Re: Security of IIS - Secure Intranet web site on SBS2003 box

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Yes I should have included keeping up to date with patches in the list.
Thanks for pointing that out.

I guess a lot of those patches would be required anyway to ensure the HTTPS
stays secure.
And my test bed SBS2003 seems to run automatic updates without too much
bother.

Does your reference to CodeRed include the latest IIS ( 6 ? ) as supplied
with SBS2003 ?
Because if IIS via HTTPS only is still not considered secure then surely the
same restriction must be applied to running Outlook via RPC over HTTPS.
That is the point of my thesis. I would rather stick to plain old internet
mail rather than upgrade into a mode where all the "credit card details" can
be stolen or worse modified/deleted messed with.

See what others think.
Roger



"SuperGumby [SBS MVP]" <not@xxxxxxxxxxx> wrote in message
news:uUGB9VWgFHA.2916@xxxxxxxxxxxxxxxxxxxxxxx
> we've run OWA over HTTPS for a good many years, and not been bitten, but
> does that mean we won't?
>
> Though arguments over the impact of webserver traffic on your office
> connection are valid it's not the main justification for outhousing. COST
> IS.
>
> How much does it COST you to ensure that not only 'patch Tuesday' patches
> are applied to your server but also those ones which come out at random?
> When you patch, you have a choice, either wait for everybody to go home
and
> do it outside hours or ask everyone to shutdown during business hours. Is
> the cost of either alternative on par with outsourcing?
>
> A _reasonable_ guestimate suggests a client of mine could pay for
webhosting
> for 100 years @ $15/yr rather than pay me a similar amount to take two
days
> to rebuild their server and return everything to normal. If their server
was
> compromised I WILL NOT promise to return all facilities in two days.
>
> Before 'Code Red' IIS was considered reasonably secure. The only way to
> recover fully from a Code Red violation was to flatten _every_ PC on the
> network, the possibility existed for not only the Code Red infestation but
> just about any trojan to walk through your network (once one was coded).
The
> consensus of opinion in security circles was 'format C:, no, actually, a
> format may not be good enough, take the HDD's out of every system and
throw
> them in the bin, the _possibility_ exists that not one can be trusted and
> the effort involved in moving items from 'untrusted' to 'sortta trusted'
> outweighs the benefits'.
>
> Code Red was avoidable by a patch released several months before the
exploit
> 'went wild', I gave up paying attention to systems trying to get into mine
> about three years later.
>
> "SBS2003 Upgrader" <rogerdav@xxxxxxxxxxxxxxxxxx> wrote in message
> news:%23vlXKuUgFHA.1416@xxxxxxxxxxxxxxxxxxxxxxx
> >
> >
> > The user group continues to provide useful advice and the benefits of
> > others
> > experiences. Thanks to all who contribute. I have a general policy type
> > of
> > question to raise in the light of "improved security" in the 2003
> > software.
> >
> >
> >
> > The more experienced SBS users [ I include herein both the Gurus and
> > Divas - but not sure about the dog ? ] have usually advised against
> > running
> > a public access web server on SBS box. Traffic volume and IIS security
> > issues seem to be the reasons. "Run the public access web site at the
ISP"
> > is probably still very good general advice.
> >
> >
> >
> > However, if one is only looking at only INTRANET sized traffic for 9
staff
> > and 6 directors we can rule out the traffic problem. One is surely left
> > only with concerns about IIS related security. If one ever implements
> > RPC
> > over HTTP via SSL for OUTLOOK-EXCHANGE links to users operating in the
> > field
> > then one is now running IIS anyway on the SBS2003 server albeit only via
> > SSL. Same would apply to providing OWA. Under these conditions, is a
> > restricted access web server also now safe to run ? The restricted
access
> > web site needs to house commercial in confidence documents. Providing
the
> > RPC over HTTP via SSL for exchange benefit and enabling IIS to suit
must
> > not place any other server based files at risk.
> >
> >
> >
> > Using only the SSL certificate supplied with SBS2003, and given all the
> > work
> > MS has done in the last 2 years to tighten up security in IIS, do you
all
> > believe it is now safe to run a restricted access web "site" on the
> > SBS2003
> > ?
> >
> >
> >
> >
> >
> > SBS2003 Upgrade from SBS2000 is planned for next week.
> >
> >
> >
> >
> >
> >
>
>


.

Relevant Pages

  • Re: IIS Hack : Anyone explain cause...
    ... it looks like you cleaned up the server -- if you care about security, ... Microsoft tries and mostly succeeds to release patches PRIOR to ... weeks/months/years prior to exploitation. ... > protected rant as we all know that IIS and indeed lots of software has ...
    (microsoft.public.inetserver.iis)
  • Re: Security of IIS - Secure Intranet web site on SBS2003 box
    ... IIS there was a known payload which could be used to introduce further ... Many security people take the stance 'the system has been compromised, ... HTTP vs HTTPS and/or RPC over HTTPS ... >> to rebuild their server and return everything to normal. ...
    (microsoft.public.windows.server.sbs)
  • Re: Open Ports....How to block them all....?
    ... > I keep it up to date with SP's and Patches but find that the server keeps ... Frequently this happens through an IIS ... Ways to secure your system are detailed at: ...
    (microsoft.public.inetserver.iis.security)
  • Re: Open Ports....How to block them all....?
    ... >> What can be done to secure this server so that this doesn't keep> happening? ... Frequently this happens through an IIS> vulnerability. ... Installing Serv-U software typically involves a> person having the ability to remotely run commands and install files on your> system, ... > Remember that security is not just patches but also proper configuration and> third party hardening tools. ...
    (microsoft.public.inetserver.iis.security)
  • no log entries using SSL with IIS 6
    ... The issue started because the SSL certificate expired for a pair of IIS servers for a particular site. ... He renewed the SSL cert and installed it on one server then exported it to install on the second server. ... IIS 6 will not serve https page ... using https or respond to https clients. ...
    (microsoft.public.inetserver.iis)