Click here to get back home

Best practice to secure server?????
 Home | NewsGroups | Search | About
Login Password
Register Now!
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Best practice to secure server????? Franky 11-28-2006
Posted by Franky on November 28, 2006, 4:35 am
Please log in for more thread options
 Hi All

A server I have been asked to look at (& I'm no expert) but I have checked
the security logs & this server is getting hit upon about 100 times a
minute. I believe these are failed access attempts to login to the server
so the server appears to be secure(ish).

However on doing a nmap of the ip it showed that the following ports were
open, obviously I would like this server to be as secure as possible so
would the obvious answer be to put a hardware firewall or could someone
recommend the best course of action, any help or information would be
greatly appreciated

The sever is running SBS2003, no websites running from it, it is just used
as a storage device, to send emails etc.

|___ 21 File Transfer Protocol [Control]
|___ 25 Simple Mail Transfer
|___ 42 WINS Host Name Server
|___ 80 World Wide Web HTTP
|___ 88 Kerberos
|___ 110 Post Office Protocol - Version 3
|___ 135 DCE endpoint resolution
|___ 139 NETBIOS Session Service
|___ 389 Lightweight Directory Access Protocol
|___ 443 https MCom
|___ 444 Simple Network Paging Protocol
|___ 445 Microsoft-DS
|___ 464 kpasswd
|___ 636 ssl-ldap
|___ 995 SSL based POP3
|___ 1027 ICQ?
|___ 1155 Network File Access
|___ 1723 pptp
|___ 2002 ?


Thanks in advance

Franky



Posted by Roger Abell [MVP] on November 28, 2006, 9:09 am
Please log in for more thread options
 SBS is a special breed of Windows server.

You would by far get the best advise by asking in
microsoft.public.windows.server.sbs
to which this is x-posted for you.

You say no webserver (but it is there) etc., and if
there is no external access other than email needed
then your use of a hardware firewall is workable.

Roger

> Hi All
>
> A server I have been asked to look at (& I'm no expert) but I have checked
> the security logs & this server is getting hit upon about 100 times a
> minute. I believe these are failed access attempts to login to the server
> so the server appears to be secure(ish).
>
> However on doing a nmap of the ip it showed that the following ports were
> open, obviously I would like this server to be as secure as possible so
> would the obvious answer be to put a hardware firewall or could someone
> recommend the best course of action, any help or information would be
> greatly appreciated
>
> The sever is running SBS2003, no websites running from it, it is just used
> as a storage device, to send emails etc.
>
> |___ 21 File Transfer Protocol [Control]
> |___ 25 Simple Mail Transfer
> |___ 42 WINS Host Name Server
> |___ 80 World Wide Web HTTP
> |___ 88 Kerberos
> |___ 110 Post Office Protocol - Version 3
> |___ 135 DCE endpoint resolution
> |___ 139 NETBIOS Session Service
> |___ 389 Lightweight Directory Access Protocol
> |___ 443 https MCom
> |___ 444 Simple Network Paging Protocol
> |___ 445 Microsoft-DS
> |___ 464 kpasswd
> |___ 636 ssl-ldap
> |___ 995 SSL based POP3
> |___ 1027 ICQ?
> |___ 1155 Network File Access
> |___ 1723 pptp
> |___ 2002 ?
>
>
> Thanks in advance
>
> Franky
>



Posted by Maxibo on November 28, 2006, 9:42 am
Please log in for more thread options
Hi Franky

Welcome to SBS land (thanks Roger, we will help best we can)

Franky, How long server been running?
Does it have two network cards in ?
How is it connected to the internet, server connected to ? and what
connected to internet.

Is this Premium or Standard (Premium has ISA)

First concern I have is Port 139, indicates file and printernsharing network
card connected directly to internet.

