October 30, 2012
Slovak	October 30, 2012
Slovenian	October 30, 2012
Bulgarian	October 30, 2012
Croatian	October 30, 2012
Estonian	October 30, 2012
Kazakh	October 30, 2012
Latvian	October 30, 2012
Lithuanian	October 30, 2012
Danish	October 30, 2012
Finnish	October 30, 2012
Norwegian (Bokmål)	October 30, 2012
Swedish	October 30, 2012
Arabic	October 30, 2012
Hindi	October 30, 2012
Polish	October 30, 2012
Portuguese-Portugal	October 30, 2012
Malay (Malaysia)	October 30, 2012
Indonesian	October 30, 2012
Vietnamese	October 30, 2012
Galician	October 30, 2012
Basque	October 30, 2012

–

Office Web Apps 2013
Language Packs for Office Web Apps 2013 is a free download (link)
(wacserverlanguagepack.exe) I recommend renaming the files when downloaded since all LP’s have the ame name, add for example the two letter code for your country after the filename: wacserverlanguagepack_se.exe (Swedish LP)
Size: Aproximately 25.5 MB

List last updated May 23, 2013

Language	Release date
English
German
French
Hebrew
Italian
Japanese
Spanish
Catalan
Portuguese-Brazil
Chinese – Simplified
Chinese – Traditional
Dutch
Korean
Russian
Czech
Greek
Hungarian
Romanian
Thai
Turkish
Ukrainian
Serbian (Latin) N/A!
Serbian (Cyrillic)
Slovak
Slovenian
Bulgarian
Croatian
Estonian
Kazakh
Latvian
Lithuanian
Danish
Finnish
Norwegian (Bokmål)
Swedish
Arabic
Hindi
Polish
Portuguese-Portugal
Malay (Malaysia)
Indonesian
Vietnamese
Galician
Basque

I hope that this will help you find what you need. This was the kind of info I was looking for and could not find so hopwefully it will help you save time.

References:

Language Packs for Microsoft Office Web Apps Server
http://www.microsoft.com/en-us/download/details.aspx?id=35490

Language Packs for SharePoint Foundation 2013
http://www.microsoft.com/en-us/download/details.aspx?id=35492

Office Server 2013 Language Pack on MSDN Subscriber Downloads
https://msdn.microsoft.com/en-us/subscriptions/securedownloads/hh442898.aspx#FileId=50889

Install or uninstall language packs for SharePoint 2013 (Foundation and Server)
http://technet.microsoft.com/en-us/library/cc262108.aspx

Thanks to:
Wictor Wilén who pointed out the simple fact to me that the Server LP’s were available on MSDN…a fact I had somehow managed to miss.

___________________________________________________________________________________________________

Enjoy!

Regards

Twitter | Technet Profile | LinkedIn

A guide to quick SharePoint 2013 branding – part 2 – with Javascript

A new revised version of this post is available, please go to:
‘
Revised A guide to quick SharePoint 2013 branding – part 2 – with Javascript

‘

NO DEVELOPMENT IN VISUAL STUDIO OR SHAREPOINT DESIGNER REQUIRED

Hi dear SharePointies and SharePoints.

Welcome to part 2, I assume that you have seen and followed part 1, A guide to quick SharePoint 2013 branding so I will not cover every step needed, some you will have to get from part 1.
This is for all of you SharePoint technicians and enthusiasts out there who are not developers or don’t really have time or feel like learning the new ‘Design Manager’. All of the steps here can be done using only a Windows client and appropriate permissions.

This guide has been verified in SharePoint Online. If you have done the steps in Onpremise server and/or Foundation, please drop me a comment and I will add that here and also give you credit for it.

In part 1, we added a custom masterpage, a css/stylesheet file, a favicon and a logo image. We configured SharePoint to use the custom masterpage and in that we referenced the custom css, the favicon and the logo. All good.
Now, we want to get rid of the annoying default blue ‘banner’ with the Office 365 logo(SPO), the SharePoint text (Onprem/Foundation).
Without using Visual Studio…or SharePoint Designer…

In this short guide, I will use a site located in SharePoint Online (2013/Preview, link at the end), but the steps are exactly the same in an onprem environment.

