HACK PROOFING WINDOWS 2000 SERVERS
CONTENTS CHAPTER 1 THE WINDOWS SERVER SECURITY MIGRATION PATH INTRODUCTION WINDOWS 2000 SERVER SECURITY WHY THE CHANGE? DIFFERENCES IN WINDOWS 2000 SERVER SECURITY AUTHENTICATION LIMITATIONS WHAT IS THE SAME IN WINDOWS 2000 SERVER? UPGRADING AND MIGRATING CONSIDERATIONS NETWORK SECURITY PLAN HOW TO BEGIN THE PROCESS GETTING STARTED EXERCISE 11 SWITCHING TO NATIVE MODE ISSUES TO PRESENT TO YOUR MANAGER PROPER ANALYSIS TIMING COST RESOURCES SUMMARY SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 2 DEFAULT ACCESS CONTROL SETTINGS THE ADMINISTRATORS GROUP THE USERS GROUP THE POWER USERS GROUP CONFIGURING SECURITY DURING WINDOWS 2000 SETUP DEFAULT FILE SYSTEM AND REGISTRY PERMISSIONS DEFAULT USER RIGHTS EXERCISE 21 CHECKING USER RIGHTS THROUGH THE MICROSOFT MANAGEMENT CONSOLE DEFAULT GROUP MEMBERSHIP PRE-WINDOWS 2000 SECURITY CHAPTER 3 KERBEROS SERVER AUTHENTICATION AUTHENTICATION IN WINDOWS BENEFITS OF KERBEROS AUTHENTICATION STANDARDS FOR KERBEROS AUTHENTICATION EXTENSIONS TO THE KERBEROS PROTOCOL OVERVIEW OF THE KERBEROS PROTOCOL BASIC CONCEPTS AUTHENTICATORS KEY DISTRIBUTION CENTER SESSION TICKETS TICKET-GRANTING TICKETS SERVICES PROVIDED BY THE KEY DISTRIBUTION CENTER SUBPROTOCOLS AS EXCHANGE TGS EXCHANGE CS EXCHANGE OPTION FLAGS FOR KRB_AS_REQ AND KRB_TGS_REQ MESSAGES TICKETS PROXY TICKETS AND FORWARDED TICKETS KERBEROS AND WINDOWS KERBEROS POLICY CONTENTS OF A MICROSOFT KERBEROS TICKET DELEGATION OF AUTHENTICATION PREAUTHENTICATION SECURITY SUPPORT PROVIDERS CREDENTIALS CACHE DNS NAME RESOLUTION UDP AND TCP PORTS AUTHORIZATION DATA KDC AND AUTHORIZATION DATA SERVICES AND AUTHORIZATION DATA KERBEROS TOOLS KERBEROS LIST KERBEROS TRAY CHAPTER 4 SECURE NETWORKING USING WINDOWS 2000 DISTRIBUTED SECURITY SERVICES THE WAY WE WERE: SECURITY IN NT A WHOLE NEW WORLD: DISTRIBUTED SECURITY IN WINDOWS DISTRIBUTED SERVICES OPEN STANDARDS WINDOWS 2000 DISTRIBUTED SECURITY SERVICES ACTIVE DIRECTORY AND SECURITY ADVANTAGES OF ACTIVE DIRECTORY ACCOUNT MANAGEMENT MANAGING SECURITY VIA OBJECT PROPERTIES MANAGING SECURITY VIA GROUP MEMBERSHIPS ACTIVE DIRECTORY OBJECT PERMISSIONS EXERCISE 41 ASSIGNING ACTIVE DIRECTORY PERMISSIONS TO A DIRECTORY OBJECT RELATIONSHIP BETWEEN DIRECTORY AND SECURITY SERVICES ACTIVE DIRECTORY COMPONENTS EXERCISE 42 CREATING TRUSTS WITH ACTIVE DIRECTORY DOMAINS AND TRUSTS DELEGATION OF ADMINISTRATION FINE-GRAIN ACCESS RIGHTS INHERITANCE OF ACCESS RIGHTS SECURITY PROTOCOLS NTLM CREDENTIALS KERBEROS CREDENTIALS GETTING A TICKET TO RIDE PRIVATE AND PUBLIC KEY PAIRS AND CERTIFICATES OTHER SUPPORTED PROTOCOLS INTERNET SINGLE SIGN-ON INTERNET SECURITY FOR WINDOWS AUTHENTICATION OF EXTERNAL USERS MICROSOFT CERTIFICATE SERVER CRYPTOAPI INTERBUSINESS ACCESS: DISTRIBUTED PARTNERSHIP CHAPTER 5 SECURITY CONFIGURATION TOOL SET SECURITY CONFIGURATION TOOL SET SECURITY CONFIGURATION TOOL SET COMPONENTS SECURITY CONFIGURATION AND ANALYSIS SNAP-IN SECURITY SETTING EXTENSIONS TO GROUP POLICY SECURITY TEMPLATES THE SECEDITEXE COMMAND-LINE TOOL SECURITY CONFIGURATIONS SECURITY CONFIGURATION AND ANALYSIS DATABASE SECURITY CONFIGURATION AND ANALYSIS AREAS ACCOUNT POLICIES LOCAL POLICIES EVENT LOG RESTRICTED GROUPS SYSTEM SERVICES REGISTRY FILE SYSTEM SECURITY CONFIGURATION TOOL SET USER INTERFACES THE SECEDITEXE COMMAND-LINE INTERFACE CONFIGURING SECURITY EXERCISE 51 CONFIGURING RESTRICTED GROUPS REGISTRY SECURITY EXERCISE 52 CONFIGURING REGISTRY SECURITY FILE SYSTEM SECURITY EXERCISE 53 CONFIGURING FILE SYSTEM SECURITY SYSTEM SERVICES SECURITY EXERCISE 54 CONFIGURING SYSTEM SERVICES SECURITY ANALYZING SECURITY EXERCISE 55 ANALYZING THE LOCAL MACHINE ACCOUNT AND LOCAL POLICIES RESTRICTED GROUP MANAGEMENT GROUP POLICY INTEGRATION SECURITY CONFIGURATION IN GROUP POLICY OBJECTS THE SECURITY SETTINGS EXTENSION TO THE GROUP POLICY EDITOR ADDITIONAL SECURITY POLICIES CHAPTER 6 ENCRYPTING THE FILE SYSTEM FOR WINDOWS USING THE ENCRYPTING FILE SYSTEM ENCRYPTION FUNDAMENTALS HOW EFS WORKS USER OPERATIONS FILE ENCRYPTION ASSESSING AN ENCRYPTED FILE COPYING AN ENCRYPTED FILE THE COPY COMMAND MOVING OR RENAMING AN ENCRYPTED FILE DECRYPTING A FILE CIPHER UTILITY DIRECTORY ENCRYPTION RECOVERY OPERATIONS EXERCISE 61 CONFIGURING A RECOVERY AGENT WITHOUT AN EFS CERTIFICATE EXERCISE 62 ADDING A RECOVERY AGENT THAT HAS AN EFS RECOVERY CERTIFICATE EFS ARCHITECTURE EFS COMPONENTS THE ENCRYPTION PROCESS THE EFS FILE INFORMATION THE DECRYPTION PROCESS CHAPTER 7 IP SECURITY FOR MICROSOFT WINDOWS 2000 SERVER NETWORK ENCROACHMENT METHODOLOGIES SNOOPING SPOOFING THE TCP/IP SEQUENCE NUMBER ATTACK PASSWORD COMPROMISE DENIAL-OF-SERVICE ATTACKS TCP SYN ATTACKS SMURF ATTACKS TEARDROP ATTACKS PING OF DEATH MAN-IN-THE-MIDDLE ATTACKS APPLICATION-DIRECTED ATTACKS COMPROMISED KEY ATTACKS IPSEC ARCHITECTURE OVERVIEW OF IPSEC CRYPTOGRAPHIC SERVICES MESSAGE INTEGRITY MESSAGE AUTHENTICATION CONFIDENTIALITY IPSEC SECURITY SERVICES THE AUTHENTICATION HEADER ENCAPSULATING SECURITY PAYLOAD SECURITY ASSOCIATIONS AND IPSEC KEY MANAGEMENT PROCEDURES IPSEC KEY MANAGEMENT DEPLOYING WINDOWS IP SECURITY EVALUATING INFORMATION EVALUATING THE “ENEMY” DETERMINING REQUIRED SECURITY LEVELS BUILDING SECURITY POLICIES WITH CUSTOMIZED IPSEC CONSOLES EXERCISE 71 BUILDING AN IPSEC MMC CONSOLE FLEXIBLE SECURITY POLICIES RULES FLEXIBLE NEGOTIATION POLICIES FILTERS CREATING A SECURITY POLICY MAKING THE RULE COMPATIBILITY NOTES CHAPTER 8 SMART CARDS INTEROPERABILITY ISO 7816, EMV, AND GSM THE PC/SC WORKGROUP THE MICROSOFT APPROACH A STANDARD MODEL FOR INTERFACING SMART CARD READERS AND CARDS WITH PCS DEVICE-INDEPENDENT APIS FOR ENABLING SMART CARD-AWARE APPLICATIONS INTEGRATION WITH VARIOUS MICROSOFT PLATFORMS SMART CARD BASE COMPONENTS SERVICE PROVIDERS CRYPTOGRAPHIC SERVICE PROVIDERS SMART CARD SERVICE PROVIDERS CARDS RESOURCE MANAGER ENHANCED SOLUTIONS CLIENT AUTHENTICATION PUBLIC KEY INTERACTIVE LOGON SMART CARD READER INSTALLATION SMART CARD CERTIFICATE ENROLLMENT SMART CARD LOGON SECURE E-MAIL CHAPTER 9 MICROSOFT WINDOWS PUBLIC KEY INFRASTRUCTURE CONCEPTS PUBLIC KEY CRYPTOGRAPHY PUBLIC KEY FUNCTIONALITY DIGITAL SIGNATURES AUTHENTICATION SECRET KEY AGREEMENT VIA PUBLIC KEY BULK DATA ENCRYPTION WITHOUT PRIOR SHARED SECRETS PROTECTING AND TRUSTING CRYPTOGRAPHIC KEYS CERTIFICATES CERTIFICATE AUTHORITIES CERTIFICATE TYPES TRUST AND VALIDATION WINDOWS 2000 PKI COMPONENTS CERTIFICATE HIERARCHIES DEPLOYING AN ENTERPRISE CA TRUST IN MULTIPLE CA HIERARCHIES INSTALLING A WINDOWS 2000 PKI EXERCISE 91 INSTALLING CERTIFICATE SERVICES ENABLING DOMAIN CLIENTS GENERATING KEYS KEY RECOVERY EXERCISE 92 EXPORTING A CERTIFICATE AND A PRIVATE KEY CERTIFICATE ENROLLMENT EXERCISE 93 REQUESTING A USER CERTIFICATE WITH THE CERTIFICATE REQUEST WIZARD EXERCISE 94 REQUESTING AN EFS RECOVERY AGENT CERTIFICATE FROM THE CA WEB PAGE RENEWAL USING KEYS AND CERTIFICATES ROAMING REVOCATION EXERCISE 95 REVOKING A CERTIFICATE AND PUBLISHING A CRL TRUST EXERCISE 96 IMPORTING A CERTIFICATE FROM A TRUSTED ROOT CA PUBLIC KEY SECURITY POLICY IN WINDOWS TRUSTED CA ROOTS EXERCISE 97 CONFIGURING AUTOMATIC CERTIFICATE ENROLLMENT THROUGH GROUP POLICY CERTIFICATE ENROLLMENT AND RENEWAL EXERCISE 98 CHANGING THE TEMPLATES AVAILABLE ON THE ENTERPRISE CERTIFICATION AUTHORITY APPLICATIONS OVERVIEW WEB SECURITY DIGITALLY SIGNED CONTENT ENCRYPTING FILE SYSTEM SMART-CARD LOGON IP SECURITY PREPARING FOR WINDOWS 2000 PKI BACKING UP AND RESTORING CERTIFICATE SERVICES EXERCISE 99 BACKING UP CERTIFICATE SERVICES EXERCISE 910 RESTORING CERTIFICATE SERVICES CHAPTER 10 SUPPORTING NON-WINDOWS 2000 CLIENTS AND SERVERS AUTHENTICATING DOWN-LEVEL CLIENTS DEFINING LAN MANAGER AND NT LAN MANAGER AUTHENTICATION USING THE DIRECTORY SERVICES CLIENT DEPLOYING NTLM VERSION WORKING WITH UNIX CLIENTS INSTALLING SERVICES FOR UNIX EXERCISE 103 ADDING A USER TO THE SCHEMA ADMIN GROUP EXERCISE 104 ENABLING THE SCHEMA MASTER FOR WRITE OPERATION EXERCISE 105 INSTALLING SERVICES FOR UNIX NFS SOFTWARE USING THE CLIENT SOFTWARE FOR NFS USING THE SERVER SOFTWARE FOR NFS USING THE GATEWAY SOFTWARE FOR NFS USING THE PCNFS SERVER SOFTWARE FOR NFS ACCOUNT ADMINISTRATION TOOLS NETWORK ADMINISTRATION TOOLS USING THE UNIX UTILITIES AUTHENTICATING UNIX CLIENTS WORKING WITH NOVELL CLIENTS CLIENT SERVICES FOR NETWARE GATEWAY SERVICES FOR NETWARE EXERCISE 106 INSTALLING GATEWAY SERVICES FOR NETWARE EXERCISE 107 CONFIGURING GATEWAY SERVICES FOR NETWARE UNDERSTANDING SERVICES