) Security management for dedicated web servers

IIS settings:
Delete the virtual directory of the default site, stop the default web site, delete the corresponding file directory c: inetpub, configure public settings for all sites, and set the connection limit,

Bandwidth settings, Performance Settings, and other settings. Configure ApplicationProgramIng to delete all unnecessary Application Extensions. Only ASP, PHP, CGI, PL, and aspx Application Extensions are retained. Pair

For PHP and CGI, we recommend that you use ISAPI for parsing. EXE resolution affects security and performance. The user program debugging settings send text error messages to the customer. For databases, try to collect

You do not need to change the MDB suffix to ASP. You can set an MDB extension ing in IIS to use an unrelated DLL file such as C: winntsystem32inetsrvssinc. dll.

To prevent the database from being downloaded. Set the IIS log storage directory to adjust the log record information. Set to send text error message. Modify the 403 error page and redirect it to another page.

Stop some scanners. In addition, to hide system information and prevent system version information leaked by Telnet to port 80, you can modify the banner information of IIS by using winhex or

Such as banneredit.
For the directory where the user site is located, note that the user's FTP root directory should store site files and databases respectively for three files: wwwroot, database, and logfiles.

Back up and log of the site. If an intrusion event occurs, you can set specific permissions for the directory where the user site is located. The directory where the image is located only gives the column directory permission and the directory where the program is located.

If you do not need to generate a file (such as an HTML Program), write permissions are not granted. Because Virtual Hosts usually have no way to detail Script Security, more methods can only be used.

User Privilege Escalation from script:

ASP Security Settings:
After permissions and services are set, you need to do the following to prevent ASP Trojans. Run the following command in the CMD window:
Regsvr32/U c: \ winnt \ system32 \ wshom. ocx
Del c: \ winnt \ system32 \ wshom. ocx
Regsvr32/U c: \ winnt \ system32 \ shell32.dll
Del c: \ winnt \ system32 \ shell32.dll
You can uninstall the wscript. Shell, Shell. Application, and wscript. network components to effectively prevent ASP trojans from executing commands through wscript or shell. Application and

Use a Trojan horse to view sensitive system information. In addition, you can cancel the permissions of the users of the preceding files and restart IIS to take effect. This method is not recommended.
In addition, for FSO, because the user program needs to be used, the component can not be deregistered on the server. Here we only mention the FSO prevention, but do not need to be in the virtual merchant server that automatically opens the space.

Only applicable to manually activated sites. You can set two groups for sites that require both FSO and FSO. for user groups that require FSO, give C: winntsystem32scrrun. dll

File Execution permission. permissions are not required. Restart the server to take effect.
If this setting is combined with the above permission settings, you will find that the Haiyang trojan has lost its role here!

PHP security settings:
Note the following when installing PHP by default:
C: \ winnt \ PHP. ini only grants users read permission. In PHP. ini, you need to make the following settings:
Safe_mode = on
Register_globals = off
Allow_url_fopen = off
Display_errors = off
Magic_quotes_gpc = on [the default value is on, but you need to check it again]
Open_basedir = web directory
Disable_functions = passthru, exec, shell_exec, system, phpinfo, get_cfg_var, popen, chmod
By default, Com. allow_dcom = true is set to false. [cancel the previous modification before modification.]

MySQL Security Settings:
If the MySQL database is enabled on the server, note the following security settings for the MySQL database:
Delete all default users in MySQL, retain only the local root account, and add a complex password to the root user. When updatedeletealertcreatedrop is granted to a common user

And limited to a specific database, especially to avoid ordinary customers having the permission to operate the MySQL database. Check the mysql. User table and cancel shutdown_priv and relo of unnecessary users.

The ad_priv, process_priv, and file_priv permissions may leak more server information, including other non-mysql information. You can set a startup user for MySQL,

This user only has permissions on the MySQL directory. Set the permission of the data database in the installation directory (this directory stores the data information of the MySQL database ). Add read to users for MySQL installation directory

Permission for obtaining, column directory, and execution.