For the permanent production branding, I have to recommend using Visual Studio to create a wsp package, as long as you add the same files as I do here it will work the same. That way you will have an installable package that can be reinstalled and used in test and dev environment. You can also make sure the package works Before moving it into production.

We will in part 2, make this (pretty good):

Look like this (even better):

In my opinion, a whole lot better!
Now let’s get on with branding our site:

Use the sitecollection you used before, or simply any site collection will do. Work with the rootsite as usual.

To do what I am going to do, we need two new and one modified file:

truesec.js – New (Contains all the actual JavaScript code)
TrueSec_transparent_white.png – New (New logo, White on transparent for a nice effect)
truesec.master – Old (only modified to load the JavaScript file)

I will start by creating a simple JavaScript file, use a local folder to store your files in, we will later upload them to SharePoint.

Yes, you want to change the extension.
I added this JavaScript lines to my truesec.js file, see inline comments to see what it does

_spBodyOnLoadFunctionNames.push(“ConfigureBrandingsuite”);

function ConfigureBrandingsuite()
{
<!– Replace the default logo with my own shiny white with transparant background, oh-yeah! –>
document.getElementById(‘suiteBrandingIcon’).src = “/_catalogs/masterpage/truesec/TrueSec_transparent_white.png”;

<!– Setting the width to a little more than default, else the image may be cropped –>
document.getElementById(‘suiteBrandingIcon’).style.width=”155px”;

<!– Set the background of the entire suitebarleft to jet-black for maximum effect! –>
document.getElementById(‘suiteBarLeft’).style.background = ‘#000000’;
}

Make sure that your quotes and double quotes are correct, copying from a webpage often result in misformatted quotes. Avoid this by reviewing the code thoroughly in notepad. The ‘wrong’ kind usually leans to one or the other direction, whilst the ‘correct’ kind are straight. Example:

Ok, thats one out of three files, moving on to the masterpage.
This you may allready have stored locally, but if you don’t, download a copy from SharePoint. I’ll use my custom truesec.master from part 1.

In your SharePoint site collection root, select Site Settings, then ‘Web Designer Galleries/Master pages’

In the master page gallery, navigate to your custom folder, mine is named ‘TrueSec’ obviously…

Open the custom branding folder and in it, locate you master page.
Select the file in the checkbox and click on ‘Download a Copy’.

Save the file to your local folder.

Now, we will add a simple line to the masterpage, right click on the masterpage and select edit in notepad.

Locate the following SharePoint:Scriptlinks:

After the line:
<SharePoint:ScriptLink language=”javascript” name=”suitelinks.js” OnDemand=”true” runat=”server” Localizable=”false” />

Add:
<SharePoint:ScriptLink ID=”ScriptLink1″ runat=”server” Defer=”False” Name=”~siteCollection/_catalogs/masterpage/TrueSec/truesec.js”></SharePoint:ScriptLink>

Make sure that your quotes and double quotes are correct, copying from a webpage often result in misformatted quotes.
Avoid this by reviewing the code thoroughly in notepad. The ‘wrong’ kind usually leans to one or the other direction, whilst the ‘correct’ kind are straight.
Example:

With the code added, that part of the masterpage will now look like this:

<SharePoint:ScriptLink language=”javascript” name=”sharing.js” OnDemand=”true” runat=”server” Localizable=”false” />
<SharePoint:ScriptLink language=”javascript” name=”suitelinks.js” OnDemand=”true” runat=”server” Localizable=”false” />

<SharePoint:ScriptLink ID=”ScriptLink1″ runat=”server” Defer=”False” Name=”~siteCollection/_catalogs/masterpage/TrueSec/truesec.js”></SharePoint:ScriptLink>

<SharePoint:CustomJSUrl runat=”server” /> <SharePoint:SoapDiscoveryLink runat=”server” />

or:

Save the file and leave it for now. We will upload all the files later.

So, two out of three done.
Time for the simplest one, the image. I wanted to add something a bit different than the logo I have already added, so I went with a logo in white on black instead of black on white. The image file is White on transparent and then the java script sets the background to jet-black which makes it all perfect. You use the images you want and for your customer/company/organization and make the decisions based on the colors you have there, I bet it will be beautiful!

