Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a MUonline (link) gameserver running on Windows 2003 enterprise X64. I had a website running there too. I do not know much about security here so I'm asking for some tips or tutorials you know about this as my server was hacked (I don't know how, exactly) and Windows has been erased. So now I want to make a secure gameserver, to start from 0.

Any ideas ?

share|improve this question

3 Answers 3

Firstly will you be running a website on the server again? What games do you plan to host?

both of these can change bits of how you secure the server.

The most basic security i can think of for a windows server is

  1. Administrator password with Alpha Numeric Special Character long password
  2. Keep your system and software up to date
  3. Install antivirus/malware software
  4. Enable only needed services though Services.msc
  5. Don't give out Administrator accounts
  6. Disable all unneeded accounts
share|improve this answer
    
I will be running Muonline again, on this server. Yes, a webserver would be hosted here aswell. I think they broke in through my website and I need better security there too. I am opened to anything. Thanks. –  Calavera Oct 19 '10 at 17:17
    
Are you running a private server? just asking as most private servers operate using a site/server created by someone/some team and include the webserver ect... - if not i would suggest that if you are using PHP you harden the install of php and mabby install some brute force detection software a quick google search will show alot of results for such things –  Trozz Oct 19 '10 at 18:32

Get SP2 installed, if not already done. Configure Windows Update to pull down any critical security updates.

I'm assuming you've got a firewall in front of the server? If not, configure the Windows Firewall (not very flexible on Win2k3).

Ensure your event log sizes are fairly big (>16K), configure them to overwrite as needed. Enable auditing.

Make your passwords very complex (include upper case, lower case, numerics and punctuation). Make them at least 10 characters.

Ensure any unnecessary accounts are disabled. Disable any unecessary services, use AutoRuns to stop as much stuff starting.

Run services using an account with the minimal privileges possible.

Uninstall any unncesesary applications / windows features.

Possibly install the Security Configuration Wizard.

Then, monitor, monitor, monitor. Use TCPView and ProcessExplorer.

share|improve this answer

Make sure it's updated all the time for all it's code, that it's running as little code as possible and that it's fire walled to within an inch of its life. Then pay someone ti try to hack it, lusted to them when they're done and implement what they say. Keep this up, forever.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.