Web Server Security

Some tips and guidelines from various sources re hardening a web server install.

Security Vulnerabilities

The recently published SANS resources list includes the following general critical internet security vulnerabilities. The SANS site includes details for addressing these vulnerabilites..

1. Default installs of operating systems and applications
2. Accounts with No Passwords or Weak Passwords
3. Non-existent or Incomplete Backups
4. Large number of open ports
5. Not filtering packets for correct incoming and outgoing addresses
6. Non-existent or incomplete logging
7. Vulnerable CGI Programs

Windows (IIS) specific..

1. Unicode Vulnerability (Web Server Folder Traversal)
2. ISAPI Extension Buffer Overflows
3. IIS RDS exploit (Microsoft Remote Data Services)
4. NETBIOS - unprotected Windows networking shares
5. Information leakage via null session connections
6. Weak hashing in SAM (LM hash)

Unix specific vulnerabilities...

1. Buffer Overflows in RPC Services
2. Sendmail Vulnerabilities
3. Bind Weaknesses
4. R Commands
5. LPD (remote print protocol daemon)
6. sadmind and mountd
7. Default SNMP Strings

Other Reccomendations

• Dont allow web service to run as root. Startup using anonymous account which has limited privilege
• Remove 'test-cgi' from /cgi-bin folder/s or at least remove execute privilege for anonymous user.

References/Resources:

• Security Focus (Bugtraq)
• Internet Security Systems - X-Force
• The Twenty Most Critical Internet Security Vulnerabilities
• Slashdot Article on the Above
• Security in (NZ) Government Departments
• RainForestPuppy
• Microsoft Attempts to Secure IIS (SlashDot)

---

See Also: Front Page

---

 Top Of Page     Home     Wiki Home     Contact     Author