Windows Server 2003 Recommended Baseline Security

More documents

Recommendations

Info

Unclassified ITSG for Windows Server 2003 netsh ipsec static add filterlist name="Domain Member" description="Server Hardening" netsh ipsec static add filterlist name="Monitoring" description="Server Hardening" netsh ipsec static add filterlist name="Block Domain Access" description="Server Hardening" netsh ipsec static add filterlist name="ALL Inbound Traffic" description="Server Hardening" :IPSec Filter Action Definitions netsh ipsec static add filteraction name=SecPermit description="Allows Traffic to Pass" action=permit netsh ipsec static add filteraction name=Block description="Blocks Traffic" action=block :IPSec Filter Definitions netsh ipsec static add filter filterlist="CIFS/SMB Server" srcaddr=any dstaddr=me description="CIFS/SMB Server Traffic" protocol=TCP srcport=0 dstport=445 netsh ipsec static add filter filterlist="CIFS/SMB Server" srcaddr=any dstaddr=me description="CIFS/SMB Server Traffic" protocol=UDP srcport=0 dstport=445 netsh ipsec static add filter filterlist="NetBIOS Server" srcaddr=any dstaddr=me description="NetBIOS Server Traffic" protocol=TCP srcport=0 dstport=137 netsh ipsec static add filter filterlist="NetBIOS Server" srcaddr=any dstaddr=me description="NetBIOS Server Traffic" protocol=UDP srcport=0 dstport=137 netsh ipsec static add filter filterlist="NetBIOS Server" srcaddr=any dstaddr=me description="NetBIOS Server Traffic" protocol=UDP srcport=0 dstport=138 netsh ipsec static add filter filterlist="NetBIOS Server" srcaddr=any dstaddr=me description="NetBIOS Server Traffic" protocol=TCP srcport=0 dstport=139 netsh ipsec static add filter filterlist="Terminal Server" srcaddr=any dstaddr=me description="Terminal Server Traffic" protocol=TCP srcport=0 dstport=3389 netsh ipsec static add filter filterlist="Block Domain Access" srcaddr=me dstaddr=any description="Block Domain Access" protocol=TCP srcport=any dstport=1097 netsh ipsec static add filter filterlist="ALL Inbound Traffic" srcaddr=any dstaddr=me description="ALL Inbound Traffic" protocol=any srcport=0 dstport=0 REM NOTE: IP Address or server names of Domain Controllers must be hardcode into the dstaddr of the Domain Member filters defined below netsh ipsec static add filter filterlist="Domain Member" srcaddr=me dstaddr=192.168.0.1 description="Traffic to Domain Controller" protocol=any srcport=0 dstport=0 REM netsh ipsec static add filter filterlist="Domain Member" srcaddr=me dstaddr= description="Traffic to Domain Controller" protocol=any srcport=0 dstport=0 REM NOTE: IP Address or server name of Monitoring server must be hard coded into the dstaddr of Monitoring filter defined below REM netsh ipsec static add filter filterlist="Monitoring" srcaddr=me dstaddr= description="Monitoring Traffic" protocol=any srcport=0 dstport=0 120 March 2004 Role Based Server Policies
Windows Server 2003 Recommended Baseline Security (ITSG-20) :IPSec Rule Definitions netsh ipsec static add rule name="CIFS/SMB Server" policy="Packet Filters - File" filterlist="CIFS/SMB Server" kerberos=yes filteraction=SecPermit netsh ipsec static add rule name="NetBIOS Server Rule" policy="Packet Filters - File" filterlist="NetBIOS Server" kerberos=yes filteraction=SecPermit netsh ipsec static add rule name="Terminal Server Rule" policy="Packet Filters - File" filterlist="Terminal Server" kerberos=yes filteraction=SecPermit netsh ipsec static add rule name="Domain Member Rule" policy="Packet Filters - File" filterlist="Domain Member" kerberos=yes filteraction=SecPermit netsh ipsec static add rule name="Block Domain Access Rule" policy="Packet Filters - File" filterlist="Block Domain Access" kerberos=yes filteraction=Block REM netsh ipsec static add rule name="Monitoring Rule" policy="Packet Filters - File" filterlist="Monitoring" kerberos=yes filteraction=SecPermit netsh ipsec static add rule name="ALL Inbound Traffic Rule" policy="Packet Filters - File" filterlist="ALL Inbound Traffic" kerberos=yes filteraction=Block 5.3 Domain Print Server Policy The domain print server allows authenticated users access to shared printers. These shared printers use access controls. Users outside a domain can authenticate with domain-based credentials. Once authenticated, access is granted based on domain policy. To fulfill print services, the Baseline configuration settings do not require further changes. 5.3.1 Variance from Microsoft “Hardening Print Servers” Guidance The Microsoft role-based policy for print servers has two activities: 1) Start the print spooler and 2) disable “Microsoft network server: Digitally sign communications (always)”. The CSE policy also starts the print spooler but differs in the handling of signatures. The Microsoft Security Options section recommends disabling “Microsoft network server: Digitally sign communications (always)”. Their reason is the user community would not be able to view the status of their print jobs. We did not observe this limitation in our lab. As a result, the option to digitally sign communications is enabled. The remaining differences are a result of the CSE and Microsoft Baseline configuration variance. It is important to note that the role-based policies cannot be viewed in isolation from the Baseline configuration. 5.3.2 [Registry Values] machine\system\currentcontrolset\control\securepipeservers\winreg\allowedpaths\machine=7,Sof tware\Microsoft\Windows NT\CurrentVersion\Print,System\CurrentControlSet\Control\Print\Printers Role Based Server Policies March 2004 121
Page 1 and 2:
IT Security Guidance Windows Server
Page 3 and 4:
Windows Server 2003 Recommended Bas
Page 5 and 6:
Page 7 and 8:
Page 9 and 10:
Page 11 and 12:
Page 13 and 14:
Page 15:
Page 18 and 19:
Page 20 and 21:
Page 22 and 23:
Page 24 and 25:
Page 26 and 27:
Page 28 and 29:
Unclassified ITSG for Windows Serve
Page 30 and 31:
Page 32 and 33:
Page 34 and 35:
Page 36 and 37:
Page 38 and 39:
Page 40 and 41:
Page 42 and 43:
Page 44 and 45:
Page 46 and 47:
Page 48 and 49:
Page 50 and 51:
Page 52 and 53:
Page 54 and 55:
Page 56 and 57:
Page 58 and 59:
Page 60 and 61:
Page 62 and 63:
Page 64 and 65:
Page 66 and 67:
Page 68 and 69:
Page 70 and 71:
Page 72 and 73:
Page 74 and 75:
Page 76 and 77:
Page 78 and 79:
Page 80 and 81:
Page 82 and 83:
Page 84 and 85:
Page 86 and 87:
Page 88 and 89:
Page 90 and 91: Unclassified ITSG for Windows Serve
Page 190 and 191:
Page 192 and 193:
Page 194 and 195:
Page 196 and 197:
Page 198 and 199:
Page 200 and 201:
Page 202 and 203:
show all

Windows Server 2003 Recommended Baseline Security

Create successful ePaper yourself

Delete template?

Save as template?