Securing Infrastructure Servers
Infrastructure
servers are computers that run network support services such as DNS,
DHCP, and Windows Internet Name Service (WINS). An infrastructure server
can run any or all of these services, and might also fill other roles,
such as an application or file and print server.
For an infrastructure
server that provides all these services, you should modify the System
Services policies in your infrastructure servers’ GPO to include the
following services, using the Automatic startup type:
Configuring DNS Security
It is common
for administrators to run the DNS Server service on Windows Server 2003
domain controllers, particularly when they use Active
Directory-integrated zones. One benefit of storing the zone database in
Active Directory is that the directory service takes over securing and
replicating the DNS data. However, even if you do use Active
Directory-integrated zones, there are additional security measures you
might consider.
Protecting Active Directory-Integrated DNS When
you create Active Directory-integrated zones on your DNS server, the
zone database is stored as part of the Active Directory database, which
protects it from direct access by unauthorized users. However, you
should still take steps to ensure that the MicrosoftDNS container object
in Active Directory (shown in Figure 2) is secure.
Tip
To
access the MicrosoftDNS container object in the Active Directory Users
And Computers console, you must first select the Advanced Features
option from the console’s View menu. The console then displays
additional containers, including the System container, which contains
MicrosoftDNS. |
By default, the
DnsAdmins, Domain Admins, and Enterprise Admins groups all have the
Full Control permission for the MicrosoftDNS container. The local
Administrators group lacks the Full Control permission, but it does have
the permissions needed to create new objects and modify existing ones.
You might modify these defaults to limit the number of users with
permission to modify this container.
Protecting DNS Database Files For
DNS zones that are not integrated into Active Directory, the zone
databases are simple text files stored in the C:\Windows\System32\ Dns
folder by default. Windows Server 2003 creates DNS debug logs in the
same folder. The permissions for this folder grant the Administrators
group Full Control, while the Server Operators group receives all
permissions except Full Control. The Authenticated Users group receives
the permissions needed to read and execute files in this folder (see Figure 3).
You don’t need
file system permissions to maintain the DNS zone databases using the
DNS console or to access DNS server information using a client.
Therefore, there is no reason for the Authenticated Users group to have
file system permissions. By enabling users to view the DNS data files,
you give them an opportunity to gather information about your domain
that they could use to stage an attack against the network. You can
safely revoke the Authenticated Users group’s permissions for this
folder, and even limit the Server Operators group to read-only access,
if desired.
Configuring DHCP Security
The interruption of a DHCP
server’s functions might not have an immediate effect on your network,
but eventually your DHCP clients’ leases will expire and they will be
unable to obtain new ones. Apart from enabling the DHCP Server service
itself, there is little you can do to configure DHCP using a GPO.
However, there are security measures that can help to ensure
uninterrupted performance.
Denial
of service attacks (DoS) constitute one of the biggest threats to DHCP
servers. It is relatively simple for an unscrupulous individual to
create a script that sends repeated requests for IP address assignments
to the server until all the addresses in the scope are depleted.
Legitimate clients are then unable to obtain addresses until the bogus
leases expire. Several techniques can defend against denial of service
attacks, including the following:
Use the 80/20 address allocation method—
Use two DHCP servers to provide addresses for each subnet, with 80 per
cent of the available addresses in one server’s scope and 20 per cent in
the other. This ensures that there are addresses available to clients,
even if one of the servers is under attack.
Create a DHCP server cluster—
Clustering enables you to use multiple servers to create a single
network entity. If one server fails, the other servers in the cluster
take up the slack.
Monitor DHCP activity—
You can monitor the activity of a DHCP server by using tools such as
the Performance console and Network Monitor or by enabling audit logging
on the DHCP server.
DHCP audit logging is not
integrated into the main Windows Server 2003 auditing facility. You can
enable DHCP audit logging using group policies but you cannot access the
logs using the Event Viewer console. To enable DHCP audit logging, you
must open the DHCP console, display the Properties dialog box for the
DHCP server, and then select the Enable DHCP Audit Logging check box in
the General tab. The server stores the log files in the
C:\Windows\System32\Dhcp folder, by default.
Securing File and Print Servers
Security for a file and print server requires policy settings similar to those of the baseline installation you created in this article. The two main changes you must make for the file and print server role are as follows:
Enable the Print Spooler service
Use the appropriate policy in the System Services container of your GPO
to enable the Print Spooler service with the Automatic startup type.
The server needs this service to receive print jobs from other computers
on the network.
Disable the Microsoft Network Server: Digitally Sign Communications (Always) security policy
When this security option is enabled, users are unable to view the
print queue on the server, even though they are able to submit print
jobs. Defining this policy with a value of Disabled in the Security
Options container of your GPO ensures that your clients can access the
print queue on the server.
Note
To
view print queues on file and print servers, client computers must have
the Security Options policy, Microsoft Network Client: Digitally Sign
Communications (Always) (or its equivalent) disabled as well. |
Configuring Permissions Using a GPO
One of the most important
security measures for a file and print server is protection for the user
data stored on the server drives. You create this protection by using
the NTFS file system on your drives and by using NTFS permissions to
control access to the server drives. You can specify the permissions for
your NTFS drives in a GPO by browsing to the File System container in
the Group Policy Object Editor console and, from the Action menu,
selecting Add File. In the series of dialog boxes that appear, you
perform the following tasks:
Specify the files or folders for which you want to configure file system permissions.
Specify the permissions you want to assign to the selected files or folders.
Specify whether you want the permissions to be inherited by subfolders.
By default, all
the NTFS drives on a computer running Windows Server 2003, except the
system drive, have Full Control permission assigned to the Everyone
group. Therefore, it is up to you to design a directory structure and a
system of permissions for your drives that gives users only the access
they need to the files stored there.
Tip
In
addition to file system permissions, you can also use a GPO to
configure registry permissions on a computer running Windows Server
2003. Browse to the Registry container and, from the Action menu, choose
Add Key. The process resembles configuring file system permissions,
except that you select a registry key instead of a file or folder. |
Securing Application Servers
It is difficult, if
not impossible, to create a generic security configuration for
application servers, because the requirements of the individual
applications are usually unique. Windows Server 2003 includes some
software that enables the computer to function as an application server,
most notably Internet Information Services (IIS), which provides World
Wide Web, File Transfer Protocol (FTP), and other Internet server
services, but in most cases, application servers run external software
products, such as database or e-mail servers. To secure these
applications, you must compare the security requirements of your network
and your users with the security features provided by the application
itself.