Serv-U security questions:
The installer should use the latest version whenever possible. Avoid using the default installation directory, set the permissions of the Serv-U directory, and set a complicated administrator password. Modify the banner information of Serv-U

, Set the port range in passive mode (4001-4003)
Set security in the local server settings: including checking anonymous passwords, disabling anti-Timeout scheduling, intercepting FTP Bounce attacks and fxp, and connecting more than 3 times in 30 seconds

User interception for 10 minutes. The complex password is required. The directory only uses lowercase letters. In advanced settings, the date on which the MDTM command is allowed to change the file is disabled.
Change the start user of Serv-U: Create a new user in the system and set a password for the complex node, which does not belong to any group. Grant the user full control permission to the installation directory of The ServU. Create

For an FTP root directory, you must grant the user full permission to this directory, because all ftp users upload, delete, and change files all inherit the permissions of this user; otherwise, operations cannot be performed.

File. In addition, you must grant the user the read permission to the parent directory above this directory. Otherwise, 530 not logged in, home directory does not

Exist. For example, if the FTP root directory is D: Soft during the test, you must grant the read permission to the user of drive D. In order to safely cancel the inherited permissions of other folders on drive D. Generally, the default S is used.

Ystem does not solve these problems because system generally has these permissions.

Database Server Security Settings

For dedicated MSSQL database servers, follow the settings described above to set TCP/IP filtering and IP policies, and only open ports 1433 and 5631 to the outside. For MSSQL, you must first set a strong

Strong Password, use mixed identity authentication, enhance database log records, audit database Login Events "Success and Failure". Delete unnecessary and dangerous OLE Automatic stored procedures (will

These processes include:
Sp_oacreate sp_oadestroy sp_oageterrorinfo sp_oagetproperty
Sp_oamethod sp_oasetproperty sp_oastop
Remove unnecessary registry access processes, including:
Xp_regaddmultistring xp_regdeletekey xp_regdeletevalue
Xp_regenumvalues xp_regread xp_regremovemultistring
Xp_regwrite
Remove other system stored procedures. If you think there are threats, be careful to drop these processes. You can test them on the testing machine to ensure that the normal system can complete the work. These processes include:

:
Xp_mongoshell xp_dirtree xp_dropwebtask SP_ADDSRVROLEMEMBER
Xp_makewebtask XP_RUNWEBTASK xp_subdirs sp_addlogin
Sp_addextendedproc
Select the TCP/IP protocol attribute from the instance attributes. Select to hide the SQL server instance to prevent port 1434 from being detected. You can modify the default port 1433. Remove the database guest

The account keeps unauthorized user data away. The exception is the master and tempdb databases, because they are required for their guest accounts. In addition, pay attention to setting

Permissions. These users only have some permissions on their databases. Do not use the SA user to connect to any database in the program. We recommend that you use protocol encryption on the network.

Otherwise, you can only reinstall MSSQL.

Part 2 intrusion detection and Data Backup

§ 1. 1 Intrusion Detection

As the daily management of servers, intrusion detection is a very important task. In the normal detection process, it mainly includes routine server security inspection and intrusion detection during intrusion.

Queries are classified into security checks during intrusion and before and after intrusion. The system security follows the barrel principle. The barrel principle refers to the following: a barrel is composed of multiple wooden boards.

If the length of these wooden boards is different, the maximum capacity of the wooden barrel does not depend on the long wooden board, but on the shortest wooden board. Application to security, that is, System

System security depends on the weakest part of the system, which is the focus of routine security detection.

Routine Security Detection

Routine Security Detection mainly focuses on system security. The work is carried out in the following steps:
1. view the server status:
Open the Process Manager, view the server performance, and observe the CPU and memory usage. Check whether there are high CPU and memory usage exceptions.
2. Check the current process
Switch "Task Manager" to the process to check whether any suspicious application or background process is running. When you use the Process Manager to view the process, there will be a taskmgr, which is a process manager

The process of the scheduler. If Windows Update is running, there will be a wuauclt.exe process. For inaccurate processes or processes that do not know which application is enabled on the server

You can search for the process name on the network to confirm the [Process Knowledge Base: http://www.dofile.com/#. If a webshell has a process, the system process

For example, svch0st.exe. In this case, you must carefully identify [the usual obfuscation is to change the letter O to the number 0, and change the letter L to the number 1].
3. Check the system account
Open Computer Management, expand local users and group options, view group options, check whether new accounts are added to the Administrators group, and check whether clone accounts exist.
4. view the current port opening status
Use activeport to check the current port connection status. Pay special attention to the external connection port status and check whether unauthorized ports are communicating with the outside world. If yes, close immediately

Close the port, record the program corresponding to the port, and transfer the program to another directory for later analysis. Open Computer Management = software environment = running task [

Here, you can view hidden processes that are not visible in the Process Manager], view the currently running program, if there is an unknown program, record the location of the program, open the task manager to end the process

You can try to end the process tree for a program that uses a daemon backdoor. If it still cannot end, search for the program name in the registry, delete the key value, and switch to safe mode to delete the program.

Remove related program files.
5. Check System Services
Run services. msc, check the services in the started status, check whether the newly added unknown service exists, and determine the purpose of the service. For services that are unclear, open the service attributes and check

Check the executable file corresponding to the service. If you confirm that the file is a normally used file in the system, you can roughly ignore it. Check whether other normal open services exist.

, If there is, you can roughly let it go. If you cannot determine whether the execution file is a normal file in the system and no other normal open services exist on the service, you can temporarily stop

Service, and then test whether the applications are normal. Because some backdoors adopt the hook system API technology, the added service items cannot be seen in the Service Manager.

Open the hkey_local_machinesystemcurrentcontrolsetservices item in the Registry for search. Check the service name and corresponding execution file to determine whether the service is a backdoor.

And trojan programs.
6. View related logs
Run eventvwr. MSC to roughly check related log records in the system. During viewing, right-click the corresponding log record and select "attribute". In "filter", set a LOG filter.

To view the log source and specific description. If you can find a solution to an error in the troubleshooting of common server faults, follow this solution.

If no solution is available, record the problem, and record the event source, ID number, and description in detail to find a solution to the problem.
7. Check System Files
Check the EXE and DLL files on the system disk. We recommend that you use dir *. EXE/S> 1.txt to save the list of all EXE files on the C disk after the system is installed.

Use this command to generate a list of the files at that time. Use FC to compare two files and perform related checks on DLL files. It should be noted that after patching or installing software, the original

Start List. Check whether the related system files are replaced or whether Trojans and Backdoor programs are installed in the system. If necessary, run a antivirus program to scan the system disk.
8. Check whether the security policy is changed.
Open the properties of the local connection, check whether only "TCP/IP protocol" is checked in "General", and enable "TCP/IP" protocol settings, click "advanced" = "option" to view "IP Security"

Check whether the port permitted by the "TCP/IP" filter has been changed. Open "Administrative Tools" = "" Local Security Policy "to view the IP Security currently in use

Whether the policy is changed.
9. Check Directory Permissions
Check whether the system directory and important application permissions are changed. The directories to be viewed include C:; C: winnt;
C: winntsystem32; C: winntsystem32inetsrv; C: winntsystem32inetsrvdata; C: documents and
Settings; then, check the Serv-U installation directory to check whether the permissions of these directories have been changed. Check whether the permissions of some important files under system32 have been changed, including: cmd,

. Net, FTP, TFTP, and cacls files.
10. Check startup items
Check the current Boot auto-Start Program. You can use areporter to check the self-starting program.

Measures for detecting intrusion

If the system has been damaged and the system has not been damaged or cannot be noticed, check the system according to the above inspection steps.

After checking the information, consider the following measures as appropriate. Immediately after the system is damaged, take the following measures:
Depending on the situation, the processing method is determined by remote processing or on-site processing. If the situation is serious, we recommend that you handle it on the spot. If on-site processing is adopted, the service can be implemented immediately after intrusion detection.

If the server is shut down in the IDC, the waiting personnel will disconnect the network cable when they arrive at the IDC, and then enter the system for inspection. If remote processing is adopted, if the situation is serious, all application services will be stopped immediately, and I

The P policy is to allow only remote management ports to connect and then restart the server. After restart, connect to the server remotely. Before restart, areporter is used to check the self-started

Program. Then perform a security check.

The following measures are taken to reinforce the security of your site if your site is compromised but the system is not compromised:

Site root directory-only read permissions to the Administrator. The permissions are inherited.
Wwwroot ------ read and write permissions to Web users. Advanced has the permission to delete subfolders and files.
Logfiles ------ write permission to system.
Database ------ read and write permissions for Web users. Advanced does not have permission to delete subfolders and files.

