Web-Server security settings and security policies for data intrusion

Zhou Min Yao Jin Li Yang Qi Shou

(School of Manufacturing Science and Engineering, Sichuan University, Chengdu 610065)

Pick

To:: Focus on the security configuration of the system and SQL INJECTION for data,

Key words: network security; SQL INJECTION; system; data

One.

introduction

With the popularity and development of the network, all types of Internet-based systems have also played an increasingly important role in all walks of life. However, due to the characteristics of the computer network has a diversity of connection, the terminal distribution unevenness and the network of openness, interconnection, such as hackers, malware, and other habitats. Moreover, it is especially important to improve network security when it involves privacy information about personal identity, or the sensitive data of various groups such as companies, and even commercial data. This article will focus on the typical configuration in the web system (Win2000 Server SQL IIS5.0), focusing on the system security settings of the Web server and SQL Injection security policies.

two.

Network security hazard analysis and safety technology

Usually, the network security we said is that the data in the network system, software and its systems are protected, and it will not be destroyed, change, leak, and the system can be continuous, reliable, normal due to accidental or malicious attacks. Franc, online service is not interrupted. Therefore, usually network security includes two parts of system security and data security. Similarly, malicious attacks on networks can also be roughly divided into systematic attacks and data type attacks. In network security, various hardware facilities, firewalls are essential. In addition, the system security settings and code data security is also part of it in which this is in-depth discussion. The specific analysis is as follows:

1. System security settings

Take Windows 2000 Server SQL Server 2000 IIS5.0 as an example: relatively, this is our most common network server configuration. But Microsoft's vulnerability is endless, and a patch is one. Therefore, the security of the reinforcement system is extremely important.

First, you should choose a dedicated Web Server server to disconnect the server's network connection when installing the system, and install the Patch of Service Pack 3 on this basis.

Modify the registry after finishing the patch, first prohibit the default sharing. In Windows 2000, there is a "default share", which is automatically shared when the server installation partition is installed, although it is necessary to access the password of the superuser, but this is a potential security hazard, from the server Safety consideration, it is best to close this "default share" to ensure system security. Put the key value:

HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / Services / Lanmanserver / Parameters / AutoShareserver modified to 0.

HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / SERVICES / LANMANSERVER / Parameters / AutoShaRewKs are modified to 0. If there is no two key values, new will be created. Note that "Dual Number Value" is selected when new.

Also prohibit IPC $ empty connection, set the key value

HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / CONTROL / LSA / RESTRICTANONYMOUS is modified to 1. IPC $ (Internet Process Connection) is a named pipe that is open to inter-process communication, you can use the corresponding permissions by verifying the username and password, using the remote management computer and the shared resource of the computer to view the computer. With IPC $, the connectors can even create an empty connection with the target host without the username and password (of course, the host must open IPC $ sharing, otherwise it is not connected), and use this empty connection, the connection You can also get the list of users on the target host.

Second, for IIS, try to avoid installing IIS on the main domain controller in the network. Because after IIS is installed, an anonymous account for IUSR_Computername will be generated on the installed computer. This account will be added to the domain user group, providing access to domain user groups to each anonymous user accessing the web server, which not only guarantees the security of IIS, but also threatens the main domain controller. After installation, IISLOCKD.EXE should be run, which is software used to fill IIS vulnerabilities in Microsoft. But this is not enough to guarantee the security of IIS, and should be further reinforced by IIS:

a. Delete and deactivate IIS's demonstration procedures and directories, this is the procedures and files comes with IIS, but also a way to attack the web system.

entry

position

IIS

? / INETPUB / IISSAMPLES

Admin Scripts

? / Inetpub / adminsscripts

Iis Documentation

% SystemRoot% / Help / Iishelp

Data Access

? / Program files / componfiles / system / msadc

b. In order to prevent the attacker from using the server's FTP settings and send mail to the website content to modify the website content, if the server does not need FTP and send mail, you can delete the ftProot and mailroot two folders and turn off the relevant service.

c. To avoid log files to be modified or overwritten, you need to set access control permissions for IIS log files: By default, IIS's logs will under "% systemroot% / system32 / logfiles" directory. If possible, you can change the path of the log into a place. Recommended Access Control Permissions: Administrators; System (Full Control); Everyone (RWC). This step will prevent some malicious users from covering his records by deleting log information.

d. Delete the dangerous script image:

For example: the map of the .htr file, request processing presence orbital vulnerability, remote attacker can use this vulnerability to get the host local ordinary user access. For idq.dll, there is an unchecked buffer when handling some URL requests. If an attacker provides a URL in a special format, it may cause a buffer overflow. By sending data by carefully constructing, an attacker can change the program execution process and perform any code. Successfully use this vulnerability, an attacker can get "local system" permissions remotely. Therefore, deleting some script images that do not need, can minimize the possibility of using the vulnerability attack:

Script type

Mapping

Web-based Password Reset

.htr

Internet Database Connector

.idcser-side incrudes

.stm .shtml .shtm

Internet Printing, INTERNET

.printer

INDEX Server

.ida .idq .hta

2. Data attack

The following mainly summarizes security policies for SQL INJECTION and settings to SQL Server. The so-called SQL INJECTION means that the user data is inserted into the actual database operation language using some of the external interfaces of some databases, thereby achieving the purpose of invasive database or even operating systems. In the WEB Scripting Language (ASP, PHP), the front desk database is made in the background Web system, in order to achieve the purpose of interacting with the user, there is inevitable information from the information from the user, such as the user's login information, inquiry String, or user can modify remotely, etc.. This information is often possible to be utilized by an attacker, tampering with the SQL statement into other combined statements to achieve its attack purposes.

Here, we will give a simple example: