Virtual Host Security Configuration and Optimization

Recently, as a system administrator in a network company, we will perform security configuration and Optimization for Win2000 Servers Based on our own experience and environment.

The following are the operating systems and server software of my VM:
OS: Win2k Advancd Server
Ftp server: Serv-u 6.0.2
Www server: IIS
Mail server: WebEasyMail 3.5.3.1 Enterprise Edition
Firewall: A personal cracked version of Skynet Firewall
Anti-Virus Software: McAfee VirusScan Enterprise 8.0. I
Remote Management Software: Terminal Services Terminal Service

Next I will discuss the process of installing the system, installing server applications, security settings, and optimization.

1. Hard Disk partitioning and Installation System

I strongly recommend that you select the NTFS file format for partitioning. Not only does the NTFS file system bring us high security, but also

For WEB Service virtual hosts, the disk quota is very high. files and folders are compressed to our system administrators.

Convenience.
Before partitioning, make sure that you set partitions properly. Reasonable partitioning not only facilitates our work, but also

Improve system security and stability. My hard drive is divided into five zones (120 GB ).
Disk C is used to install operating system files. Disk D is used to store files of various WEB sites. An edisk is used to save IIS log files and Temporary Internet Files.

Folder and page file. F disk is used to install applications. That is to say, all applications are installed on the F disk. Disk G is used to save the backup file and

Some common tools. You can set partitions based on your own situation without having to match them one by one. The following figure shows how to install the system.

When installing the system, you must choose to install only the components you need, but do not install some unused components. None

Components will bring us some unexpected "surprises ". FrontPage2000 Server Extension, Inetern

Remove the check boxes of the et Service Manager (HTML), NNTP Server, SMTP Server, and file transfer protocol (FTP) Server. To guarantee these

Unused services do not pose security risks to us.
Move the Temporary Internet folder to a non-system partition. For example, if I set an edisk: Internet Explorer, right-click it-

Property-Ineternet temporary file-settings-move folder, select the corresponding partition.
Move the virtual memory page file to a non-system partition. For example, if I set an edisk, right-click my computer, choose Properties> Advanced tab, and select performance.

Item-change, set the initial size and maximum value, and restart the computer. Note: Both of the preceding operations must be restarted before they take effect.

2. Provide normal services to users.

Create a folder for each WEB site on disk D to ensure that the files of each site are stored in the corresponding folder. Create

Website, settings, and host headers, home directories, ports, and IP addresses. Corresponding users are created in Serv-u,

To point to their respective WEB folders, so as to maintain future upload and download needs. In WebEasyMail, set the mail for each domain

Parts users, and capacity. For server software installation problems, please refer to the relevant articles.

3. service configuration

There are many services in Windows, which are provided for different needs. Here we need to configure according to our own Environment

Services, disable services that are not needed. A conventional saying: "minimum service + minimum permission = maximum security ".
Disable unavailable services: Alerter, ClipBook, Computer Browser, Distributed File System, Indexing

Service, Internet Connection Sharing, Messenger, NetMeeting Remote Desktop Sharing, Print

Spooler, Remote Registry Service, Smart Card, Task Scheduler, TCP/IP NetBIOS Helper Service,

Telnet, Windows Time, And Workstation. I will talk about why the Workstation service is disabled below.

3. Port Configuration

Next, let's take a look at how to disable common dangerous ports and useless sharing, such as default sharing.
In local connection-properties, uninstall "Microsoft network file and printer sharing.
Leave the TCP/IP protocol and Microsoft network client among the selected components.

According to debugging in the past few days, if you do not install it, the system will prompt "the service cannot be started and cannot be verified" when you restart IIS ".
Select TCP/IP protocol-properties-advanced-WINS-Disable Netbios on TCP/IP.
Change the HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlGraphicsDriversDCI and Timeout dual-byte values

0. We recommend that you set this value to 0. This key value is useful for playing games and cannot be used as a VM.
Change the value restrictanonymous under HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsa from 0 to 1.

.
Create a double byte under HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceslanmanserverparameters

The AutoShareServer value is 0.
Create a dual-byte SMBDev value under HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNetBTParameters

The iceEnabled value is 0.
Add IP rules in the firewall, which can be 21, 25, 80, or 110. Disable port 135. Finally, start to prohibit all other ports from passing through.
You can also set the ports to be opened and closed by using the Local Security Policy and TCP/IP filtering provided by the system.

