Windows Server 2003 Recommended Baseline Security

More documents

Recommendations

Info

Unclassified ITSG for Windows Server 2003 4.7 Additional Security Settings The following settings are in the policy file and organized similarily with the Windows Server 2003 Security Guide. While the settings affect the Registry, they do not appear in the Registry section of the Policy GUI. 4.7.1 Security Consideration for Network Attacks 4.7.1.1 EnableICMPRedirect machine\system\currentcontrolset\services\tcpip\parameters\enableicmpredirect=4, 0 The ‘enableicmpredirect’ registry value causes TCP to find host routes. This overrides OSPF generated routes. The setting ‘0’ disables this capability. If enabled, a ten-minute timeout makes the system unavailable to the network. Disabling causes the system to rely on OSPF routing. 4.7.1.2 SynAttackProtect machine\system\currentcontrolset\services\tcpip\parameters\synattackprotect=4, 1 The ‘synattackprotect’ registry value adjusts retransmissions of SYN-ACK. The setting ‘1’ causes connection timeouts faster when a SYN-ATTACK is detected. The setting reduces effort expended on unresponsive connections. 4.7.1.3 EnableDeadGWDetect machine\system\currentcontrolset\services\tcpip\parameters\enabledeadgwdetect=4, 0 The ‘enabledeadgwdetect’ value allows TCP re-direction to a backup gateway. The setting ‘0’ disables this capability. If a system detects difficulties on a network, it will automatically switch to a different gateway. This may cause undesireable packet traversal over un-trusted networks. 4.7.1.4 EnablePMTUDiscovery machine\system\currentcontrolset\services\tcpip\parameters\enablepmtudiscovery=4, 0 The ‘enablepmtudiscovery’ registry value determines if TCP automatically finds the maximum transmission unit (MTU) or the largest packet size to a remote host. The setting ‘0’ causes a fixed size packet be used for all connections to remote hosts. If enabled, an attacker could force a very small packet size. This results in a significant increase of network workload. This may also lead to a DoS condition. 4.7.1.5 KeepAliveTime machine\system\currentcontrolset\services\tcpip\parameters\keepalivetime=4, 300000 The ‘keepalivetime’ registry value determines how often TCP verifes an idle connection is intact. The setting ‘300,000’ (5 minutes) is short enough to provide some defense against DoS conditions. This setting provides the ability to recover resources from unresponsive connections. 98 March 2004 Server Policy Files
Windows Server 2003 Recommended Baseline Security (ITSG-20) 4.7.1.6 DisableIPSourceRouting machine\system\currentcontrolset\services\tcpip\parameters\disableipsourcerouting=4, 2 The ‘disableipsourcerouting’ value determines if the sender of a TCP packet can dictate the route. The setting ‘2’ disables this ability. Dictating packet routes can obscure an attacker’s location on the network. 4.7.1.7 TcpMaxConnectResponseRetransmissions machine\system\currentcontrolset\services\tcpip\parameters\tcpmaxconnectresponseretransmi ssions=4, 2 The ‘tcpmaxconnectresponseretransmissions’ value determines the number of attempts that TCP re-transmits a SYN packet before aborting. The setting ‘2’ limits the possibility of a DoS attack without affecting normal users. This setting reduces the effort expended on unresponsive connections. 4.7.1.8 TcpMaxDataRetransmissions machine\system\currentcontrolset\services\tcpip\parameters\tcpmaxdataretransmissions=4, 3 The ‘tcpmaxdataretransmissions’ defines the number of times unacknowledged data is retransmitted before disconnection. The setting ‘3’ reduces the success of a DoS attack. This is achieved by reducing the effort expended on unresponsive connections. 4.7.1.9 PerformRouterDiscovery machine\system\currentcontrolset\services\tcpip\parameters\performrouterdiscovery=4, 0 The ‘performrouterdiscovery’ value controls the use of Internet Router Discovery Protocol. The setting ‘0’ disables discovery and forces the use of known routers. If the system were to discover routers, an attacker could redirect packets to another destination. 4.7.1.10 TCPMaxPortsExhausted machine\system\currentcontrolset\services\tcpip\parameters\tcpmaxportsexhausted=4, 5 The ‘tcpmaxportsexhausted’ value controls the point which SYN-ATTACK protection begins. The setting ‘5’ causes protection to start after five failures. This is the Microsoft standard for TCP/IP. The setting is a balance between performance and security. 4.7.1.11 TCPMaxHalfOpen machine\system\currentcontrolset\services\tcpip\parameters\tcpmaxhalfopen=4, 100 The ‘tcpmaxhalfopen’ value defines the number of connections in the SYN state table before SYN attack protection begins. The setting of ‘100’ initiates SYN attack protection when the state table reaches one hundred connections. Server Policy Files March 2004 99
Page 1 and 2:
IT Security Guidance Windows Server
Page 3 and 4:
Windows Server 2003 Recommended Bas
Page 5 and 6:
Page 7 and 8:
Page 9 and 10:
Page 11 and 12:
Page 13 and 14:
Page 15:
Page 18 and 19:
Page 20 and 21:
Page 22 and 23:
Page 24 and 25:
Page 26 and 27:
Page 28 and 29:
Unclassified ITSG for Windows Serve
Page 30 and 31:
Page 32 and 33:
Page 34 and 35:
Page 36 and 37:
Page 38 and 39:
Page 40 and 41:
Page 42 and 43:
Page 44 and 45:
Page 46 and 47:
Page 48 and 49:
Page 50 and 51:
Page 52 and 53:
Page 54 and 55:
Page 56 and 57:
Page 58 and 59:
Page 60 and 61:
Page 62 and 63:
Page 64 and 65:
Page 66 and 67:
Page 68 and 69: Unclassified ITSG for Windows Serve
Page 168 and 169:
Page 170 and 171:
Page 172 and 173:
Page 174 and 175:
Page 176 and 177:
Page 178 and 179:
Page 180 and 181:
Page 182 and 183:
Page 184 and 185:
Page 186 and 187:
Page 188 and 189:
Page 190 and 191:
Page 192 and 193:
Page 194 and 195:
Page 196 and 197:
Page 198 and 199:
Page 200 and 201:
Page 202 and 203:
show all

Windows Server 2003 Recommended Baseline Security

Create successful ePaper yourself

Delete template?

Save as template?