Web Server Hardening
•
5 j'aime•6,414 vues
Web Server Hardening by Supraja Shankaran @ null Pune Meet, September 2011
Recommandé
Contenu connexe
Tendances
Tendances (20)
En vedette
En vedette (20)
Similaire à Web Server Hardening
Similaire à Web Server Hardening (20)
Plus de n|u - The Open Security Community
Plus de n|u - The Open Security Community (20)
Dernier
Dernier (20)
Web Server Hardening
- 1. Web Server Hardening Supraja Shankar Symbiosis Institute Of Computer Studeies And Research
- 2. Web server ● It’s a client – server architecture ● The function of a web server is to service requests made through HTTP protocol.
- 3. Main threats to a web server • Profiling • Denial of service • Unauthorized access • Arbitrary code execution • Elevation of privileges • Viruses, worms, and Trojan horses Source: http://msdn.microsoft.com/en-us/library/ff648653.aspx
- 4. Apache
- 5. An overview ● Apache runs under multitasking operating system. ● httpd for unix and apache.exe for Win ● Usually runs in background ● Originally named from A PAtCHy in 1991 ● Open source under Apache License
- 6. Structure Source: http://www.voneicken.com/courses/ucsb-cs290i-wi02/papers/Concept_Apache_Arch.htm
- 9. Securing apache ● mod_auth ● For authorizing content ● AuthUserFilefile-path tells the file where username and password saved. ● Passwd can be set by htpasswd command ● mod_access ● Limits access ● Can be whole set of IP’s or narrow down to ports ● Deny/ Allow/ Order
- 10. Hardening Remove default apache files sudorm –fr /opt/apache2/htdocs/* ~>sudorm –fr /opt/apache2/cgi-bin/* ~>sudorm –fr /opt/apache2/icons Hide the apache version number ServerSignature Off ServerTokensProd Chroot
- 11. Hardening From Source ●userdir – Mapping of requests to user-specific directories. i.e username in URL will get translated to a directory in the server ●autoindex – Displays directory listing when no index.html file is present ●status – Displays server stats ●env – Clearing/setting of ENV vars ●setenvif – Placing ENV vars on headers ●cgi – CGI scripts ●actions – Action triggering on requests ●negotiation – Content negotiation ●alias – Mapping of requests to different filesystem parts ●include – Server Side Includes ●filter – Smart filtering of request ●version – Handling version information in config files using IfVersion ●as-is – as-is filetypes
- 12. IIS
- 13. What is IIS? ♦ IIS (Internet Information Server) is a group of Internet servers (including a Web or Hypertext Transfer Protocol server and a File Transfer Protocol server) with additional capabilities for Microsoft's Windows NT and Windows 2000 Server operating systems. ♦ IIS is Microsoft's entry to compete in the Internet server market that is also addressed by Apache, Sun Microsystems, O'Reilly, and others. ♦ With IIS, Microsoft includes a set of programs for building and administering Web sites, a search engine, and support for writing Web-based applications that access databases. ♦ Microsoft points out that IIS is tightly integrated with the Windows NT and 2000 Servers in a number of ways, resulting in faster Web page serving.
- 15. FEATURES ◙ HTTP modules ◙ Security modules ◙ Content modules ◙ Compression modules ◙ Caching modules ◙ Logging and Diagnostics modules
- 16. Vulnerabilities Microsoft has been criticized for IIS's susceptibility to computer virus attacks such as Code Red and Nimda. According to Secunia, as of June 2011, IIS 7 had a total of 6 resolved vulnerabilities while IIS 6 had a total of 11 vulnerabilities out of which 1 was still unpatched. The unpatched security advisory has a severity rating of 2 out of 5.
- 17. Securing IIS
- 19. GENERAL • Do not connect an IIS Server to the Internet until it is fully hardened. • Place the server in a physically secure location. • Do not install the IIS server on a domain controller. • Do not install a printer. • Use two network interfaces in the server — one for admin and one for the network. • Install service packs, patches and hot fixes. • Run IISLockdown run on the server. • Install and configure URLScan. • Secure remote administration of the server and configure for encryption, - low session time-outs - account lockouts. • Disable unnecessary Windows services. • Ensure services are running with least-privileged accounts. Continued….
- 20. GENERAL (contd..) • Disable FTP, SMTP and NNTP services if they are not required. • Disable Telnet service. • Disable ASP.NET state service if not used by your applications. • Disable webDAV if not used by the application, or secure it if it is required. • Do not install Data Access Components unless specifically needed. • Do not install the HTML version of the Internet Services Manager. • Do not install the MS Index Server unless required. • Do not install the MS FrontPage Server extensions unless required. • Harden TCP/IP stack. • Disable NetBIOS and SMB (closing ports 137, 138, 139 and 445). • Reconfigure Recycle Bin and Page file system data policies. • Secure CMOS settings. • Secure physical media (floppy drive, CD-ROM drive and so on).
