Re: IIS6 on W2k3 DCs

From: Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] (sbradcpa_at_pacbell.net)
Date: 01/16/05

  • Next message: Paul Kurczaba: "RE: PGP and Outlook" 
    Date: Sun, 16 Jan 2005 13:26:50 -0800
To: dcdave@att.net

    And I'll point you to the SBS newsgroups where we are running IIS on our
    DCs and our biggest issues is with passwords and SMTP auth attacks not
    with IIS on our DC. Sorry but you have to look at what you are
    protecting, the budget and the risks and balance this. I'm assuming
    that if the firm has spent the bucks to hire Joe they have the budget so
    tell them to shut up and take your advice :-)

    We don get specifically "target hacked".

    You have to look at the risk level folks.

    dcdave@att.net wrote:

    > As someone who helped write the NSA/NIST guides when I worked on the
    > National Security Team, I recommend against running ANY unnecessary
    > services on a Domain Controller. If a Domain Controller is
    > compromised, so is your entire network. The risk here is in the HIGH
    > category.
    >
    > However, if circumstances (such as budget) dictate that it is
    > *necessary* to run any other service on a DC, then
    >
    > 1) disable ALL other unnecessary services and ports
    > 2) set file and ownership permissions correctly
    > 3) Do appropriate lockdowns on both the Operating System AND every
    > other service you have running INCLUDING IIS (there are enough guides
    > out there I shouldn't need to include on here - if you don't know
    > wherre to find them or you want one of mine, please reply off-list).
    > 4) DO NOT connect a WAP to your DC :)
    > 5) Position the DC behind multi-layered security
    >
    > These are general instructions, you can quote to your client.
    >
    > Then tell me who it is, so everyone can hack in and show them a
    > screenshot of their most precious protected (not) information.
    >
    > Why do businesses hire experts to advise them and then don't listen to
    > the advice?
    >
    > dcdave
    > --
    > CSO
    > InfoSec Group
    > 703-626-6516
    >
    > -------------- Original message from "Susan Bradley, CPA aka Ebitz
    > - SBS Rocks [MVP]" <sbradcpa@pacbell.net>: --------------
    >
    >
    > > I may be laughed from here to kingdom come on this
    > listserve...but I
    > > gotta ask....
    > >
    > > Common best practices for whom? Define a role please? What is
    > "common
    > > best practices" may not be good enough for one person, but may
    > be just
    > > fine for another. What are they doing with this box? Exposing it to
    > > the web as a web server...yeah I'd still argue that's insanity.
    > >
    > > But Small Business Server 2003 runs with IIS on our domain
    > controller.
    > > Where's MY security risks these days? Not my
    > server..nope......it's my
    > > desktops where my security risks lie.
    > >
    > > Port 80 is closed on my server but IIS is still on there. On the
    > > outside is Firewall, intrusion detection and what not. Running
    > with XP
    > > sp2 firewalls on the inside but still need to get to more use of
    > user
    > > mode on the desktop.
    > >
    > > Am "I" freaking out over IIS on my domain controller? Nope. Not at
    > > this moment. Am I freaking out over admin rights on desktops?
    > >
    > > You betcha I am... big time.
    > > www.threatcode.com
    > >
    > > Susan...the wacko SBSer.
    > >
    > > Joe Blatz wrote:
    > >
    > > >The security guides published by many sources (NSA,
    > > >MS, etc) stated that IIS4 and IIS5 do not belong on
    > > >DCs. Common best practices would, in general, guide
    > > >that an HTTP (IIS or otherwise) daemon doesn't belong
    > > >on DC.
    > > >
    > > >By referring to numerous security guides written
    > > >specifically for NT4 and W2k we were able to convince
    > > >a customer of this. Now that IIS6 has come out, and
    > > >the customer feels that IIS6 is much safer than IIS4
    > > >and IIS5, they wan! t to put it back on their DCs.
    > > >
    > > >I am looking for sources that document that this is a
    > > >bad idea. When it comes to the NSA they don't have a
    > > >guide for W2k3 but have instead pointed to Microsoft's
    > > >"Windows Server 2003 Security Guide" and the use of
    > > >the "High Security" settings and templates. The MS
    > > >guide does (rather subtly) show that IIS should not be
    > > >on a DC. They only show the HTTP service enabled on an
    > > >IIS server, but I think this may not be direct enough
    > > >for our client.
    > > >
    > > >Any help finding an explicit statement that IIS6 does
    > > >not be belong on a DC would be greatly appreciated.
    > > >
    > > >__________________________________________________
    > > >Do You Yahoo!?
    > > >Tired of spam? Yahoo! Mail has the best spam protection around
    > > >http://mail.yahoo.com
    > > >
    > >
    > >---------------------------------------------------------------------------
    >
    > >
    > >---------------------------------------------------------------------------
    >
    > > >
    > > >
    > > >
    > > >
    > >
    > >
    > ---------------------------------------------------------------------------
    >
    > >
    > ---------------------------------------------------------------------------
    >
    > >
    >

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Paul Kurczaba: "RE: PGP and Outlook"

    Relevant Pages

    • Re: Senior management really concerns about security?
      ... Netragard Whitepaper Downloads: ... Attain sign off on those risks by the senior management. ... personnel understands the potential security risks involved. ...
      (Security-Basics)
    • Re: IIS on domain controller
      ... If IIS is compromised on a member server, then the attacker controls that server. ... If IIS is performing poorly on a member server, then usually only other services on that server are affected. ... There are no local accounts on DCs, so all user accounts that IIS uses will become domain accounts. ... These are all risks, and you need to weigh up the implications of those risks. ...
      (microsoft.public.inetserver.iis.security)
    • Re: How secure is SSL emails?
      ... >>This illustrates some of the pitfalls of unsafe defaults and the risks ... kinds of additional risks is not prudent engineering practice. ... You might disagree with that assessment, ... associated security risks, that's their right -- but if others don't ...
      (sci.crypt)
    • Re: PHP blamed for security problems
      ... > By not running code taken from remote machines, ... >> and flags possible security risks. ... scripts just b4 release so that they can get a report of possible security ...
      (comp.lang.php)
    • Re: IIS Group
      ... >in my network that installing IIS.???...And that is, ... >the risks of hacking when you have IIS. ... If you're asking how to not allow IIS to be installed on workstations, ...
      (microsoft.public.win2000.security)