Windows Server 2003 Recommended Baseline Security

More documents

Recommendations

Info

Unclassified ITSG for Windows Server 2003 netsh ipsec static add filteraction name=Block description="Blocks Traffic" action=block :IPSec Filter Definitions netsh ipsec static add filter filterlist="CIFS/SMB Server" srcaddr=any dstaddr=me description="CIFS/SMB Server Traffic" protocol=TCP srcport=0 dstport=445 netsh ipsec static add filter filterlist="CIFS/SMB Server" srcaddr=any dstaddr=me description="CIFS/SMB Server Traffic" protocol=UDP srcport=0 dstport=445 netsh ipsec static add filter filterlist="NetBIOS Server" srcaddr=any dstaddr=me description="NetBIOS Server Traffic" protocol=TCP srcport=0 dstport=137 netsh ipsec static add filter filterlist="NetBIOS Server" srcaddr=any dstaddr=me description="NetBIOS Server Traffic" protocol=UDP srcport=0 dstport=137 netsh ipsec static add filter filterlist="NetBIOS Server" srcaddr=any dstaddr=me description="NetBIOS Server Traffic" protocol=UDP srcport=0 dstport=138 netsh ipsec static add filter filterlist="NetBIOS Server" srcaddr=any dstaddr=me description="NetBIOS Server Traffic" protocol=TCP srcport=0 dstport=139 netsh ipsec static add filter filterlist="Terminal Server" srcaddr=any dstaddr=me description="Terminal Server Traffic" protocol=TCP srcport=0 dstport=3389 netsh ipsec static add filter filterlist="ALL Inbound Traffic" srcaddr=any dstaddr=me description="ALL Inbound Traffic" protocol=any srcport=0 dstport=0 :IPSec Rule Definitions netsh ipsec static add rule name="CIFS/SMB Server" policy="Packet Filters - File" filterlist="CIFS/SMB Server" kerberos=yes filteraction=SecPermit netsh ipsec static add rule name="NetBIOS Server Rule" policy="Packet Filters - File" filterlist="NetBIOS Server" kerberos=yes filteraction=SecPermit netsh ipsec static add rule name="Terminal Server Rule" policy="Packet Filters - File" filterlist="Terminal Server" kerberos=yes filteraction=SecPermit netsh ipsec static add rule name="ALL Inbound Traffic Rule" policy="Packet Filters - File" filterlist="ALL Inbound Traffic" kerberos=yes filteraction=Block 5.5 Workgroup Print Server Policy The workgroup print server allows authenticated users to access shared printers on the system. Access to these shared printers can be controlled. Users who attempt to access print servers can authenticate with user-based credentials. Once authenticated, appropriate access is granted. 5.5.1 Variance from Microsoft Guidance Differences are a result of the CSE and Microsoft Baseline configuration variance. 126 March 2004 Role Based Server Policies
Windows Server 2003 Recommended Baseline Security (ITSG-20) 5.5.2 [Registry Values] machine\system\currentcontrolset\control\lsa\lmcompatibilitylevel=4,4 machine\system\currentcontrolset\control\print\providers\lanman print services\servers\addprinterdrivers=4,0 machine\system\currentcontrolset\control\securepipeservers\winreg\allowedpaths\machine=7,Sof tware\Microsoft\Windows NT\CurrentVersion\Print,System\CurrentControlSet\Control\Print\Printers 5.5.3 [Service General Setting] "lanmanworkstation", 2, "D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCR SDRCWDWO;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" "lanmanserver", 2, "D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCR SDRCWDWO;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" "browser", 2, "D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCR SDRCWDWO;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" "spooler", 2, "D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCR SDRCWDWO;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)" 5.5.4 Workgroup Print Server IPSec Policy The following file has been modified from the Microsoft Windows Server 2003 Security Guideline. The CSE IPSec policy does not reference Domain Controllers. Run the file as a command to load the policy. The procedure outlined in 5.1 Role Based IPSec Policies is used to apply the policy. REM (c) Microsoft Corporation 1997-2003 REM Packet Filters for Server Hardening REM REM Name: PacketFilter-Print.CMD REM Version: 1.0 REM This CMD file provides the proper NETSH syntax for creating an IPSec Policy REM that blocks all network traffic to a Print Server except for what is REM explicitly allowed as described in the Windows 2003 Server Solution Guide. REM Please read the entire guide before using this CMD file. Role Based Server Policies March 2004 127
Page 1 and 2:
IT Security Guidance Windows Server
Page 3 and 4:
Windows Server 2003 Recommended Bas
Page 5 and 6:
Page 7 and 8:
Page 9 and 10:
Page 11 and 12:
Page 13 and 14:
Page 15:
Page 18 and 19:
Page 20 and 21:
Page 22 and 23:
Page 24 and 25:
Page 26 and 27:
Page 28 and 29:
Unclassified ITSG for Windows Serve
Page 30 and 31:
Page 32 and 33:
Page 34 and 35:
Page 36 and 37:
Page 38 and 39:
Page 40 and 41:
Page 42 and 43:
Page 44 and 45:
Page 46 and 47:
Page 48 and 49:
Page 50 and 51:
Page 52 and 53:
Page 54 and 55:
Page 56 and 57:
Page 58 and 59:
Page 60 and 61:
Page 62 and 63:
Page 64 and 65:
Page 66 and 67:
Page 68 and 69:
Page 70 and 71:
Page 72 and 73:
Page 74 and 75:
Page 76 and 77:
Page 78 and 79:
Page 80 and 81:
Page 82 and 83:
Page 84 and 85:
Page 86 and 87:
Page 88 and 89:
Page 90 and 91:
Page 92 and 93:
Page 94 and 95:
Page 96 and 97: Unclassified ITSG for Windows Serve
Page 196 and 197:
Page 198 and 199:
Page 200 and 201:
Page 202 and 203:
show all

Windows Server 2003 Recommended Baseline Security

Create successful ePaper yourself

Delete template?

Save as template?