12
votes

When you are deploying a new web server box what are the standard things you install on it and do to set it up?

What things do you do to ensure the box is locked down and not going to get compromised?

So far:

General

Network

IIS

Related Articles

2
  • 1
    Is this an Internet facing server or not?
    – K. Brian Kelley
    May 1, 2009 at 1:11
  • Yes, I was thinking of an Internet facing server.
    – Luke Quinane
    May 1, 2009 at 1:31

5 Answers 5

Reset to default
6
votes

What we do:

  • Put web server in DMZ
  • Put web server in a workgroup (not allowed to be on a domain)
  • Ensure all security patches are applied
  • Minimize services which are running
  • Use URLScan. Remove server fingerprint (RemoveServerHeader=1).
  • Harden TCP/IP stack
  • Apply IPSEC policy to only permit the traffic we want (whitelisting)
  • Rename default accounts so they can be targeted by typical scripts/tools.
  • Move default directories (InetPub, WWWRoot, etc.)
  • Minimize local user accounts.
  • All NetBIOS is removed or disabled.
2
  • Nice list, but can you provide pointers to the reasoning behind not putting web servers on a domain? Is this 'best practice' or simply an internal policy.
    – David Christiansen
    Jun 1, 2009 at 10:03
  • If a web server is on the domain, it has to have LDAP, Global Catalog, ports, etc. all opened up to at least one DC. Therefore, if you can compromise the web server, you can directly attack the DC. Mull over that for a few minutes and you'll understand why it's generally recommended against. If you must do the domain route, advice like the following is generall used (use a separate forest with 1 way trust): searchsecurity.techtarget.com/expert/KnowledgebaseAnswer/…
    – K. Brian Kelley
    Jun 1, 2009 at 13:18
3
votes
  • Add user accounts for each person that will be administering the computer
  • Configure terminal services to allow each user only one concurrent sign on
  • Add alternate administration accounts that are only used if runas doesn't serve the purpose for a given user

-Adam

2
votes

You may wish to;

  • Disable SSL 2 (fix depreciated SSL protocol usage)
  • Perform a network vulnerability assessment

If so, I wrote a detailed article on Howto: Disable SSL2 and Weak Ciphers on IIS6 which may be worth taking a look at.

This article takes things from the standpoint of satisfying the security requirements set by the Payment Card Industry but is still relevant to general server hardening.

So now to fix the depreciated SSL protocol usage you should either read said Howto: Disable SSL2 and Weak Ciphers article for step-by-step instructions OR read MS Support Article #187498 and you can use ServerSniff to confirm your modifications have taken effect.

p.s. Indeed you could also use ServerSniff to confirm the modifications mentioned in Scott's reply.

1
  • +1 Handy article and ServerSniff looks pretty neat too!
    – Luke Quinane
    Jun 1, 2009 at 13:28
1
vote

In addition to the things already mentioned, I disable weak SSL ciphers.

EDIT: I found the step-by-step instructions I wrote a few years ago.

  1. Click Start, click Run, type regedt32 or type regedit, and then click OK.
  2. In Registry Editor, locate the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL
  3. Perform steps 4 thru 8 for the following keys: a. Ciphers\DES 56/56 b. Ciphers\RC2 40/128 c. Ciphers\RC4 40/128 d. Ciphers\RC4 56/128 e. Protocols\SSL 2.0\Client f. Protocols\SSL 2.0\Server
  4. On the Edit menu, click Add Value.
  5. In the Data Type list, click DWORD.
  6. In the Value Name box, type Enabled, and then click OK.
  7. Type 00000000 in Binary Editor to set the value of the new key equal to “0”.
  8. Click OK.
  9. When you have finished modifying the registry, restart the computer.
3
  • Which ciphers in particular?
    – Luke Quinane
    May 15, 2009 at 6:44
  • I can't find the exact list right now, but SSL 2.0 and anything weaker than 128-bit.
    – Scott
    May 15, 2009 at 18:59
  • I dug around in my archives and found the step-by-step instructions. I edited my answer to include them.
    – Scott
    May 28, 2009 at 1:23
-3
votes

If possible start with Windows 2003 SP1 Server and make sure the built in firewall is turned on unless you have a network firewall to protect it.

Make sure the following ports are open if you do setup the firewall: - 3389 : Remote Desktop (RDP) - 80 : HTTP

Optional: - 443 : HTTPS (optional) - 25 : SMTP - 110 : Pop3

Utilities:

  • Notepad++ (all around great editor) - free
  • 7-Zip (handles zip,arc, and other compressed files) - free
  • Beyond Compare v3 (file comparison and FTP) - $ but not much
  • Database management
3
  • 1
    You mean Windows 2003 SP2, right? Also, if it's a web server you want to lock down, you don't want SMTP and POP3 open on it. You also don't want RDP. At least, not on the default port.
    – K. Brian Kelley
    May 1, 2009 at 1:53
  • 1
    I'd avoid loading the server with too much dev. junk. You don't want to optimize for spending a lot of time using the server as a workstation, that's a recipe for failure.
    – Wedge
    May 1, 2009 at 2:01
  • each to his own. if you only have one server running your website having a few dev tools is a must. having your email and web hosting on one server is also. not everyone needs or can afford separate servers for each service.
    – Brian Boatright
    May 1, 2009 at 16:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.