What are some security concerns running WSUS?

[onechuck]

I like to setup a Windows Server Update Service on my windows 2003 backup server. Because this software requires running IIS, should I be using a dedicated server for this? What are some security concerns running WSUS with IIS?

 

[porkchopexpress]

If this server is only available on your LAN and running a well configured IIS6 install there should be no real security risk. IIS6 is really pretty secure these days.

 

[onechuck]

Thank you for your response. Any suggestion on how I should configure IIS6 to just give me the ability to run WSUS?

 

[porkchopexpress]

IIS is pretty secure by default it will only serve static content out of the box so the only alterations are what WSUS needs to run, i'd worry more about setting a good SA password on MSDE as this is required for WSUS.

Take a look here for good pointers you will find most of these suggestions are already done on IIS6 (i'm assuming you are using 2003 server here).

http://windows.stanford.edu/docs/IISsecchecklist.htm

 

[porkchopexpress]

At the end of the day if you are on a firewalled single site and it's not installed on a DC you won't go far wrong. Just follow the checklists.

http://technet2.microsoft.com/WindowsServer/en/Library/ace052a0-a713-423e-8e8c-4bf198f597b81033.mspx

http://technet2.microsoft.com/windowsserver/en/technologies/featured/iis/default.mspx

 

[onechuck]

Thank you so much. I'll check all those links out. By the way, if I configured the IIS to only allow IP addresses of my computers in, will this be enough?

 

[porkchopexpress]

You could do that but it might be considered overkill if your LAN is already firewalled and IIS6 is locked down and not available on the internet.

 

[onechuck]

Thanks!