0

I have to set up a Windows 2003 Small Business Server to work as a Subversion repository and possibly as an E-Mail server later.

The machine is a virtual one, hosted with a hosting company, and freshly initialized.

I used the Security Configuration Wizard to deactivate all server roles. After I install Subversion, I will open the necessary ports for the service; in addition, obviously, RDP will stay open so I can remote control the machine.

Automatic updates are activated, and I will set up E-Mail notification every time somebody logs on to the server.

I'm a programmer and not a professional systems administrator, so I would like to know whether you would regard this a sane and secure setup for a (publicly available) box to host sensitive code and/or E-Mail on.

Is there anything in addition I should do to make the machine secure?

Is there anything I can do on a long-term basis to keep the machine secure, apart from monitoring the event log (as far as I can make sense out of it), and seeing that any hotfixes are installed properly?

1
  • 1
    w2k3 is ok for security when firewalled proberly but w2k8+ is a lot better.
    – tony roth
    Apr 5, 2010 at 15:36

3 Answers 3

1

If you're content with SBS 2003/Windows, I've think you've done a decent job as it sits now. Couple of other things:

  1. enable Failure Auditing in the event logs so that you see when login failures happen, not just successes; you can google how to do this.

  2. Create a new administrator user called "somebodyelse" or whatever and disable the built-in\administrator user (check to make sure no services are running with it though first and change accordingly). This way, anyone authenticating will need to know the username as well as the password.

  3. Enable NTLMv2 only; LanManager hashes are trivial to break.

  4. Use passphrases instead of passwords

  5. Use Remote Web Workplace, not RDP directly, to your SBS Server; I'd also limit the IP addresses that can access Remote Web Workplace (443, 4125) with your firewall; same goes for SVN, if possible.

  6. Check out Microsoft's docs on Windows Hardening at TechNet; there's checklist you can complete and you can also run the Baseline Security Analyzer as well: http://www.microsoft.com/downloads/details.aspx?FamilyID=F32921AF-9DBE-4DCE-889E-ECF997EB18E9&displaylang=en

1
  • Cheers @Gravyface to providing me with a lot of options. Great stuff. I will look into whether I'll set up a Linux server. If I choose to stay with Windows, I'll go through this great list.
    – Pekka
    Apr 5, 2010 at 20:01
1

Windows Small Business Server is great value for the money: you get Exchange, SharePoint, Remote Web Workplace, etc. for a very low price point, which is perfect for small offices.

However, SBS would probably be the last server I'd suggest for a purpose-built SVN server, regardless of email or not. I would feel much better hosting SVN on a UNIX-like OS (Linux/BSD in your distro of choice) with something like Postfix for mail. Not only should it be less expensive in hosting fees (no Windows license/CALs to buy for example), but you can radically reduce the footprint (and therefore attack vectors) with something like FreeBSD by only installing the Ports packages required to support your two requirements; ditto for a Server version of Linux (Ubuntu, Debian, CentOS, RHEL, etc.) vs. what you can with SBS without difficulty.

3
  • Cheers @gravyface, I'm sure you're right - and Linux hosting would be a lot cheaper as well. But while I can do basic Linux administration, I don't feel versed enough to set up a production server with sensitive data on it, something I'm more comfortable with on Windows. Hmm. Still, maybe this is a path to follow - I'll look into this. Any links to comprehensive HOWTOs or similar are much appreciated.
    – Pekka
    Apr 5, 2010 at 15:53
  • Seeing that Subversion is an open source project (and pulling numbers out of the air, likely deployed on 90% Linux/BSD OSs), you'll actually find better support out there for a UNIX-like platform vs. Windows.
    – gravyface
    Apr 5, 2010 at 15:54
  • If you've already got a windows SBS server, there isn;t any difference running subversion for windows vs linux other than the obvious- one's on linux and the others on windows. Obviously setup and admin are far simpler on windows than on linux.
    – Jim B
    Apr 5, 2010 at 16:26
1

Another option would be to run with a dedicated private SVN hosting company; I've heard good things about http://beanstalkapp.com/.

Similarly, for email (and some collaborative features as well like shared calendaring and private Google Docs), you could go with Google Apps for My Domain -- free/standard version supports up to 5 users.

1
  • @gravyface I have explored that option, but would like to keep the possibility to install new applications (like Redmine for project management, etc.). Still, thanks for making me aware of Google Apps, that looks generally very interesting.
    – Pekka
    Apr 5, 2010 at 16:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .