Strengthening the safety of NT and IIS (authoritative translation, recommended to 9CBS and all Microsoft server users !!!)

zhaozj2021-02-08 212

This article is only tried to run the NTS 4.0 system of IIS 4.0. If there are other applications (such as Cold Fusion) on the server, these applications must be guaranteed. The method described below should be carried out when installing a new system to avoid unpredictable results. It is also important to note that this method should not be used on an internal network (such as a file server) because it deletes some NT commonly used default services.

First, install

1. All partitions NTFS

Server selects separate servers, do not choose PDC

Select a member of the workgroup, no domain

2. Install IE 4.0 SP2, do not install Active Desktop

3. Install the latest service pack: SP6A

Install the latest hot patch:

Q241041 Enabling NetBt to Open IP Ports Exclusively

Q243404 Winobj.exe May Let You View Securable Objects CREATED / OPENED by Jet500.dll

Q243405 Device Drivers Create THEIRESPONDING DeviceObject with file_device_secure_open Device Characteristics

Q244599 FIXES REQUIRED IN TCSEC C2 Security Evaluation Configuration for Windows NT 4.0 Service Pack 6A. Windows NT Appears To HANG WHEN You Log Off Installing Service Pack 6.

Q188806 NTFS Alternate Data Stream Name of a File May Return Source

Q252463 SECURITY UPDATE, April 13, 2000

Q267559 Security Update, July 17, 2000

Q269862 Security Update, August 15, 2000

Q271652 Security Update, September 8, 2000

4. Install OPTION PACK:

Select a custom installation:

Only the following components are installed:

Internet Information Server, INTERNET Information Server

Internet Service Manager

[_] World Wide Web Server

[_] Microsoft Data Access Components 1.5

Data Sources

[_] MDAC: ADO, OBDC, And Ole DB

[_] Remote Data Service 1.5

RDS Core Files

[_] Microsoft Management Console

[_] NT OPTION PACK Common Files

[_] Transaction Server

[_] Transaction Server Core Components

Install WWW on different partitions different from operating systems

Select Default / Local Administration when installing Transaction Server

5. Install the latest MDAC (2.6 RTM AS OF 10/30/00)

Second, configure NT

1. Setting permissions:

Set the following using the User Manager on the root of all partitions as follows:

* Administrators :: Full Control

* SYSTEM :: Full Control

2. Set screen protection Select display in the control panel

Select screen saver

Select Password Protection, click OK

3. Set service:

Prohibit the following services:

ALERTER (Disable)

CLIPBOOK Server (Disable)

Computer Browser (Disable)

DHCP Client (Disable)

DIRECTORY Replicator (Disable)

FTP Publishing Service (Disable)

License logging service (disable)

Messenger (Disable)

Netlogon (Disable)

Network DDE (Disable)

Network DDE DSDM (Disable)

Network monitor (disable)

Plug and Play (Disable After All Hardware Configuration)

Remote Access Server (Disable)

Remote Procedure Call (RPC) Locater (Disable)

Schedule (Disable)

Server (Disable)

Simple Services (Disable)

Spooler (Disable)

TCP / IP NetBIOS Helper (Disable)

Televhone Service (Disable)

The following services are prohibited when necessary:

SNMP Service (Optional)

SNMP Trap (Optional)

UPS (Optional

Set the following service to start:

EventLog (Required)

NT LM Security Provider (Required)

RPC Service (Required)

WWW (required)

WorkStation (Leave Service On: Will Be Disabled Later in The Document)

MSDTC (Required)

Protected Storage (Required)

4. If SNMP is installed, change the value of Community

5. Delete the directory of the IIS example:

IIS D: / INETPUB / IISSAMPLES

Admin Scripts D: / INETPUB / SCRIPTS

Admin Sample% SystemRoot% / System32 / inetsrv / adminssamples

IisadMPWD% systemroot% / system32 / inetsrv / isadmpwd

Iisadmin% systemroot% / system32 / inetsrv / iisadmin

Data Access C: / Program Files / Common Files / System / MSADC / Samples

6. Remove the following directory from the ISM (Internet Service Manager):

Iissamples

Scripts

Iisadmin

Iishelp

Iisadmpwd

7. Delete unnecessary IIS extension mappings:

From ISM:

Select the computer name, right-click, select Properties:

Then select Edit

Then select the primary directory, click configure

Select the extension ".hta", ".htr" and ".idc", click to delete

If you don't use Server Side Include, delete ".shtm" ".stm" and ".shtml" 8. Prohibition of default WWW sites

9. Disable administrator from logging in

Use the tool passprop in NT Resouce Kit to execute the following command:

Passprop / AdminLockOut / Complex

10. Only open ports:

Select the network in the control panel, click the property to select the TCP / IP protocol and click Properties.