For further modification, you can grant only the read permission to the common file storage directories such as HTML, JS, and image folders based on the features of your site, and grant the permissions in the preceding table to ASP and other script files.

. In addition, you can view the security logs corresponding to the user's site to find out the cause of the vulnerability and help the user fix the vulnerability.

§ 1. 2 data backup and data recovery

Data backup is roughly as follows:
1. Back up system data once a month.
2. The application data is backed up independently once every two weeks after the system is backed up, including IIS, Serv-U, database, and other data.
3. Ensure the security of the backup data and classify the backup data. Because the full backup method is basically used, only the backup and the last backup can be retained for the data retention period.

Copy Data in two copies.

Data Recovery:
1. When the system crashes or encounters other situations where the system is not recoverable, back up and restore the settings of some changes that occur after the last system backup, such as applications and security policies.

After the system is restored, the changes will be restored.
2. Applications and other errors use the last backup data recovery related content.

Part 3 server performance optimization

§ 3. 1 server performance optimization

System Performance Optimization
Organize system space:
Delete the system backup file, delete the driver backup, Remove unused access methods, remove the system help file, and uninstall unused components. Minimize disk C files.
Performance Optimization:
Delete unnecessary programs that run automatically at startup; reduce pre-reading and progress bar wait time; enable the system to automatically close the program that stops responding; Disable Error reports, but notify when a serious error occurs

; Disable automatic update and change to manual update;
Enable hardware and DirectX acceleration, disable shutdown event tracking, disable the configuration server wizard, reduce the waiting time for disk scanning, and adjust both the processor plan and memory usage to the application

; Adjust virtual memory; Memory optimization; modify the second-level cache of the CPU; modify the disk cache.

IIS Performance Optimization
1. Adjust IIS Cache
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ inetinfoparametersmemorycachesize
The memorycachesize range is from 0 to 4 GB. The default value is 3072000 (3 MB ). Generally, this value should be at least 10% of the server memory. IIS uses the cache system handle and Directory

List and other common data values to improve system performance. This parameter specifies the memory size allocated to the cache. If the value is 0, it means "no cache is performed.

". In this case, the system performance may be reduced. If your server is busy with network communication and has enough memory, you can increase the value. Note that

After the table is created, you must restart the table to make the new value take effect.

2. Do not close the system service: "Protected Storage"

3. Restrict Access traffic
A. restrict the number of visitors to the site
B. Site bandwidth limit. Keep the HTTP connection.
C. Process restrictions: Percentage of CPU input consumed

4. Improve IIS processing efficiency
The "application protection" drop-down button in the "application settings" area. Select the "low (IIS Process)" option from the displayed drop-down list to improve the processing efficiency of IIS servers by 20%.

Left and right. However, this setting may cause serious security issues and is not recommended.

5. Set the IIS server as an independent server
A. Improve hardware configuration to optimize IIS Performance
Hard Disk: the hard disk space is used by NT and IIS in two ways: one is to simply store data, and the other is to use as virtual memory. If you use the SCSI hard drive of ultra2, you can

Significantly improves IIS Performance
B. You can distribute the Page Swap files of the NT Server to multiple physical disks. Note that multiple "physical disks" are invalid when they are distributed across multiple partitions. In addition, do not place Page Swap files

In the same partition as the Windows NT boot Area
C. Using a disk image or a disk zone set can improve the disk read performance
D. It is best to store all the data in a separate partition. Then, run the disk fragment program regularly to ensure that no fragments exist in the partition where the Web server data is stored. NTFS has

This helps reduce fragments. We recommend that you use the speeddisk of Norton to quickly sort NTFS partitions.

6. Start with HTTP Compression
HTTP compression is used to transfer compressed text content between web servers and browsers. HTTP compression adopts common CompressionAlgorithmSuch as gzip to compress HTML, JavaScript, or CSS files. Yes

Use pipeboost for configuration.

7. Recovery of initial resources
Use iis5recycle to regularly Recycle Process resources.

§ 3. 2 troubleshooting of common server faults

1. ASP solution for "requested resources in use:
This problem is generally related to anti-virus software. It is caused by the installation of personal anti-virus software on the server. If this error occurs, you can uninstall the antivirus software or try to register VBScript. DL again.

Run regsvr32 VBScript. dll and regsvr32 jscript. dll in the command line.

2. asp500 error solution:
First, determine whether the problem exists for a single site or all sites. If the problem exists for a single site, it is a problem with the website program. You can open the site error prompt and

The "show friendly HTTP Error" information is canceled, view the specific error information, and modify the relevant program accordingly. If this problem exists on all sites and the problem does not occur on the HTML page,

The related log shows "The server cannot load the application '/lm/w3svc/1/root '. The error is 'this interface is not supported '". The ASP-related components in the server system

If the problem persists, restart the IIS service and try to solve the problem. If the problem persists, restart the system and try to solve the problem. If the problem persists, restart the ASP Component.

: First, delete the three items about IIS in the COM component. You Need To deselect the "Disable deletion" check in the advanced section of the attribute.
In the command line, enter the "CD winnt \ system32 \ inetsrv" string command, click the Enter key, then run the "rundll32 wamreg. dll, createiispackage" command, and then

Run the "regsvr32 asptxn. dll" command and the "iisreset" command in sequence, and restart the computer operating system. Then, the IIS server can correctly respond to the ASP script again.

Page.

3. IIS error 105:
In the system log, "the server cannot register the information found by the management tool. Management tool may not be able to see this server "Source: W3SVC ID: 105
Solution: reinstall the NetBIOS protocol in the network connection. After the installation is complete, deselect the check box.

4. MySQL service cannot be started [ErrorCode1067] Solution
An error is reported during MySQL service startup! Content: unable to start MySQL service on local computer error 1067: Process aborted unexpectedly.
Solution: Find the my. ini file in the Windows directory and edit the content (if the file does not exist, create a new one), including at least
Basedir and datadir are two basic configurations.
[Mysqld]
# Set basedir to installation path, e.g., C:/MySQL
# Set it to the MySQL installation directory
Basedir = D:/www/webserver/MySQL
# Set datadir to location of data directory,
# E.g., C:/MySQL/data or D:/mydata/Data
# Set it to the MySQL DATA DIRECTORY
Datadir = D:/www/webserver/MySQL/Data
Note: I did not grant the System user permission to the changed directory after changing the temp directory of the system.

5. CPU consumption of dllhotst processes: 100%
The normal CPU consumption of the server should be below 75%, and the CPU consumption should be fluctuating. If such a problem occurs on the server, the CPU will suddenly remain at the level of 100% and will not decrease.

Check the task manager and you can find that DLLHOST. EXE consumes all the CPU idle time. In this case, the Administrator has to restart the IIS service. The strange thing is, restart IIS.

After the service, everything is normal, but after a while, the problem may occur again.
Cause:
One or more access databases are damaged during multiple read/write operations. When the MDAC system writes this corrupt access file, the ASP thread is in the block state, and other threads can only wait.

Wait, IIS is deadlocked, and all CPU time is consumed in DLLHOST.
Solution:
Download the database to your local computer, and then open it with access for restoration. Upload it to the website. If not, you only need to create an Access database and then export it from the original database.

Enter all tables and records. Then upload the new database to the server.

6. Windows Installer error:
When installing the software, the following error occurs: "You cannot access the Windows Installer Service. You may be running Windows in safe mode, or the Windows Installer is not properly installed.

Installation. Please contact your support staff for help. "If you try to reinstall instmsiw.exe, the system prompts" the specified service already exists ".
Solution:
For installer errors, there may be other error prompts. You can try the following solutions:
First, check whether it is a permission issue. The prompt will provide relevant information. If it is a permission issue, grant the WINNT directory everyone permission. [after installation, change the permission back.

]. If the preceding information is displayed, Run "msiexec/unregserver" to uninstall Windows.

If the installer service cannot be uninstalled, you can use srvinstw to uninstall it, and then download windows

Installer [Address: Installer

I. inf file, right-click and select "Install", restart the system, and run "msiexec/regserver" to re-register the Windows Installer Service.

Part 4 Server Management

§ 4. 1 daily server management arrangements

Server Management must be standardized and rigorous, especially when there is not only one administrator. daily management includes:
1. timed restart of the server. Each server must be restarted once a week. Review after restarting, confirm that the server is started, and confirm that all services on the server are restored.

Restore normal. Take appropriate measures if the service is not started or the service fails to be restored in a timely manner. The former can ask the relevant staff of the producer to help manually restart, if necessary

Connect to the monitor to check whether it has been started; the latter needs to remotely log on to the server to find the cause and try to restore the service based on the cause.
2. Check the security and performance of the server. Each server must log on twice a week for at least two rough checks. The results of each check must be registered. If you need to use some tools for inspection

You can find related tools in E: tools. For tools that need to be found on the network temporarily, first adjust the security level of IE to a high level, and then search on the network.

He does not know how to download the site. He tries his best to select large websites such as huajun and skysky to download the site. After downloading the site, make sure that the current anti-virus software has been upgraded to the latest version.

The second anti-virus attack can be used only after confirmation is normal. If you need to use the downloaded new tool for future maintenance, save the tool to E: tools and make it in the readme.txt file in the directory.

Record the name, function, and usage of the tool. In addition, keep a copy of The WinRAR compressed file backup in the RAR folder of this tool and set the decompression password.
3. Backup of server data. Each server must back up system data at least once a month. The system backup adopts the ghost method, and ghost files are stored in the E: ghost file directory.

The file name is named after the backup date, such as 02.16.gho. each server must back up application data at least once every two weeks, and each server must back up user data at least once a month.

Copies of data are stored in the E: databak folder, and corresponding subfolders are created for various types of data, such as the number of IIS sites where Serv-U user data is stored in the ServU folder.

Data is stored in the IIS folder under this folder.
4. During the monitoring of servers, the status of all servers must be monitored every day during normal operation. Once the service is found to be stopped, appropriate measures should be taken in a timely manner. If the service is found to be stopped, first check

Check whether services of the same type on the server are interrupted. If all services of the same type have been interrupted, log on to the server in time to view the relevant reasons and try to restart the corresponding services for this reason.
5. Log operations on the server. Each server ensures that the relevant logs are cleared once a month. All the logs corresponding to the logs before cleaning, such as application logs, security logs, and system logs, should be

Select save log ". All log files are stored in E: logs, application logs are stored in E: logsapp, and system program logs are saved in E: logssys.

Exist in E: logssec. Logs of other applications are also processed in this way. For example, FTP logs are stored in E: logsftp. All the backup log files

Name the backup date, for example, 200502.16.evt. For logs that are not in the form of a single file, create a folder named by date at the corresponding record location and store these files in

Folder.
6. server patch and application update. For new vulnerability patches, application security updates must be applied to each server immediately upon discovery.

.
7. Check for potential risks of servers, including security risks and performance. Each server must be checked separately on a monthly basis. The results of each check must be recorded.
8. For irregular work, all administrators must be informed about the installation of new applications or uninstallation of applications on each server due to application software changes or other reasons.
9. Regularly change the management password. Each server must change the password at least once every two months. For SQL servers, changing the system administrator password will be affected if SQL adopts hybrid verification.

Database usage is not modified.

Related suggestion: Set up a server management record for each server. The Administrator should record the details in each login system. The following items must be recorded: Logon Time, exit

Time, server status during login [contains unknown process records, port connection status, system account status, memory/CPU status], detailed operation records [detailed records of administrator login to the System

Next step]. Both remote login and physical contact operations should be recorded, and these records should be archived by servers and documents should be sorted in chronological order.
We recommend that you group servers for data backup and regular server restart operations, such as dividing them into four groups, backing up the data of a group of servers on Saturday every month, and restarting them on a regular basis every week.

Group server, which is more convenient for work, these are fixed work. In addition, some tasks can be synchronized, such as monthly data backup, security check, and management.

To change the password, back up data first, perform security checks, and then change the password. Real-time operations, such as the installation of server patches and the maintenance of server faults from time to time

Protection and other work, these are immediate work, but in principle, immediate work cannot affect the arrangement of fixed work.

§ 4. 2 administrator's daily notes

During server management, the Administrator must pay attention to the following:
1. Make a detailed record of each of your operations. For details, refer to the above suggestions for later checks.
2. Strive to improve your own level and enhance your learning.