China DOS Union

First: how to install it

　　1. Choosing the version

　　The author strongly recommends: if language is not a barrier, be sure to use the English edition. You should know that Microsoft's products are famous for "Bug & Patch"; the Chinese edition has far more bugs than the English edition, and patches are usually delayed by at least half a month (that is, after Microsoft announces a vulnerability, your server will generally still remain unprotected for half a month).

　　2. Customizing components

　　WIN2K will install some commonly used components by default, but this default installation is very dangerous. According to the security principle, "the fewest services + the least privileges = the greatest security"; just install the services you actually need. What especially needs attention here are these dangerous services: "Indexing Service", "FrontPage 2000 Server Extensions", and " Internet Service Manager".

　　3. Choosing administration applications

　　Choosing a good remote administration program is very important. This is not only a security requirement, but also an application need. WIN2K's Terminal Service is remote-control software based on RDP (Remote Desktop Protocol). It is fast, easy to operate, and quite suitable for routine operation. However, Terminal Service also has its shortcomings. Because it uses a virtual desktop, and because Microsoft's programming is not rigorous enough, when you use Terminal Service to install software or reboot the server and do other operations that interact with the real desktop, strange and frustrating things often happen. For example, using Terminal Service to reboot Microsoft's certified servers (Compaq, IBM, etc.) may directly shut them down. So, to be safe, it is recommended to equip another remote-control program as a supplement to Terminal Service. PcAnyWhere is one good choice.

　　4. Partitioning and logical drive allocation

　　Create at least two partitions: one system partition and one application partition. This is because Microsoft's IIS (Internet Ihformation Server) often has vulnerabilities. If the system and IIS are placed on the same drive, it may lead to leakage of system files, and may even let an intruder remotely obtain administrative control.

　　It is recommended to create three logical drives: the first for the system and important log files; the second for IIS; the third for FTP. This way, no matter whether IIS or FTP has a security hole, it will not directly affect the system directory and system files.

　　5. Choosing the installation order

　　Don't think that as long as the system is installed, the job is done. In fact, the installation order of WIN2K is very important.

　　First, pay attention to when you connect to the network. WIN2K has a vulnerability during installation: after you enter the Administrator password, the system creates the "$ADMIN" share, but it is not protected with the password you just entered. This situation continues until the computer is restarted. During this period, anyone can enter the system through "$ADMIN". At the same time, as soon as installation is completed, all kinds of services start running automatically, while the server is still full of vulnerabilities at that point, making it very easy to break in from outside. Therefore, before WIN2K Server is completely installed and configured, do not connect the host to the network.

　　Second, pay attention to installing patches. Patches should be installed only after all application programs have been installed, because patch programs often replace or modify certain system files. If you install patches first, they may not achieve their intended effect.

Second: how to configure it

　　Even if WIN2K Server is installed correctly, the system still has many vulnerabilities, and further detailed configuration is still needed.

　　1. Ports

　　Ports are the logical interfaces connecting a computer to the external network, and are also the computer's first line of defense. Whether port configuration is correct directly affects host security.


　　2. IIS

　　IIS is the most problematic of Microsoft's components; on average a vulnerability appears every two or three months, and Microsoft's default IIS installation is really hard to praise, so IIS configuration is our key focus.

　　First, delete the Inetpub directory on drive C, create an Inetpub on drive D, and in IIS Manager point the home directory to D:\Inetpub.
　　Second, delete the default virtual directories such as scripts created during IIS installation. If you need directories with certain permissions, you can create them later (pay special attention to write permission and program execution permission).

　　Next is application configuration. In IIS Manager, delete all useless mappings (of course you must keep ASP, ASA, and the like). In IIS Manager, go to "Host → Properties → WWW Service Edit → Home Directory Configuration → Application Mappings", then start deleting them one by one. Next, in the application debugging tab, change ?quot;script error message" to "send text". When clicking "OK" to exit, don't forget to have the virtual site inherit the properties you just set.
　　Finally, to be safe, you can use IIS's backup function to back up all the settings you just made, so that you can restore IIS's security configuration at any time. Also, if you are afraid that excessive IIS load may cause the server to crash, you can enable CPU limits in performance settings, for example limiting IIS's maximum CPU usage to 70%.