Click Advanced Options

Select "Enable Security Mechanism" and click "Configuration"

Allow all changes to only the following ports:

TCP Ports UDP Ports IP Protocols

80 HTTP 161 SNMP 6

443 SSL 162 SNMP 8

22 SSH

11. Install only TCP / IP protocol

Select the network in the control panel, click on the protocol, and remove all non-TCP / IP protocols.

12. No Netbios:

Select the network in the control panel, click Bind, select the NetBIOS interface, then click Disable

13. Move some important files and add access control:

Create a directory that only the system administrator can access, such as:

D: / admin

Move the following files in the System32 directory to the directory you created above:

Xcopy.exe, Wscript.exe, Cscript.exe, Net.exe, ftp.exe, telnet.exe, arp.exe, edlin.exe, ping.exe, route.exe, at.exe, finger.exe, POSIX. EXE, RSH.EXE, ATSVC.EXE, QBasic.exe, Runonce.exe, syskey.exe, cacls.exe, ipconfig.exe, rcp.exe, secfixup.exe, nbtstat.exe, rdisk.exe, debug.exe, Regedt32.exe, regedit.exe, edit.com, netstat.exe, tracert.exe, nslookup.exe, rexec.exe, cmd.exe, nslookup.exe

Third, run bation.inf reinforcement script

Download the latest bastionf.zip, run the following command after decompression:

SECEDIT / configure / cfg bastion.inf / db% temp% / successdit.sdb / verbose / log% TEMP% / SECLOG.TXT

This security policy script has made the following changes in the system:

1. Set the following password strategy:

Password Uniqueness: Record 6 passwords last time

Shortest password period: 2

Password longest deadline: 42

The shortest password length: 10

Password complication (passfilt.dll): Enable

The user must log in to change the password: enable

Account failed login locking threshold: 5

Time lapse of re-enabled after lock: 720 minutes

2. Audit strategy:

Audit the following events:

User and group management success: failed

Successful login and cancellation: failed

Document and object access failure

Change safety rules success: failed

User privilege failed

System event success: failed

3. User authority assignment:

Access this computer from the network: No One Adds the workstation to the domain: No One

Backup file and directory: administrators

Change system time: administrators

Forced from remote system shutdown: no one

Load and download device drivers: administrators

Local login: Administrators

Manage review and security logs: administrators

Restore files and directories: administrators

Turn off system: administrators

Get the authority of the file or object: administrators

Ignore traversal inspection (advanced power): Everyone

As a service login (advanced power): no one

Memory locking page: no one

Replace process grade marker: no one

Produce security audit: no one

Create a page file: administrators

Configuring system performance: no one

Create a marker object: No One

Debugger: no one

Add progress priority: administrators

Add quota: administrators

Configure a single process: administrators

Modify firmware environment value: administrators

Generate system strategy: administrators

4. Event Viewer Settings:

Applications, systems, and secure log spaces are set to 100MB

The event log coverage is: overwriting the log of 30 days ago

No anonymous user view log

5. Registry value

Key Type Value

Machine / Software / Microsoft / DataFactory / HandlerInfo /

HandlerRequid Reg_dword 1

Machine / System / CurrentControlSet / Control / FileSystem /

NTFSDISABLE8DOT3NAMECREATION REG_DWORD 1

Machine / Software / Microsoft / WindowsNT / Version / Winlogon / AllocatecDroms REG_SZ 1

Machine / System / CurrentControlSet / Control / LSA / AuditbaseObjects

REG_DWORD 1

Machine / System / CurrentControlSet / Control / LSA / SU

Machine / System / CurrentControlSet / Control / Print / Providers / Lanman

PrintServices / AddPrintDrivers Reg_dword 1

Machine / System / CurrentControlSet / Services / RDR /

Parameters / EnablePlainTextPassword Reg_dword 0