FOR NETWARE EXERCISE 108 INSTALLING SERVICES FOR NETWARE USING MICROSOFT DIRECTORY SYNCHRONIZATION SERVICES USING THE MICROSOFT FILE MIGRATION UTILITY USING FILE AND PRINT SERVICES FOR NETWARE UNDERSTANDING THE SECURITY RISK ASSOCIATED WITH ACCESSING NETWARE COMPUTERS WORKING WITH MACINTOSH CLIENTS UNDERSTANDING FILES SERVICES FOR MACINTOSH UNDERSTANDING PRINT SERVICES FOR MACINTOSH INSTALLING FILE AND PRINT SERVICES FOR MACINTOSH AUTHENTICATING MACINTOSH CLIENTS SECURING THE WINDOWS 2000 SERVER EXERCISE 112 CREATING AN ANSWER FILE FOR INSTALLING IIS SETTING WEB SITE, FTP SITE, AND FOLDER PERMISSIONS CONFIGURING WEB SITE PERMISSIONS CONFIGURE FTP SITE PERMISSIONS EXERCISE 113 SETTING FTP SITE PERMISSIONS CONFIGURING NTFS PERMISSIONS USING THE PERMISSIONS WIZARD USING THE PERMISSION WIZARD TEMPLATE MAKER RESTRICTING ACCESS THROUGH IP ADDRESS AND DOMAIN NAME BLOCKING CONFIGURING AUTHENTICATION CONFIGURING WEB SITE AUTHENTICATION EXERCISE 114 SELECTING THE LEVEL OF AUTHENTICATION SUPPORTED CONFIGURING FTP SITE AUTHENTICATION EXERCISE 115 SETTING FTP AUTHENTICATION EXAMINING THE IIS SECURITY TOOLS USING THE IIS SECURITY PLANNING TOOL THE INTERVIEWING PROCESS CONFIGURING THE TEMPLATE FILES DEPLOYING THE TEMPLATE FILES AUDITING IIS EXERCISE 116 CONFIGURING AUDITING FOR AN ORGANIZATIONAL UNIT CHAPTER 12 USING SECURITY-RELATED TOOLS INSTALLING THE SUPPORT TOOLS EXERCISE 121 INSTALLING THE SUPPORT TOOLS INSTALLING THE WINDOWS 2000 SERVER RESOURCE KIT EXERCISE 122 INSTALLING THE WINDOWS 2000 SERVER RESOURCE KIT USING APPLICATION TOOLS USING THE APPLICATION SECURITY TOOL INSTALLING THE APPLICATION SECURITY TOOL RUNNING THE APPLICATIONS AS SERVICES UTILITY INSTALLING SRVANY EXERCISE 123 USING SRVANY EXERCISE 124 USING THE SERVICE INSTALLATION WIZARD CONFIGURING AN APPLICATION TO RUN AS A SERVICE EXERCISE 125 CONFIGURING THE REGISTRY TO RUN APPLICATIONS AS SERVICES USING SERVICE TOOLS RUNNING THE SERVICE CONTROLLER TOOL USING SCLIST USING THE SERVICE MONITORING TOOL EXERCISE 126 RUNNING THE SERVICE MONITOR CONFIGURATION WIZARD USING REGISTRY TOOLS USING REGISTRY BACKUP USING REGISTRY RESTORATION RUNNING THE REGISTRY CONSOLE TOOL USING PROCESS TOOLS RUNNING THE PROCESS VIEWER RUNNING THE TASK LIST VIEWER USING THE TASK KILLING UTILITY USING PROCESS TREE EXERCISE 127 INSTALLING PROCESS TREE USING PULIST USING LOGGING TOOLS USING THE EVENT LOG QUERY TOOL USING TRACE LOGGING USING TRACE DUMP USING REDUCE TRACE DATA USING PERMISSION TOOLS USING THE SERVICE ACL EDITOR USING PERMCOPY RUNNING ACCESS CONTROL LIST DIAGNOSTICS RUNNING DSACLS USING GROUP MANAGEMENT TOOLS SHOW GROUPS USING SHOW MEMBERS USING FIND GROUP USING MISCELLANEOUS TOOLS USING SHOW PRIVILEGE RUNNING UPTIME HEARTBEAT USING FLOPPY LOCK RUNNING SYSTEM SCANNER EXERCISE 129 RUNNING A SCAN WITH SYSTEM SCANNER