146
to compromise a server. The value of this configuration change has diminished over the past few
years since the release of attack tools that attempt to break into the server by specifying the security
identifier (SID) of the built-in Administrator account to determine its true name. A SID is the value that
uniquely identifies each user, group, computer account, and logon session on a network. It is not
possible to change the SID of this built-in account. Renaming the local administrator account to a
unique name can make it easy for the domain operations groups to monitor attempted attacks against
this account. Complete the following steps to
secure well known accounts on IIS servers:
1.
Rename the
Administrator
and
Guest
accounts, and change their passwords to a long
and complex value on every domain and server.
2.
Use different names and passwords on each server. If the same account names and
passwords are used on all domains and servers, an attacker who gains access to one
member server will be able to gain access to all others with the same account name and
password.
3.
Change the account descriptions to something other than the defaults to help prevent
easy identification of the accounts.
4.
Record these changes in a secure location.
Note
: The built-in
Administrator
account can be renamed via Group Policy. This setting was not
configured in any of the security templates provided with this guide because administrators should
choose a unique name for their environment. The
Accounts: Rename administrator account
setting can
be configured to rename administrator accounts in the three environments defined in this guide. This
setting is a part of the Security Options settings in Group Policy.
Never configure a service to run under the security context of a domain account unless absolutely
necessary. If a server is physically compromised, domain account passwords can be easily obtained
by dumping Local Security Authority (LSA) secrets.
2.11.6.9
Blocking Ports with IPSec Filters
Internet Protocol Security (IPSec) filters can provide an effective means for enhancing the level of
security required for servers. This guide recommends this optional guidance for the High Security
environment defined in this guide to further reduce the attack surface of the server. For more
information on the use of IPSec filters, see Chapter 11, "Additional Member Server Hardening
Procedures" in Microsoft’s “Windows Solution for Security: Threats and Countermeasures: Security
Settings in Windows Server 2003 and Windows XP”
.
The following table lists all of the IPSec filters
that can be created on IIS servers in the High Security environment defined in this guide.
Important
: For Legacy Client and Enterprise Client environments, HP does not recommend blocking
ports with IPSec filters.