Ok, if you started out like I did with the ‘light branding’ already in Place, then you are pretty much done, all we need to do is upload the files and reload the page to see the result. Go to your site, open ‘Site settings’, ‘Master page’, browse to your folder, in my case its ‘/TrueSec’. Once here, select the ‘Files’ tab and ‘Upload Document’.

Now, if you already had the custom master selected in the site, it will load automatically with the JavaScript and all. Load the site in a browser to see the result:

Where to go from here?
In addition to the objects I have modified using java, there are several you can figure out how to configure for yourselves. If you want to find the objects, you can use F12 – Developer Toolbar that is built into IE.
Or, use any of these that are part of the 2013 default objects:
suiteBarLeft
suiteBarRight
suiteBrandingBox
DeltaSuiteLinks
suiteBarRight
RibbonContainer-TabRowRight

All og these have different properties to be configured, google, test, play around and find out what can be done.

References:

SharePoint 2013 Top links – Name, ID and How to Hide them (Excellent post on the objects and a start, how to hide them completely)
http://www.tuyrcorp.com/sharepoint-2013-top-links-name-id-and-how-to-hide-them/

A great place to learn html and css
http://www.w3schools.com/

Great overall branding blogger
http://blog.drisgill.com/

Map a network drive to the SharePoint 2013 Master Page Gallery
http://msdn.microsoft.com/en-us/library/jj733519.aspx

How to: Convert an HTML file into a master page in SharePoint Server 2013
http://msdn.microsoft.com/en-us/library/jj822370.aspx

Starter Master Pages for SharePoint 2013 (more advanced branding)
http://startermasterpages.codeplex.com/

Office 365 Preview
http://www.microsoft.com/office/preview/en/office-365-enterprise

___________________________________________________________________________________________________

Enjoy!

Regards

Twitter | Technet Profile | LinkedIn

A guide to quick SharePoint 2013 branding

NO DEVELOPMENT IN VISUAL STUDIO OR SHAREPOINT DESIGNER REQUIRED

Hi dear SharePointies and SharePoints.

This will be a Quick way to get a familiar touch applied to your teamsites (and other sites as well)
(See also part two: A guide to quick SharePoint 2013 branding – part 2 – with Javascript)

This guide has been verified in SharePoint Foundation 2013 as well as Server and Online, BIG thanks to Chuck Snyder and others for verifying functionality in SharePoint Foundation 2013.

Some of you may already have tried some of the branding features built into SharePoint 2013 and SharePoint Online (2013), Microsoft have added some functionality that makes it easier for some and harder for some. I had branding in 2010 pretty much figured out and now to me it seems like they have given the box a good shake, everything is almost in the same place as before…but not quite…
I have noticed that most of the branding info that is out, most blogs and presentations have been about branding a publishing site, meaning an external website or intranet portal or similar, sites meant to be branded and customized. In this guide I will fokus on the teamsite, probably the most used site of them all…

I will show you step by step how to access some of the basics in branding your sites, no development yet…the tools needed for this exercise, is notepad.exe…that’s it…

In this short guide, I will use a site located in SharePoint Online (2013/Preview, link at the end), but the steps are exactly the same in an onprem environment.

We will make this:

Look like this:

Now let’s get on with it:

Create a new site collection and work with the rootsite.

Having a brand-new unbranded, untouched team site, I will start by getting the files to start working with, we need a new MasterPage (.master) and a new StyleSheet (.css).
In the top right corner, click on the little cogwheel/gearwheel.

Then click on ‘Site settings’ in the dropdown.

Site Settings offers a lot of choices, we are only going to be using a few.

The branding features of SharePoint are mainly located in the ‘Web Designer Galleries’ and the ‘Look and Feel’ sections of site settings.

In Web Designer Galleries section, click on Master pages

In here we will store the files we need, to make it a bit more structured, we will create a dedicated folder for our efforts only, I’ll call mine TrueSec.
In the ribbon section, click on the tab called FILES, then ‘New Folder’.

Type in the name and hit ‘Save’

The folders and files are in alphabetical order, so in my case using truesec, I have to go to the next page. Use the arrow at the bottom.

