Journey to Secure a Windows 2000 Server

[Michael42]

Hello,

I am having a heck of a time staying ahead of hackers on a Win 2k Web server. I have renamed my root, guest and IIS accounts but I can see from my logs that hackers have found the account names.

1. How can I conceal User Account names from hackers?
2. Concerning what I have done below, is there anything other than using LINUX that I have missed?

Other things I have done:
1. Installed latest Service Pack and updates (and stay on top of this).
2. Installed Firewall Software.
3. Install Virus and Spyware detection software.
4. Disabled all unrequired Services and Accounts.
5. Locked down Security Policies on accounts.
6. Removed common 2000 shares ($name etc.).

Thanks for your advice,

Michael42

 

[Marcs41]

If you have done all that PROPERLY, there should not be any hackers getting in.
If they still do, pull out the internet and start fixing it ASAP!

Marc
[sub]If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all. Please specify details.
Free Tip: The F1 Key does NOT destroy your PC![/sub]
How Do I Get Great Answers To my Tek-Tips Questions? See faq222-2244

 

[bofhrevenge2]

You might concider giving Win2k3 a go if possible IIS6 seems to be a more secure product.
But like marcs41 said there really shouldn't be a problem if you have locked it down properly, have you tried the IIS lockdown tool?

http://www.microsoft.com/downloads/...c0-bb30-47eb-9a61-fd755d23cdec&displaylang=en

 

[bofhrevenge2]

Oh and if you have the budget i would recommend a hardware firewall, even a budget one should provide better security than a software firewall.

 

[FaiTHLeSS]

Have you ran IIS Lockdown Tool ? This can block out alot of unwanted stuff getting access in IIS.

http://www.microsoft.com/technet/security/tools/locktool.mspx

 

[De8o]

I agree with bofhrevenge2, get a seperate firewall. An old PC and smoothwall which cost nothing should be enough.

On a second point make sure that what ever option you go for configure your firewall properly. For your web server, know what ports you require and disallow all others. e.g connections in on a basic web server should be port 80 (maybe 81, 8080 and 8081). If you are using https 443. FTP 21. You should also restrict what connections your web server makes out.

Run IIS lockdown and lock down as much as possible. This is fairly easy if you are only using static html pages. If you are using asp pages make sure you select the relevant options.

When renaming user accounts use "invisible" characters, see ASCII charts, use ALT + 3 numbers. Also passwords should be at least 15 characters and use "invisible characters". Remove discriptions from accounts. Create a dummy Administrator account with proper description, remove from all groups, disable and set a very long password. May slow down some hackers.


If you know Linux then definitely use it. Will require hardening as well.

Best of luck.

http://www.energizingcomputing.com

 

[Zelandakh]

Linux is all well and good but is not actually more secure than Windows.

Either one is open to the world unless configured properly.

I agree with the above - hardware firewall and proper locking down of ports should make you safe. It works for millions of other people.

<signature for rent>

 

[kmcferrin]

Are you saying that your server was hacked, then you were patching the holes trying to get them out and they keep getting back in? Typically when something like that happens, you'll want to pull the server out of production, archive any data that you need (web sites, etc) and then wipe the server and rerun from scratch. Once your box has been exploited, you'll never be 100% sure that you don't have some backdoor on the system after it has been cleaned.

 

[Michael42]

Hey All,

Thanks for the suggestions they are very useful.

I think I have to agree that I was hacked and yet another reload is in order.

As many of you I'd like to keep my investment in Windows as I am getting good at knowing where hackers tend to put things etc. (thanks to all of you). I am not at this point yet with LINUX. If I was being hacked with LINUX I may not detect it...scary.

-Michael42