4. IIS and permission settings

To make IIS run more stable and secure, we need to modify it, such as deleting unnecessary mappings and log settings.
The following is my IIS settings:
Internet Information Service-computer name-properties-WWW Service (edit)-home directory-configuration-application ing, delete the following application ing

Shot:. htr,. idc,. printer,. cer,. shtm,. stm,. cdx. Only. asp and. asa mappings are retained. For general applications such

Line ASP is enough. Additional useless security ing will cause unnecessary trouble to the system.
On the process tab, set the maximum number of ASP files to 300 in the high-speed cache of script files to improve the execution efficiency of ASP files.

. On the Application debugging tab, select "send text error message to customer" to prevent system, network, and data from being acquired through error messages.

Library Information.
On the "Internet Information Service"-"computer name"-"properties"-"WWW Service"-"services" tab, select the HTTP compressed static file to improve the execution speed.

Row efficiency.
Create a log folder in a non-system partition to save the logs of each site. For example, if the partition I set is E, create an IISlog in the partition.

Directory, which is used to save the log files of each site, instead of the default path of the system. Point the logs of each site to the IISlog folder.
Set Internet Service Manager-Web site-properties-Web site tab-activity log format-properties-log file directory

To point to the IISlog folder. This makes it easier for us to view logs later.
To ensure system security and FSO of each site, create corresponding users for each site user in the local user and group, and set the corresponding password,

Delete the default group of users and add them to the guests group. Properties on each Web site-Directory Security-Anonymous Access and verification control

-Edit-select the user account corresponding to your site in the "anonymous access account" dialog box. In this dialog box, select the attributes of each site folder on disk D-Security

The full tab removes the permissions inherited by the parent, and sets the access permission of this folder to redblood (this user is the Administrator after my name is changed,

I will mention later) Full Control (FC), SYSTEM (FC), modification, reading and running of users corresponding to the Web site, and list folders

Permission for recording, reading, and writing. In this way, when a WEB site is uploaded to an ASP Trojan, it will not harm other sites because it only has

Web site permissions, but no other site permissions.
Set the permissions of each partition to only full control of redblood and system. However, note that if your page file is set

To other partitions, for example, if I put it on an edisk, you must grant this partition the full control permissions of redblood and system.

The read permission of each shard everyone. Otherwise, an error will be reported during restart!
On the Security tab of the C: Program FilesCommon Files Folder Properties dialog box, deselect "allow inherited permissions from the parent ".

Spread to this object ", access permission is set to redblood, system full control, everyone read and run, list folder directories, read

. This directory is used when ASP connects to the database. Then set the WINNT directory to the Common directory in the same way.

Files folder has the same permissions.
We also need to set a special directory that is C: WINNTTemp. The access permission for this directory is everyone to modify, read, run, and column

Folder directory, read, and write.
Set the following file to only have full control of the redblood and cancel the permissions inherited by the parent. These files are: C: winntsytem32

Folder and C: net.exe?net1.exe=netstat=netsh=cacls=cmd.exe, f

Tp.execomputftp.execompuat.execompuformat.comcompuxcopy.exe.
Set the access permission of the f: soft directory to redblood, full control of system, and read by everyone.

Permission to get and run and list folders and directories.
Disable insecure components, such as Scripting. FileSystemObject, WScript. Shell, and Shell. Application.
Scripting. FileSystemObject component:
We can modify the name and value of the corresponding item in the registry:
HKEY_CLASSES_ROOTScripting.FileSystemObject
HKEY_CLASSES_ROOTScripting.FileSystemObjectCLSID project value
WScript. Shell component:
HKEY_CLASSES_ROOTWScript.Shell
HKEY_CLASSES_ROOTWScript.Shell.1
Value of the HKEY_CLASSES_ROOTWScript.ShellCLSID Project
Value of the HKEY_CLASSES_ROOTWScript.Shell.1CLSID Project
Shell. Application Component:
HKEY_CLASSES_ROOTShell.Application
HKEY_CLASSES_ROOTShell.Application.1
Value of the HKEY_CLASSES_ROOTShell.ApplicationCLSID Project
Value of the HKEY_CLASSES_ROOTShell.Application.1CLSID Project
Because we have already set up the corresponding Web site separately in the front, we do not have to modify the Scripting. FileSystemObject (fso) component.
Here, I directly deregister the following two components:
Regsvr32/u C: WINNTSystem32wshom. ocx corresponds to the WScript. Shell component.
Regsvr32/u C: WINNTSystem32shell32. dll corresponds to the Shell. Application component.
Prohibit users in the guests group from calling it:
Cacls C: WINNTsystem32scrrun. dll/e/d guests
Cacls C: WINNTsystem32shell32. dll/e/d guests
Before setting the service, I set the Workstation Service