RE: Binding Windows Services to Specific Addresses Only



Hello Chris

Look at the services configuration, you often have a "listen on" option

Example : DNS server

By default DNS is listening on all interfaces, you can verify with netstat
Command

netstat -an |find ":53"
UDP 0.0.0.0:53

Go to DNS server's config panel, and set an address to "listen to", let say
It should be bound to the internal address 192.168.25.16

Netstat will then show
UDP 192.168.25.16:53

Other interfaces (like WAN) shouldn?t reply to DNS requests.

Hope that helps

Have a nice day

Maxime Ducharme



-----Message d'origine-----
De : listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx] De
la part de Christian Koerner
Envoyé : 3 mai 2008 19:13
À : focus-ms@xxxxxxxxxxxxxxxxx
Objet : Binding Windows Services to Specific Addresses Only

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hello everybody!

When it comes to Windows hardening and in specific restricting
Windows' services, the only suggestions that I've found so far are:
*) disable unnecessary services
*) restrict network access through packet filtering

What else can be done and isn't it possible to bind Windows' services
to a specific address/interface, e.g. LAN.

Thanks in advance
Chris




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIHPGV6rqywW28g1IRAohNAKCQ9vfcx/N5vRr0bbbiBityYayO4wCgottt
+JClyFFafYzq0ojEA0AfS1c=
=2nbF
-----END PGP SIGNATURE-----

Relevant Pages

  • Re: Maybe useful if you use a laptop for web dev...
    ... >>> I never could make DNS and Apache work if I had it setup to localhost. ... >>> machines on he network DNS queries failed. ... >> interfaces as they get addresses, and stop listening on interfaces as they ...
    (uk.comp.sys.mac)
  • Re: DNS problem
    ... >Something on your FreeBSD box is sending DNS queries to your Windows box ... neither an explanation as to why, no a way to fix it ... There are 2 network interfaces and the syslog indicates ...
    (freebsd-stable)
  • Re: Problem with DNS
    ... The DNS server could not signal the service "NAT". ... Use the DNS manager server properties, interfaces dialog, to verify ... It means that the DNS server is listening on an IP address that is not on ...
    (microsoft.public.windows.server.dns)
  • Re: NT Domain to AD migration
    ... Windows 2000/XP always prefer Kerberos authentication, ... Server 2003 Active Directory service, ensure that you have designed a DNS ...
    (microsoft.public.windows.server.active_directory)
  • Re: Find AD hostname from Linux command line
    ... The Windows XP workstation gets an IP ... "Register this connection's addresses in DNS" turned ON. ... If I am on a Linux server and do "ping lancelot.ad.mydomain.com", ...
    (microsoft.public.win2000.dns)