SQL Server Magazine

Do you think that your Windows NT server is safe? Before you answer, if you're the administrator of an NT server that connects to the Internet, consider the following:

• At the time of this writing, Netcraft's Web Server Survey (http://www.net craft.com/survey) reports that about 30 percent of the computers in active Internet sites are Microsoft servers and that the vast majority of those are NT servers. Although Microsoft servers constitute less than a third of the market, they have been the favorite targets of intruders. The Attrition Defacement Statistics Web site (http:// www.attrition.org/mirror/attrition/ os.html#all) reports that from August 1999 through May 2001, almost 55 percent of all defacements were against NT and almost 7 percent of all defacements were against Windows 2000.
  
  
• During a Black Hat Windows Security convention, three intruders easily infiltrated one of the most popular firewalls, Check Point Software Technology's FireWall-1. This demonstration brought home that a firewall is only as secure as the underlying OS. (For more information, see "Hackers Breach FireWall-1," http://www .zdnet.com/zdnn/stories/news/ 0,4586,2610719,00.html?chkpt=zdhp news01, and "A Stateful Inspection of FireWall-1," http://www.dataprotect .com/bh2000/blackhat-fw1.html.)

To provide the highest level of security for your NT network, you can build a bastion host. A bastion host is typically an Internet-connected server that has no devices (e.g., filtering routers) to protect against Internet attacks. Instead, the bastion host's defense is a stripped down, highly secure OS.

You can configure a bastion host for a variety of server roles on the Internet. For example, you can use the bastion host as an FTP, Microsoft IIS, SMTP, POP3, Network News Transfer Protocol (NNTP), or firewall server. First, let's look at three good practices to keep in mind as you're building a bastion host; then, we'll discuss how to configure an NT server as a bastion host.

Good Practices
When building a bastion host, you should follow three good practices. First, you should build it in stages so that you're applying the security measures in layers. That way, if problems occur later, you can peel back and check each layer until you find the root of the problem. Second, you should install only programs that are absolutely necessary to achieve the desired functionality. This practice is often referred to as the minimalist approach. Finally, you should document every action you perform on the bastion host. I keep a separate notebook for each bastion host for the entire life of that server. If more than one administrator manages a Web site, keep the notebook in a central location. That way, the notebook becomes a communications tool.

In the notebook, document events and measurements, including hardware and software installations, upgrades, and removals; services running; server reboots; and server statistics (e.g., memory, disk-space utilization). By keeping track of how the server usually behaves, you'll be better able to tell when it's behaving abnormally. Unusual behavior can be a symptom of defacement or another problem.

Keeping these three good practices in mind, let's build a bastion host. Building a host is a six-stage process:

1. Install NT and the application.
2. Remove unnecessary network services.
3. Disable unnecessary local services.
4. Change the network configuration.
5. Run setup.cmd.
6. Test the application.

Install NT and the Application
The first step to building a bastion host is to install NT 4.0 on the server. You're likely experienced in installing NT, so I won't detail that process here. When you install the OS, though, make sure that you

• configure all volumes as NTFS. If you have enough space, make a separate partition for user data and logs. Separating the OS from user data and logs makes assigning permissions much easier and eliminates the risk of crashing the system should the user data and logs fill up the root partition.
  
  
• select TCP/IP as the only protocol.
  
  
• configure the bastion host as a standalone server.
  
  
• don't install IIS, even if the bastion host will be an IIS server. If you plan to install IIS, you should do so after you finish working with the OS.

The next step is to install the latest service pack. When you install NT 4.0 from a CD-ROM, the CD-ROM typically includes Service Pack 1 (SP1). To avoid any hardware and software problems, I always install the latest service pack and update all my drivers with OEM drivers that I know are solid and stable.

Now you can install your application (e.g., IIS, firewall software). Install updates and hotfixes that the application might need. In following the minimalist approach, you probably won't need to install Microsoft Internet Explorer (IE). However, if you need to install IE, don't install the Shell Update Release (SUR) add-on component (aka Active Desktop). This component isn't necessary and consumes a lot of memory.

With the OS and the application installed, you can tweak your bastion host. Specifically, you need to remove unnecessary network services, disable unnecessary local services, and change the network configuration.

   Prev. page   [1] 2 3     next page