Web Server - User Access and Priviledges.

From: Brad Causey (brad_at_bradcausey.com)
Date: 09/22/04

  • Next message: Dave: "Re: Can someone tell me what's "gdidet.exe"?" 
    Date: Wed, 22 Sep 2004 08:41:15 -0700

    Well steve,
    I'll take you up on that challenge.

    First off I can understand the mistake of jacking up the
    admin pass, it happens. However, the idea of creating a
    user account for several services running on your web
    servers will be taking steps backwards from the hardening
    your trying to accomplish. You should review the user
    restriction policy that came out with the server 2003
    release. Have a logon for your everyday use and one admin
    account that your or only a few people have access to.
    utilize the "run as" for administrative uses. The fewer
    user accounts you have the safer you are.
    Hope this helps

    -Brad Causey
    Instructor, New Horizons Montgomery AL
    MCP, MCDST, MCSA, MCDBA, MCT, A+, Network+, CTT+
    >-----Original Message-----
    >G/Day Forum,
    >
    >I'm currently hardening access to all my IIS 5.0 and IIS
    6.0 servers, that
    >are located within multiple DMZ environments in multiple
    locations.
    >
    >
    >
    >All servers are Firewalled and are administered through
    VPN's using Terminal
    >Services/RDP. Recently, I encountered a (self induced)
    problem with one of
    >these Servers where I mucked up the password change (on
    the only
    >Administrator account on the server) on one of our
    Production Systems - NOT
    >GOOD BUT I LEARNED MY LESSON. I managed to access the Sam
    database and reset
    >my password - thus enabling me to log back into the
    system. This required a
    >site visit and more importantly it created downtime that
    shouldn't have
    >happened if there was a fall back mechanism in place that
    corrects/prevents
    >this from happening.
    >
    >
    >
    >Here is what I think should be done:
    >
    >Create a second Administrator account on each Web Server.
    Take it that each
    >account password is 10 characters long and meets the
    complexity requirements
    >dictated by the local security policy - roughly 48 bit in
    strength. This
    >account will prevent anything like the incident above
    from happening.
    >
    >
    >
    >For the purposes of deploying content and other
    information, I've created a
    >hidden share on the server - accessible from our
    corporate LAN environment
    >only. I've also created a user called 'ShareUser',
    specifically used for
    >accessing this hidden share. I've modified the NTFS and
    Share permissions to
    >reflect this user's required access. This will eliminate
    the administrators
    >from using the server Administrator credentials to access
    the we server
    >share for the future deployment of content to the WS. I
    also added this
    >account to the 'Deny Log on Locally' section of the Local
    Security Policy.
    >
    >
    >
    >I'm also tempted to create another user specifically for
    Terminal Services
    >connections (thus removing the right of an Administrators
    to log on under a
    >Terminal Services session) - if they want Admin
    privileges then let that TS
    >user escalate to Admin through the usage of an Admin
    command shell or 'runas
    >'. I've read a few articles by Keith Brown -
    pluralsight.com (yep your
    >still talking to a Network Engineer) with regards to the
    utilisation of the
    >thinking that 'least privilege is best'. I agree and
    want to enforce. A
    >helpful blog that I found on running the explorer.exe
    process under a
    >different user can be found at
    >http://blogs.msdn.com/aaron_margosis/archive/2004/07/07.as
    px
    >
    >
    >
    >So what you ask am I posting to the newsgroup for? I'm
    trying to provoke a
    >response where my (maybe silly, ludicrous and daft) ideas
    are challenged,
    >corrected and hopefully improved.
    >
    >
    >
    >Regards,
    >
    >Steve.
    >
    >
    >.
    >

  • Next message: Dave: "Re: Can someone tell me what's "gdidet.exe"?"

    Relevant Pages

    • Re: FIRED IT ADMIN HAS LOCKED US OUT OF SBS
      ... you have risen to an Administrator this would be a given. ... server and run all LOB apps on these. ... If there are no encrypted files, just reset the DSRM account ...
      (microsoft.public.windows.server.sbs)
    • Re: FIRED IT ADMIN HAS LOCKED US OUT OF SBS
      ... Teneo> Interesting post and Im now gonna be a party pooper... ... connections) before cutting power to the server and to the Internet ... If there are no encrypted files, just reset the DSRM account ... and try old domain Administrator account's passwords. ...
      (microsoft.public.windows.server.sbs)
    • Re: Remote desktop: cannot copy files why still not working
      ... I created a new user on the XP box, set as an administrator ... this new user account is local to the XP system, ... In my environment, when I do an RDP connection to a server, I first log ... member of the local administrators group on the server. ...
      (microsoft.public.windows.server.security)
    • Re: Remote desktop: cannot copy files why still not working
      ... this new user account is local to the XP system, and a member of the local administrator's group on that workstation. ... In my environment, when I do an RDP connection to a server, I first log on to the xp workstation using my regular, non-privileged domain account, run mstsc, and then logon to the server using a domain account that is a member of the local administrators group on the server. ... In addition, I frequently use runas to run privileged applications on the workstation using my "administrator" account, and have found that files cannot be copied between those applications and anything running under the credentials of my regular account - even though my administrator account actually does have full access to everything on the workstation - just not through my regular account's view of that workstation. ...
      (microsoft.public.windows.server.security)
    • Re: Keep admins off of client machines
      ... the sharepoint admin is simple, just create a standard user account for them ... The 'Domain Administrator' account is ... Domain Administrator password. ... takes a thorough understanding of such priveleges to do so. ...
      (microsoft.public.windows.server.sbs)