RE: Share Point?
From: Matt Andreko (mandreko_at_ori.net)
Date: 05/09/03
- Previous message: Roberts Phillip (IBM): "RE: Share Point?"
- Maybe in reply to: Derek Schaible: "Share Point?"
- Next in thread: Bronek Kozicki: "Re: Share Point?"
- Reply: Bronek Kozicki: "Re: Share Point?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: "'Roberts Phillip (IBM)'" <phillip.roberts@thomson.net>, "'Derek Schaible'" <dschaible@cssiinc.com>, <focus-ms@securityfocus.com> Date: Fri, 9 May 2003 13:17:09 -0500
I had difficulties when trying to use it on a test machine, trying to
make it on a domain controller.
Going with that, do you really want your anonymous users visiting your
domain controller? If the machine gets compromised, the user has domain
privileges. This negates all the security, unless it's a domain
controller for a domain with 0 clients.
When I tried setting it up, I was unable to do many things, and I
remember reading at one time that Sharepoint (again, i was just doing
Team Services) was not able to install on a domain controller. It seems
they may have fixed that since I tried, according to some documents i
found while searching google. I'm not sure about sharepoint server,
since I've not used it yet.
Another thing about running it on a domain controller, is that you're
going to lose some performance, since Active Directory requires you to
run DNS as well as some other services that will slow down the machine a
bit. This isn't too bad if you have a nice machine, but if it's a used
machine, or not a very fast machine, this could be somewhat harmful.
-----Original Message-----
From: Roberts Phillip (IBM) [mailto:phillip.roberts@thomson.net]
Sent: Friday, May 09, 2003 12:56 PM
To: 'Matt Andreko'; 'Derek Schaible'; focus-ms@securityfocus.com
Subject: RE: Share Point?
Couldn't you make that server its own PDC/Domain within the DMZ in order
to avoid this as an issue?
-----Original Message-----
From: Matt Andreko [mailto:mandreko@ori.net]
Sent: Friday, May 09, 2003 11:25 AM
To: 'Derek Schaible'; focus-ms@securityfocus.com
Subject: RE: Share Point?
Be sure to make a note that Sharepoint (at least sharepoint team
services) uses local users. It does not use some authentication
database or anything. If you tell it to create a new user for the site,
or if the site allows a user to sign up, that user has an NT password on
the system. This could help in establishing a privilege escalation
exploit.
Normally the local users are pretty stripped down, but it could be used
with an exploit of some sort that requires little privilege.
-----Original Message-----
From: Derek Schaible [mailto:dschaible@cssiinc.com]
Sent: Friday, May 09, 2003 8:33 AM
To: focus-ms@securityfocus.com
Subject: Share Point?
Greetings List,
I have a customer who wants to place sharepoint in a DMZ for outside
clients to access documents. It is their intent to place all of their
data regarding a project on the SharePoint server and use that as the
single point of storage for this project. Meaning, everyone on the team
uses this one share in the DMZ.
Does this sound safe? Has anyone here tested Share Point's security?
I'm sure this isn't the first time someone has needed to do something
like this, how have some of you handled this scenario?
I appreciate anyone's input on this matter and any advice at all is
welcome!
Thanks,
Derek
------------------------------------------------------------------------
-----
FastTrain has your solution for a great CISSP Boot Camp. The industry`s
most
recognized corporate security certification track, provides a
comprehensive
prospectus based upon the core principle concepts of security. This ALL
INCLUSIVE curriculum utilizes lectures, case studies and true hands-on
utilization
of pertinent security tools. For a limited time you can enter for a
chance
to win one of the latest technological innovations, the SEGWAY HT.
Log onto http://www.securityfocus.com/FastTrain-focus-ms
------------------------------------------------------------------------
------
------------------------------------------------------------------------
-----
FastTrain has your solution for a great CISSP Boot Camp. The industry`s
most
recognized corporate security certification track, provides a
comprehensive
prospectus based upon the core principle concepts of security. This ALL
INCLUSIVE curriculum utilizes lectures, case studies and true hands-on
utilization
of pertinent security tools. For a limited time you can enter for a
chance
to win one of the latest technological innovations, the SEGWAY HT.
Log onto http://www.securityfocus.com/FastTrain-focus-ms
------------------------------------------------------------------------
------
-----------------------------------------------------------------------------
FastTrain has your solution for a great CISSP Boot Camp. The industry`s most
recognized corporate security certification track, provides a comprehensive
prospectus based upon the core principle concepts of security. This ALL INCLUSIVE curriculum utilizes lectures, case studies and true hands-on utilization
of pertinent security tools. For a limited time you can enter for a chance
to win one of the latest technological innovations, the SEGWAY HT.
Log onto http://www.securityfocus.com/FastTrain-focus-ms
------------------------------------------------------------------------------
- Previous message: Roberts Phillip (IBM): "RE: Share Point?"
- Maybe in reply to: Derek Schaible: "Share Point?"
- Next in thread: Bronek Kozicki: "Re: Share Point?"
- Reply: Bronek Kozicki: "Re: Share Point?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
