Securing the Registry.

From: Stephen O'Sullivan (steve_at_nospam_noway_dontyoudare.net)
Date: 11/24/03 

Date: Mon, 24 Nov 2003 17:36:38 -0000

G/day forum,

I've been ploughing through documents and whitepapers on how to secure your
web server, the best resource of all was probably Improving Web Application
Security - Threats and Countermeasures, an absoloute bible for all ye web
admins out there. Before you read the part i'm querying, it i just want to
doublecheck that i'm not missing anything. Your thoughts please :)

On Chapter 16: Securing Your Web Server, page 449, the following:

Step 9. Registry
The registry is the repository for many vital server configuration settings.
As such,you must ensure that only authorized administrators have access to
it. If an attacker is able to edit the registry, he or she can reconfigure
and compromise the security of your server.

During this step, you:

? Restrict remote administration of the registry.

? Secure the SAM (stand-alone servers only).

Restrict Remote Administration of the Registry

The Winreg key determines whether registry keys are available for remote
access. By default, this key is configured to prevent users from remotely
viewing most keys in the registry, and only highly privileged users can
modify it. On Windows 2000, remote registry access is restricted by default
to members of the Administrators and Backup operators group. Administrators
have full control and backup operators have readonly access.

The associated permissions at the following registry location determine who
can remotely access the registry.

HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg

To view the permissions for this registry key, run Regedt32.exe, navigate to
the key, and choose Permissions from the Security menu.

Secure the SAM (Stand-alone Servers Only)

Stand-alone servers store account names and one-way (non-reversible)
password hashes (LMHash) in the local Security Account Manager (SAM)
database. The SAM is part of the registry. Typically, only members of the
Administrators group have access to the account information.

Although the passwords are not actually stored in the SAM and password
hashes are not reversible, if an attacker obtains a copy of the SAM
database, the attacker can use brute force password techniques to obtain
valid user names and passwords.

Restrict LMHash storage in the SAM by creating the key (not value) NoLMHash
in the registry as follows:

HKLM\System\CurrentControlSet\Control\LSA\NoLMHash

For more information, see Microsoft Knowledge Base article 299656, "New
Registry

Key to Remove LM Hashes from Active Directory and Security Account Manager."

Relevant Pages

  • RE: Should webservers, eg. IIS 6 have anti--virus installed on them?
    ... I take a more community mind approach to security. ... As much as I don't want my server infected, ... wouldn't load either one on the same system as the web server. ... Let's say Joe SysAdmin does install the A/V software ...
    (Focus-Microsoft)
  • Re: Moving webserver inside firewall
    ... current OS/Product Service Packs, security patches, security tools, virus ... | I think inside the firewall is the best place for most any server. ... | The only way to be 100% sure the web server is not compromised is to ...
    (microsoft.public.inetserver.iis.security)
  • Re: Recommended Windows Hosts
    ... I see that you have conveniently left Windows Server 2003 out of your ... Using Microsoft Office FrontPage 2003 ... >>attempt to repair security flaws...". ... >>recommended not allowing parent paths on the Web server. ...
    (microsoft.public.frontpage.client)
  • Securing the Registry.
    ... web server, the best resource of all was probably Improving Web Application ... Security - Threats and Countermeasures, an absoloute bible for all ye web ... The registry is the repository for many vital server configuration settings. ...
    (microsoft.public.security)
  • Securing the Registry.
    ... web server, the best resource of all was probably Improving Web Application ... Security - Threats and Countermeasures, an absoloute bible for all ye web ... The registry is the repository for many vital server configuration settings. ...
    (microsoft.public.inetserver.iis.security)