Opsætning af webserver (win 2000 server) - sikkerhed

hvis du skal bruge den til det mindste seriøse med et lille flow på. Drop access den knækker nakken ret hurtigt ved flere requests samtidig

Det er jeg klar over - ellers tak.

Lige et tip til fjernstyring af en server.

Med WinVNC kan du arbejde direkte på den grafiske brugerflade fra en fjerncomputer...

Læs mere her: http://www.uk.research.att.com/vnc/

En god ting er at installere hotfixes fra MS..

Download og kør Catchup, som finder rettelser til diverse dele af Windows.

catchup.cnet.com

-Hvordan krypterer jeg terminal-services adgang?

Taget fra help:

Determining the level of encryption
For Terminal Services connections, data encryption can protect your data by encrypting it on the communications link between the client and the server. Enable encryption whenever there is a risk of unauthorized transmission interception on the link between server and client. Terminal Services provides multilevel encryption support, before setting the level of encryption for a connection, determine the appropriate level of security for your organization. All levels use the standard RSA RC4 encryption.

There are three levels of encryption available:

Level of encryption Description
Low This level secures all data sent from the client to the server by using either a 56-bit or 40-bit key. A Windows 2000 Terminal server uses a 56-bit key when Windows 2000 clients connect to it, and a 40-bit key when earlier versions of the client connect. This input-only encryption is used to protect sensitive data, such as a user password.
Medium This level secures data sent in both directions (from the client to the server and from the server to the client) by using either a 56-bit or a 40-bit key. A Windows 2000 Terminal server uses a 56-bit key when Windows 2000 clients connect to it, and a 40-bit key when earlier versions of the client connect. Use medium encryption to secure sensitive data as it travels over the network to display on remote clients.
High If you are located in the United States or Canada, you have the option to select the high level. High encryption affects all data sent in both directions, but encrypts using the non-exportable 128-bit key.

Og for at lave om på krypteringen:

To change the level of encryption

Open Terminal Services Configuration.
In the console tree, click Connections.
In the details pane, right-click the connection you want to modify, and then click Properties.
On the General tab, in Encryption level, select the appropriate level for your organization. You can select from these levels of encryption:

The Low level encrypts data sent from the client to the server by using either a 40-bit or 56-bit key. A Windows 2000 Terminal server uses a 56-bit key when Windows 2000 clients connect to it and a 40-bit key when earlier versions of the client connect to it. This input-only encryption is used to protect sensitive data, such as a user password.

The Medium level encrypts data sent from client to server and from server to client by using either a 40-bit or a 56-bit key. A Windows 2000 Terminal server uses a 56-bit key when Windows 2000 clients connect to it and a 40-bit key when earlier versions of the client connect. Use medium encryption to secure sensitive data as it travels over the network for display on remote clients.

If you are located in the United States or Canada, you have the option to select the High level, which encrypts data sent from client to server and from server to client by using strong 128-bit encryption.

If you want the connection to default to the standard Windows authentication when another authentication package has been installed on the server, select the Use standard Windows authentication check box.
Notes

To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.
All levels use the standard RSA RC4 encryption.


-Hvilke rettigheder skal jeg sætte?
Hmmm .. ingen? Du skal bare have et godt password!


-Hvad skal jeg sætte log på?
Lav audit på hvem der logger på din TS - jeg kan dog ikke lige huske hvordan dette laves.. :-)


-Hvilke sikkerhedsindstillinger skal jeg sætte på de enkelte sites i IIS?
Tja, det kan jeg desværre ikke hjælpe så meget med, men hvis du bruger catchup, skulle diverse sikkerhedshuller være rettet!

Er der nogen af dine spørgsmål som er blevet besvaret? Eller er der noget vi skal forklare nærmere eller?

Hvordan laver man f.eks. log over hvem der logger på TS.

+hvilke sikkerhedstjek på IIS -sites.
Jeg har på egen hånd fundet ud af at det er en god ide at fjerne understøttelse af \".htr\" det er til at administrere brugere og adgangskoder via browseren.

========================================================
Hvordan laver man f.eks. log over hvem der logger på TS.
========================================================

Start -> Programs -> Administrative Tools -> Local Security Settings -> Local Polies -> Audit Policy -> Audit Logon Events

Denne sætter du til både \"Success\" og \"Failure\"

=====================================
+hvilke sikkerhedstjek på IIS -sites.
=====================================

http://www.microsoft.com/technet/security/iis5chk.asp

Det med \"Audit\" - det kommer så til at ligge i Event loggen under \"Security\"...

Jeg siger tak for point!

Det var billge point - svaret var ikke så omfattende. Det var vist også meningen kune at giv dig nogle point.

Et godt svar havde været et forslag om at opsætte remote access (PPTP VPN). Og så lukke ned for alt udefra kommende med undtagelse af 80, 443 og GRE protokol.

kholst> Tja ... jeg er også blevet klogere siden min svar.. :)

Du kan da godt få point tilbage..

Ja gi\' mig lidt tilbage :)

http://www.eksperten.dk/spm/143624