Ok, now we have a place to put our files, next, we download a copy of the default masterpage beeing used in a SharePoint 2013 team site, ‘Seattle.master’

Use the dropdown menu on the file

In the IE download bar, select the dropdown arrow and select ‘Save as’.

Save the file in a suitable location, I put mine in a folder on the desktop. Leave the filename as is.

Select ‘Open folder’

Next, we make a copy of the seattle.master and rename it to what we want. I’m going with truesec.master

Ok, now we have a local copy of the default masterpage called truesec.master. It is at this point still identical to the default and we’ll leave it that way for now.
Now, we get a copy of the default stylesheet used in the seattle.master, called core15.css.
Go back to the browser with your site and masterpage gallery, click on the SharePoint logo.

Now, we are back in the root team site and its homepage, from here it is a simple task to download the stylesheet, since it is not located in the masterpage gallery, I’ll use a different method to get it.
In your Internet Explorer browser, click on F12, this will bring up the F12-Developer toolbar, a great built in tool.

Click on the tab named ‘CSS’

Make sure that the path is selected, that points to the core15.css file

Then on the little ‘Save’ button

This method may result in a slightly ‘off’ css file (missing navigation in one occation), the reason is that the developer dashbord will save a rendered css file instead of the actual file.
In order to avoid any risk for that, type in the full path to the actual corev15.css file, then save it to disk.

Place the file in the same folder locally on your computer as the seattle.master/truesec.master.

Same as before, make a copy and then rename it to truesec.css

A slightly more difficult but better way, is to create a new blank text file and rename it to ‘truesec.css’, then, add to this file only the ID’s and Classes that you want to style.
Adding only the classes/ID’s you want to edit the styles for, will save bandwidth and improve performance as well as keep the css file manageble.
Example, say that you want to style the Page Title with a new font-size and color, add only this to the empty text file:
.ms-core-pageTitle
{
font-size:30pt;
color:rgb(255, 127, 39); /* blksthl orange */
}

(read the core15.css to get an idea of how it is built)

Ok, now we have both the files needed to make the changes to the branding, but we do need two more things to make the branding a bit more interesting. Logos, I’ll show you how to replace the default logo (the big one) and the favicon (the smaller ones), the little thing in the address bar that is actually used for a few things and will affect the braded feel of the site pretty much.

I’m adding the files to my local folder to make it simple and keep it all in one place.

If you don’t already have a favicon for your organization, you can use any one of the free image to favicon sites available to create one from a image. I have used several and for example this works: http://favicon.htmlkit.com/favicon/.
This tool will also let you select the formats you want.

I have in my example a favicon file of dimension 32×32 with a color depth of 32. 16×16 works just as well.

The original ‘SharePoint‘ logo is 180×64 and as long as you stay close to that, the design will be ok.

Now, we will edit the files and add the simple magic lines….

First, we want to load out custom StyleSheet, it’s not custom yet, but loading it will allow you to make modifications to it later. So, open up the copy of the master file, in my case the file named truesec.master
(Notice the filepaths, all pointing to the masterpage gallery catalog and our truesec folder)

Attention! If you copy and paste from the code below, you may have to replace the quotes and double-quotes with your own, do a replace in notepad. I have tried to replace them in the code samples but be aware.
The quotes if copied here is for some reason of a different format and will cause the code to fail if used as-is. Usually you will see that you get a left and right version of the quotes, they do not work. See example:

(This may differ depending on what text editor you are using)

Locate the line:
(Use Notepad find and search for ‘corev15’)
<SharePoint:CssRegistration Name=”Themable/corev15.css” runat=”server”/>

Add directly below it as one line:
<SharePoint:CssRegistration name=”/_catalogs/masterpage/truesec/truesec.css” After=”corev15.css” runat=”server”/>

That will make:

Next we add our custom favicon, locate the line:
(Use Notepad find and search for ‘favicon’)
<SharePoint:SPShortcutIcon runat=”server” IconUrl=”/_layouts/15/images/favicon.ico?rev=23″ />

Change it to:
<SharePoint:SPShortcutIcon runat=”server” IconUrl=”/_catalogs/masterpage/truesec/favicon.ico” />