　　3. Account security

　　First, WIN2K's default installation allows any user to obtain the system's entire account and share list through a null user. This was originally for the convenience of LAN users sharing resources and files, but at the same time, any remote user can also obtain your user list by the same method, and may use brute force to crack user passwords and damage the whole network. Many people only know to change the registry
Local_Machine\System\CurrentControlSet\Control\LSA-RestrictAnonymous =
1 to prohibit null-user connections, but in fact WIN2K's local security policy already has such an option (if it is a domain server, then in domain server security and domain security policy): RestrictAnonymous (additional restrictions for anonymous connections). It has three values:

　　"0": None, Rely on default permissions (none, depends on default permissions)

　　"1": Do not allow enumeration of SAM accounts and shares (do not allow enumeration of SAM accounts and shares)

　　"2": No access without explicit anonymous permissions (no access without explicit anonymous permissions)

　　The value "0" is the system default, with no restrictions at all. Remote users can know all accounts, group information, shared directories, network transport lists (NetServerTransportEnum), etc. on your machine. For a server, such a setting is very dangerous. The value "1" allows only non-NULL users to access SAM account information and share information. The value "2" is supported only by WIN2K. It should be noted that if you use this value, you will no longer be able to share resources, so it is still recommended to set the value to "1".



　　4. Security logs

　　What needs attention here is: WIN2K's default installation does not enable any security auditing at all! So you should go to "Local Security Policy → Audit Policy" and enable the corresponding audits. What needs to be explained here is that if there are too few audit items, then when you want to check later and find there is no record, there will be nothing you can do; but if there are too many audit items, not only will they consume a large amount of system resources, you may also have no time to look through them all, and then auditing loses its meaning. The recommended auditing is as follows:

　　For "Account Management", "Logon Events", "Policy Change", "System Events", and "Account Logon Events", enable both "Success" and "Failure"; for "Object Access", "Privilege Use", and "Directory Service Access", enable only "Failure".

　　Related to this, in "Account Policies → Password Policy" set: "Password must meet complexity requirements enabled", "Minimum password length 6 characters", "Enforce password history 5 times", "Maximum age 30 days"; in "Account Policies → Account Lockout Policy" set: "Account lockout after 3 invalid logon attempts", "Lockout duration 20 minutes", "Reset lockout count after 20 minutes", etc.

　　Terminal Service security logging is also disabled by default. You can configure security auditing in "Terminal Service Configration (Remote Service Configuration) → Permissions → Advanced". Generally speaking, it is enough just to record logon and logoff events.

　　5. Directory and file permissions

　　In order to properly control user privileges on the server, and also to guard against possible future intrusions and overflows, you must set access permissions for directories and files very carefully. NT access permissions are divided into: Read, Write, Read & Execute, Modify, List Directory, and Full Control. By default, most folders are completely open to all users (the Everyone group) with Full Control. You need to reset permissions according to application needs. When controlling permissions, please remember the following principles:

　　1. Permissions are cumulative. If a user belongs to two groups at the same time, then he has all the permissions allowed by both groups.

　　2. Denied permissions are higher than allowed permissions (the deny policy is executed first). If a user belongs to a group that is denied access to a certain resource, then no matter how many other permissions are granted to him, he still cannot access that resource.

　　3. File permissions are higher than folder permissions.

　　4. Using user groups for permission control is a good habit that a mature system administrator must have.

　　5. Give users only the permissions they truly need. The principle of minimum permissions is an important guarantee of security.

　　6. Prevent ICMP attacks: ICMP flood attacks and fragment attacks are also attack methods that give NT hosts quite a headache. In fact, the response method is also very simple. WIN2K comes with a Routing & Remote Access tool, and this tool already has the rudiments of a router. In this tool, we can easily define inbound and outbound packet filters. For example, setting inbound ICMP code 255 to drop means dropping all external ICMP packets.

Third: things to note

　　In fact, security and application are often contradictory in many situations, so you need to find a balance point between them. After all, the server is for users to use. If security principles hinder system use, then that security principle is not a good principle either.

　　Network security is a systematic project. It has not only a spatial span, but also a temporal span. Many friends (including some system administrators) think that a host that has undergone security configuration is secure. In fact, this is a misunderstanding. We can only say that a host is secure under certain circumstances for a certain period of time. As network structures change, new vulnerabilities are discovered, and administrators and users perform operations, the host's security status changes anytime and anywhere. Only by letting security awareness and security rules run through the entire process can real security be achieved.

--