|
Posted by Miha Pihler [MVP] on December 4, 2006, 3:05 pm
Please log in for more thread options Hi,
Here are some good articles and white papers on security...
http://www.microsoft.com/security/default.mspx
Service overview and network port requirements for the Windows Server system
http://support.microsoft.com/default.aspx?scid=kb;en-us;832017&Product=winsvr2003
Threats and Countermeasures
http://www.microsoft.com/technet/security/guidance/serversecurity/tcg/tcgch00.mspx
Windows Server 2003 Security Guide
http://www.microsoft.com/technet/security/prodtech/windowsserver2003/w2003hg/sgch00.mspx
--
Mike
Microsoft MVP - Windows Security
> Hi Mike,
>
> Thanks for your response. I was just trying to figure out whether
> something I saw in the netstat results was a likely security concern.
>
> When I use only netstat the first two lines shows this:
>
> Proto Local Address Foreign Address State
> TCP myserver:microsoft-ds myserver:1383 Established
> TCP myserver:1383 myserver:microsoft-ds Established
>
>
> When I did netstat -nb | more, as you suggested I got this:
> Proto Local Address Foreign Address State PID TCP 127.0.0.1:445
> 127.0.0.1:1383 ESTABLISHED 4
> [System]
>
> TCP 127.0.0.1:1383 127.0.0.1:445 ESTABLISHED 4
> [System]
>
>
> I am not sure why my localhost is connecting to itself. Could it be
> because I am running a DNS server? (I know my questions must seem very
> silly to those who actually know about this stuff).
>
> Could you recommend any specific resources to learn more about Windows
> 2003 server security?
>
> Thanks,
> J.S.
>
> Miha Pihler [MVP] wrote:
>> Hi,
>>
>> What information are you looking for? Microsoft-DS TCP port is TCP port
>> 445. This port is also commonly referred to as SMB or CIFS.
>>
>> About 1383 port. Since Windows will often dynamically assign ports to
>> different services it is hard to tell what actually runs behind this port
>> (which service). Once way to find out is to run following command...
>>
>> netstat -nb | more
>>
>> It will display something like this...
>>
>> TCP 10.10.190.74:1956 10.10.2.46:3389 ESTABLISHED
>> 2072
>> [mstsc.exe]
>>
>> This means that mstsc program is connecting from IP address 10.10.190.74
>> to 10.10.2.46 on TCP port 3389...
>>
>> After you know which service is running on this port, you can decide if
>> you need it or if it can be shut down and disabled.
>>
| 
XML Sitemap