- 21. ACCOUNTS • Remove unused accounts from the server. • Disable Windows Guest account. • Rename Administrator account and set a strong password. • Disable IUSR_MACHINE account if it is not used by the application. • Create a custom least-privileged anonymous account if applications require anonymous access. • Do not give the anonymous account write access to Web content directories or allow it to execute command-line tools. • If you host multiple Web applications, configure a separate anonymous user account for each one. Continued….
- 22. ACCOUNTS (contd..) Configure ASP.NET process account for least privilege. (This • only applies if you are not using the default ASP.NET account, which is a least-privileged account.) • Enforce strong account and password policies for the server. • Restrict remote logons. (The "Access this computer from the network" user-right is removed from the Everyone group.) • Do not share accounts among administrators. • Disable Null sessions (anonymous logons). • Require approval for account delegation. • Do not allow users and administrators to share accounts. • Do not create more than two accounts in the Administrators group. • Require administrators to log on locally or secure the remote administration solution.
- 23. FILES AND DIRECTORIES • Use multiple disks or partition volumes and do not install the Web server home directory on the same volume as the operating system folders. • Contain files and directories on NTFS volumes. • Put Web site content on a non-system NTFS volume. • Create a new site and disable the default site. • Put log files on a non-system NTFS volume but not on the same volume where the Web site content resides. • Restrict the Everyone group (no access to WINNTsystem32 or Web directories). • Ensure Web site root directory has deny write ACE for anonymous Internet accounts. • Ensure content directories have deny write ACE for anonymous Internet accounts.
- 24. FILES AND DIRECTORIES (Contd..) Remove remote IIS administration application • (WINNTSystem32InetsrvIISAdmin). • Remove resource kit tools, utilities and SDKs. • Remove sample applications (WINNTHelpIISHelp, InetpubIISSamples). • Remove IP address in header for Content-Location. SHARES • Remove all unnecessary shares (including default administration shares). • Restrict access to required shares (the Everyone group does not have access). • Remove Administrative shares (C$ and Admin$) if they are not required (Microsoft Management Server (SMS) and Microsoft Operations Manager (MOM) require these shares).
- 25. PORTS • Restrict Internet-facing interfaces to port 80 (and 443 if SSL is used). • Encrypt Intranet traffic (for example, with SSL), or restrict Internet traffic if you do not have a secure data center infrastructure. REGISTRY • Restrict remote registry access. • Secure SAM (HKLMSystemCurrentControlSetControlLSANoLMHas h). This applies only to standalone servers.
- 26. AUDITING AND LOGGING • Audit failed logon attempts. • Relocate and secure IIS log files. • Configure log files with an appropriate file size depending on the application security requirement. • Regularly archive and analyze log files. • Audit access to the Metabase.bin file. • Configure IIS for W3C Extended log file format auditing. • Read How to use SQL Server to analyze Web logs at support.microsoft.com
- 27. SITES AND VIRTUAL DIRECTORIES • Put Web sites on a non-system partition. • Disable "Parent paths" setting. • Remove potentially dangerous virtual directories including IISSamples, IISAdmin, IISHelp and Scripts. • Remove or secure MSADC virtual directory (RDS). • Do not grant included directories Read Web permission. • Restrict Write and Execute Web permissions for anonymous accounts in virtual directories. • Ensure there is script source access only on folders that support content authoring. • Ensure there is write access only on folders that support content authoring and these folders are configured for authentication (and SSL encryption, if required). • Remove FrontPage Server Extensions (FPSE) if not used. If FPSE are used, update and restrict access to them. • Remove the IIS Internet Printing virtual directory.
- 28. SCRIPT MAPPING • Map extensions not used by the application to 404.dll (.idq, .htw, .ida, .shtml, .shtm, .stm, idc, .htr, .printer). • Map unnecessary ASP.NET file type extensions to "HttpForbiddenHandler" in Machine.config. ISAPI FILTERS • Remove from the server unnecessary or unused ISAPI filters. IIS METABASE • Restrict access to the metabase by using NTFS permissions (%systemroot%system32inetsrvmetabase.bin). • Restrict IIS banner information (Disable IP address in content location).
- 29. SERVER CERTIFICATES • Ensure certificate date ranges are valid. • Only use certificates for their intended purpose (For example, the server certificate is not used for e-mail). • Ensure the certificate's public key is valid, all the way to a trusted root authority. • Confirm that the certificate has not been revoked. Machine.config • Map protected resources to HttpForbiddenHandler. • Remove unused HttpModules. • Disable tracing. <trace enable="false"/> • Turn off debug compiles. <compilation debug="false" explicit="true" defaultLanguage="vb">
- 31. “Security is a not a product, but a process.” - Bruce Scheiner THANK YOU