Next and last, we add the actual logo, locate the line below:
(Use Notepad find and search for ‘LogoImage’)

<SharePoint:SiteLogoImage CssClass=”ms-siteicon-img” name=”onetidHeadbnnr0″ id=”onetidHeadbnnr2″ LogoImageUrl=”/_layouts/15/images/siteIcon.png?rev=23″ runat=”server”/>

Edit or replace it to look like this:

<SharePoint:SiteLogoImage CssClass=”ms-siteicon-img” name=”onetidHeadbnnr0″ id=”onetidHeadbnnr2″ LogoImageUrl=”/_catalogs/masterpage/truesec/trueseclogo.png” runat=”server”/>
( Update: Added missing endtag /> )

There, the files are edited and if we upload and use these, we will have the logo and the favicon used in our site. We will at this point not touch the css.

Warning! Make sure that you do not make any mistakes editing the masterpage, if you accidentally remove something you could end up with a site that is inaccessible, if you do, SharePoint designer can be used to correct the masterpage again

(If you don’t plan to edit the css in the future, you can either skip loading it or at least clear the file of content, making it empty and quick to load.)

Upload the files in your local folder from the masterpage gallery, cogwheel, ‘Site settings’, ‘Master pages’. Browse to your folder, my ‘truesec’ folder.

In the upload dialog, browse to your files, add a comment if you like but make sure that the destination folder points to your folder (relative path).

In the second dialog, make sure that you for the masterpage, select ASP.NET Master Page, like in the picture below, for the other files including the css, select Content type ‘Design file’

Ok, files uploaded, all ready to use…almost.
I have found that the master needs to be published as a major version before being accessible from the gui. Click on the dropdown arrow, then ‘Publish a Major Version’.

Apparently, if the publishing site feature hasn’t been activated, the ‘Publish as a Major Version’ is missing, the workaround then is to check the file out, then check it back in and select major version.

Now, we need to change the masterpage that is used…this is actually a part of the publishing features, but if you don’t have the site collection publishing feature and the site publishing feature activated, try using this direct link instead:

[URL to your team site]/_layouts/15/ChangeSiteMasterPage.aspx

The ‘Site Setting – Site Master Page Setting’ dialog seems to only be available if the site Collection feature, ‘SharePoint Server Publishing Feature’, has once been enabled. Try it, I enabled it, accessed the page, then disabled it again and I could still access it. (I don’t Think that is by design.)
Sometimes there is an error when clicking ok but the masterpage was still updated…this in onprem as well as online.

For me it looks like:

Now, we change the masterpage used from this:

To this:

Click on OK in the bottom right corner.

Done, TADA!

(The green background comes from Windows 8s adaptive coloring based on the background image, my background Changes on a Schedule so IE will look different all the time)
If you also pin the Internet Explorer tab to the taskbar, you will also have it look like this:

Nice huh?
Try to make some light changes to the css file as well, start out small. Use F12 Developer Toolbar and the arrow function to point to an object and find out what styles are applied and from what id/class they are coming.
It’s easy:

Press F12, then use the arrow

Click on an object, like the site title

In the styles list you will now be able to find what gives the title its color and size:

.ms-core-pageTitle, .ms-corepageTitle a
and
.ms-core-pageTitle

Locate them in the local css, upload it and overwrite the old, reload the page, VOILA!

To continue, follow the next part of this SharePoint 2013 branding guide:
A guide to quick SharePoint 2013 branding – part 2 – with Javascript

This will allow you to use java to set the color and image of the top ‘chrome’. Even the Little buttons and toggles to the right. You will own them all.

References:

A great place to learn html and css
http://www.w3schools.com/

Great overall branding blogger
http://blog.drisgill.com/

Map a network drive to the SharePoint 2013 Master Page Gallery
http://msdn.microsoft.com/en-us/library/jj733519.aspx

How to: Convert an HTML file into a master page in SharePoint Server 2013
http://msdn.microsoft.com/en-us/library/jj822370.aspx

Starter Master Pages for SharePoint 2013 (more advanced branding)
http://startermasterpages.codeplex.com/

Office 365 Preview
http://www.microsoft.com/office/preview/en/office-365-enterprise

___________________________________________________________________________________________________

Enjoy!

Regards

Twitter | Technet Profile | LinkedIn

TCP/IP Ports of SharePoint 2013

Hi fellow SharePoint lovers!
(Find the 2016 version here)

Have you ever wondered? What ports do I need to open? Why can’t the web server access the Databases…what does that event mean? For example in SharePoint 2010 we had the ‘Cannot connect to SQL Server – Event 3355‘, perhaps you need to know simply for the docmentation you want to leave behind?
Wonder no more. I have here tried to compile a complete list of all the ports used. Most are configured by SharePoint but some needs to be manualy configured and it all depends on hw you have installed and configured your farm in the first Place.

I hope that the list will be of use! Please let me know if I have missed anything related, however remote…

List of ports used by SharePoint 2013 and its related services.
Reference links at the end.

Protocol	Port	Usage	Comment
TCP	80	http	Client to SharePoint web server traffic (SharePoint – Office Web Apps communication)
TCP	443	https/ssl	Encrypted client to SharePoint web server traffic (Encrypted SharePoint – Office Web Apps communication)
TCP	1433	SQL Server default communication port.	May be configured to use custom port for increased security
UDP	1434	SQL Server default port used to establish connection	May be configured to use custom port for increased security
TCP	445	SQL Server using named pipes	When SQL Server is configured to listen for incoming client connections by using named pipes over a NetBIOS session, SQL Server communicates over TCP port 445
TCP	25	SMTP for e-mail integration	Cannot be configured
TCP	16500-16519	Ports used by the search index component	Intra-farm only Inbound rule Added to Windows firewall by SharePoint
TCP	22233-22236	Ports required for the AppFabric Caching Service	Distributed Cache…
TCP	808	Search – Query processing component Windows Communication Foundation communication	Search – Query processing component WCF
TCP	32843	Communication between Web servers and service applications	http (default) To use custom port, see references section Inbound rule Added to Windows firewall by SharePoint
TCP	32844	Communication between Web servers and service applications	https Inbound rule Added to Windows firewall by SharePoint
TCP	32845	net.tcp binding: TCP 32845 (only if a third party has implemented this option for a service application)	Custom Service Applications Inbound rule Added to Windows firewall by SharePoint
TCP	32846	Microsoft SharePoint Foundation User Code Service (for sandbox solutions)	Inbound on all Web Servers Inbound rule Added to Windows firewall by SharePoint Outbound on all Web and App servers with service enabled.
TCP	5725	User Profile Synchronization Service(FIM)	Synchronizing profiles between SharePoint 2013 and Active Directory Domain Services (AD DS) on the server that runs the Forefront Identity Management agent
TCP + UDP	389	User Profile Synchronization Service(FIM)	LDAP Service
TCP + UDP	88	User Profile Synchronization Service(FIM)	Kerberos
TCP + UDP	53	User Profile Synchronization Service(FIM)	DNS
UDP	464	User Profile Service(FIM)	Kerberos change password
TCP	809	Office Web Apps	Intra-farm Office Web Apps communication.

References:

Plan security hardening for SharePoint 2013
http://technet.microsoft.com/en-us/library/cc262849.aspx

Configure SQL Server security for SharePoint 2013 environments
http://technet.microsoft.com/en-us/library/ff607733.aspx#proc1

Blocking the standard SQL Server ports
http://technet.microsoft.com/en-us/library/cc262849.aspx#BlockingSQL

Service application communication
http://technet.microsoft.com/en-us/library/cc262849.aspx#ServiceApp

User Profile service hardening requirements
http://technet.microsoft.com/en-us/library/cc262849.aspx#UserProfile

Set-SPServiceHostConfig
http://technet.microsoft.com/en-us/library/ff607922.aspx

Get-SPServiceHostConfig
http://technet.microsoft.com/en-us/library/ff607794.aspx

TCP/IP Communications (Windows Server AppFabric Caching)
http://msdn.microsoft.com/en-us/library/ee790914(v=azure.10).aspx

___________________________________________________________________________________________________

Enjoy!

Regards

Twitter | Technet Profile | LinkedIn