Recommended SBS configuration with two network cards...
http://www.smallbizserver.net/Articles/tabid/266/articleType/ArticleView/articleId/74/Default.aspx


> SBS is a special breed of Windows server.
>
> You would by far get the best advise by asking in
> microsoft.public.windows.server.sbs
> to which this is x-posted for you.
>
> You say no webserver (but it is there) etc., and if
> there is no external access other than email needed
> then your use of a hardware firewall is workable.
>
> Roger
>
>> Hi All
>>
>> A server I have been asked to look at (& I'm no expert) but I have
>> checked the security logs & this server is getting hit upon about 100
>> times a minute. I believe these are failed access attempts to login to
>> the server so the server appears to be secure(ish).
>>
>> However on doing a nmap of the ip it showed that the following ports were
>> open, obviously I would like this server to be as secure as possible so
>> would the obvious answer be to put a hardware firewall or could someone
>> recommend the best course of action, any help or information would be
>> greatly appreciated
>>
>> The sever is running SBS2003, no websites running from it, it is just
>> used as a storage device, to send emails etc.
>>
>> |___ 21 File Transfer Protocol [Control]
>> |___ 25 Simple Mail Transfer
>> |___ 42 WINS Host Name Server
>> |___ 80 World Wide Web HTTP
>> |___ 88 Kerberos
>> |___ 110 Post Office Protocol - Version 3
>> |___ 135 DCE endpoint resolution
>> |___ 139 NETBIOS Session Service
>> |___ 389 Lightweight Directory Access Protocol
>> |___ 443 https MCom
>> |___ 444 Simple Network Paging Protocol
>> |___ 445 Microsoft-DS
>> |___ 464 kpasswd
>> |___ 636 ssl-ldap
>> |___ 995 SSL based POP3
>> |___ 1027 ICQ?
>> |___ 1155 Network File Access
>> |___ 1723 pptp
>> |___ 2002 ?
>>
>>
>> Thanks in advance
>>
>> Franky
>>
>
>



Posted by Russ - SBITS.Biz \(MCP SBS\) on November 28, 2006, 4:42 pm
Please log in for more thread options
The max ports you need on a SBS open are

25 mail
4125 -RWW
443 SSL

Do not open 80 or 21

Additional Ports
1723 - VPN PPTP
3389 - RDC to server (But Please of course always have "SECURE Pass Phrases"

Russ

--
Russell Grover
SBITS.Biz
Microsoft Certified Small Business Specialist.
MCP, MCPS, MCNPS, (MCP-SBS)
Remote SBS2003 Support
http://www.SBITS.Biz



> Hi Franky
>
> Welcome to SBS land (thanks Roger, we will help best we can)
>
> Franky, How long server been running?
> Does it have two network cards in ?
> How is it connected to the internet, server connected to ? and what
> connected to internet.
>
> Is this Premium or Standard (Premium has ISA)
>
> First concern I have is Port 139, indicates file and printernsharing
> network card connected directly to internet.
>
> Recommended SBS configuration with two network cards...
>
http://www.smallbizserver.net/Articles/tabid/266/articleType/ArticleView/articleId/74/Default.aspx
>
>
>> SBS is a special breed of Windows server.
>>
>> You would by far get the best advise by asking in
>> microsoft.public.windows.server.sbs
>> to which this is x-posted for you.
>>
>> You say no webserver (but it is there) etc., and if
>> there is no external access other than email needed
>> then your use of a hardware firewall is workable.
>>
>> Roger
>>
>>> Hi All
>>>
>>> A server I have been asked to look at (& I'm no expert) but I have
>>> checked the security logs & this server is getting hit upon about 100
>>> times a minute. I believe these are failed access attempts to login to
>>> the server so the server appears to be secure(ish).
>>>
>>> However on doing a nmap of the ip it showed that the following ports
>>> were open, obviously I would like this server to be as secure as
>>> possible so would the obvious answer be to put a hardware firewall or
>>> could someone recommend the best course of action, any help or
>>> information would be greatly appreciated
>>>
>>> The sever is running SBS2003, no websites running from it, it is just
>>> used as a storage device, to send emails etc.
>>>
>>> |___ 21 File Transfer Protocol [Control]
>>> |___ 25 Simple Mail Transfer
>>> |___ 42 WINS Host Name Server
>>> |___ 80 World Wide Web HTTP
>>> |___ 88 Kerberos
>>> |___ 110 Post Office Protocol - Version 3
>>> |___ 135 DCE endpoint resolution
>>> |___ 139 NETBIOS Session Service
>>> |___ 389 Lightweight Directory Access Protocol
>>> |___ 443 https MCom
>>> |___ 444 Simple Network Paging Protocol
>>> |___ 445 Microsoft-DS
>>> |___ 464 kpasswd
>>> |___ 636 ssl-ldap
>>> |___ 995 SSL based POP3
>>> |___ 1027 ICQ?
>>> |___ 1155 Network File Access
>>> |___ 1723 pptp
>>> |___ 2002 ?
>>>
>>>
>>> Thanks in advance
>>>
>>> Franky
>>>
>>
>>
>
>



Posted by Gary J. Dikkema on December 5, 2006, 5:57 pm
Please log in for more thread options
... er AND 444




> The max ports you need on a SBS open are
>
> 25 mail
> 4125 -RWW
> 443 SSL
>
> Do not open 80 or 21
>
> Additional Ports
> 1723 - VPN PPTP
> 3389 - RDC to server (But Please of course always have "SECURE Pass
> Phrases"
>
> Russ
>
> --
> Russell Grover
> SBITS.Biz
> Microsoft Certified Small Business Specialist.
> MCP, MCPS, MCNPS, (MCP-SBS)
> Remote SBS2003 Support
> http://www.SBITS.Biz
>
>
>
>> Hi Franky
>>
>> Welcome to SBS land (thanks Roger, we will help best we can)
>>
>> Franky, How long server been running?
>> Does it have two network cards in ?
>> How is it connected to the internet, server connected to ? and what
>> connected to internet.
>>
>> Is this Premium or Standard (Premium has ISA)
>>
>> First concern I have is Port 139, indicates file and printernsharing
>> network card connected directly to internet.
>>
>> Recommended SBS configuration with two network cards...
>>
http://www.smallbizserver.net/Articles/tabid/266/articleType/ArticleView/articleId/74/Default.aspx
>>
>>
>>> SBS is a special breed of Windows server.
>>>
>>> You would by far get the best advise by asking in
>>> microsoft.public.windows.server.sbs
>>> to which this is x-posted for you.
>>>
>>> You say no webserver (but it is there) etc., and if
>>> there is no external access other than email needed
>>> then your use of a hardware firewall is workable.
>>>
>>> Roger
>>>
>>>> Hi All
>>>>
>>>> A server I have been asked to look at (& I'm no expert) but I have
>>>> checked the security logs & this server is getting hit upon about 100
>>>> times a minute. I believe these are failed access attempts to login to
>>>> the server so the server appears to be secure(ish).
>>>>
>>>> However on doing a nmap of the ip it showed that the following ports
>>>> were open, obviously I would like this server to be as secure as
>>>> possible so would the obvious answer be to put a hardware firewall or
>>>> could someone recommend the best course of action, any help or
>>>> information would be greatly appreciated
>>>>
>>>> The sever is running SBS2003, no websites running from it, it is just
>>>> used as a storage device, to send emails etc.
>>>>
>>>> |___ 21 File Transfer Protocol [Control]
>>>> |___ 25 Simple Mail Transfer
>>>> |___ 42 WINS Host Name Server
>>>> |___ 80 World Wide Web HTTP
>>>> |___ 88 Kerberos
>>>> |___ 110 Post Office Protocol - Version 3
>>>> |___ 135 DCE endpoint resolution
>>>> |___ 139 NETBIOS Session Service
>>>> |___ 389 Lightweight Directory Access Protocol
>>>> |___ 443 https MCom
>>>> |___ 444 Simple Network Paging Protocol
>>>> |___ 445 Microsoft-DS
>>>> |___ 464 kpasswd
>>>> |___ 636 ssl-ldap
>>>> |___ 995 SSL based POP3
>>>> |___ 1027 ICQ?
>>>> |___ 1155 Network File Access
>>>> |___ 1723 pptp
>>>> |___ 2002 ?
>>>>
>>>>
>>>> Thanks in advance
>>>>
>>>> Franky
>>>>
>>>
>>>
>>
>>
>
>



Similar ThreadsPosted
Secure SFU Server for NIS November 22, 2006, 4:58 am
Security Log Best Practice March 15, 2007, 8:51 am
Best Practice for Group Names August 10, 2006, 8:35 am
Sensitive Folder Security - Best Practice November 24, 2006, 9:50 am
Local and Domain Administrator password best practice May 31, 2006, 7:05 pm
CISA Certification Practice Exam CD for sale September 8, 2007, 6:50 pm
Secure FTP June 15, 2005, 2:16 pm
is ssl secure enough ? June 15, 2005, 11:33 pm
Best way to secure August 20, 2007, 7:44 pm
Secure VPN access...? June 21, 2005, 5:13 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap