Hardening Windows W2K Server

| | |
This document is intended as a starting checklist to harden Windows 2000 Server and IIS for security vulnerabilities. This checklist is designed for those that are extremely familiar with Windows and IIS, as explanations for the checklist actions are not included. It is strongly recommend that you visit the Microsoft Security and Privacy page, at http://www.microsoft.com/security/default.asp, for specific information about each step and the reason behind each action.
  • Install 2000 Server operating system
  • Install only options required
  • Specify machine is part of a Workgroup and not a domain
  • Install latest OS service patches as recommended at
    http://v4.windowsupdate.microsoft.com/en/default.asp
  • Install all needed "critical updates"
  • Install all needed "Windows 2000 updates"
  • Install latest Office updates as recommended at
    http://office.microsoft.com/productupdates/
  • Run Microsoft Baseline Security Analyzer (MBSA) that can be found at
    http://www.microsoft.com/technet/treeview/?url=/technet/security/
    tools/Tools/MBSAhome.asp. Select the applicable type of server configuration.
    Note: This product will automatically set some of the setting below.
  • Rename the "Everyone" Group to a different name
  • Rename the "Administrator" account to a different name (do not use "admin")
  • Run syskey.exe, select Encryption Enabled, then select Ok

Registry Changes

  • HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogin\LegalNoticeCaption
    change value to include your company name or site owner
  • HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogin\LegalNoticeText change
    value to "Unauthorized Use Prohibited by 18, U.S.C."
  • Run drwtsn32 uncheck all options except Append to "Existing Log File"
  • Delete HKLM\System\CurrentControlSet\Control\Session Managaer\SubSystems\OS2
  • Delete HKLM\System\CurrentControlSet\Control\Session Managaer\SubSystems\Posix
  • Delete HKLM\System\CurrentControlSet\Control\Session Managaer\SubSystems\Optional
  • Delete HKLM\Software\Microsoft\RPC\ClientProtocols\ncacn_ip_tcp
  • Delete HKLM\Software\Microsoft\RPC\ClientProtocols\ncagd_ip_upd

Control Panel Changes

Control Panel\System/Advanced\Startup and Recovery
  • Set display list to 10 seconds.
  • Check "Automatic Reboot"
  • Set Write Debugging Information to "none"
Control Panel\ Administrative Tools\Local Security Policy\Account Policies\Password Policy\
  • Enforce password history to 8
  • Minimum password length to 8
  • Maximum password age to 30
Control Panel\ Administrative Tools\Local Security Policy\Account Policies
\Account Lockout Policy
  • Account lockout duration to 10 minutes
  • Account lockout threshold to 5
  • Reset account lockout counter to 10 minutes
Control Panel\ Administrative Tools\Local Security Policy\Local Policies\Audit Policy
  • Audit account logon events to Success, Failure
  • Audit account management to Success, Failure
  • Audit directory service access to Success, Failure
  • Audit login events to Success, Failure
  • Audit policy change to Success, Failure
  • Audit privilege use to Success, Failure
  • Audit process tracking to Success, Failure
  • Audit system events to Success, Failure
Control Panel\ Administrative Tools\Local Security Policy\Local Policies\Security Options
  • Allow System to Be Shut Down Without Having to Login On to Disabled
  • Audit Use of Backup and Restore Privilege to Enabled
  • Clear Virtual Memory Pagefile When System Shuts Down to Enabled
  • Disable CTRL-ALT-DEL Requirements for Login to Disabled
  • Do Not Display Last User Name in Login Screen to Enabled
  • Message Text for Users Attempting to Log On to
    "Unauthorized use prohibited by 18, U.S.C"
  • Message Title for Users Attempting to Log On to company or site owners name
  • Prevent Users from Installing Printer Drivers to Enabled
  • Recovery Console: Allow Automatic Administrative Login to Disabled
  • Restrict CD-ROM Access to Locally Logged-On User to Enabled
  • Restrict Floppy Access to Locally Logged-On user to Enabled
  • Set Unsigned Driver Installation Behavior to Do not allow
    (NOTE: May prevent software installs)
  • Unsigned Non-Driver Installation Behavior to Do no allow
    (NOTE: May prevent software installs)
  • Additional restrictions for anonymous connections to No access without explicit
    anonymous permissions
Control Panel\Network and Dial-up Connections\applicable connections\Properties\General
  • Deselect all components except "Internet Protocol (TCP/IP)"
Control Panel\Network and Dial-up Connections\applicable connections\Properties\General\,
select Internet Protocol (TCP/IP), select Properties, select Advanced\Wins
  • Disable NetBIOS over TCP/IP
  • Disable LMHOSTS lookup
Control Panel\Network and Dial-up Connections\applicable connections\Properties\General\,
select Internet Protocol (TCP/IP), select Properties, select Advanced\Options\TCP/IP filtering
  • Disable or filter all TCP, UDP, and IP ports as needed
Control Panel\ Administrative Tools\Computer Management\Local Users and Groups\Users
  • Guest account\General Tab\Cannot change password
  • Guest account\General Tab\Password never expires
  • Guest account\General Tab\Account disabled
  • Guest account\Dial-in Tab\Remote Access Permission\Deny access

Services

Configure the following Windows Services to start automatically:
  • DNS Client
  • Event Log
  • Logical Disk Manager
  • IPSec Policy Agent
  • Plug and Play
  • Protected Storage
  • Remote Registry Service
  • RunAs
  • Security Accounts Manager
  • Task Scheduler
Configure the following Windows Services to start manually
  • Application Management
  • ClipBook
  • COM+ Event System
  • Logical Disk Manager Administrative Service
  • Distributed Link Tracking Server
  • Fax Service
  • File Replication
  • Indexing Service
  • Internet Connection Sharing
  • Net Logon
  • Netmeeting Remote Desktop
  • Network Connections
  • Network DDE
  • Network DDE DSDM
  • NT LM Security Support Provider
  • Performance Logs and Alerts
  • Qos RSVP
  • Remote Access Auto Connection Manager
  • Remote Access Connection Manager
  • Remote Procedure Call (RPC) Locator
  • Smart Card
  • Smart Card Helper
  • Unit Power Supply
  • Utility Manager
  • Windows Installer
  • Windows Management Instrumentation Driver Extensions
Disable the following Windows Services:
  • DHCP Client
  • Intersite Messaging
  • Kerberos Key Distribution Center
  • Messenger
  • Print Spooler
  • Routing and Remote Access
  • Simple Mail Transport Protocal (SMTP)
  • Telephony
  • Telnet
  • Terminal Services
  • Windows Time

General Changes

For the Everyone Group that was renamed
  • C Drive: Document and Settings folder rights: Read and Execute, List Folder Contents, Read
  • C Drive: WinNT folder rights: none
  • Web folder: Read and Execute, List Folder Contents, Read
Remove all rights for the Everyone group, that was renamed, from following
c:\winnt\system32 files
  • arp.exe
  • at.exe
  • cacls.exe
  • cmd.exe
  • command.exe
  • debug.exe
  • edit.com
  • edlin.exe
  • finger.exe
  • ftp.exe
  • ipconfig.exe
  • nbtstat.exe
  • net.exe
  • netstat.exe
  • nslookup.exe
  • ping.exe
  • posix.exe
  • rdisk.exe
  • rcp.exe
  • rexec.exe
  • regedit.exe
  • regedt32.exe
  • route.exe
  • rsh.exe
  • runone.exe
  • syskey.exe
  • tracert.exe
  • telnet.exe
  • xcopy.exe
  • (And any others not needed)
IIS
  • Stop Administrative Web Site
  • Stop Default SMTP Virtual Server
  • Stop FTP Site if installed
  • Delete the "iisstart.asp" in the WWWRoot directory
  • Delete the "iissamples" folder under the "inetpub" directory
  • Delete the "iisadmin" folder under the "inetpub" directory
  • Delete the "iishelp", "issadmin" and "iissamples" virtual directory for all current webs.
    NOTE: These directories should be deleted on any future webs also.
Display Properties
  • Set screen saver to "Logon Screen Saver"
  • Set screen saver to 5 minutes
  • Check password protect
Install remote control program if desired
  • Disable Guest account
  • Uncheck Internet Locator services if an option
Install Firewall software
  • Disable or close all unnecessary ports
  • Be sure to grant access IP access to any machine that will be used to administer the
    server remotely
Install AntiVirus program
  • Enable "start program on Windows startup" option
  • Turn on all activity logs (detection, quarantine, etc)
  • Disable "audible alert" option
  • Check that "how to respond when a virus is found" is set for an automatic solution.
    (Norton for example uses the a default of "ask me what to do".)
  • Enable scan of "master boot records"
  • Enable scan of "boot records"
  • Scan all inbound file types
Web Content
  • Create directory for web content (do not use default web directory)
  • Load content
  • Set directory, and .NET if applicable, permissions
  • Use SiteRecons URL Comments page (http://www.siterecon.com/URLComments.aspx)
    to verify not inappropriate comments are embedded in your pages.
Vulnerability Scan
  • Use a vulnerability scanner or scanning services to verify your site is secure and no
    vulnerability exist. A web search for the term "vulnerability scanner" will yield numerous
    companies to select from.

NOTE: Other security steps may be required based on you system, architecture, and specific needs!

Site and server security requires daily procedures to insure a proper defense. Security patched must be applied upon release, and the system and firewall logs need to be reviewed daily to track activity and intrusion attempts.

About the Author

Lew Newlin is CTO of Information Solutions, Inc. that operates SiteRecon.com. SiteRecon specializes in security, email monitoring, and web site monitoring for Internet service providers and businesses.


printer-friendly version


Bookmark/Search this post with:
delicious | digg | vigillar | reddit | magnoliacom | newsvine | furl | google | yahoo | technorati | icerocket | pubsub
printer friendly version