AW: IIS6 on W2k3 DCs

From: Nelson Brandon (brandon.nelson_at_rtc.ch)
Date: 01/21/05

  • Next message: sanjiv: "ISA server logs" 
    To: 'calin oprea' <calinoprea2004@yahoo.com>, focus-ms@securityfocus.com
Date: Fri, 21 Jan 2005 07:21:10 +0100

    >My guess is that you can put IIS on a domain controler if and only if the
    server is inside your private
    >network and you are running some n-tier system and you have a tight budget.
    So much for the Web server
    >that is not exposed (inside your private network).

    Technically, you could configure your firewall to allow all the necessary
    ports between a DC/IIS Server
    in your DMZ and your internal/green network.

    http://www.microsoft.com/serviceproviders/columns/config_ipsec_P63623.asp

    Technically, lots of things are possible. IIS & DC, DMZ, internal network
    bla bla bla ..
    The question is, do the added security holes/dangers justify
    the added functionality or cost savings. - My .02

    Brandon

    -----Ursprüngliche Nachricht-----
    Von: calin oprea [mailto:calinoprea2004@yahoo.com]
    Gesendet: Donnerstag, 20. Januar 2005 09:18
    An: focus-ms@securityfocus.com
    Betreff: Re: IIS6 on W2k3 DCs

    In-Reply-To: <20050113142952.5617.qmail@web52805.mail.yahoo.com>

    Although I am just a humble professional, I feel that simple things should
    be kept simple. The very reason that IIS should not be kept on a DC machine
    is provided by Microsoft itself: the Web Edition of their 2003 Server.

    Aside from that, there's a lot to do with your design: I mean you can have a
    DMZ; I mean c'mon, if someone manages to hack your public network, the
    private one is still isolated. That is for the Web server that is exposed.
    My guess is that you can put IIS on a domain controler if and only if the
    server is inside your private network and you are running some n-tier system
    and you have a tight budget. So much for the Web server that is not exposed
    (inside your private network).

    regards,
    io

    >
    >The security guides published by many sources (NSA,
    >MS, etc) stated that IIS4 and IIS5 do not belong on
    >DCs. Common best practices would, in general, guide
    >that an HTTP (IIS or otherwise) daemon doesn't belong
    >on DC.
    >
    >By referring to numerous security guides written
    >specifically for NT4 and W2k we were able to convince
    >a customer of this. Now that IIS6 has come out, and
    >the customer feels that IIS6 is much safer than IIS4
    >and IIS5, they want to put it back on their DCs.
    >
    >I am looking for sources that document that this is a
    >bad idea. When it comes to the NSA they don't have a
    >guide for W2k3 but have instead pointed to Microsoft's
    >"Windows Server 2003 Security Guide" and the use of
    >the "High Security" settings and templates. The MS
    >guide does (rather subtly) show that IIS should not be
    >on a DC. They only show the HTTP service enabled on an
    >IIS server, but I think this may not be direct enough
    >for our client.
    >
    >Any help finding an explicit statement that IIS6 does
    >not be belong on a DC would be greatly appreciated.

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: sanjiv: "ISA server logs"

    Relevant Pages

    • Re: Remote Web Workplace not working properly
      ... Another possibility is alterations to the IIS Application Pool ... take control of the server in the room right next to ... over the internet or from any one desktop within the network). ... back to the login window. ...
      (microsoft.public.windows.server.sbs)
    • Re: IIS / Web Services Security threats
      ... You will be surprised to know, due to a recent virus attack on the perimeter network, the common ports have been closed too. ... I also develop Java applications which runs on weblogic server. ... Since, the entire world knows about port 80 and 443, I thought opening a specific port with IP Sec configuration may make the network little secure. ... My security team thinks allowing communication between the two IIS ...
      (microsoft.public.dotnet.framework.webservices)
    • Re: Steps to setup app allowing offsite network access using IIS Authe
      ... The first paras imply you want them to be able to _run_ a web app on an IIS server? ... Regardless of all that, one problem to look out for is that they won't have Active Directory if it's in a DMZ, so Integrated Authentication won't work, nor will Impersonation, You'd need to use plain text with SSL, nasty, and you'd need to pass the passwords as plain text if you want them to be able to start a process, unless you can get Kerberos working in the DMZ and able to pass the tickets over two hops. ... DMZ, there will be several steps involved - from compiling the application with a strong name, to setting up IIS and finally access to the application which will need to run on a server from the DMZ for our partners. ... Can anyone outline each step required to set this up on an IIS server in the network or DMZ along with the assembly requirements of the application to run on this network? ...
      (microsoft.public.vsnet.general)
    • Re: Restricting IP Address
      ... I looked into hosting my own web site on my server that I have, ... would give IIS your Lan address and be sure to put "permit only" in IIS. ... Network Connection again and the click properties. ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Re: Private Address Spaces
      ... > I can't quite get the difference between Address spaces, private address ... Private = a resource (e.g. a network, network address, or even telephone) ... file & print server in the bowels of the Accounting department], ... Adding a header with the original poster's address was a way to ...
      (alt.computer.security)