RE: IIS6 on W2k3 DCs

From: Sullivan Tim P (tim_at_nativemode.com)
Date: 01/15/05

  • Next message: Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]: "Re: IIS6 on W2k3 DCs" 
    Date: Fri, 14 Jan 2005 22:14:13 -0700
To: <focus-ms@securityfocus.com>

    SBS doesnt have a choice.

    Your box is your domain controller, and its your exchange server, so it
    has to have IIS installed. No way around it. That doesnt mean its not
    going against a common school of thought based on good sensible
    practice.

    This seems to be a common topic, but again the more you have on one box,
    the more you lose should that one box crash, have a hardware failure, or
    be stolen by gypsies. It then comes down to the tolerance level of your
    organization to something like this.

    So....

    Organizations who want fault tolerance put resources (AKA roles) on
    seperate boxes. DC on one, mail on another, web server on another. Your
    web server may not even be on the domain.

    So is the desktop the biggest threat, probobly, but your DC is (I would
    say) your most important machine on the network, and should be protected
    accordingly. Should it fail, AD, exchange, and everything else,
    including your desktop's and user accounts, are gone. Have fun restoring
    from tape, or your ASR, if one was made.

    Number of employees shouldn't dictate a choice between SBS and sepearate
    products, your mission requirements should.

    Tim

    -----Original Message-----
    From: Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]
    [mailto:sbradcpa@pacbell.net]
    Sent: Thursday, January 13, 2005 8:12 PM
    To: Joe Blatz
    Cc: focus-ms@securityfocus.com
    Subject: Re: IIS6 on W2k3 DCs

    I may be laughed from here to kingdom come on this listserve...but I
    gotta ask....

    Common best practices for whom? Define a role please? What is "common
    best practices" may not be good enough for one person, but may be just
    fine for another. What are they doing with this box? Exposing it to
    the web as a web server...yeah I'd still argue that's insanity.

    But Small Business Server 2003 runs with IIS on our domain controller.
    Where's MY security risks these days? Not my server..nope......it's my
    desktops where my security risks lie.

    Port 80 is closed on my server but IIS is still on there. On the
    outside is Firewall, intrusion detection and what not. Running with XP
    sp2 firewalls on the inside but still need to get to more use of user
    mode on the desktop.

    Am "I" freaking out over IIS on my domain controller? Nope. Not at
    this moment. Am I freaking out over admin rights on desktops?

    You betcha I am... big time.
    www.threatcode.com

    Susan...the wacko SBSer.

    Joe Blatz wrote:

    >The security guides published by many sources (NSA, MS, etc) stated
    >that IIS4 and IIS5 do not belong on DCs. Common best practices would,
    >in general, guide that an HTTP (IIS or otherwise) daemon doesn't belong

    >on DC.
    >
    >By referring to numerous security guides written specifically for NT4
    >and W2k we were able to convince a customer of this. Now that IIS6 has
    >come out, and the customer feels that IIS6 is much safer than IIS4 and
    >IIS5, they want to put it back on their DCs.
    >
    >I am looking for sources that document that this is a bad idea. When it

    >comes to the NSA they don't have a guide for W2k3 but have instead
    >pointed to Microsoft's "Windows Server 2003 Security Guide" and the use

    >of the "High Security" settings and templates. The MS guide does
    >(rather subtly) show that IIS should not be on a DC. They only show the

    >HTTP service enabled on an IIS server, but I think this may not be
    >direct enough for our client.
    >
    >Any help finding an explicit statement that IIS6 does not be belong on
    >a DC would be greatly appreciated.
    >
    >__________________________________________________
    >Do You Yahoo!?
    >Tired of spam? Yahoo! Mail has the best spam protection around
    >http://mail.yahoo.com
    >
    >-----------------------------------------------------------------------
    >----
    >-----------------------------------------------------------------------
    >----
    >
    >
    >
    >

    ------------------------------------------------------------------------ 

    ---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]: "Re: IIS6 on W2k3 DCs"

    Relevant Pages

    • Re: IISlockdown doesnt allow asp !!!
      ... You IIS server is a DC right? ... > It's bcos i can't access the "Domain Controller Security Policy", ... go to your Domain Controller Security policy. ...
      (microsoft.public.inetserver.iis.security)
    • RE: IIS6 on W2k3 DCs
      ... In the case of a web server, ... >Organizations who want fault tolerance put resources on ... >But Small Business Server 2003 runs with IIS on our domain controller. ...
      (Focus-Microsoft)
    • Re: middle tier recommendations
      ... I forgot to mention I do have a standby database server for failover. ... >> That depends on the amount of use that interface will get. ... >> is scalable, you can put your app, with DLLs, on any web server without ... >>> inherent performance issues with IIS ...
      (microsoft.public.dotnet.framework)
    • RE: Question on NTLM authentication.
      ... Domain controllers don't store user passwords by default. ... machines through IIS, even if it is running on a domain controller. ... to a remote machine than the NTLM hash that a normal IIS member server ...
      (microsoft.public.inetserver.iis.security)
    • Re: IIS6 on W2k3 DCs
      ... Didn't an IIS server survive OpenHackIV with IIS, ... In the case of a web server, ... >>Your box is your domain controller, and its your exchange server, so it ...
      (Focus-Microsoft)