Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

My site is running on .NET 3.5 with SQL 2008.

I’m thinking of setting up my own server, and want to know what am I getting myself into.

I need to know what apps to install so my server will be secure and run well.


The obvious list is:

• Windows Server 2003

• .Net Framework 3.5

• SQL 2008


Do I need:

• Antivirus ?

• FireWall ?

Are there more must have apps?

share|improve this question

closed as not constructive by Michael Hampton, RobM, John Gardeniers, EEAA, rnxrx Aug 20 '12 at 19:37

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

3  
Unless there is any particular reason you want to stick with 2003, you'd be best looking at server 2008, R2 if possible, –  Sam Jan 26 '10 at 15:16
    
Server 2003 FTL! =) Seriously, if your doing anything remotely web related, you want IIS 7.5. It roxors. –  Wesley Jan 26 '10 at 16:00
    
Thanks. I'll go with 2008. –  SirMoreno Jan 26 '10 at 19:50
    
what is this server going to do? just a db, or is there an app? is there another server acting as a front end? is it part of a domain? is it a production machine or a dev machine? inside your lan or dmz? –  cwheeler33 Jul 21 '12 at 15:12

7 Answers 7

Some version of TreeSize to know where in the world all your space just went. "I didn't know that thing made a 500MB logfile every day!" I think you can also get it to scan your server across the network via CIFS shares if you don't want to install anything on your server. You don't have to share out your whole drive... it already is via Admin shares.

Also, Microsoft Network Monitor. Yes, you will need it at some point and in my experience Microsoft Pro Support services don't accept WireShark files.

share|improve this answer
    
I use windirstat all the time to figure out what's eating up all my disk space. –  Grant Aug 19 '12 at 3:40

You'll probably end up needing the 2003 Resource Kit and the 2003 Support Tools at some point (I'd give links, but you'll want the ones specific to your SP). That sums up my must-have list for my 2003 servers.

I try to install as little as possible on a server - if I find the need to, I look good and hard to make sure I can't just install to my workstation and connect that way. If your server isn't sharing a LAN with any clients, and you're careful about what you install, you should be able to skip the AV (because of course you'd never browse the Web from it).

share|improve this answer
    
Thanks. If I'll go with server 2008 what are the must have from a security perspective? –  SirMoreno Jan 26 '10 at 19:55
    
At this point, PowerShell serves all my needs on 2008, but there may be good security reasons not to put that on a web server? You'd want input from brighter minds than mine on that tho - may want to throw up a new question. –  Kara Marfia Jan 26 '10 at 21:22

My recommendation is to install the components/software that are neccessary for the operation and security of the server in the role that you intend it to serve. Anything else is superfluous as far as I'm concerned.

You can install a packet capture program, or a directory analysis program, or the Windows support tools, or anything else for that matter... but are they vital to the operation of the server? If the answer is no, then leave them off until such time as you need them. Like Dan, I would also recommend that you run the Security Configuration Wizard on the server after you've got everything you need installed, configured, and tested.

share|improve this answer
    
Great point about not installing software unless it's vital to the server's stated role and even if you do use a special utility, wait until you need it. I'll squirrel that away and recall it the next time I set up a new server. The only thing that makes me hesitate is that, in my experiences, whenever I need that special utility is when the added complexity of installing it is least convenient. "Oh, the windows installer service crashed too?" or "Wait, a shared file is locked and I'll need to reboot for this to install?!" are not fun sentences to utter in a crisis. =) –  Wesley Jan 26 '10 at 15:58
    
I guess it depends on your definition of fun... ;) –  joeqwerty Jan 26 '10 at 16:14

Antivirus is a debatable subject, but a firewall is a must. Preferably a hardware appliance though, IMO.

See THIS post on AV on servers, it gives several views. Personally, I do have AV on mine, but with exclusions setup for Exchange.

One other thing to really look into, is the Security Configuration Wizard for Server 2003.

share|improve this answer
    
+1 for hardware firewall –  Chris Driver Jan 26 '10 at 14:43

Please don't forget to install whatever software is necessary to enable hardware monitoring. If a disk, fan, or PSU needs replacement, you should find out immediately, not when someone wanders into the server room and sees an an amber light flashing on the case.

If this is a Dell server, the required software is called "OpenManage Server Administrator Managed Node." Look for the most recent version available for your server at support.dell.com. If you have a different brand of server, consult the manufacturer's documentation for specific information.

share|improve this answer

Antivirus is a touchy thing, people debate endlessly over it. Choose one from reviews online and go with it, as there are sites that rank them periodically). None are infallible, and you can't layer them.

Add on for defense Ad-Aware and Spybot Search and Destroy for malware.

Get the Sysinternals Suite for troubleshooting. Invaluable.

Other security depends on your setup. Is the machine virtual? That can help for monitoring as anything that affects the computer is a little more visible by a "virtual" third party, to see network traffic and behavior. Is the machine at home, or in a business? Make sure it's behind a NAT firewall or a hardware firewall to help protect it. Software firewalls are okay, but in many cases the number one defense comes from just blocking off all non-essential for external access ports at the Internet ingress point...your cable/DSL router or NAT router.

Any other software depends on what you're going to do with the system. Web server? Database? File server?... Servers, generally, should have only what's needed to fulfill their role on them. That alone helps with security, as the more crap you later on it the more surface there is for attacking the computer (and more bugs and unforeseen behaviors can emerge...)

share|improve this answer

don't forget backups

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.